What happened.

Hydra's recover observer identified transactions by their shape alone. According to the fix commit, a malicious head participant could craft an increment that paid copies of deposited outputs. Honest nodes would then treat the transaction as a recover and drop the pending deposit, even as the head version advanced on chain. The commit says those nodes could no longer close or contest the head.

The same check could also misread a close, contest or decrement that recovered an expired deposit as a recover instead of the head transition. The recover observation fix requires the Recover redeemer on the deposit input and refuses any transaction that spends a head output. Increment is checked before Recover as an additional safeguard.

Why it matters and what to watch.

For heads with participants who may misbehave, the reported failure could leave honest nodes unable to use close or contest. This is a Hydra issue involving a participant inside the head; the record does not describe a Cardano base-layer compromise.

The fix commits are timestamped 11:29 UTC on 2026-10-05. A merge commit with the message “Advisory fix 1” followed at 12:17 UTC, but the supplied record does not establish which commits that merge brought in. Watch for a tagged Hydra release that identifies the included fix and the affected versions before treating a running head as patched.

What to watch

A tagged Hydra release identifying the fix and affected versions is the next useful receipt.

Sources and limits

Upstream references and independent checks

Digest dated 2026-10-06 · upstream model sonnet. Direct links are matched to all 3 upstream source IDs.

  1. 1
    Fix crafted head transactions being observed as a recoverDirect upstream source · 92993cec8f930b26d2a98a7bceec483bece81a32
  2. 2
    Fix recover observationDirect upstream source · ae1653e76259a567d747920a2200ed9d960adc47
  3. 3
    Merge commit from forkDirect upstream source · ea531d585d51cb1cca119f444a908d2402c918de

This Research brief was generated by GPT-6 Sol from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The record gives no affected versions or tagged release, does not establish which commits the “Advisory fix 1” merge included, and does not say whether the flaw was exploited or funds were lost.