1Sat Ordinals Replaces OrdLock Contract After Security Review Finds Vulnerability

Token Infrastructure Watch / Applications, Developer Tools

In Brief

1Sat Ordinals has announced the replacement of its original OrdLock listing contract with version 2 after a security review identified a vulnerability.

The team says existing listings under the original contract were canceled and the tokens returned to their owners’ cancellation addresses. Owners who still want to sell must create new listings using v2.

The public SDK contains the replacement implementation and disables creation of new listings through the original OrdLock template.

News Report

In an announcement published on October 12, 2026, at 12:58 UTC, the 1Sat Ordinals Team said OrdLock v2 was operational following a combined security review.

The announcement named Open Protocol Labs, GorillaPool, Project Babbage, the BSV Association and outside vulnerability auditors among the participants. It described a flaw in the original listing contract that arose under particular conditions.

A follow-up post from the same account said the vulnerability could permit asset theft or cancellation of a listing. That describes the risk identified; the post did not establish that a theft had occurred.

The team said it completed protective measures before disclosing the issue.

What Changed for Existing Listings

OrdLock allows an owner to place an ordinal into an on-chain sale contract. A buyer purchases the asset by satisfying the contract’s payment conditions, while the owner has a cancellation path.

According to the announcement, canceling the original listings returned their tokens to the cancellation addresses specified when those listings were created.

The team said owners did not need to take further action to protect or recover those tokens. Selling them again requires relisting under the replacement contract.

The statement that “all user funds are safe” is the team’s assessment. BSV TIMES has not independently reconciled every affected listing or owner balance.

What the SDK Shows

The public 1Sat SDK provides concrete implementation evidence alongside the announcement.

Its templates changelog records the addition of OrdLock v2 and states that creation of new listings through the original OrdLock.lock method remains disabled.

The canonical v2 implementation binds a listing’s required seller payment to the corresponding transaction output. The SDK’s purchase flow also checks that the listed satoshi reaches the intended one-satoshi receiving output.

The actions changelog documents v2 purchase handling for ordinals, OpNS names and BSV-21 listings.

These details matter to applications integrating the marketplace contract: preparing a purchase requires the correct funding, payment and asset-delivery arrangement.

The repository records the canonical v2 integration on September 12, 2026 (UTC). The October 12 notice is the subsequent public security and migration announcement; it should not be read as the date the first v2 code appeared.

Review Claims and Their Limits

The team said v2 underwent review by multiple parties and adversarial testing, including AI-assisted testing directed at the conditions affecting the original contract. It reported no known vulnerabilities following that process.

The announcement does not include a full technical audit report or a count of affected listings. The public SDK allows examination of the replacement implementation, but does not independently establish the full scope or outcome of the reported review.

The disclosed issue concerns the application’s listing contract on BSV Blockchain. The announcement does not describe a change to the underlying network protocol.

BSV TIMES Read

The immediate significance is operational: existing sale listings were withdrawn, assets were returned according to the team’s account, and continued selling requires a new listing.

For developers, the migration also changes the contract and transaction construction their applications must support.

The available record supports reporting a disclosed vulnerability, a replacement implementation and instructions for affected sellers. A detailed public audit would allow a fuller assessment of the original defect and the replacement’s security properties.

Developer Context

The SDK commit integrating the canonical OrdLock v2 contract is credited to David Case, whose public GitHub account is shruggr.

That work appears in the b-open-io/1sat-sdk repository. The migration announcement was issued by the 1Sat Ordinals Team and separately identifies the organizations involved in the security review.

Source Links

Posted on October 19, 2026 (UTC)