The vulnerability stems from a missing copy constraint in the double-and-add implementation of variable-base scalar multiplication in halo2_gadgets (file incomplete.rs). The base point is assigned as a private circuit input without a constraint tying it to the actual base used in the algorithm, allowing a malicious prover to choose an arbitrary base. This breaks the soundness of the Orchard Action circuit by bypassing the check that binds an Action to the correct incoming viewing key, nullifier, and spend validating key. Consequently, an adversary can produce valid proofs for double-spending notes within the Orchard pool or forge spend authorizations if they know the note plaintext. The flaw existed since the NU5 network upgrade activation on May 31, 2022, and exploitation is undetectable on-chain due to zero-knowledge properties.

An attacker can perform double-spends within the Orchard pool, causing balance violations by spending the same note multiple times with distinct valid nullifiers. Although the overall ZEC supply is protected by the turnstile mechanism, inflation within the Orchard pool is possible up to the enforced limit. Additionally, an attacker with knowledge of a note's plaintext could forge spend authorizations to steal funds, potentially bypassing hardware wallet protections if the linked software wallet is compromised. Exploitation is undetectable on-chain, and double-spends produce nullifiers indistinguishable from legitimate ones. Theft can be detected by the legitimate holder's inability to spend stolen funds or by observing the nullifier on-chain, but this may not distinguish from other compromises.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, users should be aware of the risk of undetectable double-spends and forged spend authorizations within the Orchard pool. No generic mitigations are recommended beyond following vendor guidance once available.