Headline: Zcash patches critical Sprout bug that could've let attackers drain legacy shielded funds
Zcash developers have fixed a critical vulnerability in zcashd that could have allowed attackers to bypass proof verification for transactions involving the network’s legacy Sprout shielded pool — potentially enabling theft from those funds.
Security researcher Alex “Scalar” Sol publicly disclosed the flaw on Tuesday. According to the report, the bug caused zcashd to skip zk‑SNARK proof verification for Sprout-related transactions in releases dating back to July 2020. The issue was remedied in the official release v6.12.0, published Tuesday; no exploitation has been observed so far and user funds remain intact.
Why this mattered
- Sprout is Zcash’s original shielded pool, launched with the network in 2016 as the first production implementation of zero‑knowledge proofs (zk‑SNARKs) in a cryptocurrency. Although the Sprout pool was closed to new deposits in November 2020, it still holds roughly 25,424 ZEC that have not yet been migrated to newer shielded pool implementations.
- Skipping proof verification on Sprout transactions could have allowed unauthorized spends from that pool, effectively letting attackers drain those funds if exploited.
Mitigations and rollout
- Zcash core developers released v6.12.0 to address the vulnerability. Major mining pools — Luxor, F2Pool, ViaBTC and AntPool — had deployed the fix by March 26, the disclosure notes.
- The Zebra full‑node implementation was not affected. The report also points out that an attempted exploit would likely have produced a chain fork, which would have served as an additional safeguard against unnoticed theft.
- The Zcash Open Development Team emphasized that the network’s “turnstile” mechanism, which ensures any coins leaving Sprout must have previously entered it, would have limited the risk of broader supply inflation even if the flaw had been leveraged.
Context and history
This is the second time a severe, systemic vulnerability has been found in Zcash’s shielded pools. In 2019 the team disclosed a “counterfeiting” bug in the underlying cryptography that could have allowed creation of ZEC out of thin air; that issue was fixed after discovery.
What users and node operators should do
- Upgrade zcashd to v6.12.0 (or later) immediately if you run a node or miner.
- If you hold funds in Sprout, consider migrating them to newer shielded pools as soon as practical.
The quick disclosure and coordinated response — plus the lack of observed exploitation — kept potential damage to a minimum. Still, the incident reinforces the importance of timely upgrades and continued scrutiny of shielded‑pool code in privacy‑focused blockchains.
Read more AI-generated news on: undefined/news
