Zebrad: Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness (CVE-2026-54496)
A soundness vulnerability in the variable-base scalar multiplication gadget of halo2_gadgets in the Zebrad product allowed a malicious prover to bypass the diversified-address-integrity check in Orchard Actions. This flaw enabled an adversary to produce valid proofs with an under-constrained base point, effectively allowing double-spends within the Orchard pool or theft of funds by forging spend authorizations. Exploitation is undetectable on-chain and could result in balance violations within the Orchard pool without inflating the overall ZEC supply. The vulnerability existed since the Orchard pool introduction in May 2022 and has been remediated. No evidence of exploitation prior to the fix is known.
AI Analysis
Technical Summary
The vulnerability arises from a missing copy constraint in the double-and-add implementation of variable-base scalar multiplication in halo2_gadgets (specifically in incomplete.rs). The base point is assigned as a private circuit input without a constraint tying it to the actual base, allowing a malicious prover to choose an arbitrary base for the incomplete-addition loop. This breaks the soundness of the Orchard Action's diversified-address-integrity condition, which normally binds the action to the correct incoming viewing key and nullifier. Consequently, an attacker can produce valid proofs for actions with incorrect nullifiers, enabling double-spends or theft of funds by forging spend authorizations if the note plaintext is known. The flaw affects versions of Zebrad prior to 5.0.0, 0.5.0, 0.14.0, and 0.28.0. The vulnerability is critical due to its impact on transaction integrity and undetectability on-chain.
Potential Impact
An attacker can bypass the diversified-address-integrity check in Orchard Actions, enabling double-spends within the Orchard pool by producing multiple valid nullifiers for the same note. This results in balance violations within the pool but does not inflate the total ZEC supply due to the turnstile mechanism. Alternatively, an attacker who knows the note plaintext can forge spend authorizations to steal funds, potentially bypassing hardware wallet protections if the software wallet is compromised. Exploitation is undetectable on-chain for double-spends, and theft detection relies on the legitimate holder's inability to spend stolen funds or observing the nullifier on-chain. The vulnerability existed since May 31, 2022, with no known exploitation before remediation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor vendor communications for updates. Until a fix is confirmed, avoid using affected versions and consider upgrading to versions where this vulnerability is addressed. No specific temporary mitigations are indicated in the provided data.
Zebrad: Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness (CVE-2026-54496)
Description
A soundness vulnerability in the variable-base scalar multiplication gadget of halo2_gadgets in the Zebrad product allowed a malicious prover to bypass the diversified-address-integrity check in Orchard Actions. This flaw enabled an adversary to produce valid proofs with an under-constrained base point, effectively allowing double-spends within the Orchard pool or theft of funds by forging spend authorizations. Exploitation is undetectable on-chain and could result in balance violations within the Orchard pool without inflating the overall ZEC supply. The vulnerability existed since the Orchard pool introduction in May 2022 and has been remediated. No evidence of exploitation prior to the fix is known.
CVSS v3.1
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from a missing copy constraint in the double-and-add implementation of variable-base scalar multiplication in halo2_gadgets (specifically in incomplete.rs). The base point is assigned as a private circuit input without a constraint tying it to the actual base, allowing a malicious prover to choose an arbitrary base for the incomplete-addition loop. This breaks the soundness of the Orchard Action's diversified-address-integrity condition, which normally binds the action to the correct incoming viewing key and nullifier. Consequently, an attacker can produce valid proofs for actions with incorrect nullifiers, enabling double-spends or theft of funds by forging spend authorizations if the note plaintext is known. The flaw affects versions of Zebrad prior to 5.0.0, 0.5.0, 0.14.0, and 0.28.0. The vulnerability is critical due to its impact on transaction integrity and undetectability on-chain.
Potential Impact
An attacker can bypass the diversified-address-integrity check in Orchard Actions, enabling double-spends within the Orchard pool by producing multiple valid nullifiers for the same note. This results in balance violations within the pool but does not inflate the total ZEC supply due to the turnstile mechanism. Alternatively, an attacker who knows the note plaintext can forge spend authorizations to steal funds, potentially bypassing hardware wallet protections if the software wallet is compromised. Exploitation is undetectable on-chain for double-spends, and theft detection relies on the legitimate holder's inability to spend stolen funds or observing the nullifier on-chain. The vulnerability existed since May 31, 2022, with no known exploitation before remediation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor vendor communications for updates. Until a fix is confirmed, avoid using affected versions and consider upgrading to versions where this vulnerability is addressed. No specific temporary mitigations are indicated in the provided data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ww9q-8r59-xv46
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54496"]
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a4c33ff27e9c797195f5c81
Added to database: 07/06/2026, 23:02:23 UTC
Last enriched: 07/18/2026, 11:19:51 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.