The hard fork will activate at block 1,371,000, approximately September 4, 2026 at 10:00 UTC.

All Firo wallet users, full node and masternode operators, miners, exchanges, and other service providers should upgrade to v0.14.18.0 before the activation block.

What Changes

As described in our previous update, the Spark vulnerability affected multi-input Spark spends. Single-input Spark transactions were unaffected.

To secure the network while a permanent fix was prepared and reviewed, v0.14.17.2 temporarily restricted Spark spends to a single input.

Firo v0.14.18.0 introduces a new versioned Spark spend format containing the permanent fix.

Until block 1,371,000, the existing single-input restriction remains in place. Once the hard fork activates, wallets running v0.14.18.0 will automatically begin using the new spend format and normal multi-input Spark spending will be restored.

There is no migration required. Existing Spark coins, balances, addresses and wallet keys remain valid.

What You Need To Do

Upgrade to Firo v0.14.18.0 before block 1,371,000.

You can obtain the latest release from:

• Firo Downloads
• Firo GitHub Releases

As this is a hard fork, nodes that have not upgraded will no longer remain compatible with the network once the activation height is reached.

If you do not need to spend your Spark funds immediately, we continue to recommend waiting until the hard fork activates before making Spark transactions.

Single-input Spark spends remain available before activation for users who need to move funds, but splitting a payment across multiple single-input transactions can reveal correlations between transaction amounts and therefore provide weaker privacy than a normal multi-input Spark spend.

Additional Security Hardening

While preparing the permanent fix, we used the opportunity to conduct a broader review of the Spark implementation and surrounding consensus code.

v0.14.18.0 therefore includes a number of additional hardening measures beyond the original vulnerability fix, including improvements to Spark transaction validation, proof verification, duplicate mint handling, reorganisation handling and validation of malformed Spark data.

The release also includes additional wallet, P2P and node stability fixes.

These changes do not require users to take any action beyond upgrading.

Responsible Disclosure and Review

We would once again like to thank Carter Annandale (@carter-0), who responsibly disclosed the original vulnerability, and Giap Vu, who independently identified and reported the same issue shortly afterwards.

The permanent fix and surrounding changes have undergone extensive review by the Firo core team together with Cypher Stack, with additional review assistance from HashCloak.

We are particularly grateful to everyone who assisted during the initial coordinated mitigation, including the mining pools and masternode hosting providers who deployed the protective changes before the vulnerability was publicly announced.

Their fast response allowed us to secure the network without exposing the vulnerability while a significant portion of the network remained susceptible.

What Happens Next

Once block 1,371,000 is reached:

• The new versioned Spark spend format activates.
• Full multi-input Spark spending is restored.
• The temporary privacy limitations associated with single-input-only spending are removed.
• Existing Spark funds continue to work without migration or reminting.

As promised in our previous announcement, we will publish a full technical disclosure and post-mortem after the hard fork has successfully activated.

This will cover the underlying cryptographic issue, why it affected multi-input transactions, how the mitigation worked, how the permanent fix addresses it, and the lessons we have taken from the incident.

For now, the most important action is straightforward:

Upgrade to Firo v0.14.18.0 before block 1,371,000.

The following community members will serve as CFC members for a period of 1 year starting from September 2026:

• rottenwheel
• nrsimha
• Jagmo (jh_ride)
• Firofan
• ddadybayo
• vaselexa (centaurea)
• Thorfried

The newly elected committee brings together long-standing community members, technical experts, and developers who have consistently participated in proposal reviews and guided the allocation of the Firo Community Fund.

We would like to extend our gratitude to the newly elected members for serving on the Firo Community Fund (FCF) and for contributing to the decentralization of funding decisions. We also sincerely thank the outgoing committee members for their dedication and service to the project.

How to apply for funding from the Firo Community Fund

Anyone is welcome to request funding from the FCF by submitting a proposal through the Firo Crowdfunding System and opening a forum thread to invite community discussion. In addition, the Community Fund Committee has the authority to put forward proposals of their own for consideration.

What are the responsibilities of the Community Fund Committee?

1. To decide along with taking into account community feedback on how the Firo Community Fund should be utilised.
2. To help evaluate community requests for funding, do due diligence of applicants applying for funding and obtain all necessary information to ensure sufficient detail for scope of work.
3. To evaluate and approve payment of milestone requests.
4. To make all reasonings of the CFC for approval/rejection public.
5. CFC can request for the core team’s feedback and opinion on proposals.
6. To always conduct themselves with professionalism without resorting to personal attacks or insults.

How will the Firo Community Fund (FCF) be utilised?

1. FCF funds must always be utilised for the benefit of Firo. Research, development or promotional activities that do not directly benefit Firo should not be undertaken.
2. All FCF expenditure has to be disclosed. Any proposal that does not allow this will not be able to be funded from the FCF.
3. FCF funds should not be used for giveaways even for the purpose of promoting adoption or participation.
4. FCF funds should not be used to host purely social events. Educational or awareness events are acceptable but must be the primary component of the event.
5. FCF funds should be used and while there shouldn’t be a pressure to spend funds, the FCF should not be hoarded.
6. CFC can choose to use the FCF to employ contractors to embark on specific tasks or roles that will report directly to the CFC.
7. Should the CFC deem fit, FCF funds can be burnt by sending it to this burn address.
8. FCF funds address can be viewed here.

Where can I see the deliberations of the Community Fund Committee?

All discussions of the CFC can be seen in our Discord in the channel #communityfund or The CFC telegram group and is read-only. You will need to have verified status by passing the captcha to view the channel.

Please upgrade to v0.14.17.2. Until the next hard fork, Spark spends are limited to a single input. For maximum privacy, wait for the next hard fork (v0.14.18.0) before spending Spark. Single-input-only spends can leak amount correlations (see below).

What Happened

On 1 August 2026 we received a vulnerability disclosure from Carter Annandale regarding the Spark protocol. We acknowledged it on 2 August and confirmed its validity: the issue allows an attacker to forge Spark coins in multi-input transactions. Single-input transactions are not affected. On 6 August we received an independent report of the same issue from Giap Vu.

Aside from a small, controlled amount (~200 FIRO) generated on mainnet by the researcher to validate the finding, we have found no evidence of inflation at this time and are continuing to monitor closely.

On the Nature of the Bug

The vulnerability originated in the Spark cryptography paper and was missed by both cryptography audits (we commissioned two) and the code audit. It is not a typo, a missing bounds check, or an obviously dropped validation but instead is a subtle error. Reassuringly, it is straightforward to fix and does not require any overhaul or redesign of the Lelantus Spark protocol.

How We Mitigated It

The main challenge was deploying a fix without alerting adversaries while the network updated. Working with key infrastructure providers, we first deployed a patch that disables multi-input Spark spends, securing the network ahead of a public release. Our thanks to WoolyPooly, Cedric Crispin, and Rplant on the mining side and Nodehub, Allnodes, Evoznode and Pecunia on the masternode side for their fast updates, which gave us the consensus needed to secure the network. Others were contacted but did not respond.

The fix was developed and reviewed by the Firo core team together with the developers and cryptographers at Cypher Stack, and additionally reviewed by HashCloak (one of the original Spark cryptography and code auditors). The team at Cypher Stack had jumped into action despite a busy period and did a lot of the heavy lifting, unprompted and voluntarily, greatly relieving the load. In particular, we would like to thank Josh Babb, Samuel Graf Noether, Julian Anderson, Dan Miller and Diego Salazar. HashCloak has also been a long time supporter of Firo and we would like to thank Mikerah and Manish for helping to validate the fixes.

Releases

v0.14.17.2 (available now): Allows users to make single-input Spark spends if they need to move funds before the next hard fork. Note that because Spark mints cannot currently be consolidated, single-input spends may reveal some correlation between amounts.

v0.14.18.0 (targeted for the 3rd week of August): A hard fork that re-enables full multi-input Spark spends. We will announce the exact activation height ahead of time. To protect your privacy, we recommend waiting until the v0.14.18.0 hard fork before making Spark spends, to avoid amount-correlation analysis.

Full technical details of the fix will be published after the second hard fork has activated.

Please express your interest in standing for election in the Forum thread here. Do ensure you introduce yourself and why you are applying to the post and your experience/history with Firo.

The 7 member CFC forms an important role in gradually decentralizing governance and sets up an independent fund (Firo Community Fund) to be used for the benefit of Firo. The FCF has been used to fund various community management efforts, audits, social media/marketing support and also to assist the core team where additional funds are required.

Current CFC Members:

1. @FiroFiend
2. @firofan
3. @vaselexa
4. @ddadybayo
5. @rehrar
6. @jagmot
7. @Nrsimha

CFC Committee positions are at this point in time done on a volunteer basis and we recommend only active and motivated members of the Firo community apply. There is no restriction on existing committee members seeking re-election.

Below is a reminder of the role of the CFC and the Firo Community Fund (FCF) it manages:

Brief Summary of How the CFC Came to Be

Firo conducted a series of community votes to adjust its tokenomics and established the Firo Community Fund. This process spanned several months and involved multiple vetted polls to ensure alignment with the community’s wishes. A committee comprising seven elected community members was established to manage fund allocation.

Following the nomination phase, nominees (who are new) undergo a vetting process, including an interview, to assess their eligibility and alignment with the community’s voting objectives. The interview, which can be conducted through text or online meetings, delves into the nominees’ beliefs in Firo, their grasp of Firo’s technology, personal background (without revealing sensitive information), and their vision for the fund’s utilization. Nominees not widely known in the community must provide proof of active participation for at least a year.

Moving on from these specifics, it’s essential to outline the responsibilities and prerequisites expected of a member of the Firo Community Fund Committee (CFC).

Responsibilities of Community Fund Committee Members

1. To decide along with taking into account community feedback on how the community fund should be utilized.
2. To help evaluate community requests for funding, do due diligence on applicants applying for funding, and obtain all necessary information to ensure sufficient detail for the scope of work.
3. To evaluate and approve payment of milestone requests.
4. To make all reasoning of the CFC for approval/rejection public.
5. CFC can request the core team’s feedback and opinion on proposals.
6. To always conduct themselves with professionalism without resorting to personal attacks or insults.

Minimum Requirements to Be Eligible to Be a Committee Member

1. Be a recognized and active community member of Firo for at least a year, OR a recognized industry expert/specialist.
2. Solid understanding of Firo’s technology stack and current roadmap and goals.
3. Cannot be a current full-time member of the Firo core team. Part-time contributors or contractors of Firo’s core team are allowed but must be disclosed.
4. Be able to attend a CFC meeting once a month or appoint a proxy to do the same (though proxies should be used sparingly).
5. While a technical or development background isn’t required, having a few committee members with some technical background would be helpful in evaluating proposals.
6. Be able to read, check and vote on proposals for funding at least once a week.
7. Be 18 years old and above.

Removal of CFC Members

1. If a CFC member is suspected or found to have been involved in fraud, scam, or other deceitful behavior, the other CFC members can vote to remove them via majority vote.
2. If a CFC member has acted in an unbecoming or unprofessional manner, the other CFC members can vote to remove them via a majority vote.
3. If a CFC member is absent for 2 meetings in a row without due cause, they shall be removed automatically.
4. If a CFC member has continuously failed to vote on proposals for funding, a vote shall be held at the next CFC meeting by the other CFC members on whether to remove them.
5. If a CFC member is removed, nominations should be open for the spot for the remaining term.

Meetings, Quorums, and Voting

1. A meeting should be held at least once a month with CFC members. The purpose of this meeting is to discuss proposals or to decide how to allocate the FCF funds or any other matters arising. Given CFC members may be in different time zones, this should be taken into account when determining the time of the meeting and the opportunity to take turns for amenable timing.
2. Core team members or their representatives should always be allowed to observe and attend all CFC meetings, but shall not have a vote unless otherwise specified.
3. The minutes of these meetings shall always be publicly available.
4. The meeting can be conducted by text or online meetings.
5. A quorum should be 5 members. Votes are passed using a majority of votes. In the event of an equality of votes, the core team shall have a casting vote.
6. Proposals for funding can be approved without the need for a meeting and shall be voted on in the proposal thread itself.
7. When voting for or against a proposal for funding, all CFC members are required to state the reasoning behind their choice.
8. Anyone can open a proposal for funding, including CFC members.
9. If a CFC member is an applicant for funding, the member cannot vote on that proposal. Also, if a CFC member has a close relationship (e.g. family member, best friend, significant other, spouse) with the applicant for funding, the CFC member should disclose the relationship and put it to the other CFC members to decide whether the member should be allowed to vote or choose to abstain voluntarily.
10. If the CFC wishes to make funds available to the core team to assist them (for instance to cover a shortfall or to pay for a specific employee to retain them), a higher vote threshold is required, which is 5 members out of 7 instead of the usual majority of votes.

General Guidelines to Community Fund Usage

1. Trust needs to be earned. While anyone can propose to be funded from the FCF, the person’s track record needs to be evaluated, the necessary due diligence needs to be taken, and milestone payments adjusted appropriately.
2. The CFC can choose to employ contractors to embark on specific tasks, but shall seek community feedback. Where it involves core code, the CFC has to consult the core team.
3. The CFC should not be used to host parties or purely social events. Educational or awareness events are okay but should be done with appropriate evidence and not paid upfront.
4. The CFC is to be used and while there shouldn’t be pressure to spend the CFC funds, the CFC funds shouldn’t be hoarded.
5. CFC funds should always be utilized for the benefit of Firo. Research or development that does not directly benefit Firo should not be undertaken.
6. CFC funds should not be used for giveaways, even for the purpose of promoting adoption or participation. These have limited effects.
7. All CFC expenditure has to be disclosed. Contractors that prohibit this should not be engaged.
8. Should the CFC deem fit, FCF funds can be burnt by sending them to this burn address https://explorer.firo.org/address/aFiroBurningAddressDoNotSendrPtjYA.
9. FCF funds address can be viewed here, which are from time to time anonymized.
10. Utilization of CFC funds and proposals can always be viewed on the Firo Community Crowdfunding page under the category of CFC.

What the CFC Is NOT

1. The CFC are NOT representatives of the opinion of the Firo Community. They are only tasked with matters to do with the Community Fund and do not replace the usual process of getting feedback from the general community and core team in implementing large changes.
2. The CFC shall not represent itself as core team members or as representatives of the project.

As always, please backup your wallet before updating.

Download the latest release here: https://github.com/firoorg/firo/releases/tag/v0.14.16.1

What’s New

Spark Name Overflow Fix

This release resolves an overflow bug in Spark Name handling that was present in v0.14.16.0. The fix is the primary reason this follow-up release is mandatory - all users on v0.14.16.0 must update to ensure correct Spark Name behavior at and beyond the activation block.

Minor Spark Name Vulnerability Fix

Fixes a minor vulnerability where a Spark Name transfer permission could remain valid indefinitely. Transfer permissions now expire correctly, limiting the window in which they can be used.

Receive Request Model Fix

Fixes crashes in the receive request dialog and incorrect handling of recent request history in the Qt wallet.

Spark Address Book Refresh Fix

Fixes a bug where Spark address book options could remain unavailable after syncing past the Spark activation block, requiring a wallet restart to resolve. The wallet now correctly detects activation even when the sync jumps past the exact activation height.

Lelantus Strip

Internal cleanup work removing legacy Lelantus components as the protocol continues to consolidate around Lelantus Spark.

Update Deadline

This is a mandatory update that supersedes v0.14.16.0. All wallets, full nodes, and masternodes must be updated to v0.14.16.1 before block 1,329,000, approximately 22 June 2026. This applies even if you recently updated to v0.14.16.0.

Download

Binaries are available for Linux, macOS, and Windows on the GitHub releases page.

In the founder’s own words: “The original idea behind SmoozyPool was to support privacy-focused and community-driven coins, not just add random mining coins. Firo fits that direction well because it has a strong privacy mission, real technology behind it, and an active long-term community.”

About SmoozyPool

SmoozyPool is a multi-chain pool supporting GPU, CPU, and ASIC mining across a range of privacy and community coins. Firo mines on the FiroPoW algorithm, which is GPU-friendly and ASIC-resistant by design, keeping mining accessible to commodity hardware.

Pool Details

How to Start Mining

Getting started takes three steps: choose Firo as your coin, generate your mining command using SmoozyPool’s built-in config generator, and run your miner.

PPLNS port: 4031

SOLO port: 4034

SmoozyPool’s site includes a mining command generator - enter your wallet address and worker name and it outputs a ready-to-run command for your preferred miner. No manual config editing required.

Make sure you are mining to a self-custodied Firo wallet. We recommend Campfire (mobile) or Firo QT (desktop). Avoid mining directly to an exchange address.

Welcome to the #FiroFam, SmoozyPool. 🔥

As always, please backup your wallet before updating.

Download the latest release here: https://github.com/firoorg/firo/releases/tag/v0.14.16.0

What’s new

Spark Name Renewal and Transfer Without Double Paying

Users can now extend or transfer their Spark Name and have the leftover validity period credited - so you only pay for the time you are actually adding. This makes long-term use of Spark Names more practical and cost-efficient, and removes a friction point for users who want to keep their on-chain identity current.

Spark Names are Firo’s human-readable on-chain address system, letting you send and receive FIRO using a simple alias like @sparky instead of a long cryptographic address - all while preserving the full privacy guarantees of Lelantus Spark.

Spark Name List Refresh Fix

A bug causing the Spark Name list in the wallet to not refresh correctly has been resolved. Registered names will now display accurately and update as expected.

Qt Wayland Support

This release adds Wayland display protocol support for the Qt wallet. This benefits Linux users running Wayland compositors, improving compatibility and stability of the desktop wallet on modern Linux environments.

RPC and Mempool Improvements

The getspentinfo RPC call is now properly registered, and stale mempool spent index entries are cleaned up when transactions are removed. This improves reliability for developers and node operators querying spent transaction data.

Update Deadline

This is a mandatory update. All wallets, full nodes, and masternodes must be updated to v0.14.16.0 before block 1,329,000, approximately 22 June 2026.

Download

Binaries are available for Linux, macOS, and Windows on the GitHub releases page.

What Is MeowPool?

MeowPool launched in early 2026 with a clear mission: to help decentralize hashrate and support projects worth believing in.

The founder isn’t a stranger to mining. Back in 2020–2022, she was an active miner himself and she kept running into the same frustration: hashrate was perpetually consolidating into a handful of large pools. That centralization is bad for networks, bad for decentralization, and ultimately bad for the projects that depend on a healthy, distributed mining ecosystem.

So she built his own pool. MeowPool is a passion project at heart designed to support projects she genuinely believes in and to give miners a meaningful alternative to the giants.

Firo is a natural fit.

What MeowPool Offers

• 1% fee
• Fast, UK-based server
• Low minimum payout (0.01 FIRO)
• PPLNS reward system

Getting Started

Head over to meowpool.net to get set up. You’ll find the connection details and configuration instructions there.

Make sure your wallet is ready to receive FIRO. If you haven’t set one up yet, you can download the official Firo wallet at firo.org/get-firo/download.

What Is DFX?

DFX AG is a Zug-based open-source platform that bridges traditional banking and crypto. Users can buy, sell, and swap over 80 cryptocurrencies directly from their own wallets - whether that’s MetaMask, Ledger, Trezor, or any WalletConnect-compatible wallet - via SEPA, SEPA Instant, and SWIFT bank transfers, with no centralized exchange in between. DFX also provides an integration toolkit (the DFX Toolbox) that lets wallets and apps embed fiat on/off-ramping through a simple API or iFrame widget.

Beyond on/off-ramping, DFX powers crypto payments at physical retail locations in Switzerland, including 137 SPAR supermarkets - making it one of the few platforms bridging both the fiat-to-crypto and crypto-to-retail gaps.

What This Means for Firo

DFX is integrating FIRO into their platform. This gives FIRO holders a non-custodial path between fiat and FIRO - buy directly from a bank account into your wallet, or convert back to CHF or EUR without touching an exchange. It also means FIRO becomes spendable at physical retail locations like SPAR supermarkets in Switzerland.

Payments use Firo’s privacy preserving Spark Addresses by default, so users can send and receive funds through a reusable address without exposing their transaction history. The privacy guarantees that Firo is built on carry through to the payment experience - no compromises, no workarounds.

The integration with DFX is live. We’re now working on bringing it directly into wallets, with Stack Wallet expected to be the first to integrate DFX’s on/off-ramping for FIRO. This will give users a seamless in-wallet experience for buying, selling, and spending FIRO with fiat.

Why This Matters

Privacy coins often face a practical gap: you can hold them privately, but moving between fiat and crypto, or spending at real-world merchants, usually means giving that privacy up. DFX’s non-custodial approach and Firo’s Spark Addresses close that gap. FIRO users can on-ramp, off-ramp, and pay at retail without routing through a centralized exchange or exposing their transaction history.

We’ll share more updates as wallet integrations roll out. You can learn more about DFX at dfx.swiss.

We’re pleased to welcome Pooly.ca to the Firo ecosystem! Pooly has added FIRO as one of the coins you can mine on their platform.

What Is Pooly?

Pooly.ca is a mining pool with roots going back to 2017. What started as a small community pool has grown steadily over the years and in 2026, Pooly launched a completely new pool UI, new features, and PoolyNodes, a shared masternode hosting service.

The team behind Pooly genuinely understands mining from the inside out, and they’ve always prioritized being a place where miners especially newer ones, can get real help and support.

Loyalty Program

Miners who remain connected to the PPLNS pool for 30 consecutive days will see their pool fee reduced to 0%. An incentive to retain long-term contributors to the pool.

Getting Started

Head over to pooly.ca for connection details and setup instructions.

If you need a wallet to receive your FIRO, grab the official one at firo.org/get-firo/download.