# Solana vs. ZK ElGamal Proof Bug

By [[NODERS]TEAM](https://paragraph.com/@noders-team) · 2025-05-06

---

> **TL;DR**
> 
> *   **In April 2025**, experts discovered a critical vulnerability in the **ZK ElGamal Proof** module tied to the Token-2022 program.
>     
> *   The threat involved the possibility of forging **ZK proofs**, enabling unauthorized minting or withdrawal of tokens.
>     
> *   **Anza, Jito, and Firedancer** quickly issued a patch, adopted by a supermajority of validators by April 18.
>     
> *   **The fix was deployed quietly**, sparking debate over decentralization in the community.
>     
> *   **The vulnerability was eliminated.** No losses or exploits occurred. All funds are safe.
>     
> *   **Solana** showcased maturity both in its tech stack and governance.
>     

* * *

A Threat at the Heart of Private Transfers
------------------------------------------

In mid-April 2025, the Solana Foundation and Jito teams stumbled upon a concerning discovery: a critical vulnerability in the **ZK ElGamal Proof** program, which handles private token transfers under **Token-2022**.

[https://x.com/H8KUcom/status/1918942205370404958](https://x.com/H8KUcom/status/1918942205370404958)

> **ZK ElGamal Proof** is a module that validates encrypted balances using zero-knowledge proofs.

The issue was insidious: during [Fiat-Shamir](https://en.wikipedia.org/wiki/Feige%E2%80%93Fiat%E2%80%93Shamir_identification_scheme) Transformation, some algebraic proof components weren’t hashed. This opened the door for a technically sophisticated attacker to forge proofs and:

*   **mint unlimited tokens**,
    
*   **withdraw funds from any account**,
    
*   and do it all — without leaving a trace.
    

Timeline: How the Teams Reacted
-------------------------------

*   **April 16**: Anza documents the bug and posts a PoC to [GitHub Security Advisory](https://github.com/anza-xyz/agave/security/policy).
    
*   **Same day**: Jito and Firedancer join the review. Vulnerability confirmed.
    
*   **April 17, 18:00 UTC**: initial [patch](https://github.com/anza-xyz/agave/commit/8a085eebcb901b6846d1f82f4636667742146545) distribution to validators begins.
    
*   **23:00 UTC**: a similar issue is found elsewhere in the code — a second patch is released.
    
*   **Audit & Review**: fixes are audited by Asymmetric Research, Neodyme, and OtterSec.
    
*   **April 18, 20:00 UTC**: more than 66% of stake already upgraded.
    
*   **21:01 UTC**: incident resolution is publicly shared on Discord.
    

No exploit of the vulnerability was found in the wild.

Updated Client Versions
-----------------------

    Agave:         ≥ v2.1.21, ≥ v2.2.11
    Jito-Solana:   ≥ v2.1.21-jito, ≥ v2.2.11-jito
    Firedancer:    ≥ v0.411.20121
    

> _"Since the bug was confined to the ZK ElGamal Proof program, no updates were required for the Token-2022 program. All funds are safe, and there is no known exploit of the potential vulnerability,"_ confirmed [Solana Foundation](https://solana.org/).

Community Debate: Decentralization vs. Efficiency
-------------------------------------------------

The **way the patch was distributed** stirred controversy. Instead of a public fix announcement, Solana coordinated privately with key validators (over 70%) to implement the fix quietly.

> _"This raises serious concerns — such ‘zero days’ threaten openness and decentralization,"_ one user noted.

Solana co-founder **Anatoly Yakovenko** responded swiftly:

[https://x.com/aeyakovenko/status/1919013298248560901](https://x.com/aeyakovenko/status/1919013298248560901)

> **Read.** [Solana Inside: SOL ETFs, $500M Bonds, 1inch Joins, Decentralization & More](https://medium.com/p/70632919a990)

Decentralization in Numbers
---------------------------

*   **Solana**: 1,212 active [validators](https://blockworks.co/analytics/solana/solana-supply-staking-and-validators)
    

![Solana: SOL Staking - Analytics Dashboard - Blockworks](https://storage.googleapis.com/papyrus_images/8722312aa46a45ade04ccdd8169436472c808287ea72dc014ac9e68e34d044c9.png)

Solana: SOL Staking - Analytics Dashboard - Blockworks

*   **Ethereum**: 17,983 [nodes](https://ethernodes.org/) (11,804 using Geth)
    

![Clients - ethernodes.org - The Ethereum Network & Node Explorer](https://storage.googleapis.com/papyrus_images/4ead21cb17c351aceb579b5b61dd64d6b2ed1b2a0c363554ba7df8ceb79e58ee.png)

Clients - ethernodes.org - The Ethereum Network & Node Explorer

*   **Staked supply**:
    
    *   Ethereum — 28%
        
    *   Solana — 65%
        

> **Takeaway**: Despite having fewer nodes, Solana shows 2.3x higher staking engagement.

Institutional Confidence
------------------------

[Fidelity](https://fwc.widen.net/s/zbhjbmppgq/fda-2025-look-ahead-report-v6) and [JPMorgan](https://www.theblock.co/post/339163/jpmorgan-ethereum-intense-competition) openly call Solana a serious Ethereum contender. Why? Lightning-fast incident response, strong security practices, and deep validator engagement.

Final Thoughts
--------------

Solana faced a real-world crisis — and passed with flying colors. No testnet simulation, no theory. Just swift, calm, and effective action. No panic. No losses.

> That’s what a mature ecosystem looks like.

* * *

> 🚀**Curious?** Follow us on [X](https://x.com/NODERS_TEAM) (Twitter) for crypto insights and sharp project picks!

* * *

**Useful Links**
================

*   [Solana Official Website](https://solana.com/)
    
*   [\[NODERS\]Team](https://noders.team/)

---

*Originally published on [[NODERS]TEAM](https://paragraph.com/@noders-team/solana-vs-zk-elgamal-proof-bug)*