CVE-2026-54496 Overview
CVE-2026-54496 is a cryptographic soundness flaw in the Zcash Zebra node and related Rust crates. The variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs calls assign_advice() for the base point without a copy constraint tying the value to the actual base. A malicious prover can produce a valid Halo2 proof for an Orchard Action with an under-constrained base point. This bypasses the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. The issue affects zebrad before 5.0.0, halo2_gadgets before 0.5.0, orchard before 0.14.0, zcash_primitives before 0.28.0, and zcashd before 6.20.0.
Critical Impact
A malicious prover can forge Orchard shielded transactions that break note-integrity binding, threatening the integrity of the Zcash consensus layer.
Affected Products
- zebrad prior to 5.0.0
- halo2_gadgets prior to 0.5.0 and orchard prior to 0.14.0
- zcash_primitives prior to 0.28.0 and zcashd prior to 6.20.0
Discovery Timeline
- 2026-07-17 - CVE-2026-54496 published to the National Vulnerability Database
- 2026-07-17 - Last updated in NVD database
- 2026-07-17 - Zcash Foundation announced an emergency soft fork and NU6.2 activation alongside zebrad 4.5.3 and 5.0.0 releases
Technical Details for CVE-2026-54496
Vulnerability Analysis
The vulnerability lives in the incomplete variable-base scalar multiplication gadget used by Orchard's Halo2 circuit. Halo2 circuits enforce equality between witnessed values through copy constraints on advice columns. The gadget assigned the base point using assign_advice() but omitted the copy constraint that ties the assigned cell back to the actual base supplied by the caller. This means the prover controls the value used inside the scalar multiplication region without the circuit verifying that value matches the intended base.
Orchard uses this multiplication to derive components involved in note integrity, including g_d, pk_d, ivk, ak, and the nullifier nf. Because the binding between these values collapses when the base is unconstrained, a malicious prover can generate proofs where the shielded note metadata does not correspond to the values enforced by consensus. The weakness is a form of insufficient verification of data authenticity ([CWE-345]).
Root Cause
The circuit code in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point cell but did not call constrain_equal() against the caller-provided base. Without the copy constraint, the constraint system accepts arbitrary prover-chosen values in that cell, invalidating the soundness assumption of the diversified-address-integrity gadget that consumes the result.
Attack Vector
A network-reachable attacker running a modified prover crafts an Orchard Action using a base point that differs from the value the verifier expects. The attacker submits the resulting transaction to any Zcash node running vulnerable software. The verifier accepts the proof, allowing the attacker to bypass the binding between pk_d, g_d, ivk, nf, and ak for the spent note. This can enable forged shielded spends against the Zcash consensus rules.
No verified public exploit code is available. See the Zcash Foundation Zebra Security Advisory for the authoritative technical description.
Detection Methods for CVE-2026-54496
Indicators of Compromise
- Zcash nodes running zebrad earlier than 5.0.0 or zcashd earlier than 6.20.0 accepting blocks after the NU6.2 activation height.
- Orchard Actions that verify on unpatched nodes but are rejected by patched peers after the emergency soft fork.
- Chain forks or reorganizations on hosts that failed to upgrade before the NU6.2 activation.
Detection Strategies
- Inventory hosts running Zcash node binaries and record installed versions of zebrad, zcashd, orchard, halo2_gadgets, and zcash_primitives.
- Compare peer consensus state against upgraded reference nodes to identify divergence caused by acceptance of forged Orchard proofs.
- Alert on outbound network flows from validator hosts to Zcash P2P peers where the local process version is below the fixed release.
Monitoring Recommendations
- Track process execution and version telemetry on validator, exchange, and wallet-service hosts running Zcash software.
- Monitor for tampering with node binaries, configuration files, or the Rust dependency lockfiles that pin vulnerable crate versions.
- Correlate Zcash node logs with network telemetry to detect anomalous rejections, chain splits, or unexpected reorg activity.
How to Mitigate CVE-2026-54496
Immediate Actions Required
- Upgrade zebrad to 5.0.0 or later and zcashd to 6.20.0 or later on every full node, validator, and wallet backend.
- Update Rust dependencies to halo2_gadgets 0.5.0, orchard 0.14.0, and zcash_primitives 0.28.0 in any downstream project that consumes these crates.
- Verify that upgraded nodes have activated NU6.2 and are following the canonical chain announced by the Zcash Foundation.
Patch Information
The fix adds the missing copy constraint tying the base point cell to the caller-provided base in the incomplete scalar multiplication gadget. Patched releases are available at Zebra Release 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0. The remediation is coordinated with the emergency soft fork and NU6.2 activation.
Workarounds
- No cryptographic workaround exists; the flaw is a circuit soundness defect that requires the upstream patch.
- Operators unable to upgrade immediately should stop accepting or forwarding Orchard transactions and rely on trusted upgraded peers.
- Exchanges and custodians should pause Zcash shielded deposits until node infrastructure is confirmed to be running fixed versions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
