Midnight Details Security Fixes in Ledger 9.1.0.1

Midnight has published the source code and release notes for Ledger 9.1.0.1, the version activated on mainnet during the November 6 network upgrade. The release lists 13 fixes, including changes to transaction fee calculations, block limits, and the way wallets display coins.

According to the release notes, node operators received the software on November 3. The source code and descriptions of the fixes were published on November 7. The update also rejects some transactions that earlier Ledger 9 builds accepted.

Changes to Transaction Fees and Block Limits

The ledger is the part of Midnight’s software that determines whether transactions are valid and how much they cost. Midnight moved to Ledger 9 without the usual advance period on the Preprod test network. The project explained that it uses a more controlled release process when security fixes require it.

One issue affected how nodes processed repeated entries in shared data structures. According to the release notes, a small transaction could force a node to perform an exponentially increasing amount of work before checking its fee. The updated ledger rejects repeated entries before calculating the fee and processes the data in time proportional to its size.

Two other fixes address block limits. A transaction could previously declare deletions it never performed, reducing fees for other parts of the transaction and bypassing the limit on net bytes written. A separate calculation issue allowed declared computation time of at least 2⁶³ picoseconds to be charged as zero. Both types of transaction are now rejected as invalid.

DUST, Wallets, and the Cardano Bridge

Midnight transaction fees are paid using DUST, a resource generated from NIGHT holdings. The release notes describe an issue in which a smart contract could capture excess fee resource credited during registration while the registrant still received the full amount. Contract calls that transfer the fee resource as a public input or output are now rejected.

Another fix concerns how wallets replay events from the chain. A valid output could contain an encrypted record that did not match its cryptographic commitment. This could cause a wallet to display coins it could not spend or overwrite the position of a coin it already held. The release notes state that the on-chain state was unaffected.

The update also more thoroughly clears sensitive data derived from wallet seeds from memory. Some of the listed fixes refer to audit findings, and the release notes point to nine GitHub security advisories whose pages were not publicly available on the morning of November 8.

A separate fix applies to the protocol bridge intended to transfer tokens from Cardano to Midnight. Zero-value claims could previously pass validation without paying a fee. Claims must now meet the required minimum or cover the entire remaining balance. The bridge is present in the Ledger 9 code but remains disabled on mainnet until a separate governance action enables it.

[NEWSBREAK]

Developer Packages and Remaining Issues

The release includes @midnight-ntwrk/ledger-v9 1.0.1, onchain-runtime-v4 4.0.1, and Proof Server 9.0.1. A proof server generates the zero-knowledge proofs used in transactions. Midnight’s mainnet upgrade documentation separately lists Proof Server 9.0.0 among its compatible components.

Ledger 9.1.0.1 rejects transactions with duplicate committee signatures or duplicate fee registrations. A contract may contain no more than 256 operations, each deployment is charged for its full state, and declared gas must remain within the block limit.

Several Rust cost calculation functions now return an error instead of a value. Developers who calculate fees directly must account for that change in their integrations.

Two known issues from version 9.1.0.0 remain open. One can cause a contract call to be rejected when its fee is paid with exactly one DUST spend. Midnight’s documentation identifies using two or more DUST spends as a workaround while a fix is planned for a later release.