In its September 2026 State of the Network update, Midnight announced that permissionless smart contract deployment is live on mainnet. The update says developers no longer need to complete a mandatory Preprod security review before deploying contracts. It also says applications can deploy contracts on behalf of end users, rather than requiring each user to handle deployment directly.
That distinction matters for how applications are built. A user-facing application can prepare and deploy a contract as part of onboarding, instead of asking every user to understand deployment transactions and network requirements. It can also support sponsored DUST fees, according to Tomas Garro, who described the change as enabling self-deployment, application-deployed contracts and DUST-sponsored onboarding. Garro supported the removal of the approval and review process.
The practical result is a more open production environment for decentralized finance, games and privacy-focused applications. Midnight’s privacy model depends on more than hiding transaction data. Contracts must construct valid proofs, wallets must supply and protect the right inputs, and applications must decide what information to disclose. Selective disclosure means revealing a chosen fact without necessarily exposing the underlying private data. In a running system, that property depends on the contract logic, the proof circuit and the interfaces connecting them.
The deployment process itself has also changed in the project’s documentation. A Midnight repository document says the contract-deployment authorization process has been retired. Contracts no longer require Foundation review, and the former deployment rubric is presented as optional self-assessment guidance rather than an audit.
That wording draws an important boundary. An optional rubric can help a team inspect its own deployment, but it does not create an independent assurance layer. The new model assumes that developers can evaluate their contracts and that users, auditors or the market can identify failures after deployment. The assumption is now being tested on mainnet rather than inside a permissioned release process.
The strongest objection is not that permissionless deployment increases theoretical risk. It is that a privacy system can produce a valid-looking proof while the execution layer interprets the result incorrectly. A Midnight Ledger security advisory reports a critical Q3 2026 issue involving field aliases, in which one entitlement could result in repeated contract payouts. The advisory describes a mismatch between the proof and virtual-machine behavior that could enable unauthorized payouts or theft.
That is the relevant failure mode for this launch. Zero-knowledge proofs establish that a computation satisfies a defined statement. They do not, by themselves, prove that the statement captures the economic rule the contract was meant to enforce. If aliases or field representations cause the proving logic and the execution environment to treat an entitlement differently, a proof can be accepted while the contract pays more than intended.
The advisory therefore gives the critical case more substance than a general warning about unaudited code. Removing mandatory review can accelerate deployment precisely when defects are difficult to see from application behavior. A contract may preserve confidentiality while still violating authorization, accounting or payout constraints. For users, privacy can make that failure harder to diagnose because the transaction does not expose all of the information needed to reconstruct what happened.
Midnight’s decision is consequently a change in governance as much as a developer convenience. The network is no longer asking the Foundation to approve every contract before production deployment. It is asking contract authors to validate their proof and execution assumptions, wallet developers to integrate them correctly, and users to judge the resulting risk.
Permissionless deployment can produce a larger application ecosystem, but the security boundary has moved. Midnight’s privacy claims will be tested not only by whether sensitive values remain concealed, but also by whether the system consistently binds those values to the correct permissions, payouts and disclosures.
Jared Zimmerman is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna and gpt-5.6-terra. Out on the live web: gpt-5.6-terra and gpt-5.6-luna. Pictures: gpt-image-1 and flux. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Jared Zimmerman's usual length and in Jared Zimmerman's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.