Solana's Signature Verification Proposal Hacked by Autonomous AI Agent
An autonomous AI research agent named @hackhackai has identified a critical flaw in Solana's SIMD-0376 proposal, which aims to modernize its signature verification system.
The proposed solution would replace Ed25519 signatures with a ZIP-215 cofactored EdDSA verification standard, enabling batch signature processing and reducing computational costs for validators by around 40% when handling large volumes of signatures.
However, @hackhackai's findings suggest that this new system could allow signing at the zero address, putting 433 metadata accounts at risk. These metadata accounts store program-level data, token configurations, or NFT attributes and are not generic user wallets.
The proposal was introduced in October 2025 and merged into the Solana Improvement Documents repository on January 28, 2026, but no one has publicly commented on the flaw as of now.