Connect with us
DAPA Banner

Crypto World

Zcash Patches Four Critical Vulnerabilities Across Both Full-Node Implementations

Published

on

Brian Armstrong's Bold Prediction: AI Agents Will Soon Dominate Global Financial

TLDR:

  • Security researcher Alex “Scalar” Sol reported four Zcash vulnerabilities on April 4, 2026, via coordinated disclosure channels.
  • A crafted Orchard transaction with an all-zeros randomized key could crash any reachable zcashd or Zebra node instantly.
  • A turnstile accounting bug introduced in zcashd v5.10.0 could be triggered by routine peer-to-peer duplicate block headers.
  • Mining pools ViaBTC, Luxor, F2Pool, AntPool, and Foundry all deployed patches before the public release on April 17, 2026.

Zcash vulnerabilities have been patched across two full-node implementations following a coordinated security disclosure.

On April 17, 2026, Zcash Open Development Lab released zcashd v6.12.1, while the Zcash Foundation released Zebra v4.3.1. Security researcher Alex “Scalar” Sol reported the issues on April 4, 2026.

Four vulnerabilities were addressed, covering a node crash bug, a consensus enforcement gap, and a turnstile accounting bypass. No user funds were compromised, and no ZEC supply inflation occurred at any point.

Four Bugs Identified Across Both Zcash Full-Node Clients

The most directly exploitable bug was an Orchard transaction crash present in both zcashd and Zebra. A crafted transaction with an all-zeros randomized key encoding could immediately crash any node processing it.

Repeated broadcasting of such a transaction could effectively prevent nodes from participating in the network. No transactions triggering this condition were found on the Zcash mainnet before the patch.

Advertisement

A related enforcement gap also existed between the two implementations. Zebra already enforced a protocol requirement on ephemeral public keys within Orchard actions, but zcashd did not.

This meant a crafted transaction could be accepted by zcashd while being rejected by Zebra. Such a transaction could have forced a visible chain fork between nodes running different clients.

A separate bug in zcashd, introduced with v5.10.0 in August 2024, could disable turnstile accounting under certain conditions.

Receiving a duplicate block header from a peer could silently reset pool balance tracking to null. This condition could arise from ordinary peer-to-peer network behavior, not only from deliberate attack. The turnstile tracks ZEC balances across shielded and transparent value pools and serves as a critical safety layer.

Advertisement

Even so, this bug was not independently exploitable to steal or inflate ZEC. The official disclosure confirmed that “exploiting it to steal funds would require a separate, independent balance vulnerability on top of it.”

Any resulting turnstile violation would also have been publicly visible as a detectable chain anomaly. No such anomaly occurred on the Zcash mainnet before the fix was deployed.

Advertisement

Mining Pools Deploy Patches Before Public Disclosure

Zcash Open Development Lab addressed the disclosure directly, stating: “Mining pools representing a supermajority of the network’s hash power, and the primary operator running Zebra in mining production, deployed patches prior to this disclosure.”

ZODL engineers Kris Nuttycombe and Daira-Emma Hopwood authored the zcashd patches and reviewed each other’s work.

Nuttycombe addressed the Orchard crash, enforcement gap, and turnstile accounting bug. Hopwood authored hardening patches for integer overflow undefined behavior and exception safety.

Mining pools ViaBTC, Luxor, F2Pool, and AntPool — each running zcashd — were contacted directly for coordination. Foundry, which runs Zebra in mining production, also deployed its patch ahead of public release.

Advertisement

The Zcash Foundation’s Conrado Gouvêa separately developed and delivered the Zebra patch. This outreach ensured network stability was preserved throughout the entire disclosure process.

The zcashd v6.12.1 release also included broader hardening changes beyond the core vulnerability fixes. A chain supply value checkpoint was added at NU6.1 activation to enable future corruption detection.

Integer overflow protections were added across pool balance accumulation routines in multiple code paths. These additions provide an extra defense layer against edge-case exploitation scenarios.

This marks the second set of Zcash vulnerabilities disclosed within a month. On X, Zcash Open Development Lab stated: “We have no evidence that any of these bugs were exploited.

Advertisement

User funds and privacy were never at risk, and no ZEC supply inflation was possible.” Alex “Scalar” Sol also reported the March 2026 Sprout verification vulnerability through the same coordinated channels. Users running either zcashd or Zebra should upgrade to the latest patched versions immediately.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Caitlyn Jenner Memecoin Not a Security, Judge Rules

Published

on

Court, Memecoin

US media personality and former Olympian Caitlyn Jenner has escaped a class-action lawsuit after a federal judge ruled her memecoin was not a security under US law.

California federal judge Stanley Blumenfeld Jr. wrote in an order on Thursday that the lawsuit failed to plausibly plead that Caitlyn Jenner (JENNER) tokens were investment contracts, as they didn’t pool investor money or use funds to develop “any related product or technology.”

“Defendants stated that ‘[t]he $JENNER token is a memecoin on the Ethereum blockchain intended solely for entertainment purposes,’ and that its value would increase because Jenner would use her fame and influence to promote it, increasing demand,” the order said.

“Promotion alone, however, does not establish a common enterprise absent pooling or a structure linking investor fortunes,” it added.

Advertisement

A group of JENNER memecoin buyers first sued Jenner and her late manager, Sophia Hutchins, in November 2024, claiming they lost thousands of dollars as the token’s price collapsed and that JENNER was an unregistered securities offering.

Court, Memecoin
Caitlyn Jenner, pictured at a conference in 2017, was sued by a group of buyers of her memecoin that claimed they lost thousands of dollars. Source: Web Summit

Blumenfeld tossed the suit in May 2025 for failure to state a claim, and the group filed an amended complaint later that same month, led by Lee Greenfield, a UK citizen who claimed he lost more than $40,000 investing in JENNER.

The amended complaint had argued that investors had pooled their assets as Jenner promised that once the token reached a market value of $50 million, a 3% transaction fee would fund token buybacks, marketing, donations to Donald Trump’s presidential campaign and a token for ownership in Jenner’s Olympic gold medal.

Blumenfeld wrote that the amended complaint heavily focused on planned donations to Trump, but didn’t explain how investors believed that doing so would provide a financial return to them.

“Nor is it clear that the alleged plan to distribute fractionalized ownership interests in Jenner’s gold medal has any bearing on Greenfield’s claim, since the plan was not announced until August 2024—after the last of his purchases—and was never executed,” he added.

Advertisement

Related: TRUMP whales load up as Mar-a-Lago luncheon approaches

Blumenfeld denied allowing the class group another chance to amend the lawsuit and added that claims regarding contracts and common law fraud under California law were best sent to state court.

JENNER was first launched on the Solana blockchain via the memecoin creator Pump.fun in May 2024. It was soon embroiled in controversy after Jenner and other memecoin launching celebrities claimed they were scammed by Sahil Arora, a claimed collaborator on the tokens.

Jenner relaunched the token on Ethereum, which investors claimed diminished the value of the original Solana token. The token has since essentially lost all of its value after hitting a peak value of nearly $7.5 million in June 2024.

Advertisement

Magazine: Memecoins: Betrayal of crypto’s ideals… or its true purpose?