Gate News message, April 1, privacy coin Zcash disclosed and fixed a critical security vulnerability. Security researcher Alex “Scalar” Sol disclosed on March 23 that the flaw stemmed from zcashd nodes skipping proof verification when processing transactions involving the Sprout privacy pool, which could be exploited by malicious miners to transfer more than 25,000 ZEC (about $6.5 million) from the deprecated Sprout pool.
Official statements said the vulnerability had been present since July 2020, but it was not actually exploited, and users’ funds were always safe. The development team released version v6.12.0 to complete the fix, and major mining pools completed the upgrade rollout within days. In addition, unaffected Zebra full-node implementations have the ability to trigger chain forks, providing extra protection if the vulnerability were exploited.
As disclosed, while the Sprout pool was shut down for new deposits in November 2020, there were still about 25,424 ZEC not yet migrated. Even if the vulnerability were exploited, Zcash’s turnstile mechanism could prevent inflationary issuance, ensuring the total supply could not be breached. The flaw was discovered with AI assistance, and the researcher will receive a total bounty of 200 ZEC (about $51,000). Notably, Zcash previously fixed a serious defect in 2019 that could lead to unlimited inflation.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Seven Israeli Officers Charged in Multimillion-Dollar Crypto Theft Ring
Israeli Security Forces Charged in Crypto Theft Case
Israeli authorities have charged seven military and police officers with running a multimillion-dollar theft and bribery ring involving cryptocurrency, marking the second crypto-related criminal case to hit the country's defence establishment in
CryptoFrontier3h ago
Ice Open Network Suffers Data Breach; User Emails and 2FA Phone Numbers Exposed
Ice Open Network reported a security breach on April 15, revealing unauthorized access to user data, including email addresses and 2FA phone numbers, but no financial data was compromised. The incident, linked to former partners of a service provider, is under legal review, and users are advised to update security settings. The breach highlights escalating security issues in the crypto sector, with significant losses reported in recent months.
GateNews6h ago
Russian Crypto Exchange Grinex Halts Operations After $13M Hack, Threatening Sanctions Evasion Network
Russian cryptocurrency exchange Grinex ceased operations after a cyberattack caused losses over $13 million. The shutdown impacts Russian businesses' ability to convert rubles internationally and challenges the country's shadow finance system.
GateNews8h ago
Kelp DAO Hack Attributed to Lazarus Group; eth.limo Domain Hijacked via Social Engineering
LayerZero reported that the Kelp DAO exploit, attributed to North Korea's Lazarus Group, led to a loss of $292 million in rsETH tokens due to vulnerabilities in its decentralized verifier network. Additionally, eth.limo faced a domain hijacking from a social engineering attack, but DNSSEC mitigated severe damage.
GateNews12h ago
DeFi Hack Triggers $9 Billion in Outflows from Aave as Stolen Tokens Used as Collateral
A recent hack draining nearly $300 million from a crypto project led to a liquidity crisis on Aave, causing users to withdraw around $9 billion. Concerns over collateral quality prompted mass withdrawals, highlighting risks in DeFi lending.
GateNews13h ago
