Cardano Hydra 2.4.1 Fixes Fund Theft Vulnerability

The Cardano scalability protocol Hydra has released version 2.4.1, which fixes a vulnerability that could lead to fund theft. This version includes a security patch that restores the transaction validation process during the snapshot finalization phase. The Hydra development team has advised that users of version 2.4.0 can upgrade directly to 2.4.1, while users of version 2.3.0 or below must terminate their existing Hydra heads and complete the fan-out procedure before transitioning. The vulnerability, identified as 'GHSA-cg83-6w6r-6hx3', arose from skipping some validations under the assumption that the existing optimized path contained validated transactions. If an unvalidated transaction entered the system, a malicious participant could include transactions with incorrect signatures or failing scripts in the snapshot. The Hydra development team explained that the structure allowed for snapshots containing invalid transactions to be finalized. Version 2.4.1 addresses this issue by reapplying transaction signature and Plutus script validation. The price of ADA was $0.2092 on September 12, and according to CoinGecko, the 24-hour increase rate was 3.40%, while the 7-day decrease rate was 2.40%. Hydra operators should check their current version before proceeding with the transition.