Zano prepares to rewind a day of payments that exchanges had counted as final

On Zano, a transaction the network has accepted can still be removed if the core team, miners, stakers and nodes agree to adopt a revised history ^[3]. A rollback of about 24 hours would take legitimate payments out along with the improper ones, and exchanges, traders and users would have to go back through transactions they believed were final ^[5]. An exchange that credited a ZANO or fUSD deposit inside that day, and let the customer withdraw coins on another chain, has already sent the withdrawal. The deposit that justified it is the part the rollback erases ^[5].

Zano has kept its own description narrow. "The core team has identified a vulnerability in public Gateway Addresses that affects asset issuance, including fUSD," the project wrote on X ^[9], adding that transaction privacy was unaffected and no spend keys or wallets were compromised ^[8]. That reassurance helps holders, or rather it helps them less than it sounds, because an issuance flaw is a different problem from theft. A stolen key moves coins that already exist. An inflation bug can create coins that should never have been issued, and the report says this one puts in doubt whether affected assets were created under Zano's own rules ^[13]. Anyone holding fUSD is relying on the supply being what the protocol says it is.

Gateway Addresses had been live for 30 days when the flaw was disclosed ^[1]. A rewind of about 24 hours covers roughly one of those days, about 3% of the feature's history ^[2]. If improper issuance happened only in the final day, rewinding the chain removes it. If it started earlier, the rollback cleans up only the tail, and the rest depends on Zano's promise to address discrepancies connected to the affected addresses ^[8]. At disclosure, the number of assets issued without authorization, the place in the code where the flaw sat and the rollback method were all still unknown, according to the report ^[10].

I see three ways this goes. Zano could close the flaw with the upgrade and skip the rewind, since the disclosure says only that a rollback could be required ^[2]. It could roll back and find the bad issuance sat inside the window, so the cost is one day of honest payments. Or it could roll back and find issuance that predates the window, in which case it rewrites history and still has to correct supply some other way. I think the second and third outcomes cost exchanges more than holders, because the exchange carries a payout it cannot recall. The counter-case is that a short, one-time rewind gets treated as an incident. If exchanges leave their ZANO deposit confirmation rules unchanged after the upgrade, they will have judged the rollback risk not worth pricing, and this view is wrong.

The fault sits in the feature built to bring exchanges in. Gateway Addresses keep account balances on-chain so exchanges, bridges, DEXs and payment gateways can integrate more easily than through Zano's UTXO system, and registering one costs 100 ZANO ^[12]. At CoinGecko's September 24 close of $7.50 ^[7], that fee is about $750 ^[3]. Zano spent nearly a year building the feature ^[11]. The exchanges it was meant to attract are now among those told to prepare for a coordinated upgrade ^[4].