The vulnerability spanned releases from July 2020 through the present, with Zcash developers releasing v6.12.0 on Tuesday to contain the fix. Major mining pools moved quickly to patch their systems—Luxor mining pool confirmed deployment on March 25, while F2Pool, ViaBTC, and AntPool all deployed the fix by March 26, according to the same report.
The Zebra full node implementation was not affected by the vulnerability, the report said, and would have triggered a chain fork if exploitation had been attempted, providing an additional layer of network protection.
Sol, who discovered the vulnerability using AI assistance, reported it to Shielded Labs on March 23. The organization coordinated with the Zcash Open Development Lab (ZODL), whose engineer Jack "str4d" Grigg authored the patch.
For his disclosure, Sol will receive a 200 ZEC total bounty—valued above $51,000—with Shielded Labs, ZODL, the Zcash Foundation, and Bootstrap each contributing 50 ZEC.
The Sprout pool was closed to new deposits in November 2020, making it a deprecated but still-active component holding approximately 25,424 ZEC that users have not yet migrated to newer shielded pool versions.
While the vulnerability could have allowed draining these funds, the Zcash Open Development Team (ZODL) said that Zcash's "turnstile" mechanism would have prevented broader supply inflation. The turnstile requires that any coins leaving the Sprout pool must have verifiably entered it, creating a safeguard against the creation of new tokens beyond the network's total circulation of around 16.63 million ZEC.
