Zano rolls blockchain back a month after Gateway Address exploit
Due to a vulnerability that allowed unauthorized ZANO and Freedom Dollar (fUSD) into circulation, Zano rolls blockchain back by approximately one month. The core team identified Gateway Addresses as the source of this exploit.
The blockchain has been restarted at block 3,833,000, which predates Hard Fork 6, the update that introduced the compromised Gateway Address feature. This recovery process requires all participating nodes, miners, stakers, exchanges, and other services to implement a new update.
Table of content
Impact of the Rollback and Reimbursement Plans
This rollback invalidates all transactions, both legitimate and unauthorized, that occurred during the affected month. Consequently, any transactions made within that period will no longer be reflected on the restored chain. The team noted that the rollback cannot reverse payments already settled on other blockchains.
Zano's team is currently assessing losses and plans to release a reimbursement and claims procedure. Quinten van Welzen, Zano's head of marketing and growth, stated that inaction would have led to an unlimited circulation of unauthorized ZANO and fUSD, diluting all holders and compromising the currency's fundamental promise of a fixed supply.
Understanding the Gateway Address Vulnerability
While a full post-mortem has not yet been released, Zano confirmed the issue stemmed from Gateway Addresses. This feature was designed to simplify integration for bridges, exchanges, and payment services by enabling them to manage funds through a single account-style balance, similar to other blockchains.
Previously, Zano's standard wallets tracked funds as separate transaction outputs (UTXOs). This required services to scan the blockchain, identify incoming payments, track outputs, and select them for withdrawals. Zano, launched in May 2019, is a layer-1 blockchain focused on private payments, supporting its native ZANO token and custom digital assets like fUSD.
Zano's Commitment to Rebuilding Trust
Van Welzen acknowledged that restarting the chain from before Hard Fork 6 sacrifices a month of history and trust, which the team must endeavor to regain. However, he maintained that this action restores the intended supply and offers a path for rebuilding, which is preferable to losing seven years of development.
He concluded that while the decision was difficult, not taking it would have resulted in greater harm. Such a scenario would signal to future attackers that exploited tokens retain their value, a situation no project could survive.