Zcash details seven Zebra security fixes ahead of NU7 upgrade

Zcash Foundation has outlined seven security fixes in Zebra 7.0.0 as node operators prepare for the NU7 mainnet upgrade, which remains planned for around Nov. 5.

Summary

• Zebra 7.0.0 supports NU7 activation at mainnet block 3,543,405 and addresses seven security issues.
• Operators must upgrade before activation to remain on the network's consensus chain.
• A separate alpha release addresses mining delays reported during the Zcon7 conference in Cancún.
• Zeeder v1.8.0 adds NU7 support, with seeder operators instructed to deploy it before activation.

Zcash Foundation's engineering update, published Nov. 3 and covering Oct. 20 through Nov. 2, brings together the remaining preparations for NU7. Zebra 7.0.0 was released on Oct. 22, making the latest announcement a progress report ahead of activation.

The foundation described six of the security issues as ways a peer could stall synchronization, occupy verification resources, or cause honest peers to be banned. The seventh could crash zebrad, the software process running a Zebra node.

Zebra fixes include five high-severity issues

The foundation's release announcement classifies five advisories as high severity and two as medium. The high-severity issues cover two checkpoint synchronization failures, inadequate penalties for invalid transparent scripts, costly signature calculations, and a transaction check that could occupy verification threads.

One medium-severity flaw could stop Zebra when it disconnected a busy peer. The other could cause a node to ban an honest peer for relaying a transaction whose lock-time condition would become valid at the next block.

A checkpoint advisory explains that an unauthenticated peer could supply a forged block body and leave a syncing node unable to make progress until restart. The node incorrectly treated missing blocks as already downloaded, preventing it from requesting valid copies.

The advisory limits the impact to availability: no invalid block reached disk, no chain fork occurred, and funds were unaffected. Already-synchronized nodes were outside the affected group.

A related vulnerability could leave the checkpoint verifier out of step with stored state after a failed commit. Its advisory says restarting restored progress, but an affected node could be stalled again during later synchronization.

NU7 requires operators to update before activation

The foundation says mainnet operators must upgrade before block 3,543,405. Once NU7 activates, upgraded nodes will disconnect peers running older versions, while incompatible nodes can follow a different chain.

As crypto.news previously reported, the mainnet upgrade deadline applies to operators seeking to remain on the consensus chain.

Installation carries a database change. According to the GitHub release notes, Zebra moves its stored state from format v28 to v29 on first startup without requiring a fresh synchronization.

Zebra 6.x cannot read the new format. Operators returning to an older version would therefore need a full resynchronization, and the developers advise backing up the state/v28 directory before upgrading.

Monitoring systems need attention as well. Peer metrics no longer include individual address and user-agent labels, so dashboards and alerts built around those fields require changes. Zebra 7.0.0 has an eight-week support period, compared with the usual 12 weeks.

Zcash targets 25-second blocks without faster daily issuance

Under ZIP 218, NU7 reduces target block spacing from 75 seconds to 25 seconds. The specification identifies payments, exchange deposits, and cross-chain operations among the activities affected by confirmation waits.

Scheduled ZEC issuance per day remains unchanged because the reward per block is adjusted for the faster schedule. The proposal does not recommend that clients reduce confirmation counts.

The foundation's release explanation preserves the four-year halving schedule and 21 million ZEC supply cap. NU7 introduces a fee reserve, with 60% of transaction fees removed from circulation for future rewards and 40% retained by miners.

Miner feedback produces a separate alpha release

Following complaints at Zcon7 about slow template creation, block acceptance, and relay, the foundation published Zebra Ándale, version 7.1.0-alpha.0, on Oct. 31.

The alpha replaces polling delays with responses to verified transactions and mempool changes. In the foundation's benchmark, a large transaction burst that previously took more than eight minutes to reach a mining template took approximately four seconds. The figures are developer-reported results from the alpha release.

The engineering update says Zeeder v1.8.0 advertises the NU7 protocol version so upgraded nodes continue accepting it after activation. Seeder operators are instructed to deploy the release beforehand. The team is reviewing optional block pruning to save disk space, while keeping full-chain storage as the default.