Firo Hard Fork Nears as Upgrade Fixes Spark Coin Forgery

Firo's mandatory hard fork was 153 blocks from activation early Friday, leaving node operators, exchanges and wallet services only hours to install v0.14.18.0 before the chain splits. The fork triggers at block 1,371,000 (the chain hit block 1,370,847 at 1:45:47 a.m. UTC on Sept. 4), repairing a flaw in the privacy coin's Spark transaction protocol that could allow forged coins and unbounded supply inflation under specific conditions. The vulnerability, disclosed Aug. 13, affects only multi-input Spark spends; a researcher's controlled mainnet test produced roughly 200 FIRO before interim v0.14.17.2 restricted Spark to single-input spends.

Why it matters

The flaw sits in the cryptographic proof used by multi-input Spark transactions. Firo has confirmed no wallet keys were exposed, no funds were drained, and single-input spends were never affected. The interim single-input restriction protected supply integrity at the cost of weaker privacy, since a larger payment split across separate transactions leaves correlation patterns a normal multi-input spend would hide. The permanent fix in v0.14.18.0 ships a new versioned Chaum V2 proof and transaction format, restoring full multi-input privacy once the fork lands. Existing Spark coins, balances, addresses and keys stay valid across the fork; funds do not need to migrate.

Market impact

Activation runs on block height rather than wall-clock time, so the deadline is binary: nodes still on older software at block 1,371,000 become incompatible with the upgraded chain and orphan themselves. The burden sits with full-node and masternode operators, miners, exchanges and service providers, not passive holders, though exchange-side delays could still freeze deposits and withdrawals through the activation window. Firo plans a full technical post-mortem after activation, which is when the broader privacy-coin sector will find out whether the proof-system gap generalizes to similar constructions elsewhere.