Zcash fixes critical vulnerability: This vulnerability threatened the security of over 25,000 ZEC tokens, worth approximately $6.5 million.

Privacy coin Zcash recently disclosed and patched a critical security vulnerability that could have been exploited by malicious miners to transfer over 25,000 ZEC (approximately $6.5 million) from the deprecated Sprout privacy pool. Security researcher Alex “Scalar” Sol disclosed the vulnerability on March 23rd, stating that the zcashd node skipped proof verification when processing transactions involving the Sprout pool. The official statement indicated that the vulnerability had persisted since July 2020 but had not been exploited, and user funds remained safe. The development team released version 6.12.0 to fix the vulnerability, and major mining pools upgraded and deployed the fix within days. Furthermore, unaffected Zebra full nodes have the ability to trigger chain forks, providing additional protection should the vulnerability be exploited. It was disclosed that although the Sprout pool closed new deposits in November 2020, approximately 25,424 ZEC remained unmigrated. Even if the vulnerability is exploited, Zcash's "turnstile" mechanism prevents inflationary increases, ensuring the total supply is not exceeded. This vulnerability was discovered with AI assistance, and the researcher will receive a bounty of 200 ZEC (approximately $51,000). It's worth noting that this is not the first time Zcash has encountered a major vulnerability; back in 2019, it fixed a serious flaw that could have led to unlimited issuance. (Decrypt)