Critical Vulnerability in halo2_gadgets Affects Zebrad
An early warning has been issued regarding a critical vulnerability in the halo2_gadgets library, which could potentially allow double-spending and fund theft in the Zebrad ecosystem. Users of affected components should monitor for updates from maintainers.
What happened
A soundness vulnerability has been reported in the variable-base scalar multiplication gadget of the halo2_gadgets library. This vulnerability, tracked as GHSA-WW9Q-8R59-XV46, appears to allow a malicious prover to generate a valid proof for an Orchard Action with an under-constrained base point. This could potentially enable double-spending within the Orchard pool or the forging of spend authorizations to steal funds.
The vulnerability affects several components within the Zebrad ecosystem, including zebrad (cargo) versions up to and including v4.4.1, halo2_gadgets (cargo) versions prior to 0.5.0, orchard (cargo) versions prior to 0.14.0, and zcash_primitives (cargo) versions prior to 0.28.0. The issue is under investigation, and no definitive compromise has been confirmed.
Professional software engineers using these components are advised to monitor for updates from the maintainers of zebrad, halo2_gadgets, orchard, and zcash_primitives. For the latest information and patches, consult the primary sources linked in the threat data.
How 0Day mitigates this
zebrad is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.