News linked to both this project and an event.
According to CryptoSlate, researchers from USENIX Security publicly disclosed a clock attack vulnerability against Solana’s Proof of History (PoH) mechanism on August 12. The vulnerability had been privately reported to the Solana development team as early as December 2025. Research indicates that a malicious scheduler leader could manipulate the PoH logical clock through "re-anchoring," slowing the progression of logical time. This would yield a longer transaction selection window within physical time, allowing the attacker to isolate honest leaders' blocks via the TowerBFT fork-choice mechanism, with the required stake for the attack falling below 33%. The Alpenglow security contest hosted by Anza, which offered a 50,000 SOL prize pool, concluded on August 19. However, the vulnerability was excluded from the evaluation scope because the contest rules explicitly excluded "behaviors that can only be triggered when Alpenglow is inactive." The Solana development team confirmed awareness of the issue, stating that the probability of the worst-case scenario occurring under current conditions is low. They expect the Alpenglow upgrade to fundamentally eliminate the attack's prerequisites. The Alpenglow code is already integrated into the Agave 4.2 client but remains inactive on the mainnet, with full deployment expected alongside Agave 4.3. Until then, the transitional risks associated with this vulnerability have yet to receive public implementation-level analysis or official responses.
Anza, a core Solana development team, announced that it has recommended Solana mainnet validators upgrade to Agave 4.0. This release includes XDP for Turbine, TPU transaction ingestion exclusively over QUIC, faster replay stages, and a suite of feature-gated SIMD instructions set to activate during this cycle. Production environment results from large mainnet validators show Turbine retransmission latency has dropped from 600 ms to approximately 0.8 ms. Additionally, UDP-based transaction ingestion has been removed, making QUIC the sole transaction submission method; simple vote transactions now follow the same cost model as regular transactions. Features including p-token, Stake Program v5, SBPFv3 program support, pre-funded account creation, and BLS12-381 system calls will also be enabled during the 4.0 cycle.