Zephyr Audit – Postmortem

Summary

Between late 2024 and mid‑2025, Zephyr undertook an unprecedented chain‑wide audit in response to concerns raised after exploits uncovered on other Monero-based forks and our own subsequent investigations. Two distinct issues drove our actions:

• Cross‑asset ring member bug ("morphing" bug): Prior to v2.0.2 (HF7), consensus did not strictly enforce that ring members match the spending output’s asset_type. With modified wallet code, this allowed some transactions to spend inputs of one asset as if they were another (e.g., ZSD or ZRS spent as ZEPH). Thirty transactions were identified with this characteristic, and analysis suggested a material—but bounded—amount of ZSD (and some ZRS) was morphed 1:1 into ZEPH.

• Range‑proof anomalies: Three historical transactions failed under updated range‑proof checks. While we did not seem to experience the effects of a catastrophic chain‑wide inflation, these transactions prevented us from asserting perfect finality over historical supply without a chain‑level reconciliation.

Response:

• We executed an emergency hotfix fork (v2.0.2 / HF7 at block 433,000, Jan 2025) enforcing asset‑type matching in rings, closing the morphing vector going forward.

• We designed and executed an on‑chain Audit hardfork process (v2.1.0 / HF8 at block 481,500, Mar 31, 2025) that temporarily disabled normal transfers and enabled special audit transactions per asset (ZEPH, ZSD, ZRS, ZYS). Coins not audited would be invalidated in a subsequent fork.

• Due to partner operational constraints, we extended the audit window (v2.2.0 / HF10 at block 511,000, May 9, 2025).

• We completed the migration, restored normality, and moved supply accounting to the audited asset types (v2.3.0 / HF11 at block 536,000, June 11, 2025). Because one major exchange (MEXC) could not audit its entire custodial balance in time, HF11 included a one‑time mint of 1,921,650 ZEPH to reconcile their unauditable balance.

Outcome:

• Final reported ZEPH supply increased versus the pre‑audit trajectory (roughly aligning with an effective shift to end‑of‑Year‑3 emission), while ZSD, ZRS, and ZYS supplies fell below pre‑audit expectations; consistent with ZSD/ZRS → ZEPH morphing.

• Old (unaudited) asset types are now invalid; normal functionality is restored.

• We retained DJED reserve integrity, exchange order book sanity, and ecosystem continuity.

Bottom line: The audit was disruptive, but necessary. It closed a consensus hole, reconciled supply with evidence‑backed on‑chain attestations, and reset Zephyr on a robust, auditable footing.

Incident #1: Cross‑Asset Ring Member Bug ("Morphing")

What happened

Prior to HF7, ring signatures did not enforce that all ring members shared the same asset_type as the spent output. With custom wallet code, inputs from ZSD/ZRS could be presented in a ring for a ZEPH spend, enabling 1:1 morphing into ZEPH at validation time.

Scope & data points

• 30 transactions exhibited cross‑asset ring members beginning soon after v1.0.0 (Sep 2023, when multi‑asset support launched).

• Pattern analysis inferred ~95k ZSD morphed in 10 of those transactions and an upper bound in the low‑hundreds‑of‑thousands of ZSD/ZRS across the remainder.

• Most morphing appeared to be ZSD → ZEPH, rational given pricing differentials.

User‑visible effects

No immediate market chaos manifested. DJED reserve metrics, exchange order books, and balances remained within expected ranges, implying the morphing volume, while material, was absorbable by the market and/or dispersed over time.

Fix

HF7 (v2.0.2) enforced strict asset‑type matching for ring members at consensus, preventing further morphing attempts.

Incident #2: Range‑Proof Anomalies (3 Tx)

What happened

Three historical transactions failed under updated range-proof verification. During the Zephyr Protocol v2.0.0 development cycle, which enabled the ZSD Yield Mechanism and introduced ZYS (Zephyr Yield Share), we overhauled our codebase and refactored our range-proofs implementation. When these new stricter checks were applied to our historical chain during the audit investigation, the three pre-existing transactions did not validate under the new rules.

Risk & context

We were not able to determine if or how much net chain-wide inflation originated from this vector, but the possibility that this contributed could also not be ruled out. In addition, their existence prevented a mathematically clean historical reconciliation leaving doubt and uncertainty.

Status

This is distinct from the cross-asset ring-member “morphing” bug fixed at HF7 (v2.0.2). The audit forks (HF8/HF10/HF11) resolved historical ambiguity by migrating supply to audited asset types and invalidating unaudited coins.

Why a Chain Audit?

A Chain audit was the only practical way to produce an explicit, on‑chain snapshot of legitimate supply and ownership.

Audit steps:

1. Freeze normal activity and enable deterministic audit transactions per asset.
2. Require every holder (including reserves and exchanges) to re‑attest balances on‑chain.
3. Invalidate all unaudited coins.
4. Migrate accounting to new, audited asset types with determined supply figures

Timeline

• Dec 29, 2024: Public disclosure of investigations; exchanges asked to disable deposits while we prepared the audit plan.

• Jan 21, 2025: HF7 (v2.0.2) announced.

• Jan 23, 2025: Post‑fork details: bug fixed; 30 cross‑asset ring transactions identified; preliminary morphing estimates shared; continued audit work.

• Feb 19, 2025: Audit HF announced for Mar 31.

• Mar 31, 2025: HF8 (v2.1.0) activated at block 481,500; normal transfers paused; audit tx types enabled.

• Apr 1–May 7, 2025: Audit window opened; CLI + GUI/Web tooling rolled out; periodic progress reports shared.

• May 9, 2025: HF10 (v2.2.0) audit extension at block 511,000 to accommodate a major exchange’s operational backlog.

• May 12, 2025: Extension live; final push to completion.

• Jun 11, 2025: HF11 (v2.3.0) activated at block 536,000; normal network restored; one‑time 1,921,650 ZEPH mint for MEXC unauditable balance; supply accounting switched to audited assets.

• Jun 16, 2025: HF11 success update; explorers & wallets catching up; on‑chain supply figures published.

Impact Assessment

Economic

ZEPH supply: Final audited ZEPH exceeded the pre‑audit emission trajectory. We adjusted the emission schedule such that the network is effectively at the end of Year 3 for ZEPH emission while preserving the 18.4M max supply (pre‑tail).

ZSD/ZRS/ZYS: Supplies came in below pre‑audit expectations, consistent with some ZSD/ZRS having been morphed into ZEPH historically.

MEXC reconciliation: A one‑time mint (1,921,650 ZEPH) was included in HF11 to reconcile their custodial balance that could not be fully audited within the window.

Audited supply deltas (vs. pre‑audit reported):

• ZEPH: +2,056,803

• ZSD: −106,320.68

• ZRS: −146,210.32

• ZYS: −4,103.28

Operational

• Exchanges were temporarily offline for deposits/withdrawals; partners coordinated audit transactions at scale.

• Two additional forks (HF10/HF11) were required to accommodate operational realities and finalize the migration.

Security & correctness

• The morphing vector is permanently closed.

• Historical ambiguity from the 3 range‑proof‑anomalous transactions is removed by migration to audited asset types and invalidation of unaudited coins.

What Went Well

• Rapid remediation: HF7 closed the morphing vector quickly after discovery.

• Transparent comms: Frequent public updates; clear instructions for nodes, pools, exchanges, and users (CLI + GUI/Web); Updates on audit progress and audited supply.

• Deterministic audit design: Using our native-asset conversion framework to create audit transaction types enabled a clean, on-chain attestation process.

• DJED resilience: Throughout the audit and beyond, DJED reserve integrity was maintained.

What Didn’t Go Well

• Complexity & delay: The audit took longer than initial hopes due to scope expansion (morphing bug) and partner throughput.

• UX friction: Large wallets (especially with many small inputs) hit splitting constraints; we had to iterate the tooling and provide workarounds.

• Partner dependency: A single large custodian’s backlog required an extension and a bespoke reconciliation (mint), delaying completion and complicating optics.

Final State Snapshot

At ~HF11 activation / shortly after (heights ~536,000–536,012), publicly shared figures included:

• Supply (wallet supply_info)

  • ZEPH ≈ 9,750,021.39
  • ZSD ≈ 419,218.23
  • ZRS ≈ 1,028,603.22
  • ZYS ≈ 185,474.35

• Reserves (wallet reserve_info)

  • DJED Reserve ZEPH ≈ 2,339,903.24
  • ZSD circ ≈ 419,219.25; ZRS circ ≈ 1,028,603.22
  • Reserve Ratio (spot/MA) ≈ 6.94 / 5.62

Values evolve with block rewards and asset conversions; see website for live data.

Acknowledgments

We thank the anonymous developer who responsibly disclosed and helped analyze the morphing vector, our exchange and pool partners for their coordination, and the Zephyr community for patience and support during this challenging period. We remain committed to Zephyr’s mission of privacy, decentralization, and financial sovereignty, and look forward to the future of Zephyr Protocol!