What happened

Hydra merged a change to bind each deposit to the snapshot that authorizes it. The update folds `depositTxId` into `commitOutputsHash`, requires the head’s Increment redeemer to name the claimed deposit, and requires that deposit to be output 0.

The stated issue was a look-alike deposit: copied deposit data could hash the same way and reuse a signature intended for the real deposit. That could allow a head to credit more Layer 2 value than it had actually received.

Why it matters

Hydra heads custody real user funds on Layer 2, so accurate deposit accounting is a core safety property. The merged change is intended to ensure that a signed authorization is attached to the specific deposit being claimed, rather than to matching deposit content alone.

For Hydra integrators, the change affects commit and snapshot semantics. Teams using Hydra deposits may want to review their integration before the next release.

What to watch

The practical receipt is a tagged Hydra release that includes this change, followed by implementation and integration evidence from users of the deposit flow. The supplied record describes work merged to master, not a deployed release.

What to watch

Watch for the next tagged Hydra release and evidence that the revised deposit semantics are included in downstream integrations.

Sources and limits

Upstream references and independent checks

Digest dated 2026-08-25 · upstream model claude-sonnet-4-6. Direct links are available for 2 of 3 upstream source IDs; unresolved IDs remain visible for audit.

  1. 1
    Bind deposits to the snapshots that authorize themDirect upstream source · a39d457969274e29f047dd40e4935df5a6a1ba5e
  2. 2
    Close gaps found reviewing the deposit bindingDirect upstream source · 98e8d5b3dbf6f21e6459157ed71ebdf2cb99872d
  3. 3
    eaff8fc939ca357b2a6569cdee4e521bc1a46a29Upstream reference; direct URL unavailable.

This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: This is an in-development repository fix merged to master, not a disclosed exploit of a live mainnet Hydra head or a tagged Hydra release; no funds were reported lost.