Executive brief
Zebra is a software implementation used to run nodes on the Zcash cryptocurrency network. A vulnerability has been identified where a specially crafted, valid block can cause the software to crash and fail to restart. This results in a permanent halt of the node, disrupting services such as wallets, exchanges, and mining operations that rely on it.
Technical details
The vulnerability is an uncaught exception (panic) caused by an integer overflow in the finalized state writer located at zebra-state/src/service/finalized_state/zebra_db/transparent.rs. The component processes all transaction outputs (credits) in a block before processing inputs (debits); a block containing many self-spends to the same address can cause the intermediate balance to exceed the MAX_MONEY supply cap, triggering a panic via .expect(). Because the block is consensus-valid, the node will re-encounter and re-process the same block upon restart, creating a permanent chain halt. An attacker with sufficient ZEC and mining capability can exploit this remotely by mining a malicious block. The issue is fixed in Zebra 4.4.2 (zebrad) and 7.0.0 (zebra-state) by processing credits and debits together per transaction.
Affected products
- ZcashFoundation zebrad <= 4.4.1
- ZcashFoundation zebra-state <= 6.0.0
Timeline
- 2026-05-29: disclosed
- 2026-07-02: advisory