Svmuu News: Privacy coin Zcash recently disclosed and patched a critical security vulnerability that could have allowed malicious miners to transfer over 25,000 ZEC (approximately $6.5 million) from the deprecated Sprout privacy pool. Security researcher Alex "Scalar" Sol disclosed on March 23 that the vulnerability stemmed from zcashd nodes skipping proof verification when processing transactions involving the Sprout pool. Officials stated that the vulnerability had existed since July 2020 but was never exploited, and user funds remained secure.

The development team has released version v6.12.0 to complete the fix, and major mining pools have deployed the upgrade within days. Additionally, the unaffected Zebra full node implementation has the capability to trigger a chain fork, providing extra protection if the vulnerability were to be exploited. According to the disclosure, although the Sprout pool stopped accepting new deposits in November 2020, approximately 25,424 ZEC remain unmoved. Even if the vulnerability were exploited, Zcash's "turnstile" mechanism would prevent inflationary issuance, ensuring the total supply is not exceeded.

This vulnerability was discovered with AI assistance, and the researcher will receive a total bounty of 200 ZEC (approximately $51,000). It is worth noting that this is not the first major vulnerability Zcash has encountered; in 2019, it fixed a severe flaw that could have led to infinite issuance. (Decrypt)