According to PANews, the Solana Foundation has reported a potential vulnerability in the ZK ElGamal Proof program, as identified by security researchers. The report includes a proof of concept (PoC) for the vulnerability, although there is no evidence of exploitation at this time. The flaw could allow attackers to construct arbitrary proofs and bypass verification, impacting Token-2022 confidential tokens and enabling illegal operations such as unlimited minting.
In response, the team updated the upgradeable Token-2022 program on June 11, initially disabling the confidential transfer feature. An urgent upgrade request was sent to Solana's technical Discord on June 13, urging operators to update their software to disable the ZK ElGamal proof program. The program was officially disabled on June 19, coinciding with the start of epoch 805 on the mainnet-test version.
Currently, the Token-2022 features utilizing the ZK ElGamal function are primarily used by innovative products in testing phases. While mainstream stablecoins have initialized confidential transfers, they are not available to users, resulting in minimal actual usage and impact. The program will be re-enabled following audits and problem resolution, which is expected to take several months.
