Post Mortem: ZK ElGamal Proof Program Bug

Timeline

In mid-April 2025, security researcher LonelySloth responsibly reported a potential vulnerability to the Anza Github Security Advisory, accompanied by a proof of concept. While no known exploit exists, the discovery triggered immediate action from engineering teams across Anza, Firedancer, and Jito, who confirmed that the vulnerability enabled the construction of arbitrary proofs that would be incorrectly accepted as valid by the ZK ElGamal Proof program.

A comprehensive patch was promptly developed and reviewed by leading security firms including Asymmetric Research, Neodyme, and OtterSec. Within the following days, the Solana Foundation and Jito teams conducted direct outreach to validator operators to distribute the patch. However, during the distribution phase, engineers identified a second related vulnerability in another section of the codebase, necessitating an additional patch. This secondary patch underwent the same rigorous security review before distribution.

Within approximately 48 hours, adoption metrics indicated that a supermajority of stake had implemented the patches. The vulnerability was subsequently disclosed to the public via Discord. The Solana cluster has now fully adopted the patches, and no funds remain at risk.

Preliminaries

Token-2022 confidential transfers operate through a coordinated interaction between two programs: the Token-2022 program and the ZK ElGamal Proof program. The Token-2022 program functions as the primary on-chain component responsible for managing token mints, accounts, and core application logic. Complementing this system, the ZK ElGamal Proof program operates as a native program specifically designed to verify the mathematical correctness of intricate zero-knowledge proofs that certify the validity of encrypted balances within accounts and transactions.

Zero-knowledge proof systems are conventionally constructed by transforming interactive two-party protocols into non-interactive proof systems via the Fiat-Shamir Transformation—a fundamental cryptographic technique. This transformation enables provers to generate public randomness deterministically using cryptographic hash functions. During verification of proofs generated through the Fiat-Shamir Transformation, verification logic must comprehensively hash all algebraic components that comprise the complete proof structure, ensuring the integrity and non-repudiability of the verification process.

The Bug

The vulnerability existed in the on-chain ZK ElGamal Proof program where certain critical algebraic components were excluded from the hash function used to generate the cryptographic transcript required by the Fiat-Shamir Transformation. This omission created an exploitable security gap: a sufficiently sophisticated attacker could manipulate these unhashed components to construct a forged proof that would bypass verification mechanisms and be incorrectly accepted as valid.

The scope of this vulnerability was limited to Token-2022 confidential tokens. However, within this scope, the impact was severe, as attackers could execute unauthorized operations including but not limited to minting unlimited tokens and withdrawing tokens from arbitrary accounts without proper authorization. The cryptographic nature of the exploit required sophisticated knowledge, making it a vulnerability of critical severity that demanded immediate remediation.

The Patch

The ZK ElGamal Proof program has been comprehensively patched to include all previously omitted algebraic components in the Fiat-Shamir Transformation hash function. Patched versions are now available across all major Solana implementations:

• Agave: version 2.1.21 or later, and version 2.2.11 or later
• Jito-Solana: version 2.1.21-jito or later, and version 2.2.11-jito or later
• Firedancer: version 0.411.20121 or later

The patch has undergone rigorous security review by three independent security firms: Asymmetric Research, Neodyme, and OtterSec. Additionally, the ZK ElGamal Proof program had previously been subject to comprehensive security audits. Since the vulnerability was confined exclusively to the ZK ElGamal Proof program, no modifications were necessary for the Token-2022 program. All user funds are secure, and no known exploits of this vulnerability have been identified or deployed on the Solana network.

Conclusion

This postmortem demonstrates the effectiveness of responsible vulnerability disclosure and rapid incident response in protecting blockchain infrastructure. Security researcher LonelySloth's professional reporting enabled swift collaboration among multiple development teams and security firms to identify, patch, and deploy a critical security fix within approximately 48 hours. The vulnerability, while theoretically severe in nature, was prevented from causing real-world harm through coordinated action. The successful deployment of patches across the validator network reflects the maturity and responsiveness of Solana's security infrastructure, ensuring that Token-2022 confidential transfers remain cryptographically secure and reliable for all users.

FAQ

What are the main reasons for performing a postmortem?

Postmortems identify failure root causes, prevent future incidents, improve system reliability, enhance security protocols, and document lessons learned for organizational improvement and transparency.