Zcash fixes a critical security vulnerability that once threatened the safety of over 25,000 ZEC

Gate News message, April 1, privacy coin Zcash disclosed and fixed a critical security vulnerability. Security researcher Alex “Scalar” Sol disclosed on March 23 that the flaw stemmed from zcashd nodes skipping proof verification when processing transactions involving the Sprout privacy pool, which could be exploited by malicious miners to transfer more than 25,000 ZEC (about $6.5 million) from the deprecated Sprout pool.

Official statements said the vulnerability had been present since July 2020, but it was not actually exploited, and users’ funds were always safe. The development team released version v6.12.0 to complete the fix, and major mining pools completed the upgrade rollout within days. In addition, unaffected Zebra full-node implementations have the ability to trigger chain forks, providing extra protection if the vulnerability were exploited.

As disclosed, while the Sprout pool was shut down for new deposits in November 2020, there were still about 25,424 ZEC not yet migrated. Even if the vulnerability were exploited, Zcash’s turnstile mechanism could prevent inflationary issuance, ensuring the total supply could not be breached. The flaw was discovered with AI assistance, and the researcher will receive a total bounty of 200 ZEC (about $51,000). Notably, Zcash previously fixed a serious defect in 2019 that could lead to unlimited inflation.