CVE-2026-54496

Name of the Vulnerable Software and Affected Versions zebrad versions prior to 5.0.0 halo2 gadgets versions prior to 0.5.0 orchard versions prior to 0.14.0 zcash primitives versions prior to 0.28.0 zcashd versions prior to 6.20.0

Description A soundness issue in the variable-base scalar multiplication gadget of halo2 gadgets allows a malicious prover to produce valid proofs for Orchard Actions using an under-constrained base point. The flaw exists in the double-and-add implementation within halo2 gadgets/src/ecc/chip/mul/incomplete.rs, where the base point is assigned via assign advice() without a copy constraint tying it to the actual base. This allows an attacker to bypass the diversified-address-integrity check that binds the spending validating key ak, the nullifier nf, and other parameters to the note being spent.

This could lead to two primary impacts: double-spending within the Orchard pool by generating multiple valid nullifiers for the same note, or the theft of funds by forging spend authorizations for existing notes if the note plaintext is known. While the Zcash turnstile mechanism prevents unbounded inflation of the total ZEC supply, value inflation within the Orchard pool is possible. Exploitation is undetectable on-chain due to the zero-knowledge properties of the system.

Recommendations Update zebrad to version 5.0.0. Update halo2 gadgets to version 0.5.0. Update orchard to version 0.14.0. Update zcash primitives to version 0.28.0. Update zcashd to version 6.20.0. As a temporary mitigation, restrict the use of the assign advice() function in cases where a witnessed value must equal a fixed value, and use copy advice() instead.