•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Zcash vulnerabilities have been patched across two Zcash full-node implementations following a coordinated security disclosure. On April 17, 2026, the Zcash Open Development Lab released zcashd v6.12.1, while the Zcash Foundation released Zebra v4.3.1. Security researcher Alex “Scalar” Sol reported the issues on April 4, 2026.
Four vulnerabilities were addressed, including a node crash bug, a consensus enforcement gap, and a turnstile accounting bypass. The disclosure states that no user funds were compromised and that no ZEC supply inflation occurred at any point.
The most directly exploitable issue was an Orchard transaction crash present in both zcashd and Zebra. A crafted transaction using an all-zeros randomized key encoding could immediately crash any node that processed it.
Repeatedly broadcasting such a transaction could prevent nodes from participating in the network. The disclosure says no transactions triggering this condition were found on the Zcash mainnet before the patch.
A related enforcement gap also existed between the two implementations. Zebra already enforced a protocol requirement on ephemeral public keys within Orchard actions, but zcashd did not. As a result, a crafted transaction could be accepted by zcashd while being rejected by Zebra, potentially forcing a visible chain fork between nodes running different clients.
A separate bug in zcashd, introduced with v5.10.0 in August 2024, could disable turnstile accounting under certain conditions. Specifically, receiving a duplicate block header from a peer could silently reset pool balance tracking to null. The turnstile tracks ZEC balances across shielded and transparent value pools and is described as a critical safety layer.
The disclosure notes that this bug was not independently exploitable to steal or inflate ZEC. It states that exploiting it to steal funds would require a separate, independent balance vulnerability in addition to the turnstile issue. It also says any resulting turnstile violation would have been publicly visible as a detectable chain anomaly, and that no such anomaly occurred on the Zcash mainnet before the fix was deployed.
Zcash Open Development Lab said mining pools representing a supermajority of the network’s hash power, along with the primary operator running Zebra in mining production, deployed patches prior to the disclosure.
The zcashd patches were authored by ZODL engineers Kris Nuttycombe and Daira-Emma Hopwood, with mutual review. Nuttycombe addressed the Orchard crash, the enforcement gap, and the turnstile accounting bug. Hopwood authored hardening patches covering integer overflow undefined behavior and exception safety.
Mining pools contacted for coordination included ViaBTC, Luxor, F2Pool, and AntPool, each running zcashd. Foundry, which runs Zebra in mining production, also deployed its patch ahead of public release.
The Zcash Foundation’s Conrado Gouvêa separately developed and delivered the Zebra patch to preserve network stability throughout the disclosure process.
Beyond the core vulnerability fixes, the zcashd v6.12.1 release included broader hardening changes. A chain supply value checkpoint was added at NU6.1 activation to enable future corruption detection. The release also added integer overflow protections across pool balance accumulation routines in multiple code paths, described as an additional defense layer against edge-case exploitation scenarios.
ZODL said it has no evidence that any of the bugs were exploited. It added that user funds and privacy were never at risk and that no ZEC supply inflation was possible.
Alex “Scalar” Sol also reported a separate vulnerability in March 2026 involving Sprout verification through the same coordinated channels. The disclosure advises users running either zcashd or Zebra to upgrade to the latest patched versions immediately.
Premium gym chains are entering a “golden era” that is ending or already in decline, as rising operating costs collide with shifting consumer preferences toward more flexible, community-based ways to exercise. Long-term memberships are shrinking, margins are pressured by higher rents and facility expenses, and competition from smaller, more personalized…
