The vulnerability occurs in zebrad versions up to v4.4.1 where the pop_tip method, used to revert the tip block during chain forks, fails to remove stale Sapling and Orchard note commitment subtree root data from the in-memory non-finalized state. When the chain finalizes, this stale data is persisted to RocksDB, causing on-disk corruption of subtree root history. This affects the z_getsubtreesbyindex RPC used by lightwalletd for wallet synchronization, potentially leading to incorrect wallet states. The pop_root method correctly cleans up subtree roots, but pop_tip does not, causing an asymmetry in state cleanup. Other state elements like nullifiers and UTXOs are unaffected. The issue is fixed by adding subtree root cleanup to pop_tip in zebra-state 7.0.0 and zebrad 4.5.0.

The corruption of Sapling and Orchard subtree root history persists on disk and survives node restarts. Downstream consumers relying on z_getsubtreesbyindex, such as lightwalletd and light wallets, may receive incorrect subtree roots, causing wallet synchronization failures or incorrect wallet states. This does not directly impact consensus validation or block acceptance but affects wallet functionality. Recovery requires rebuilding the state database from scratch.

A fix is available in zebra-state 7.0.0 and zebrad 4.5.0 that addresses the subtree root cleanup in pop_tip. Operators should upgrade to these versions to resolve the issue. There is no configuration-level workaround. Operators can mitigate downstream impact by periodically verifying subtree root consistency using z_getsubtreesbyindex against a known-good reference. Recovery from corruption requires rebuilding the state database.