Verify a decision

{"actor":"system:backfill","investigation_id":"5fad0aa1-193c-4b7e-8c1b-fbcfb7481b8c","kind":"publish","page_slug":"zodl","published_at":"2026-10-13T05:16:35.621Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Zodl","sections":[{"content":"Zodl describes itself as a Zcash mobile wallet for shielded, private transactions. Its site states it is self-custodial and lists features including shielded payments, CrossPay (send ZEC while the recipient receives another asset), swaps via NEAR Intents, Keystone hardware wallet support, and Flexa payments. A post dated February 16, 2026 says Zashi is being renamed Zodl through an app update, that the wallet and team stay the same, and that users need not download a new app, change their seed phrase or move funds. The post says the team left Electric Coin Company in January and formed Zcash Open Development Lab (ZODL). Organisational disputes are outside the scope of this page.","heading":"Overview and rebrand","severity":"low","sources":[{"credibility":2,"name":"Zashi is becoming Zodl (official)","type":"official","url":"https://zodl.com/zashi-is-becoming-zodl/"},{"credibility":2,"name":"Zodl official site","type":"official","url":"https://zodl.com"},{"credibility":2,"name":"Forklog: Zcash developers establish new entity and rebrand wallet","type":"news_article","url":"https://forklog.com/en/zcash-developers-establish-new-entity-and-rebrand-wallet/"}]},{"content":"On 2025-10-21 the on-chain investigator ZachXBT reported that Zashi's CrossPay feature, which uses NEAR Intents, returned a refund to the transparent address from which funds had originally been shielded. In his test, a small ZEC refund went back to the transparent address, which could allow observers to link transparent and shielded addresses by matching timing and amounts. Per Cryptopolitan, the development team acknowledged the issue and said it planned ephemeral addresses and shielded refunds in a future update. This review did not confirm whether those fixes have shipped. Reporting relies on a secondary news outlet summarising a social media post.","heading":"Privacy linkage in cross-chain refunds (October 2025)","severity":"medium","sources":[{"credibility":2,"name":"Cryptopolitan: ZachXBT flags privacy flaw in Zashi Wallet's NEAR Intents integration","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-flags-privacy-flaw-in-zashi-wallets-near-intents-integration/"}]},{"content":"BlockSec reports that a soundness bug in the Zcash Orchard shielded-pool circuit was found on May 29, 2026 by researcher Taylor Hornby, who reported it to ZODL the same day. An emergency soft fork on June 2 temporarily disabled Orchard transactions, and the NU6.2 upgrade on June 3 introduced a corrected circuit. The bug was publicly disclosed June 4. The article states no evidence of exploitation has been found, but notes the privacy properties mean exploitation cannot be conclusively ruled out. This is a protocol-level issue affecting Zcash generally, not specific to Zodl.","heading":"Zcash Orchard protocol bug (June 2026)","severity":"medium","sources":[{"credibility":2,"name":"BlockSec: Zcash Orchard soundness bug analysis","type":"research","url":"https://blocksec.com/blog/web3-security-zcash-orchard-soundness-bug-analysis"}]},{"content":"Zodl's site does not mention security audits, and this review found no published formal third-party audit of the wallet. The site links to a GitHub organization (zodl-inc), Android release downloads and an F-Droid listing, but does not state a licence. The site says it does not collect wallet activity and uses anonymized crash reports; this is a self-reported claim not independently verified here. No scam allegations, fund losses or regulatory actions against the wallet were found, though the search was limited in scope.","heading":"Transparency and audit information","severity":"low","sources":[{"credibility":2,"name":"Zodl official site","type":"official","url":"https://zodl.com"}]}],"sources_used":[{"credibility":2,"name":"Zashi is becoming Zodl (official)","type":"official","url":"https://zodl.com/zashi-is-becoming-zodl/"},{"credibility":2,"name":"Zodl official site","type":"official","url":"https://zodl.com"},{"credibility":2,"name":"Forklog: Zcash developers establish new entity and rebrand wallet","type":"news_article","url":"https://forklog.com/en/zcash-developers-establish-new-entity-and-rebrand-wallet/"},{"credibility":2,"name":"Cryptopolitan: ZachXBT flags privacy flaw in Zashi Wallet's NEAR Intents integration","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-flags-privacy-flaw-in-zashi-wallets-near-intents-integration/"},{"credibility":2,"name":"BlockSec: Zcash Orchard soundness bug analysis","type":"research","url":"https://blocksec.com/blog/web3-security-zcash-orchard-soundness-bug-analysis"}],"summary":"Zodl, formerly Zashi, is a self-custodial mobile wallet for Zcash (ZEC) focused on shielded transactions. The rename was announced on 2026-02-16. No fraud, hack of user funds or enforcement action against the wallet was found; documented concerns are a October 2025 privacy-linkage issue in its NEAR Intents cross-chain feature and a protocol-level Orchard bug (disclosed June 2026) that affected Zcash generally. No formal third-party audit of the wallet was found.","timeline":[{"date":"2025-10-21","date_evidence":"Published October 21, 2025","event":"ZachXBT reports a refund-linkage privacy issue in Zashi's CrossPay / NEAR Intents integration; team acknowledges it.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-flags-privacy-flaw-in-zashi-wallets-near-intents-integration/"},{"date":"2026-01","event":"Former ECC team reportedly leaves ECC and forms Zcash Open Development Lab (ZODL).","source":"Zodl announcement","source_url":"https://zodl.com/zashi-is-becoming-zodl/"},{"date":"2026-02-16","date_evidence":"The post is dated February 16, 2026","event":"Zodl announces Zashi is being renamed Zodl.","source":"Zodl announcement","source_url":"https://zodl.com/zashi-is-becoming-zodl/"},{"date":"2026-05-29","date_evidence":"May 29, 2026","event":"Orchard circuit soundness bug discovered and reported to ZODL.","source":"BlockSec","source_url":"https://blocksec.com/blog/web3-security-zcash-orchard-soundness-bug-analysis"},{"date":"2026-06","date_evidence":"NU6.2 network upgrade on June 3","date_original":"2026-06-03","event":"NU6.2 upgrade introduces corrected Orchard circuit; bug publicly disclosed June 4.","source":"BlockSec","source_url":"https://blocksec.com/blog/web3-security-zcash-orchard-soundness-bug-analysis"}]},"v":1}