The Elastos main chain remains paused after a consensus-level monetary validation exploit on July 20, 2026.
The first affected block was 2,260,451. Block production stopped at 2,260,595, covering 145 blocks over approximately four hours and five minutes.
A safety patch and coordinated rollback procedure are now being developed, tested, and prepared for independent review.
ELA deposits and withdrawals should remain suspended. Users and services should not initiate main-chain or cross-chain transfers until an official restoration notice is published.
What happened
Elastos stores ELA monetary values using Fixed64, a signed 64-bit integer format.
The malicious transaction contained several extremely large outputs. Each output fit within the permitted integer range on its own, but their combined value exceeded the maximum amount the format could safely hold.
The transaction validation code added those outputs without a complete overflow check or a fixed upper limit on the total. When the combined amount exceeded the safe range, the value wrapped around and appeared to be a much smaller valid number.
The fee calculation then used that incorrect total. This allowed the transaction to pass validation and create invalid ELA outputs.
Detailed reproduction steps and sensitive forensic information will not be published while the patch and recovery work remain in progress.
What the patch changes
The immediate safety patch adds stricter monetary validation across the main chain.
It introduces:
- A maximum allowed value for every transaction output
- A maximum allowed value for all outputs combined
- Rejection of negative and invalid monetary values
- Checked arithmetic for fee and transaction calculations
- Regression tests that reproduce the exploit conditions
- The same validation rules across the mempool, block processing, mining, and chain synchronisation
These are consensus rules. Every node must apply them in the same way before the network can safely restart.
Why the main chain remains paused
Stopping block production prevents the affected chain history from growing while the team completes the patch and recovery work.
Elastos uses both AuxPoW mining and BPoS validation. A safe recovery requires miners, validators, exchanges, explorers, wallets, and infrastructure providers to follow the same software, rollback point, and activation process.
Individual node operators must not attempt their own rollback.
Uncoordinated action could split the network, with different nodes accepting different versions of the chain.
The main chain will remain paused until the patch, rollback procedure, historical compatibility, and activation process have been tested and reviewed.
Separately, Elastos Smart Chain and Elastos Identity Chain have been paused as a precaution as audits cover both side-chains as well.
Proposed rollback and recovery
The proposed recovery would return the main chain to the last known valid state before the exploit and resume block production under the corrected monetary rules.
This is a coordinated blockchain recovery. It is not a normal wallet transaction reversal.
Transactions confirmed during the affected 145-block period are now being reconciled. Some legitimate transactions from that period may need to be submitted again after the network resumes.
Clear instructions will be published before the restart.
No rollback height, activation time, or production procedure will be announced until the recovery has been independently reviewed and rehearsed in representative AuxPoW and BPoS environments.
Current status
At the time of this notice:
- Main-chain block production remains paused
- The affected activity has been identified and is being reconciled
- The immediate safety patch is under development and review
- A wider security review of the main-chain codebase is underway
- Independent third-party review is being arranged
- The controlled rollback and restart procedure is being tested
- ELA deposits and withdrawals should remain suspended
- Cross-chain transfers should not be initiated
The network will not restart until the team and independent reviewers are satisfied that all participants can recover onto the same corrected chain.
User and wallet safety
There is no evidence that user seed phrases, private keys, or wallet software were compromised.
Wallet holders do not need to take any action at this time.
Do not share a seed phrase or private key with anyone claiming to offer incident support. Elastos will never ask for these credentials.
Wait for an official restoration announcement before attempting main-chain or cross-chain transfers.
Guidance for exchanges and service providers
Exchanges should keep ELA deposits and withdrawals suspended until the recovery is complete and balances have been reconciled.
Explorers, wallets, indexers, mining pools, and infrastructure providers should wait for approved binaries and activation instructions.
Node operators should not restart the chain, roll back data, or apply unofficial patches independently.
Final instructions will include the approved software version, rollback point, activation process, and verification steps.
Separate from the July 13 cross-chain incident
This event is separate from the cross-chain reserve incident disclosed on July 15.
The earlier incident involved authorisation rules for spending the cross-chain reserve. The July 20 incident involves a different vulnerability in main-chain monetary arithmetic and transaction validation.
Details of the earlier event are available in the Cross-Chain Reserve Incident and Response notice.
What must happen before the restart
Before main-chain block production resumes, the following work must be completed:
- Finalise and test the immediate safety patch.
- Complete an independent review of the patch.
- Test the rollback in representative AuxPoW and BPoS environments.
- Reconcile legitimate activity from the affected block window.
- Coordinate the release with miners, validators, exchanges, explorers, wallets, and other service providers.
- Publish approved binaries, activation details, and verification instructions.
A detailed technical postmortem and verified accounting will be published when doing so no longer adds risk to the active remediation process.
