Zcash developers restored transaction functionality after an emergency network upgrade fixed a critical vulnerability in the Orchard shielded pool. The Zcash Foundation confirmed no evidence of exploitation or user privacy impact, though the network briefly became unstable during the upgrade process.
This incident highlights the ongoing challenges in maintaining the security and stability of privacy-focused blockchains, even after a critical vulnerability is identified and patched, demonstrating the importance of rapid response and robust upgrade mechanisms.
Zcash has successfully restored transaction functionality following an emergency network upgrade to address a critical vulnerability found in the Orchard shielded pool. The Zcash Foundation confirmed that the vulnerability affected the zero-knowledge proof circuit within Orchard and had the potential to permit invalid state transitions. However, the Foundation emphasized that there was no evidence to suggest the bug was exploited, no unauthorized value creation was detected, and crucially, user privacy remained unaffected. The resolution was implemented through a two-step emergency upgrade process. Initially, Zebra version 4.5.3 was used to temporarily disable Orchard actions. Subsequently, Zebra version 5.0.0 activated the NU6.2 upgrade, which re-enabled Orchard with a corrected circuit, thereby resolving the issue. The Zcash Open Development Lab noted that the network experienced brief instability as miners upgraded their systems.