The Zcash Foundation has detailed seven security fixes within the Zebra 7.0.0 release as node operators finalize preparations for the NU7 mainnet upgrade, which is scheduled to activate around Nov. 5 at block 3,543,405. This version specifically addresses seven distinct security issues, and operators are required to upgrade their software before this activation date to stay on the network's consensus chain. Additionally, a separate alpha release has been issued to resolve mining delays that were reported during the Zcon7 conference held in Cancún.
Zcash Foundation engineering updates published on Nov. 3 cover the period from Oct. 20 through Nov. 2 and consolidate the remaining preparations for NU7. The Zebra 7.0.0 software was previously released on Oct. 22, positioning this latest announcement as a progress report ahead of the upcoming activation. Furthermore, Zeeder v1.8.0 now includes support for NU7, with instructions for seeder operators to deploy this update before the mainnet activation occurs.
Critical Fixes Target Synchronization and Node Stability
On November 3, the Zcash Foundation issued an engineering update spanning October 20 to November 2 that outlined seven security corrections. Among these, six vulnerabilities allowed peers to stall synchronization, consume verification resources, or trigger bans against honest nodes, whereas the seventh represented a potential crash risk for zebrad, the software executing Zebra node operations.
According to the foundation's release announcement, five advisories were rated high severity and two as medium. The high-severity category included two checkpoint synchronization failures, insufficient penalties for invalid transparent scripts, expensive signature calculations, and a transaction check capable of occupying verification threads. Additionally, one medium-severity flaw could halt Zebra upon disconnecting an active peer, while the other might lead a node to ban an honest peer relaying a transaction with a lock-time condition valid in the subsequent block.
According to a checkpoint advisory, an unauthenticated peer might deliver a fabricated block body, causing a syncing node to halt until it is restarted because the system mistakenly assumed missing blocks were already present. This restriction applies solely to availability concerns; no invalid block was written to disk, no chain fork happened, and funds remained safe, while nodes that had already synchronized were not impacted.
Another vulnerability risks desynchronizing the checkpoint verifier from stored state following a failed commit. Although restarting reportedly restores progress, an affected node might become stalled again during subsequent synchronization efforts. The foundation requires mainnet operators to upgrade prior to block 3,543,405; once NU7 is active, upgraded nodes will sever connections with peers on older versions, whereas incompatible nodes may continue along a separate chain.
As previously reported by the report, the mainnet upgrade deadline applies specifically to operators who wish to remain on the consensus chain. The installation process involves a database change where Zebra transitions its stored state from format v28 to v29 upon first startup, eliminating the need for a fresh synchronization.
Returning to a legacy version like Zebra 6.x prevents reading the updated format, which mandates a complete resynchronization and leads developers to recommend backing up the state/v28 directory prior to the upgrade. Surveillance tools also demand adjustments since peer metrics have dropped individual address and user-agent labels, forcing modifications to dashboards and alerts; furthermore, Zebra 7.0.0 offers an eight-week support window rather than the standard twelve weeks.
Under ZIP 218, the NU7 upgrade reduces the target block spacing from 75 seconds to 25 seconds, a change affecting payments, exchange deposits, and cross-chain operations. Although the faster schedule alters the reward per block, the scheduled ZEC issuance per day remains unchanged, and the proposal explicitly does not recommend that clients reduce their confirmation counts.
While maintaining the established four-year halving timeline and the 21 million ZEC supply limit, the foundation's announcement details a new fee reserve mechanism in which miners keep 40% of transaction fees while 60% are withdrawn from circulation to fund future rewards. Addressing grievances raised at Zcon7 concerning sluggish template generation, block acceptance delays, and relay issues, the team issued Zebra Ándale version 7.1.0-alpha.0 on Oct. 31.
Protocol Changes Reduce Block Time and Adjust Fee Distribution
Developer-reported benchmarks from the alpha release show that swapping polling delays for responses to verified transactions and mempool changes cut the time needed for a large transaction burst to reach a mining template from over eight minutes down to roughly four seconds.
To ensure upgraded nodes keep accepting the NU7 protocol version, Zeeder v1.8.0 now advertises it, with instructions for seeder operators to deploy this release prior to activation; meanwhile, the team examines optional block pruning as a way to reduce disk usage while maintaining full-chain storage as the standard setting.