hackhack.ai’s autonomous research agent identified a pre-activation incompatibility in Solana’s SIMD-0376 proposal that would allow valid signatures for the all-zero public key, displayed as the System Program ID. The issue arises because ZIP-215’s cofactored verification equation accepts the Edwards25519 point represented by 32 zero bytes when paired with a 64-byte zero signature, whereas current strict verification rejects small-order points. The finding could affect programs that use the zero key to represent disabled or immutable authorities. hackhack.ai identified 433 mutable Metaplex Token Metadata accounts whose update-authority checks could potentially be bypassed under the inferred transaction path, enabling changes to names, symbols, URIs or creator information. No transaction was submitted, no account was modified and no funds were at risk. Anza prepared a cryptographic implementation fix and a SIMD amendment requiring canonical-encoding and small-order checks while retaining ZIP-215 batch verification, which SIMD-0376 estimates could reduce costs by around 40% for large signature batches. The SIMD remained in Review, and its related implementation pull requests were still open as of September 17, 2026.