We have released Firo v0.14.18.0, the mandatory hard fork release that restores full Spark functionality following the Spark vulnerability mitigation announced earlier this month.
The hard fork will activate at block 1,371,000, approximately September 4, 2026 at 10:00 UTC.
All Firo wallet users, full node and masternode operators, miners, exchanges, and other service providers should upgrade to v0.14.18.0 before the activation block.
What Changes
As described in our previous update, the Spark vulnerability affected multi-input Spark spends. Single-input Spark transactions were unaffected.
To secure the network while a permanent fix was prepared and reviewed, v0.14.17.2 temporarily restricted Spark spends to a single input.
Firo v0.14.18.0 introduces a new versioned Spark spend format containing the permanent fix.
Until block 1,371,000, the existing single-input restriction remains in place. Once the hard fork activates, wallets running v0.14.18.0 will automatically begin using the new spend format and normal multi-input Spark spending will be restored.
There is no migration required. Existing Spark coins, balances, addresses and wallet keys remain valid.
What You Need To Do
Upgrade to Firo v0.14.18.0 before block 1,371,000.
You can obtain the latest release from:
As this is a hard fork, nodes that have not upgraded will no longer remain compatible with the network once the activation height is reached.
If you do not need to spend your Spark funds immediately, we continue to recommend waiting until the hard fork activates before making Spark transactions.
Single-input Spark spends remain available before activation for users who need to move funds, but splitting a payment across multiple single-input transactions can reveal correlations between transaction amounts and therefore provide weaker privacy than a normal multi-input Spark spend.
Additional Security Hardening
While preparing the permanent fix, we used the opportunity to conduct a broader review of the Spark implementation and surrounding consensus code.
v0.14.18.0 therefore includes a number of additional hardening measures beyond the original vulnerability fix, including improvements to Spark transaction validation, proof verification, duplicate mint handling, reorganisation handling and validation of malformed Spark data.
The release also includes additional wallet, P2P and node stability fixes.
These changes do not require users to take any action beyond upgrading.
Responsible Disclosure and Review
We would once again like to thank Carter Annandale (@carter-0), who responsibly disclosed the original vulnerability, and Giap Vu, who independently identified and reported the same issue shortly afterwards.
The permanent fix and surrounding changes have undergone extensive review by the Firo core team together with Cypher Stack, with additional review assistance from HashCloak.
We are particularly grateful to everyone who assisted during the initial coordinated mitigation, including the mining pools and masternode hosting providers who deployed the protective changes before the vulnerability was publicly announced.
Their fast response allowed us to secure the network without exposing the vulnerability while a significant portion of the network remained susceptible.
What Happens Next
Once block 1,371,000 is reached:
- The new versioned Spark spend format activates.
- Full multi-input Spark spending is restored.
- The temporary privacy limitations associated with single-input-only spending are removed.
- Existing Spark funds continue to work without migration or reminting.
As promised in our previous announcement, we will publish a full technical disclosure and post-mortem after the hard fork has successfully activated.
This will cover the underlying cryptographic issue, why it affected multi-input transactions, how the mitigation worked, how the permanent fix addresses it, and the lessons we have taken from the incident.
For now, the most important action is straightforward:
Upgrade to Firo v0.14.18.0 before block 1,371,000.