Zodiac has published a full post-mortem on the security incident that affected Zodiac Roles Modifier v2.1.0 and Delay Modifier v1.1.0 on June 1. In the disclosure, Zodiac described what happened, how the team responded, and what has changed since the incident. The statement was posted by @zodiaceco at 16:23 on June 19, 2026, and the post page showed 3,780 views.
The flaw was in the ERC-1271 signature check
According to Zodiac, the root cause was found in the ERC-1271 contract-signature verification used by the affected modules. The check accepted a signature based only on the returned magic value, but did not verify that the call itself had succeeded. As a result, a failed check could be made to appear valid, allowing an attacker to bypass module authentication.
The issue described by Zodiac was not a broad statement about ERC-1271 as a standard. The post-mortem focused on the implementation in the affected versions: Zodiac Roles Modifier v2.1.0 and Delay Modifier v1.1.0. In that implementation, the returned magic value was treated as sufficient, while the success state of the call was not checked. This gap allowed a failed verification path to be presented as a valid one.
Exposure was limited to one narrow Safe configuration
Zodiac said the bug was exploitable only in one narrow configuration: a Safe using the CompatibilityFallbackHandler assigned to an affected module. The team also stated that EOA role members were never at risk, and that setups without an affected module were never at risk.
This scope is central to the post-mortem. Zodiac did not describe the issue as affecting every Safe user or every Zodiac setup. Instead, the affected path required a specific combination involving CompatibilityFallbackHandler, an affected module, and the relevant Safe configuration.
Response included private outreach, tooling and whitehat recovery
After detecting the issue, Zodiac said it privately contacted affected users, shipped a self-service checker and remediation app, disclosed the matter publicly on June 2, and ran whitehat recovery. The team reported that more than 99% of at-risk value was secured.
On losses, Zodiac stated that confirmed realized loss outside Gnosis Pay was approximately $4,500. The post did not provide additional loss categories beyond that figure. The wording in the disclosure was specific: “confirmed realized loss outside Gnosis Pay was ~$4,500.”
Contracts patched, apps updated and service restored
In its current status update, Zodiac said the contracts have been patched and independently audited. It also said all Zodiac apps have been updated and the service has been fully restored. The team pointed readers to the full post-mortem at engineering.gnosisguild.org/posts/zodiac-p… and listed [email protected] for security reports.
Zodiac ended the disclosure by thanking users, integrators, Gnosis, Safe, SEAL 911 and independent researchers who helped identify, contain and remediate the issue. The post-mortem centers on the June 1 incident, the ERC-1271 verification defect, the limited configuration in which the bug was exploitable, and the remediation steps completed by the team.