Zcash Foundation Urges Immediate Upgrade to Zebra Node Client 4.5.0

Zcash Foundation has released version 4.5.0 of the Zebra node client, addressing multiple security vulnerabilities, including a critical consensus-level flaw. According to Foresight News, the foundation strongly recommends that all node operators upgrade immediately. The most severe vulnerability (GHSA-gf9r-m956-97qx) involved the Rust script parser incorrectly counting signature operations in P2SH redemption scripts, causing Zebra to accept blocks rejected by zcashd, potentially leading to a chain split. Additionally, nine high to medium severity vulnerabilities were fixed, including issues related to block retry suppression, address balance overflow causing node crashes, mempool queue saturation, and sync restart poisoning. Three low-severity vulnerabilities were also addressed. The new version also adds support for mining to shielded addresses. This update covers over 80 security reports received during the ZCG vulnerability disclosure program from April to May.