Zebra 6.2.1: Security Hardening and a Testnet Template Fix
We are pleased to announce the release of Zebra 6.2.1. This patch release adds two security hardening improvements to chain synchronization and mempool verification, and fixes a Testnet-only block-template timing issue. All node operators are encouraged to upgrade.
Security Advisories
GHSA-x93j-mj2f-q338: Poisoned Blocks Can Delay Download of Valid Blocks (Moderate)
Chain synchronization can now immediately retry an honest block body after rejecting a body that shares its header hash, instead of waiting for a later child block to trigger cleanup. This shortens the window in which a peer delivering a poisoned same-hash block body can delay the download of the valid block. It builds on the stale-rejection fix in GHSA-8gxx-hc65-vv82. (#11052)
Thanks to @oxarbitrage for identifying this issue.
Other Security Improvements
On nodes with NU6.3 (Ironwood) active, Zebra now rejects underpaying and structurally invalid shielded mempool transactions before running their expensive proof verification, and disconnects peers that send transactions with invalid shielded proofs. (#11053, #11054)
Changed
Testnet getblocktemplate Timestamp Handling
On Testnet, the getblocktemplate RPC no longer switches to a minimum-difficulty block template early. Zebra previously treated a template as minimum-difficulty as soon as its cur_time came within a fixed 150 seconds of the consensus minimum-difficulty threshold, clamping cur_time up to just past the threshold, which future-dated the block’s timestamp and produced spurious minimum-difficulty blocks that depress Testnet difficulty far below its equilibrium. Templates now switch to minimum difficulty only once cur_time reaches the consensus threshold itself. This is a Testnet-only, template-construction change: it does not alter block validity, and it does not change the difficulty-averaging rule that amplifies each minimum-difficulty block into a large difficulty drop (tracked in zcash/zips#1321). (#10873)
Upgrading
You can find the release on GitHub, crates.io, and Docker Hub. We encourage all node operators to upgrade to pick up these fixes.
Thank You to Our Contributors
This release was made possible by the work of @conradoplg, @daira, @jvff, and @upbqdn. Thank you for your continued contributions to Zebra.
Zebra is the Zcash Foundation’s independent, Rust-based implementation of the Zcash protocol. Learn more at github.com/ZcashFoundation/zebra.