Zano switched back to blockchain after encountering a gateway address vulnerability attack in April

Zano因“网关地址”漏洞回滚区块链，恢复网络完整性

Zano 在识别出与“网关地址（Gateway Addresses）”相关的漏洞后，对区块链历史进行了约一个月的回滚。据项目核心团队称，该漏洞曾导致未经授权的 ZANO 和 Freedom Dollar (fUSD) 进入流通。

Zano 在周日发布的更新中表示，网络已在区块 3,833,000 处重启——这恰好是在引入受影响功能的硬分叉 6（Hard Fork 6）之前。目前的恢复工作依赖于生态系统参与者，包括节点、矿工、质押者、交易所和其他服务提供商升级至修订后的软件。

关键要点

• 链上回滚： Zano 在区块 3,833,000 处重新启动了链，回滚了约一个月与利用“网关地址”漏洞相关的所有活动。
• 交易清理： 此次回滚不仅移除了该时间段内的合法交易记录，还清除了通过漏洞进入流通的未经授权 ZANO 和 fUSD。
• 跨链限制： 已在其他区块链上完成的支付无法撤销，这在一定程度上限制了恢复操作对现实世界结算的回溯能力。
• 赔偿机制： Zano 表示将通过报销和索赔流程处理受影响方的补救措施，但具体细节尚未公布。
• 协同要求：The remediation plan requires coordinated adoption by infrastructure operators and service providers, including exchanges and other third parties that integrate Zano services.

Detailed explanation of hard fork 6 and gateway address vulnerability

As of the time of publication of this article, Zano has not yet released a complete accident review report, but has confirmed that the problem originated from the "gateway address." This feature is designed to simplify the integration of external platforms such as bridges, exchanges and payment services with the Zano network.

According to the project party's interpretation, the gateway address allows these services to use a single "account-style" balance to manage funds, rather than processing payments as a decentralized transaction output (UTXO).

Before the advent of gateway addresses, Zano wallets operated using a separate transaction output (UTXO). For similar services such as exchanges, this means that incoming funds need to scan the blockchain to identify which outputs belong to the platform before specific outputs can be selected for withdrawal.

The newly introduced feature changes this workflow and provides a different way to book funds. However, Zano believes that this approach has become a loophole path that makes it possible to minting or otherwise enter circulation of unauthorized tokens.

Effects and limitations of rollback

Zano's rollback invalidates on-chain records during the affected period. The project party pointed out that transactions processed during this period will no longer appear on the chain after recovery. At the same time, unauthorized ZANO and fUSD created or introduced through the vulnerability will be removed from the recovered ledger.

然而，Zano 警告称，回滚无法逆转已在其他区块链上完成的支付。这一区别对用户和服务运营商至关重要：如果在重启前完成了跨链转账或链下结算，即使源链历史记录被重写，这些转账也可能无法追回。

Zano 还表示正在核算损失，并将公布报销和索赔流程。但在撰写本文时，项目方并未提供关于如何计算损失或需要何种文档的具体机制说明。

为何 Zano 选择重启网络

Zano 市场与增长主管 Quinten van Welzen 将这一决定描述为在恢复货币供应完整性和接受痛苦的历史损失之间做出的权衡。

在与回滚公告一同发布的声明中，van Welzen 辩称，“无所作为”将导致未经授权的 ZANO 和 fUSD 无限期地留在流通中——这实际上稀释了持有者的价值，并破坏了他所描述的货币的基本承诺：固定的供应量。他还暗示，允许攻击者保留价值将树立一个危险的先例。

他承认，从硬分叉 6 之前重启链会带来成本，包括大约一个月的交易历史消失。与此同时，van Welzen 表示，这次回滚恢复了用户预期的供应状态，并为重建信任留下了一条路径。

网关地址与集成风险

Zano 的大背景有助于解释为何此漏洞影响深远。该项目于 2019 年 5 月启动，是一个专注于隐私支付的 Layer-1 区块链。标准的隐私交易旨在隐藏发送者、接收者、转移金额和资产类型。

除了其原生代币（ZANO）外，Zano 允许用户部署和铸造自定义数字资产。Freedom Dollar (fUSD) 就是在这种 Zano 区块链上运行的此类代币之一。因此，该漏洞并非局限于单一代币：未经授权的发行影响了 ZANO 以及绑定到同一底层系统的发行资产。

网关地址的创建是为了使集成更加容易——特别是对于那些需要处理存取款而无需手动扫描 UTXO 的服务。但 Zano 的回应凸显了区块链安全中的一个核心主题：为第三方简化托管和余额的功能，如果引入了新的假设或攻击者可滥用的路径，也可能集中风险。

在此背景下，重启所需的协调具有实际重量。Zano 表示，恢复工作需要参与的节点、矿工、质押者、交易所和其他服务提供商采纳更新。如果没有广泛的采用，网络可能会分裂成不同版本，这将使结算复杂化，并增加交易平台和托管服务商的运营风险。

For users, the rollback also highlights a limitation that goes beyond Zano itself: Even if the source chain is corrected, downstream impacts-especially those involving cross-chain transfers or completed settlements-may remain permanent.

Looking ahead, the focus should be on the reimbursement and claims process that Zano said will be announced, and how quickly exchanges and infrastructure operators can finally complete adoption of the restart. Subsequent security communication by the project party-whether or not it ultimately releases a more in-depth technical review report-will also be critical to assessing whether the gateway address will be modified to prevent similar failures.