Firo Fork Nears: Fixes for Spark Privacy Flaw

Heads up, Firo folks: the network was seconds–well, blocks—away from a mandatory upgrade that patches a quirky but potentially serious bug in its Spark privacy system. If you run a wallet, node, masternode, miner, exchange, or any other Firo service, you needed to install the new software before the fork hit, or your node would stop talking to the upgraded network.

The problem, in plain (and slightly silly) English

Spark is the privacy layer that lets Firo users mix inputs so transactions don’t look like a grocery list. Researchers found a corner-case issue in multi-input Spark transactions that, under very specific conditions, could be abused to create forged coins — basically inflation by trickery. Importantly, the bug didn’t let anyone steal keys or empty wallets, and single-input transactions weren’t affected.

In a controlled test, the researcher who reported the flaw created roughly 200 FIRO on the mainnet to demonstrate the problem. No other cases of unexplained inflation were found at the time the issue was disclosed.

The fix, the stopgap, and what you must do

Developers shipped a temporary patch that limited Spark spending to one input at a time. That stopgap kept the supply honest but made privacy weaker: larger payments had to be split into several single-input transactions, which can be correlated more easily than a native multi-input spend.

The permanent fix arrives as the v0.14.18.0 release. It introduces a new versioned Chaum V2 proof and an updated transaction format so multi-input Spark spends work safely again. At the activation block (the upgrade turns on by block height, not by wall-clock), upgraded wallets will resume normal multi-input behavior while still validating older Spark transactions.

Practical notes you’ll actually care about: balances, addresses, and keys remain valid — you don’t need to migrate or remint funds. But software matters: any node left running the old release will become incompatible with the network once the fork passes the activation block. Operators were asked to update before the fork; the chain was reported at block 1,370,847 in the early hours of Sept. 4 and the fork triggers at block 1,371,000 (estimated to arrive around 10:00 UTC), so the window to upgrade was short.

The team behind the project said they’ll publish a full technical post-mortem after activation. For now: update your software, restart your nodes, and enjoy the restored privacy — with a little less drama and a lot more patched code.