Solana devs fix bug that allowed unlimited minting of certain tokens

The Solana Foundation has confirmed that a zero-day vulnerability that allowed an attacker to potentially mint certain tokens and even withdraw those tokens from user accounts has been fixed.
A May 3 post-mortem from the Solana Foundation said that the security vulnerability, first discovered on April 16, could have allowed an attacker to forge an invalid proof affecting Solana’s privacy-enabling “Token-22 confidential tokens.”
There is no known exploit of the vulnerability, and Solana validators have since adopted the patched version, the foundation said.
Solana zero-day security bug affected Token-22 confidential tokens
The Solana Foundation said the security vulnerability concerned two programs: Token-2022 and ZK ElGamal Proof.
Token-2022 handles the main application logic for token mints and accounts, while ZK ElGamal Proof verifies the correctness of zero-knowledge proofs to show accurate account balances.
The foundation said certain algebraic components were omitted from the hash in the Fiat-Shamir Transformation’s transcript generation, which specifies how provers create public randomness using a cryptographic hash function.
The flaw could have enabled an attacker to exploit the unhashed components by crafting a forged proof that passes verification to mint and steal Token-22 confidential tokens.
Token-22 confidential tokens, or “Extension Tokens,” leverage zero-knowledge proofs for private transfers and aim to enable advanced token functionality.
The vulnerability was first identified on April 16, and two patches were deployed to resolve the issues. A super majority of Solana validators adopted the patches around two days later.
Solana development firms Anza, Firedancer and Jito were the main parties behind the security patch, while Asymmetric Research, Neodyme and OtterSec also assisted.
The foundation confirmed that all funds remain safe.
Related: Bloomberg Intelligence boosts Solana ETF approval odds to 90%
Despite the fix, the Solana Foundation’s private handling of the issue with Solana validators raised centralization concerns from some in the crypto community.
This included a Curve Finance contributor who raised concerns about the foundation’s close relationship with Solana validators.
“Why does someone have a list of all validators and their contact details? What else are they talking about in those comms channels,” they asked, fearing that they could collude to potentially censor transactions or roll back the chain.
Solana Labs CEO Anatoly Yakovenko didn’t directly deny the claims but said members of the Ethereum community could also coordinate to resolve a similar security bug.
More than 70% of Ethereum network validators are also controlled by crypto exchanges or staking operators such as Lido, Yakovenko said in arguing his point.
“It’s the same people to get to 70% on ethereum. All the lido validators (chorus one, p2p, etc..) binance, coinbase, and kraken. If geth needs to push a patch, I’ll be happy to coordinate for them.”
In August, the Solana Foundation and network validators resolved another critical vulnerability behind the scenes. At the time, the foundation’s executive director, Dan Albert, said the ability to coordinate a patch doesn’t mean that Solana is centralized.
Ethereum wouldn’t fall for the same issue, community member says
Ethereum community member Ryan Berckmans slammed claims that Ethereum is subject to the same centralization issues as Solana, pointing out that Ethereum has sufficient client diversity.
The most popular Ethereum client, geth, has at most 41% market share on Ethereum, Berckmans said, while noting that Solana has just one production-ready client, Agave.
“This means zero day bugs in the single Sol client are de facto protocol bugs. Change the single client program, change the protocol itself. The client is the protocol.”
Meanwhile, Solana is looking to roll out a new client, Firedancer, in the next few months, which is expected to improve the network’s resilience and uptime.
However, Berckmans said that Solana would need three clients to be sufficiently decentralized at the client level.
Magazine: Memecoins are ded — But Solana ‘100x better’ despite revenue plunge
Bitcoin (BTC) $ 108,808.00
Ethereum (ETH) $ 2,606.37
Tether (USDT) $ 1.00
XRP (XRP) $ 2.30
BNB (BNB) $ 659.97
Solana (SOL) $ 151.26
USDC (USDC) $ 0.999903
TRON (TRX) $ 0.287485
Dogecoin (DOGE) $ 0.170160
Lido Staked Ether (STETH) $ 2,604.42
Cardano (ADA) $ 0.585181
Wrapped Bitcoin (WBTC) $ 108,662.00
Hyperliquid (HYPE) $ 38.96
Wrapped stETH (WSTETH) $ 3,154.49
Sui (SUI) $ 2.88
Bitcoin Cash (BCH) $ 500.32
Chainlink (LINK) $ 13.92
LEO Token (LEO) $ 9.08
Stellar (XLM) $ 0.258654
Avalanche (AVAX) $ 18.27
USDS (USDS) $ 0.999768
Wrapped eETH (WEETH) $ 2,791.85
Shiba Inu (SHIB) $ 0.000012
Toncoin (TON) $ 2.79
Hedera (HBAR) $ 0.160196
WETH (WETH) $ 2,606.06
Litecoin (LTC) $ 87.40
WhiteBIT Coin (WBT) $ 44.84
Binance Bridged USDT (BNB Smart Chain) (BSC-USD) $ 1.00
Monero (XMR) $ 315.64
Coinbase Wrapped BTC (CBBTC) $ 108,749.00
Ethena USDe (USDE) $ 1.00
Polkadot (DOT) $ 3.44
Bitget Token (BGB) $ 4.32
Uniswap (UNI) $ 7.62
Aave (AAVE) $ 292.15
Pepe (PEPE) $ 0.000010
Dai (DAI) $ 1.00
Pi Network (PI) $ 0.458959
Ethena Staked USDe (SUSDE) $ 1.18
Cronos (CRO) $ 0.097422
Bittensor (TAO) $ 320.22
OKB (OKB) $ 48.22
Aptos (APT) $ 4.44
BlackRock USD Institutional Digital Liquidity Fund (BUIDL) $ 1.00
NEAR Protocol (NEAR) $ 2.23
Jito Staked SOL (JITOSOL) $ 183.67
Internet Computer (ICP) $ 4.82
Ethereum Classic (ETC) $ 16.88
Ondo (ONDO) $ 0.797651
sUSDS (SUSDS) $ 1.06
USD1 (USD1) $ 1.00
Kaspa (KAS) $ 0.077460
Fasttoken (FTN) $ 4.45
Mantle (MNT) $ 0.568615
Cosmos Hub (ATOM) $ 4.11
Gate (GT) $ 15.66
VeChain (VET) $ 0.020852
Artificial Superintelligence Alliance (FET) $ 0.673999
POL (ex-MATIC) (POL) $ 0.191857
Official Trump (TRUMP) $ 8.60
Sky (SKY) $ 0.079756
Bonk (BONK) $ 0.000022
Ethena (ENA) $ 0.263609
Arbitrum (ARB) $ 0.336714
Render (RENDER) $ 3.20
Lombard Staked BTC (LBTC) $ 108,720.00
Binance-Peg WETH (WETH) $ 2,605.87
Filecoin (FIL) $ 2.30
Algorand (ALGO) $ 0.179121
Jupiter Perpetuals Liquidity Provider Token (JLP) $ 4.51
Worldcoin (WLD) $ 0.870791
USDtb (USDTB) $ 0.999687
First Digital USD (FDUSD) $ 0.997694
Sei (SEI) $ 0.258265
Binance Staked SOL (BNSOL) $ 160.64
KuCoin (KCS) $ 11.05
USDT0 (USDT0) $ 1.00
Jupiter (JUP) $ 0.430222
SPX6900 (SPX) $ 1.35
Kelp DAO Restaked ETH (RSETH) $ 2,731.71
Rocket Pool ETH (RETH) $ 2,969.93
NEXO (NEXO) $ 1.22
Tokenize Xchange (TKX) $ 14.27
Celestia (TIA) $ 1.59
Flare (FLR) $ 0.016077
Polygon Bridged USDT (Polygon) (USDT) $ 0.999966
XDC Network (XDC) $ 0.065186
Fartcoin (FARTCOIN) $ 1.05
Injective (INJ) $ 10.38
Mantle Staked Ether (METH) $ 2,786.73
Stacks (STX) $ 0.656130
Binance Bridged USDC (BNB Smart Chain) (USDC) $ 1.00
Solv Protocol BTC (SOLVBTC) $ 108,417.00
StakeWise Staked ETH (OSETH) $ 2,737.78
Sonic (S) $ 0.303424
Virtuals Protocol (VIRTUAL) $ 1.46
Optimism (OP) $ 0.545702
SyrupUSDC (SYRUPUSDC) $ 1.11
Pudgy Penguins (PENGU) $ 0.014870