Zcash Foundation Releases Emergency Zebra Update for Consensus Flaw.
Key Takeaways
- The Zcash Foundation has issued an emergency update, Zebra version 4.5.1, for its node software.
- The update addresses a critical security flaw, identified as GHSA-2prc-cj5x-4443.
- This vulnerability could lead to a consensus split within the network.
- The flaw stems from an error in counting signature operations (sigops) in P2SH transactions.
- All Zebra node operators are strongly urged to upgrade to version 4.5.1 immediately.
- There is currently no workaround for the issue; upgrading is the sole solution.
The Zcash Foundation has released an urgent update for its Zebra node software, urging all operators to upgrade immediately. This critical release, version 4.5.1, targets a security vulnerability that poses a risk of triggering a consensus split across the network.
The flaw, officially identified as GHSA-2prc-cj5x-4443, arises from an error in the calculation of signature operations (sigops) within P2SH transactions. This miscalculation can cause different nodes to produce varying transaction validation results. Such discrepancies could lead directly to a potential chain split, compromising network integrity and consistency.
Get the Z-Brief
ZEC price analysis and the best Zcash content. 1-2x per month.
Â
Published on June 01, Zebra version 4.5.1 also rectifies shortcomings present in the prior release, version 4.5.0, which was deployed a day earlier. The Zcash development team pinpointed that divergent implementations of the sigop calculation logic were the root cause, leading to the risk of inconsistent validation outcomes among nodes.
According to the Foundation, version 4.5.1 specifically focuses on reverting and adjusting the Rust implementation logic. This modification ensures that the software now accurately aligns with the protocol's intended behavior regarding sigop counting.
The Foundation confirmed that no alternative workaround exists for this vulnerability. Consequently, upgrading to Zebra version 4.5.1 represents the only definitive action for node operators to ensure they remain synchronized with the correct chain and mitigate the risk of a network split.
