Zcash Foundation has detailed seven security fixes for its Zebra node software before the NU7 upgrade planned around November 5. The update also warns operators to install a compatible release before the network switches to 25-second blocks.
Table of Contents
The November 3 engineering report covers work completed between October 20 and November 2. Zebra 7.0.0 launched on October 22 with five high-severity fixes and two medium-severity patches. Activation is set for block 3,543,405.
Six vulnerabilities have the potential to interfere with the synchronization process and verification processes and may cause blocking of legitimate peers. The other vulnerability has the ability to crash zebrad, which is the process that runs Zebra.
What Security Issues Did Zcash Developers Fix
The two high-severity vulnerabilities concerned checkpoint blocks during synchronization. A peer running maliciously could send an invalid block body and hinder the download of the valid block body. After restarting the program, a new stall would occur.
There was a vulnerability related to checkpoint verification being ahead of the blockchain data when a commit operation was not successful. Now Zebra resets checkpoint verification progress after such failures occur.
Also Read: Tether Freezes $4.5M USDT as Mercado Bitcoin Probes $40M Breach
Some high-severity vulnerabilities related to invalid transparent scripts, recalculations of signatures, and transaction validation. One transaction was enough to keep a node busy for several minutes due to the intensive work of its CPU. Another vulnerability was that the node would repeatedly ask the same questions to verification threads.
The two medium-severity vulnerabilities impacted the Zebra node differently. Disconnection of a busy peer could cause a node crash. Another vulnerability is related to the wrong ban of a peer because of sending transactions that become valid in the next block.
What Must Zcash Node Operators Do Before NU7
As stated by the Zcash Foundation, there is a need to upgrade before the block number 3,543,405 for the mainnet operators. The upgraded node will be able to disconnect any peer using the old version after the activation of the upgrade. Nodes still using the old software will follow another chain.
Zebra 7.0.0 migrates to v29 from the format v28 in the state database. The migration process takes place automatically on the first startup of the nodes. This migration does not need downloading another blockchain since it happens automatically.
Source: Yahoo Finance
The release notes have taken off some peer labels from the metrics network. There is a need to update any dashboard that relies on these peer labels.
The Zcash Foundation has limited the support period for this version to eight weeks from 12 weeks. Another change faced by wallets and exchanges is NU7 rejecting version 4 transactions. All the funds remaining in the Sprout pool become unspendable due to the Sprout transactions.
How Will NU7 Change Zcash Block Times
Under ZIP 218, Zcash will decrease its block time from 75 seconds to 25 seconds. This decreases the wait time before the first confirmation. But the specification does not recommend decreasing the number of confirmations needed.
The daily amount of ZEC minting stays the same, as the reward per block gets lowered. The schedule of halvings every four years and a cap of 21 million ZEC remain the same too.
The new limits increase the Orchard throughput from 2.9 to 6.6 transactions per second. It also reduces the worst-case bandwidth of light-wallet synchronization by 37%.
In accordance with ZIP 235, miners get 40% of all the transaction fees. The other 60% is put into the reserve and comes back through block rewards. The reserve starts coming back to rewards after block 8,939,664.
Why Did Zcash Miners Receive a Separate Release
Following issues raised at Zcon7, Zebra Ándale 7.1.0-alpha.0 was released on October 31. Zcash miners have been complaining about slow template building, blocks validation, and relaying. The new version solves that problem by offering faster reaction to changes in transactions and mempool.
According to the foundation’s testing of this software, a transaction burst of substantial size became available for mining within about four seconds. The old approach needed more than eight minutes. These numbers are provided by the developers and do not imply independent verification.
The report also confirms Zeeder v1.8.0 compatibility with the NU7 network. The DNS seeder is advertising the new protocol version. Also, developers are considering block pruning to decrease storage requirements. It is still a default setting to store the full chain.
Also Read: Solana Gains Genius App Support for Mobile Token Trading
Arslan Tabish is a Technical Reporter and Market Analyst at Tron Weekly with over five years of experience covering cryptocurrency markets and blockchain developments. His reporting focuses on Bitcoin, Ethereum, altcoins, and decentralized finance, alongside NFTs, crypto regulation, policy, and Web3 innovations.
Arslan covers blockchain technology, Layer 2 scaling solutions, and emerging use cases, including AI-driven crypto applications, while delivering clear market analysis on how technical and regulatory developments impact digital asset markets. His work is designed for both beginners and experienced readers, offering accurate, easy-to-understand reporting without speculation or investment guidance.
