What happened

Hydra merged a fix for GHSA-f825-9gwc-h5xq, a partial-fanout issue in its head close and payout path. The accompanying repository work includes fixtures intended to prove the behavior that existed before the fix.

In the described case, a non-final PartialFanout could pay a snapshot member even after that member’s value had already left the head. That could cause a pre-settled output to be paid again from the remaining funds, or leave the final payout step impossible to satisfy.

Why it matters

The issue sits on a path that accounts for and pays out value when a Hydra head closes. The change is marked breaking: it updates the signed snapshot message, redeemers, and head validator script hash. Integrators that construct or verify the affected messages and redeemers may need corresponding changes.

For head operators, the operational implication is coordination. The record indicates that the new on-chain surface cannot simply be mixed across parties during an upgrade.

What to watch

Watch for a tagged Hydra release before treating this merged development-branch work as an available deployment update. A release cut would be the clearest receipt that operators and tooling can use to plan the coordinated upgrade.

What to watch

Watch Hydra releases for a tagged version containing the breaking fix and updated head validator script hash.

Sources and limits

Upstream references and independent checks

Digest dated 2026-09-15 · upstream model claude-sonnet-4-6. Direct links are matched to all 3 upstream source IDs.

  1. 1
    Fix pre-settled partial fanout drain (GHSA-f825-9gwc-h5xq)Direct upstream source · 69688501b0023fe973edd5a14a807eb084b5826d
  2. 2
    Prove the pre-settled partial fanout drain (GHSA-f825-9gwc-h5xq)Direct upstream source · 437f608f5a2a6e044071a6c220c1d8be3fafeeab
  3. 3
    Derive pre-settled fanout fixtures from a real CloseUsedDirect upstream source · abf6df6c05c7c0d42e4f375dfd995fa00f44a9cb
Continue reading
  1. 1

This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The evidence is limited to merged commits in Hydra’s authoritative repository; it does not establish a tagged release, a mainnet deployment, or real-world exploitation, and it concerns Hydra Layer-2 code rather than the Cardano base protocol.