Zcash fixes 6-year-old zcashd bug that silently skipped Sprout proof verification, pays 200 ZEC to AI-assisted researcher

Zcash patched a 6-year-old zcashd consensus bug (v3.1.0-v6.11.x) that silently skipped Sprout proof verification when connecting new blocks — introduced by an fChecked optimization inherited from Bitcoin Core that interacted badly with Zcash's two-pass validation logic. Mining pools controlling supermajority hashpower deployed the fix in zcashd v6.12.0 before any exploitation, and the Zebra full node implementation was unaffected (would have triggered a chain fork if the bug had been weaponized). Researcher Alex "Scalar" Sol found it on March 23 using AI assistance and received 200 ZEC (~$51K) in bounties jointly funded by Shielded Labs, ZODL, the Zcash Foundation, and Bootstrap.

TLDR by @Benthic

More coverage

• Zcash Fixes Critical Bug Impacting Sprout Shielded Pool (financefeeds.com)
• Zcash patches critical bug affecting the Sprout shielded pool (crypto.news)
• Zcash Vulnerability That Put Millions of Dollars of ZEC at Risk Has ... (cryptonews.net)
• Zcash Counterfeiting Vulnerability Successfully Remediated (electriccoin.co)
• Zcash Vulnerability Successfully Remediated - Zodl (zodl.com)

Explore the topic

• Zcash
• ZEC
• AI