Midnight takes Ledger 9 directly to mainnet, bypassing Preprod

Midnight moved its mainnet from Ledger 8 to Ledger 9 on November 6, adding contract-to-contract calls and new cryptographic primitives while bypassing the network’s usual Preprod deployment and soak period.

The privacy-focused network said the direct-to-production route is used when security fixes require a more controlled release path. It did not identify a vulnerability, publish an incident notice or say that funds had been at risk. The verified development is therefore an activated hard fork with an unusual release process—not evidence of an exploit.

That distinction matters because Ledger 9 expands what developers can build while leaving some documentation unfinished and several known issues unresolved. It also puts Mainnet and the reset Preview network on the new ledger while Preprod remains on Ledger 8.

Composability arrives with limits

Ledger 9 lets one contract call another within a single transaction and allows contracts to identify their caller. It also adds public event emission through the indexer, giving wallets and applications a standard way to observe contract activity.

Those features can support modular applications in which separate contracts handle tokens, identity checks or escrow. But the official release notes say the first phase of both cross-contract calls and events is limited to unshielded data. The upgrade does not establish that private DeFi applications, cross-chain stablecoins or institutional integrations are live.

The release also adds ECDSA verification, native Keccak hashing and secp256k1 support to Midnight’s Compact contract environment. Those are widely used building blocks for compatibility with Bitcoin- and Ethereum-style signatures. Ledger 9 additionally moves the proving stack to the third version of Midnight’s zero-knowledge intermediate representation.

The upgrade did not activate the bridge between cNIGHT and the mainnet NIGHT token. That requires a separate governance action. Block-production rewards are also outside this release, so neither feature should be treated as delivered with Ledger 9.

Operators face a breaking migration

Existing Mainnet balances and deployed contracts migrated automatically, and the network replayed live cNIGHT-backed DUST registrations after resetting DUST state. NIGHT balances were not reset. Midnight’s documentation says the replay took about 48 blocks, or less than five minutes, in a recent Mainnet-snapshot test; that was a pre-upgrade estimate, not an independently measured duration for the live event.

Applications still need migration work. Ledger 8 transaction formats no longer decode on Mainnet, wallets using the first major Wallet SDK line cannot transact, and applications must move to Midnight.js 5 and the Ledger 9 software set. Indexer operators need a full re-index from genesis because the new indexer stores contract state differently.

The official documentation also lists live limitations. A contract call that spends a shielded coin already held by the contract and writes the change back can fail on Mainnet, with no workaround in this release. A fee paid with exactly one DUST spend can also be rejected, although the notes describe a two-or-more-spend workaround. Another issue can silently stop block imports when an operator changes an existing node data directory to the unified storage layout.

The security rationale remains incomplete

Midnight’s November 6 announcement says Ledger 9 went directly to Mainnet because security fixes required controlled handling. The project has not connected that explanation to a named vulnerability, disclosed exploitation or quantified exposure. Independent Cardano and Midnight publication SIPO likewise found no named vulnerability in the announcement and noted that the usual public node release tag was not visible during its November 7 review.

Technical documentation is still being completed over the coming weeks, according to Midnight. The next verification points are publication of the final node artifacts, Preprod’s move to Ledger 9, fixes for the documented contract and fee failures, and any security advisory explaining why the normal soak sequence was skipped.

For now, the evidence supports a narrower conclusion: Ledger 9 is active on Midnight Mainnet and materially expands its contract interface, but the bridge, private cross-contract behavior and a full explanation of the security-driven rollout remain outstanding.