Zano has restarted its entire blockchain to fix a bug that let unauthorized ZANO and Freedom Dollar enter circulation. The move invalidates a month of legitimate transactions, and the company says it is working on a plan to pay back anyone who lost money.
The rollback happened at block 3,833,000, the point immediately before Hard Fork 6, which introduced Gateway Addresses. That feature was supposed to make it easier for exchanges and payment services to manage funds through a single account-style balance, similar to how other blockchains work. Instead, it opened a hole that let coins leak out.
The Exploit
The vulnerability came from Gateway Addresses, a feature Zano built to let bridges, exchanges and payment services handle funds through a single account-style balance. Before Gateway Addresses, Zano’s ordinary wallets tracked funds as separate transaction outputs, or UTXOs, rather than a single balance. Exchanges had to scan the blockchain to find incoming payments, track those outputs and pick which ones to spend on withdrawals.
Gateway Addresses were meant to simplify that process. They failed.
The exploit allowed unauthorized ZANO and Freedom Dollar to enter circulation. Zano has not released a post-mortem at the time of publication, but the company confirmed the issue came from that feature.
The Decision to Restart
Zano’s head of marketing and growth, Quinten van Welzen, explained the decision in stark terms:
“Doing nothing meant unauthorized ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply.”
He added: “It would also tell every future attacker that exploited coins get to keep their value. No project survives that.”
The rollback also means a month of legitimate transactions are now gone from the recovered chain. Those transactions will no longer appear on the recovered chain and may need to be reconciled. The company says it is working to account for any losses and will publish a reimbursement and claims process.
Van Welzen acknowledged the cost of the move. “Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which we’ll have to earn back,” he said.
“But it restores the supply everyone signed up for, and it leaves a path to rebuild. Which is better than 7 years of hard work left to die. We know it hurts. But not doing it would have hurt more.”
Recovery Process
The recovery requires participating nodes, miners, stakers, exchanges and other services to adopt the update. The team said Sunday that support from these groups is needed for the restart to hold.
There are several steps to watch as this plays out:
- Zano publishes its reimbursement and claims process.
- Participating nodes, miners, stakers, exchanges and other services adopt the update.
- The company accounts for losses and processes any claims.
- Trust, which the company admits was damaged, begins to be earned back.
The situation is unusual for the blockchain space. Most projects patch vulnerabilities without rewriting history. Zano chose to rewrite it instead, at a cost to everyone involved.
The question now is whether the company can deliver on its promises about paying back losses. A month of transactions are gone, and some users will almost certainly lose money they thought was safe. Whether Zano can rebuild trust after this will depend on how quickly and fairly it handles the fallout.
For now, the blockchain is back at block 3,833,000, and the company is trying to start over.
Source material: “Zano rolls blockchain back a month after Gateway Address exploit,” Cointelegraph.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.