Zcash has two full node implementations, Zebra and zcashd. For Zebra-related security information, see the Zebra book. The zcashd implementation is maintained by Zcash Open Development Lab. Each zcashd release contains a doc/security-warnings.md document describing security issues known to affect that release. Both Zebra and zcashd have been subjected to formal third-party security reviews. Audit reviews can be found in the Zcash Foundation and ZODL blogs.
The Zcash ecosystem is maintained by several independent teams. To reach the right maintainer quickly, route your report by the software it affects. For critical vulnerabilities, notify the relevant maintainer on Signal. Treat a vulnerability as critical if it could cause consensus divergence or a chain split, loss or counterfeiting of funds, a persistent node halt, state corruption, or remote compromise of a node. Create a new Signal group for each issue (do not reuse a previous group) that includes the contacts for the affected software:
@pilizcash.01@dairaemma.31 and @nuttycom.01For all other vulnerabilities, use the GitHub “Report a Vulnerability” feature for the affected project:
We no longer consider email a reliable or secure reporting channel. If you cannot use Signal or GitHub, the fallback contact for each project is published in that project’s security policy. See also the Zcash Foundation’s coordinated disclosure process for Zebra: https://github.com/ZcashFoundation/zebra/blob/main/SECURITY.md
The keys below were used by the Electric Coin Company to sign zcashd software in its package repository. zcashd has reached End of Life and core Zcash development has moved to the Zcash Open Development Lab (ZODL). These keys are retained for historical verification only and are no longer used to sign current software.
For signatures on current releases, refer to the signing information published by the maintainer of each project.
Key fingerprint = 3FE6 3B67 F85E A808 DE9B 880E 6DEF 3BAF 2727 66C0
Key fingerprint = AF85 0445 546C 18B7 86F9 2C62 88FB 8B86 D8B5 A68C
Key fingerprint = 01A2 20DF 0EA9 A42C 4EAE 6B1D ED41 7FBE 79C9 9E8C
Key fingerprint = 3D6A 08E9 1262 3E9A 00B2 1BDC 067F 4920 98CF 2762
Key fingerprint = 0395 DE0A 5027 BE0C 1F5A FB03 9568 4257 D8F8 B031
Key fingerprint = 2253 E2A1 EEB4 0E2A 3D22 EB1D 0EC5 1FCD A94F B53E
In order to keep the Zcash userbase up-to-date with all recent and historical security issues, we document all security related events on this page. We also publicly share when a new event has been added to this page.
This list of security-related events is no longer maintained. Please see the Zcash Foundation and ZODL blogs for newer announcements.