Junglewise Threat Intelligence

CVE-2026-54496: Zcash Orchard Action circuit soundness vulnerability in halo2_gadgets

CVE-2026-54496 · Severity: critical · CVSS 9.3 · Published 2026-07-17

Technologies: Zcash Foundation Zebra, zebrad (crates.io). Vendors: crates.io, Zcash Foundation.

Executive brief

A critical security flaw was identified in the Zcash Orchard pool, which is used for private cryptocurrency transactions. This vulnerability could allow a malicious actor to spend the same digital funds multiple times (double-spending) or potentially steal funds from other users if they have access to certain viewing keys. While the total supply of Zcash is protected by existing safety mechanisms, this issue could have led to significant financial loss and inflation within the private Orchard pool.

Technical details

A soundness vulnerability exists in the variable-base scalar multiplication gadget within halo2_gadgets/src/ecc/chip/mul/incomplete.rs. The root cause is the use of assign_advice() for the base point without a corresponding copy constraint to anchor it to the actual base. This allows a malicious prover to provide an under-constrained base point to satisfy the diversified-address-integrity check (pk_d = [ivk] g_d) with arbitrary values. Consequently, an attacker can generate multiple valid nullifiers for a single note, enabling double-spending, or forge spend authorizations. The issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0 via the NU6.2 network upgrade.

Affected products

  • ZcashFoundation zebra < 5.0.0
  • zcash halo2_gadgets < 0.5.0
  • zcash orchard < 0.14.0
  • zcash librustzcash (zcash_primitives) < 0.28.0
  • zcash zcashd < 6.20.0

Timeline

  • 2022-05-31: other: Vulnerability introduced with NU5 upgrade
  • 2026-06-02: patched: Fixes released in various component versions
  • 2026-06-15: advisory: Security advisory published by Zcash Foundation
  • 2026-07-17: disclosed: CVE-2026-54496 published

References

Related threats