Zcash Foundation Details Seven Zebra Security Fixes Ahead of NU7

The Zcash Foundation’s Zebra 7.0.0 release fixes seven security issues ahead of NU7, with operators needing to update before activation at block 3,543,405, targeted around Thursday, Nov. 5.

The Foundation detailed the fixes in a Nov. 3 engineering update. Five are rated high severity and two medium. Six could interfere with syncing, verification or peer handling; the seventh could crash a node process.

The issues include two checkpoint-related failures that could stall initial synchronization, a path for invalid transparent scripts to keep verification busy without an effective misbehavior penalty, and costly signature-hash calculations. One transaction with tens of thousands of inputs could keep a node’s CPU occupied for minutes. Another flaw could use tens of seconds of CPU per transaction, slowing verification and syncing on machines with few cores. A repeated mempool check could tie up verification threads, and valid transactions could lead to honest peers being banned.

Zebra 7.0.0 also fixes a crash that could occur when disconnecting a busy peer. Zebra 7.0.0 was released Oct. 22 and supports NU7. Operators must upgrade before activation to remain on the network’s consensus chain.

NU7 will reduce Zcash’s target block spacing from 75 seconds to 25 seconds. The shorter interval is intended to reduce the average wait for a first confirmation, but the upgrade activates when the network reaches its target height, so Nov. 5 is an estimate rather than a set time. The height and estimated timing are covered in the NU7 mainnet schedule.

On first startup, Zebra 7.0.0 migrates its database from format v28 to v29. Zebra 6.x cannot read v29, so downgrading after migration requires a full resync. Operators planning to downgrade should back up the v28 state directory before upgrading. DNS seeder operators should deploy Zeeder v1.8.0, which supports NU7, before activation.