Verify a decision

{"actor":"system:backfill","investigation_id":"90dac60d-5df4-434e-90f7-028f5cf1cf6e","kind":"publish","page_slug":"zebra-zcash-node","published_at":"2026-10-13T05:38:59.726Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Zebra (Zcash node)","sections":[{"content":"Least Authority describes Zebra as Zcash's independent, consensus-compatible node implementation written in Rust. A second implementation lets the network cross-check consensus rules: a ZODL disclosure from April 2026 describes a case in which zcashd did not enforce a non-identity ephemeral key requirement that Zebra already enforced, so a crafted transaction could have been accepted by zcashd and rejected by Zebra, which could have forked the chain; the discrepancy was addressed in the fixes. Conversely, diversity also creates divergence risk: a May 2026 advisory summary (CVE-2026-44497, a lower-credibility aggregator summary) describes Zebra mishandling invalid sighash types in a way that could split Zebra from zcashd nodes, fixed in Zebra 4.4.0. Secondary sources indicate Zebra is becoming the primary consensus implementation as zcashd is phased out, but the timeline was described as tentative and was not confirmed against primary sources (ZIPs, Zcash Foundation announcements).","heading":"Overview and why node diversity matters","severity":"low","sources":[{"credibility":2,"name":"Least Authority - Zcash Zebra NU6 Updates","type":"research","url":"https://leastauthority.com/blog/zebra-nu6-updates/"},{"credibility":2,"name":"ZODL - zcashd and Zebra April 2026 disclosure","type":"official","url":"https://zodl.com/zcashd-zebra-april-2026-disclosure/"},{"credibility":3,"name":"CraftedSignal - Zebra consensus divergence brief (CVE-2026-44497)","type":"community_report","url":"https://feed.craftedsignal.io/briefs/2024-01-09-zebra-consensus-divergence/"}]},{"content":"NCC Group's report 'Zcash Zebra Security Assessment' (report E005955, PDF filename dated 2023-06-27) states that five consultants performed the review in a total of 60 person-days; the target was the Zebra codebase at tag audit-v1.0.0-rc.0 and the report includes a table of findings. Least Authority, acting as Zcash Ecosystem Security Lead at the direction of Zcash Community Grants, reviewed the changes to Zebra for the NU6 upgrade (final report completed November 8, 2024) and later produced a final audit report for the NU6.1 upgrade (title 'ZCG Zebra NU6.1 Network Upgrade Final Audit Report'; completion date of November 3, 2025 was reported by a search summary and not independently confirmed in the document text). Individual finding severities were not extracted for this page.","heading":"Independent audits","severity":"low","sources":[{"credibility":2,"name":"NCC Group - Zcash Zebra Security Assessment (E005955)","type":"research","url":"https://nccgroup.com/media/bw3nq0vm/_ncc_group_zcashfoundation_e005955_report_2023-06-27_v10.pdf"},{"credibility":2,"name":"Least Authority - Zebra NU6 Updates","type":"research","url":"https://leastauthority.com/blog/zebra-nu6-updates/"},{"credibility":2,"name":"Least Authority - ZCG Zebra NU6.1 Network Upgrade Final Audit Report","type":"research","url":"https://leastauthority.com/zcg-zebra-nu6-1-network-upgrade-final-audit-report"}]},{"content":"CVE-2026-34202: a remote, unauthenticated attacker could crash a Zebra node with one crafted V5 transaction sent over P2P or the sendrawtransaction RPC; fixed in zebrad 4.3.0 and zebra-chain 6.0.1, with a published date of March 27, 2026 per the advisory text. It was reported through coordinated disclosure, and no public proof of concept or in-the-wild exploitation was noted. CVE-2026-41584 (GHSA-452v-w3gx-72wg): Orchard transactions with an identity-point rk value caused a panic in verification, crashing Zebra; GitHub rates it CVSS v4 9.2 (Critical) and aggregator pages list CVSS v3.1 7.5 (availability only). Fixed in zebrad 4.3.1 and zebra-chain 6.0.2; the advisory was published April 17, 2026. ZODL's disclosure states that no transactions triggering the condition exist on mainnet, that no unexplained node crashes were reported before the fix, and that user funds were safe and privacy not at risk. A further consensus-divergence issue (CVE-2026-44497, sighash handling) was reported to be fixed in Zebra 4.4.0; this is supported only by a Tier 3 aggregator.","heading":"Disclosed vulnerabilities (2026)","severity":"medium","sources":[{"credibility":1,"name":"GitHub Security Advisory GHSA-452v-w3gx-72wg (CVE-2026-41584)","type":"official","url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg"},{"credibility":2,"name":"Wiz - CVE-2026-34202","type":"research","url":"https://www.wiz.io/vulnerability-database/cve/cve-2026-34202"},{"credibility":2,"name":"Wiz - CVE-2026-41584","type":"research","url":"https://www.wiz.io/vulnerability-database/cve/cve-2026-41584"},{"credibility":2,"name":"ZODL - zcashd and Zebra April 2026 disclosure","type":"official","url":"https://zodl.com/zcashd-zebra-april-2026-disclosure/"},{"credibility":3,"name":"CraftedSignal - CVE-2026-44497 brief","type":"community_report","url":"https://feed.craftedsignal.io/briefs/2024-01-09-zebra-consensus-divergence/"}]},{"content":"Per Cointelegraph and Decrypt, independent researcher Taylor Hornby found a flaw in the Orchard Action circuit on May 29, 2026 and disclosed it to ZODL engineers; the flaw could have allowed double-spending or invalid state transitions in the Orchard pool. The response had two steps: Zebra 4.5.3 temporarily disabled Orchard (an emergency soft fork; Decrypt reports halting at block 3,363,426), and Zebra 5.0.0 activated the NU6.2 hard fork on June 3, 2026, restoring Orchard with a corrected circuit (a hard fork was needed because the verifying key had to be updated). The Zcash Foundation urged operators to upgrade to Zebra 5.0.0. The Foundation stated there was no evidence the bug was exploited, no unauthorized value creation was detected (the turnstile confirmed this per Decrypt), and privacy was not affected. Some block explorers appeared stale and prompted reports of a halt; reporting attributes this to explorers running lagging or outdated nodes, and the chain continued producing blocks. Statements of non-exploitation are the Foundation's and developers' own and were not independently audited here.","heading":"Role in the Orchard bug response (May-June 2026)","severity":"high","sources":[{"credibility":2,"name":"Decrypt - Zcash Completes 'Most Ambitious' Network Upgrade","type":"news_article","url":"https://decrypt.co/369896/zcash-completes-most-ambitious-network-upgrade-zec-resumes-recent-surge"},{"credibility":2,"name":"Cointelegraph - Zcash Orchard vulnerability emergency upgrade","type":"news_article","url":"https://cointelegraph.com/news/zcash-orchard-vulnerability-emergency-upgrade"}]},{"content":"The Zcash Foundation's own announcement of the Orchard fix and the full text of the audit findings were not retrieved for this page. Zcashd deprecation timing and the share of the network running Zebra were not verified from primary sources. Aggregator figures (CVSS, EPSS) are inconsistent between pages and should be checked against the GitHub advisories.","heading":"Information gaps","severity":"low","sources":[{"credibility":2,"name":"Decrypt - Zcash Completes 'Most Ambitious' Network Upgrade","type":"news_article","url":"https://decrypt.co/369896/zcash-completes-most-ambitious-network-upgrade-zec-resumes-recent-surge"}]}],"sources_used":[{"credibility":2,"name":"NCC Group - Zcash Zebra Security Assessment","type":"research","url":"https://nccgroup.com/media/bw3nq0vm/_ncc_group_zcashfoundation_e005955_report_2023-06-27_v10.pdf"},{"credibility":2,"name":"Least Authority - Zebra NU6 Updates","type":"research","url":"https://leastauthority.com/blog/zebra-nu6-updates/"},{"credibility":2,"name":"Least Authority - Zebra NU6.1 Final Audit Report","type":"research","url":"https://leastauthority.com/zcg-zebra-nu6-1-network-upgrade-final-audit-report"},{"credibility":1,"name":"GitHub Security Advisory GHSA-452v-w3gx-72wg","type":"official","url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg"},{"credibility":2,"name":"Wiz - CVE-2026-34202","type":"research","url":"https://www.wiz.io/vulnerability-database/cve/cve-2026-34202"},{"credibility":2,"name":"Wiz - CVE-2026-41584","type":"research","url":"https://www.wiz.io/vulnerability-database/cve/cve-2026-41584"},{"credibility":2,"name":"ZODL - zcashd and Zebra April 2026 disclosure","type":"official","url":"https://zodl.com/zcashd-zebra-april-2026-disclosure/"},{"credibility":2,"name":"Decrypt - Zcash Completes 'Most Ambitious' Network Upgrade","type":"news_article","url":"https://decrypt.co/369896/zcash-completes-most-ambitious-network-upgrade-zec-resumes-recent-surge"},{"credibility":2,"name":"Cointelegraph - Zcash Orchard vulnerability emergency upgrade","type":"news_article","url":"https://cointelegraph.com/news/zcash-orchard-vulnerability-emergency-upgrade"},{"credibility":3,"name":"CraftedSignal - CVE-2026-44497 brief","type":"community_report","url":"https://feed.craftedsignal.io/briefs/2024-01-09-zebra-consensus-divergence/"}],"summary":"Zebra is an independent, consensus-compatible Zcash full-node implementation written in Rust and developed by the Zcash Foundation. It has undergone third-party audits (NCC Group in 2023; Least Authority for the NU6 and NU6.1 upgrades) and has had several 2026 vulnerabilities disclosed and patched, including remote denial-of-service and consensus-divergence bugs. In the June 2026 Orchard circuit bug response, Zebra releases 4.5.3 and 5.0.0 delivered the temporary Orchard shutdown and the NU6.2 fix; reporting states there was no evidence of exploitation.","timeline":[{"date":"2023-06","event":"NCC Group security assessment of Zebra (report E005955); Zebra v1.0 released in June 2023 per ZODL disclosure","source":"NCC Group","source_url":"https://nccgroup.com/media/bw3nq0vm/_ncc_group_zcashfoundation_e005955_report_2023-06-27_v10.pdf"},{"date":"2024-11-08","date_evidence":"The final audit report was completed on \"November 8, 2024.\"","event":"Least Authority completes final audit report on Zebra changes for NU6","source":"Least Authority","source_url":"https://leastauthority.com/blog/zebra-nu6-updates/"},{"date":"2025-11","event":"Least Authority final audit report for Zebra NU6.1 reported completed","source":"Least Authority","source_url":"https://leastauthority.com/zcg-zebra-nu6-1-network-upgrade-final-audit-report"},{"date":"2026-03","event":"CVE-2026-34202 remote crash bug patched in zebrad 4.3.0","source":"Wiz","source_url":"https://www.wiz.io/vulnerability-database/cve/cve-2026-34202"},{"date":"2026-04","event":"CVE-2026-41584 (identity rk panic) fixed in Zebra 4.3.1 and advisory published","source":"GitHub Security Advisory","source_url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg"},{"date":"2026-05","event":"Researcher reports Orchard Action circuit flaw (end of month); sighash divergence issue CVE-2026-44497 advisory reported","source":"Decrypt","source_url":"https://decrypt.co/369896/zcash-completes-most-ambitious-network-upgrade-zec-resumes-recent-surge"},{"date":"2026-06","event":"Zebra 4.5.3 disables Orchard; Zebra 5.0.0 activates NU6.2 and restores Orchard with corrected circuit","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/zcash-orchard-vulnerability-emergency-upgrade"}]},"v":1}