Injective's core software is no longer open source, whatever the 21Shares Injective ETF prospectus filed on 18 September says. That amended S-1 tells prospective buyers of the proposed TINJ fund that "the source code for the Injective Network is open-source, and anyone can contribute to its development." On the same day, Injective's v1.20.4 release page told validators something else: "Starting from 09-09-2026 source code will no longer be published." Four days later, holders of staked INJ approved that release as the Meridian mainnet upgrade, and over the exact four-day voting window INJ rose 15.9%, from $6.601 to $7.651 on Binance's hourly INJUSDT opens. The chain was scheduled to halt at block 184,394,000, around 15:00 UTC on Thursday 24 September, and restart on a binary whose source nobody outside Injective's own teams can read.
The point most coverage has skipped is how quietly this happened. The widely repeated headline figure, "99% support", is accurate only if you drop abstentions. On-chain, 68.19% of the votes cast were yes, 31.51% abstained and 0.31% voted no. That split is normal for Injective and is no sign of a revolt. What stands out is that a chain whose ETF paperwork calls its code open-source just ratified, without visible dissent, the first mainnet release its own voters cannot inspect. Price action says the market does not care yet. The prospectus is the document that may have to.
Key facts
- INJ rose 15.9%, from $6.601 to $7.651, between the 17:00 UTC hourly opens of 18 and 22 September 2026, the exact voting window of proposal 701 — Binance INJUSDT 1h klines, read 24 Sep 2026 06:37 UTC
- Proposal 701, "Injective Meridian Mainnet Upgrade (v1.20.4)", passed with 68.19% yes, 31.51% abstain and 0.31% no on 26.05 million INJ voted — Injective chain LCD, read 24 Sep 2026
- The v1.20.4 tag contains zero Go source files and one empty file named SOURCE_CODE_IS_PRIVATE, against 929 Go files in the v1.20.3 tag — injective-core on GitHub, cloned 24 Sep 2026
- 21Shares' amended S-1 for the proposed TINJ fund was filed on 18 September 2026 and describes Injective's source code as open-source — SEC EDGAR, 18 Sep 2026
- The same filing says about 7.2 million INJ had been bought back and burned for roughly $35.1 million as of 1 September 2026 — 21Shares S-1/A, 18 Sep 2026
- INJ traded at $7.86 with a CoinGecko market value of $786.4 million and 24-hour volume of $206.4 million — CoinGecko, 24 Sep 2026 06:33 UTC
What the repository actually shows
The simplest way to test a claim about source code is to download it. A shallow clone of the v1.20.4-1789748350 tag from InjectiveFoundation/injective-core returns a single commit, hash 0000000000007db3…, dated 14 September 2026, authored by Achilleas Kalantzis, whose published validator testimonial names him as Head of Strategy at the Injective Foundation. The commit message is the whole policy statement: "NOTE: starting from 09-09-2026 source code is private." The working tree holds one zero-byte file. The repository's default branch points at the same commit.
Validators instead get a compiled injectived binary (commit 17f701a, compiled 18 September with Go 1.26.8), a Docker image and a SHA-256 hash for the libwasmvm library, with the warning that "any other hash will lead to consensus issues later." They can check that they are running the same file as everyone else. What they cannot check is what the file does.
This is a recent break, not a long drift. The emergency patch shipped after the 31 August exploit, v1.20.3-safeharbor.2, went out on 2 September with 932 Go files in its tag. The v1.20.3 tag carried 929 under a Business Source License 1.1, licensor Injective Labs, whose change date of 30 June 2026 converts the code to GPL v2 or later. So the last readable code sits under a licence that has already turned it into standard open source. The next release was never published at all.
| Upgrade proposal | Voting ended (UTC) | Yes | Abstain | No | INJ voted | Go files in tag |
|---|---|---|---|---|---|---|
| 677 · v1.20.3 | 28 Jul 2026 04:15 | 72.07% | 27.61% | 0.31% | 24.97m | 929 |
| 690 · v1.20.3-safeharbor.2 | 2 Sep 2026 16:07 | 77.23% | 22.44% | 0.33% | 24.39m | 932 |
| 701 · v1.20.4 Meridian | 22 Sep 2026 17:02 | 68.19% | 31.51% | 0.31% | 26.05m | 0 |
Source: Injective chain LCD /cosmos/gov/v1/proposals/<id>, read 24 Sep 2026; Go file counts from shallow clones of each GitHub tag, 24 Sep 2026.
Look down the "No" column. It barely moves: roughly 0.3% across a routine release, a post-exploit patch and a closed-source binary. Turnout barely moves either. Staked INJ holders treated three very different decisions identically, which tells you more about how Injective governance works than about any one proposal.
One more detail from the published changelog is easy to miss. Its header lists a "Security" category for "security related changes and exploit fixes", marked "NOT EXPORTED in auto-publishing process." The v1.20.4 notes list a white-knight liquidation reward fix, a Ledger signature fix, a new swap precompile at address 0x68, EVM post-transfer hooks and a CosmWasm 2.2 upgrade that cuts the default nested call depth from 500 to 100. Whatever security work went into the release is, by design, absent from both the notes and the code.
INJ price across the vote window
Price did most of its work before the vote began. INJ closed 17 September at $5.717 on CoinGecko's daily print. By 17:00 UTC on 18 September, the hour proposal 701 was submitted, it was already at $6.60. That day also brought the v1.20.4 release and the 21Shares amendment, and it came a day after INJ went live on Solana through Sunrise, which Injective's blog dated 17 September. The vote window then added another 15.9%.
Beyond that window the numbers need care. CoinGecko's own percentage fields put INJ up 43.6% over seven days and 32.5% over 30 days at 06:33 UTC, and neither reconciles with its daily series. The table below recomputes each return from stated anchors.
| Window | Anchor (UTC) | Anchor price | 24 Sep 06:34 UTC | Change |
|---|---|---|---|---|
| Vote window (Binance 1h opens) | 18 Sep 17:00 → 22 Sep 17:00 | $6.601 | $7.651 at close of window | +15.9% |
| 7 days | 17 Sep 00:00 | $5.405 | $7.863 | +45.5% |
| Since the exploit | 1 Sep 00:00 | $4.926 | $7.863 | +59.6% |
| 30 days | 25 Aug 00:00 | $5.692 | $7.863 | +38.1% |
| Year to date | 1 Jan 00:00 | $4.201 | $7.863 | +87.2% |
| 365 days | 25 Sep 2025 00:00 | $12.397 | $7.863 | −36.6% |
Source: CoinGecko market_chart daily prints for INJ/USD, retrieved 24 Sep 2026 06:35 UTC; vote-window row from Binance INJUSDT hourly klines. Coinbase's INJ-USD ticker showed $7.876 at 06:36 UTC.
Turnover tells the same story. CoinGecko's 24-hour volume sat near $92 million on 17 and 18 September, then jumped to $210.9 million on 19 September and $293.6 million on 20 September, the peak of the move. Neither day carried a governance milestone. The hourly high of $8.26 came at 13:00 UTC on 23 September, after the vote had closed and on the day the latest Community BuyBack opened.
A prospectus written for an earlier chain
Why should an ETF sentence matter? An S-1 is a disclosure document, and the SEC reads it as a statement of fact about the thing being securitised. 21Shares' amendment runs to about 700,000 characters of text and uses the phrase "source code" 19 times, mostly in boilerplate about flaws in digital-asset software. Its one direct description of Injective's code, the open-source sentence, was at least defensible for every tagged release up to 2 September, all of which shipped readable code. It had stopped being accurate by the time the amendment was filed.
The filing is otherwise detailed. The trust would list on Nasdaq under TINJ, price off the FTSE Injective Index, hold INJ with Coinbase Custody Trust Company and BitGo Bank & Trust, and may stake part of its holdings. Voltedge Ltd, a British Virgin Islands company, has agreed to subscribe for $30 million of shares, paid in INJ, when the registration goes effective, under a subscription agreement dated 3 September 2025. The sponsor fee and several dates are still blank. Blanks like these are normal in an S-1/A, and a second amendment would be the natural place to fix the source-code language.
The investor base behind this pitch was sold on openness. When Pineapple Financial (NYSE American: PAPL) launched the first listed INJ treasury, Shubha Dasgupta, CEO of Pineapple Financial, said the raise "demonstrates our belief that the Injective token can bring forward a future of finance that is transparent and accessible for all." In the same 2 September 2025 release, Eric Chen, Co-Founder of Injective, described a move toward "a faster, more transparent, and globally accessible financial system." Neither statement is about source code. Both are about transparency, and that is what a closed binary takes away.
Who actually decided
The mechanics of the vote help explain why no one pushed back. Injective's tally parameters, read from the chain, set quorum at 33.4% of bonded stake, a pass threshold of 50% of non-abstaining votes and a veto threshold of 33.4%. The 26.05 million INJ that voted on proposal 701 was about 44.8% of the 58.16 million INJ bonded when we read the staking pool on 24 September, comfortably over quorum. Delegators who do not vote inherit their validator's vote, so in practice the active set decided.
That set is small. The chain showed 45 bonded validators on 24 September. The largest, Injective Foundation 2, held 7.65% of bonded stake, followed by Binance Staking (6.23%), Everstake (6.22%), Innovating Capital (5.77%), FalconX (5.65%) and Kraken02 (5.62%). Those six together pass one third of bonded stake, the threshold that can stall consensus on a Cosmos SDK chain. Individual validator votes on proposal 701 are no longer queryable from the public endpoint, which returned an empty list once the tally closed, so the split among them cannot be checked.
Abstention is the house style. Across the eight most recent proposals, abstain ran from 28% to 75% of votes cast. Proposal 696, an oracle update, was rejected despite 72.2% yes, on a turnout of 11.48 million INJ, less than half of what the others drew. A 31.5% abstain on Meridian is ordinary.
Validators also had recent reason to value speed over scrutiny. On 31 August an attacker drained about $4.9 million through a market-identifier collision in binary-options settlement, according to Metaverse Post's account, which put the chain halt at three hours and 42 minutes. Injective's own 1 September statement said the accelerated upgrade "took longer than initially expected to complete across all validators," and that some validators were jailed. The governance text for the follow-up patch, proposal 690, is word-for-word the same boilerplate as the routine v1.20.3 proposal. It describes "targeted chain improvements" and new-chain transfers and does not mention the exploit.
The case that this is a non-event
There is a serious argument that none of this matters to price. Closing code is sometimes a security decision. Metaverse Post reported that Injective had justified removing core repositories from GitHub as "reducing attack surface." Critics cited in the same report argued the August attacker needed only public SDK documentation, old compiled binaries and a live testnet. That cuts both ways: reading the core code was not what made the attack possible, and hiding it did not prevent one. Kalantzis himself has praised a validator in Zellic's published testimonials for "top-notch security audits and deep technical expertise," which is the model Injective seems to prefer: vetted auditors in place of anonymous readers.
The market context also argues for modesty. Over the same four-day vote window, Bitcoin rose 6.89% and ATOM, the closest Cosmos-stack comparison, rose 5.14% on Binance's hourly opens. INJ outperformed both by roughly nine to eleven points. With a Solana launch, an ETF amendment and a buyback running at the same time, putting that gap down to a software upgrade would be a stretch. Our Optimism upgrade coverage found much the same: governance passes, price reacts to flows.
For comparison, tokenised-stock plumbing is where Injective is spending its narrative. Stockdrop, announced on 22 September, pays Robinhood Chain stock tokens to Community BuyBack participants. It sits in the same competitive lane as the tokenised-equity push we covered in Ondo's SEC order piece and the fee story behind Uniswap on Robinhood Chain.
What this changes
Three things are now different, and none of them is a price level.
RelatedOptimism (OP) Rose From $0.096 to $0.126 After Upgrade 20 Passed
First, Injective's upgrade path now runs on trust in Injective Labs rather than on code anyone can inspect. Validators can confirm they run the same binary as their peers through the published hashes. They cannot audit it. Any future exploit postmortem will depend on what Injective chooses to disclose, and its changelog template already withholds the security category.
Second, the 21Shares filing has a factual problem that a later amendment will either fix or keep. If the next S-1/A keeps "open-source," that is a disclosure question for the sponsor and its counsel. If it drops the language, the risk-factor section will probably grow. Either outcome is visible on EDGAR without anyone's cooperation. Readers who followed the Solana ETF inflows story will know that approval timelines, not code licences, usually drive these products. This one, though, is a sentence of fact in a registration statement.
Third, the reading of the vote. A 68% yes with 0.3% no on a closed binary shows that Injective's staked base will approve what Injective Labs submits. That helps when patches need to ship quickly, as they did on 31 August. It weakens the prospectus line that "no single entity controls or administers the operations of the Injective Network," though the same sentence concedes that Injective Labs exerts "significant influence."
What would change this reading: source published for v1.20.4 after the fact, perhaps on a delay, or a third-party audit of the Meridian binary that names its scope. Either would restore most of the transparency case. A second amendment to the TINJ filing that repeats the open-source sentence without qualification would suggest the gap has gone unnoticed, or has been judged immaterial. None of these outcomes touches the trust's mechanics: its net asset value is struck from the token price, not from the software underneath it.
FAQ
What is the Injective Meridian upgrade?
Meridian is Injective chain release v1.20.4, approved as governance proposal 701 on 22 September 2026. It adds regulated token standards to Injective's EVM, a native exact-input swap precompile, early private RFQ testing and oracle changes. The chain was set to halt at block 184,394,000, around 15:00 UTC on 24 September, and restart on the new binary.
How much did INJ rise during the Meridian vote?
Between the 17:00 UTC hourly opens of 18 and 22 September 2026, the exact voting window, INJ rose from $6.601 to $7.651 on Binance, a gain of 15.9%. CoinGecko's hourly series gives the same result. Bitcoin rose 6.89% and ATOM 5.14% over the same hours, so INJ outperformed both.
Is Injective's code still open source?
Not for the current release. The v1.20.4 tag on GitHub holds no source files, only an empty file named SOURCE_CODE_IS_PRIVATE, and the release page says source will no longer be published from 9 September 2026. Earlier tags, including v1.20.3 and the 2 September safeharbor patch, still contain readable code.
Did the vote really pass with 99% support?
Only if abstentions are excluded. On-chain, 68.19% of the 26.05 million INJ voted was yes, 31.51% abstain and 0.31% no. Yes against no alone comes to about 99.5%. That abstain share is typical for Injective proposals, several of which have seen abstain above 40%.
What is the 21Shares Injective ETF?
It is a proposed spot INJ fund that would list on Nasdaq as TINJ, track the FTSE Injective Index and may stake part of its INJ. Its first amendment was filed with the SEC on 18 September 2026. The fund is not yet effective, and its sponsor fee is still blank in the filing.
Disclaimer
This article is news and analysis, not investment advice. Cryptoassets are highly volatile and you can lose all of the capital you put at risk. Figures come from the sources named and dated in the text; verify them independently before making any financial decision.