Executive brief
Zebra, a Zcash node implementation, contains a flaw that causes permanent data corruption when the blockchain undergoes a 'fork' (a common event where multiple miners find blocks simultaneously). This corruption affects the records used by mobile and light wallets to synchronize their balances, potentially leading to incorrect wallet states or synchronization failures. Fixing the issue requires node operators to update their software and completely rebuild their local blockchain database.
Technical details
A logic asymmetry exists between the 'pop_root' and 'pop_tip' methods in the non-finalized state management of Zebra. While 'pop_root' correctly handles finalization cleanup, 'pop_tip' fails to remove note commitment subtree root contributions when a block is reverted during a chain fork. This stale in-memory data is subsequently written to the persistent RocksDB state during the next finalization event. The resulting corruption affects the 'z_getsubtreesbyindex' RPC, causing downstream consumers like lightwalletd to receive incorrect data. The vulnerability is tracked as CWE-459 (Incomplete Cleanup) and requires a full state rebuild to remediate existing corruption.
Affected products
- ZcashFoundation zebrad <= 4.4.1
- ZcashFoundation zebra-state <= 6.0.0
Timeline
- 2026-05-29: disclosed: Private submission via GitHub Security Advisory
- 2026-07-02: advisory