Weeks before Zcash disclosed a flaw that could have let someone create unlimited counterfeit coins without detection, the network had patched a different group of bugs that their discoverer says could have been used to do something similar.
Alex "Scalar" Sol, a security researcher who reported flaws in two types of Zcash node software, described the proposed attack in an Aug. 14 retroactive grant application.
He is seeking another $400,000 for findings that have already earned him 600 ZEC, worth almost $188,000 when paid.
- The bugs were disclosed and fixed in March and April.
- They were previously explained separately, but Sol's application says an attacker could have combined them to create and sell unlimited counterfeit ZEC for a short time.
Four bugs could have defeated each other's safeguards
The first bug affected Zcashd, a software that checked and recorded Zcash transactions. It caused the software to skip an important check on transactions using Sprout, Zcash's oldest private-transaction system.
It could have allowed a malicious miner to place fake Sprout transactions inside a block.
Two safeguards limited the danger. Zcash had a built-in accounting system that capped how many coins could leave Sprout, while Zebra, another program checking the network's transactions, would have rejected the fake coins and exposed the attack.
- One allowed an attacker to resend identifying data from an old block and make Zcashd stop tracking how many coins were moving between Zcash's different transaction systems. That would effectively switch off the withdrawal cap.
- Another bug could crash nodes when they received a specially created transaction.
- A separate flaw could make Zcashd and Zebra disagree about whether a transaction was valid, splitting the network between two versions of its history.
Sol said an attacker could have combined the bugs to divide the network, knock Zebra nodes offline, disable zcashd's accounting checks and then create counterfeit coins through the Sprout flaw.
He called the result a "temporary detectable unlimited mint-and-sell" attack. Sol estimated that an attacker might have had several hours to create, withdraw and sell counterfeit ZEC before developers and network operators intervened.
- Zcash Open Development Lab confirmed the individual bugs.
- It also said the accounting flaw could become dangerous when combined with a separate counterfeiting vulnerability.
Its public disclosures don't establish, though, that Sol's complete four-step attack was built and tested. The description of the combined attack comes only from Sol's grant application.
Zebra and newly updated Zcashd nodes would have rejected the fake transaction history, producing a network split that operators could identify and reverse.
The Sprout flaw was fixed on March 31. The remaining bugs were fixed on April 17.
This was different from the Orchard bug
Sol's proposed attack came before the better-known Orchard vulnerability discovered by security engineer Taylor Hornby on May 29.
- The Orchard flaw didn't require attackers to combine several bugs or take Zebra nodes offline.
- It directly affected the system used to prove that private Orchard transactions were legitimate.
Hornby built a working version of the exploit in a local test environment and used it to generate unlimited counterfeit ZEC. Shielded Labs said the same tool could have created unlimited counterfeit coins on the live network.
The two threats were therefore separate. Sol described a complicated attack that would have been temporary and visible, while the Orchard vulnerability could have created counterfeit coins without detection through a single underlying flaw.
Sol seeks $400,000 after almost $188,000 in payments
Sol has already received 600 ZEC from Zcash Community Grants, Shielded Labs, Zcash Open Development Lab, the Zcash Foundation and Bootstrap.
The payments were worth $187,801 when received, according to his application. Another $400,000 would bring his total compensation to almost $588,000 when the earlier payments are counted at their original dollar values.
The application remains under review, and the additional payment hasn't been approved.
The range is his own estimate, no losses occurred, and the application does not provide an independent calculation supporting it.
He also reported spending roughly $30,000 on OpenAI and Anthropic services while examining several privacy-focused cryptocurrencies. That amount covered his wider research and was not spent on Zcash alone.
- Jason McGee, a Shielded Labs board member, supported the application and said in a forum post that Sol "set off the wave of security disclosures" experienced by Zcash this year.
- McGee added that Sol's findings persuaded Shielded Labs to hire Hornby, whose later review uncovered the separate Orchard vulnerability.
Zcash Community Grants set aside $1 million for security rewards in April and doubled Sol's previous awards to 600 ZEC. McGee said the program was later overwhelmed by AI-generated reports and closed, leaving the retroactive grants program as Sol's route to seek more money.
Sol's wider search also reached Grin and Litecoin
Sol said he began examining privacy-focused cryptocurrencies at the end of February. The work also produced findings involving Grin, Litecoin and several projects he didn't name.
- Grin developers later disclosed that three bugs could have been combined to create new coins improperly. A miner could place malformed data in one block and later use it with a real coin to produce a larger amount that could be spent normally.
- A review of Grin's history found no evidence that anyone had used the attack. Grin++, a separate software that also checks the network, would have rejected the invalid block.
- The vulnerability was fixed in Grin 5.4.0, and the Grin Council approved a $70,000 payment to Sol for reporting it privately.
Sol also said he independently found a problem in Litecoin's private MWEB transaction system several hours after Litecoin developers found it. His application doesn't include enough information to determine exactly which Litecoin flaw he found.
- Litecoin's April report said developers discovered a serious MWEB bug on March 19 after someone had already used it to create an inflated withdrawal of 85,034 LTC.
- The attacker later returned the funds, except for an agreed 850 LTC reward.
- A second attempt in April disrupted Litecoin miners and produced a false version of the network's history lasting 13 blocks before it was removed.
- Some outside services suffered losses after processing transactions from those invalid blocks.