Zcash releases Zebra 6.2.1 with new sync protections and Testnet timing correction

Zcash launched Zebra 6.2.1 with two security improvements in chain synchronization and mempool verification, along with a specific fix for the testnet. The development team recommended all node operators update as soon as possible.

On the security front, the new version of Zebra addresses vulnerability GHSA-x93j-mj2f-q338, classified as moderate severity, which allowed a poisoned block to delay the download of the corresponding valid block.

Chain synchronization can now immediately retry the download of a legitimate block body after rejecting one that shares the same header hash, without having to wait for a subsequent child block to trigger the cleanup. Credit for identifying the issue went to developer @oxarbitrage.

On nodes with NU6.3 (Ironwood) active, Zebra also began rejecting mempool transactions with insufficient fees or structurally invalid shielding before executing the costly proof verification. Additionally, it disconnects peers that send transactions with invalid shielded proofs, reducing the attack surface against cybercriminals on the network.

… Continue reading the full article at the original source below.