According to reports from Wu, the Solana Foundation disclosed a second zero-knowledge verification vulnerability in the ZK ElGamal proof native program. Security researcher suneal_eth reported the vulnerability on June 10, and the engineering team confirmed that privacy transfer proofs could be forged.
On June 11, the team upgraded the Token-2022 program through a multi-signature, disabling Confidential Transfers. The official call for validation nodes to upgrade to Agave / Jito-Solana v2.2.16 or Firedancer v0.505.20216 and activate the feature switch in mainnet epoch 805 to completely disable the ZK ElGamal program.
The officials emphasized that there has been no large-scale use of privacy transfers on-chain, and there are no records of financial loss. The foundation stated that re-enabling privacy transfers will wait until the audit is complete and a secure version of the program is released before activating again. Regular SPL tokens and ordinary transactions are not affected.
