A blockchain has decided that the only way to fix a supply bug is to rewrite the last day of its own history. Zano said on Friday, Sept. 25, that an inflation bug involving its recently introduced Gateway Addresses left it with “no other choice” but to roll back the chain, according to Bitcoin.com News.
The episode matters because it shows what a protocol-level flaw can cost on a privacy-focused network. A bug that lets assets be created out of nothing threatens the integrity of the whole supply, and the remedy here means legitimate transactions disappear along with the illegitimate ones.
Key Takeaways
- Zano says an inflation bug tied to its Gateway Addresses requires rolling back roughly 24 hours of chain history.
- On Sept. 25, Zano told users to stop economic activity involving ZANO and Confidential Assets.
- Zano promises to reimburse losses from the rollback, but has not confirmed the size of the exploit or the rollback height.
- ZANO fell around 20% on the news and traded at $6.05 at the time of the source’s reporting.
What Zano has and hasn’t said
Zano’s official accounts on X and Telegram told users to stop economic activity involving ZANO and Confidential Assets, per the same report. The team also promised to reimburse economic damages caused by the rollback.
The disclosure is thin on detail. There is no public postmortem, and the report says it is unknown how many unauthorized coins were created, exactly how the bug worked, or which transactions exploited it. Zano hasn’t yet published a target rollback height, patched binaries, or a reimbursement procedure.
That ordering is the notable part. In the report’s words, Zano has “offered the remedy before publishing the diagnosis.” Users are being asked to halt activity and accept a reorganization before the team has shown what went wrong.
Why Gateway Addresses are the suspect
The new feature is where the bug is said to sit. Gateway Addresses arrived with Hard Fork 6 at block 3,833,000 on Aug. 26, after more than a year of development, according to the report.
Their purpose is integration. Zano’s core design is a private UTXO system, in which balances are not directly readable. That is awkward for exchanges, bridges and decentralized exchanges (DEXes), which generally need to see a balance to work with it. A Gateway Address instead maintains a directly tracked balance that services can read, so they don’t have to operate entirely inside the private UTXO model.
An inflation bug involving those addresses would mean assets could be created when they shouldn’t exist. How that happened isn’t confirmed. Outside observers have pointed toward code involving transactions that cross between gateway and confidential outputs, per the report. Zano hasn’t shared the vulnerable function publicly, and the report describes any link to recent code changes as speculation.
For a technical reader, the boundary between a transparent tracked balance and confidential outputs is the obvious place to look. Any path that moves value across it has to keep the accounting exact, and a mismatch there could plausibly create supply. That reading is an inference from the pointers above, not something Zano has confirmed.
What a rollback does
A rollback is more drastic than a patch. If it proceeds as announced, roughly 24 hours of accepted transactions will drop out of the canonical chain as participating miners, stakers and nodes adopt the revised history.
The cost is that honest activity is erased too. Anyone who transacted legitimately in that window has to rely on Zano’s reimbursement promise, since their transactions will no longer exist on the chain. The report also flags a practical difficulty: on a privacy-focused blockchain, demonstrating precisely what someone lost during the erased window could prove complicated. Zano has not said how it will handle that.
The market reacted quickly. ZANO shed around 20% after the news went viral, and it traded at $6.05 per unit at the time of the source’s reporting. That is a single-source figure and will have moved since.
What to Watch
The story is still developing, and the source says it will be updated. The open items are all things Zano has yet to publish:
- The target rollback height, which will show exactly which day of transactions is removed.
- Patched binaries, which nodes, miners and stakers need to adopt the revised history.
- The reimbursement procedure, including how losses will be verified on a privacy chain.
- The amount of unauthorized assets created, and a postmortem explaining how the bug worked.
Until those arrive, the central question is unanswered: how a feature built to make Zano easier for exchanges and bridges to handle ended up requiring a day of the chain to be deleted.
