Zcash performs emergency update after critical bug in Orchard

The Zcash Foundation has released an emergency update to address a critical bug in the Orchard section of the network. Zebra 5.0.0 is now available, and all node operators should upgrade immediately. The security issue involved a flaw in the Orchard Action circuit that could have compromised transaction integrity.

The foundation acted in two steps. First, Zebra 4.5.3 was rolled out with an emergency soft fork at mainnet block 3,363,426, temporarily disabling Orchard actions. Next, Zebra 5.0.0 activates the NU6.2 hard fork at block 3,364,600 and re-enables Orchard with the improved circuit.

Bug intercepted before exploitation

The good news is that the vulnerability was detected before anyone could exploit it. The Zcash Foundation states that there is no evidence of unauthorised value creation on the network. This means no illegitimate ZEC coins were created and the total supply remained intact.

User privacy was not affected by the issue. Sapling and transparent transactions continued to function without interruption. Only the Orchard section was temporarily suspended, which had no impact on the daily use of the majority of Zcash transactions.

Operators must upgrade quickly

The Zcash Foundation urges all node operators to switch to version 5.0.0 as soon as possible. This upgrade is essential to keep the network secure and stable. Although the bug was intercepted before active exploitation could occur, the environment can change rapidly, making swift action important.

This incident highlights how blockchain networks are constantly subject to security checks. The way the Zcash Foundation responded underscores the importance of active monitoring and rapid responses to security issues in decentralised systems.