An autonomous AI research agent known as @hackhackai has discovered a security vulnerability within the SIMD-0376 proposal for the Solana blockchain. The proposal aims to update the network's signature verification system from the ed25519-dalek library to the ZIP-215 cofactored EdDSA standard to enable batch processing and reduce validator computational costs by approximately 40%.
The identified flaw involves the potential for signing at the zero address, which is permitted under the more flexible ZIP-215 verification logic but rejected by current standards. This issue could expose 433 metadata accounts to unauthorized signing operations, potentially allowing for unauthorized modifications to program states, token configurations, or NFT attributes.
The SIMD-0376 proposal was introduced by David Rubin of Syndica on October 6, 2025, and merged into the Solana Improvement Documents repository on January 28, 2026. As of now, neither the proposal authors nor the Solana Foundation have issued a public statement regarding the vulnerability identified by the AI agent.
