The release was authored by Neo co-founder Erik Zhang and posted on Oct. 23, 2026, with no new features introduced beyond the security fix.

Technical details: the change is in src/Neo/SmartContract/Helper.cs and adds two new tests plus updates an existing test to ensure uniform key decoding across paths.

No formal security advisory or confirmed exploitation on Neo N3 MainNet was published; users and node operators are advised to update to v3.10.2.

Neo released Neo N3 v3.10.2 on Oct 23 to patch a witness-verification bypass in multisignature (multisig) validation.

The fix ensures all validation paths decode public keys before classifying a script as a valid multisig contract, eliminating the bypass.

New tests verify that a malformed public key is rejected by all validation paths, and a full transaction with a broken multisig witness is rejected by the network in both signer-witness match and mismatch scenarios.

The bypass occurred because one validation path decoded public keys while another only checked structural shape, allowing malformed keys to pass one path but fail another, creating inconsistency.

The release notes indicate the issue was known in testing since 2024 and describe the previous inconsistent behavior as a defect addressed by the patch.