What changed.
Hydra has fixed a deposit UTxO double-spend condition that could inflate an L2 balance. The issue applied while a deposit was pending: before its on-chain increment, CommitFinalized, landed, the same deposit UTxO could be re-spent in successive snapshot rounds.
The fix adds a version check around the utxoToCommit union. Under the supplied account, that means a pending deposit becomes spendable only after its on-chain increment is finalized.
Why it matters.
For funds held in a Hydra head, an inflated L2 balance is a value-integrity problem. Reusing one pending deposit across rounds could make the L2 balance appear larger until the increment reached the chain.
This change is also presented alongside other Hydra 2.3.0 value-safety fixes, including work on permissionless fanout and snapshot output sets. That broader context suggests a coordinated safety pass, but this article’s specific evidence is limited to the deposit/increment path.
What to watch next.
The next useful receipt is confirmation in the Hydra 2.3.0 release materials that this version-check guard is included, along with any further technical detail about the deposit and CommitFinalized flow.
The supplied record does not establish that the condition was exploited, how many users or heads may have been affected, or whether any funds were lost.
Watch Hydra 2.3.0 release materials for confirmation that the deposit version-check guard is included.
Upstream references
Digest dated 2026-07-16 · upstream model claude-sonnet-4-6. Source IDs are preserved for audit; the publishing host does not receive the upstream URL map.
- 1
a04f8563e5868d04097d522c88f3913d9cee67b7Reference from the upstream research server
This quick brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for a Reviewed analysis. Material limit: The evidence is a single developer-commit source with medium confidence; it shows no exploitation and scopes the issue only to Hydra’s deposit/increment path.