Zcash Sprout Proof Verification Vulnerability in zcashd

A vulnerability exists in Zcash zcashd versions prior to 6.12.0, allowing certain invalid transactions to be accepted. This issue could have potentially drained user funds from the Sprout pool, as the software sometimes failed to properly verify Sprout proofs. The vulnerability arose because of a flaw in the transaction verification logic, particularly when new blocks were added to the blockchain.

Impact

Exploitation of this vulnerability could have led to the acceptance of invalid transactions, allowing for the unauthorized draining of user funds from the Sprout pool.

Remediation

Users can upgrade to Zcash zcashd version 6.12.0, which includes the necessary fix for the Sprout transaction verification issue. Instructions for downloading this release are available on the Zcash GitHub repository.