Zcash NU7 upgrade: Zebra 7.0.0 fixes seven security flaws - CryptoTicker.io

Zcash (ZEC) is trading at $1,230.91, up 8.6 percent in 24 hours, as the community prepares for the NU7 network upgrade. The price surge is the strongest among the 25 largest cryptocurrencies, though the asset remains down 6.0 percent over the past week.

The upgrade, scheduled to activate at block height 3,543,405, will be the most significant change to the Zcash protocol since its launch. The Zcash Foundation has released Zebra 7.0.0, the first stable node software to support NU7, closing seven security vulnerabilities in the process.

The foundation explicitly states that all mainnet node operators must upgrade to Zebra 7.0.0 before the activation block. Failure to do so will result in nodes disconnecting from the consensus blockchain and following a different chain.

The upgrade will reduce the block interval from 75 to 25 seconds under ZIP 218, increasing transaction throughput. Daily issuance of new ZEC will remain unchanged, as the block reward is simply divided by three.

A new Network Sustainability Mechanism will also take effect, taking 60 percent of transaction fees out of circulation and placing them in a reserve. Miners will retain 40 percent of the fees, with payouts from the reserve scheduled to begin only at block height 8,939,664.

Seven security vulnerabilities

Zebra 7.0.0 addresses seven security advisories, with five rated as high severity and two as medium. The flaws targeted node availability rather than direct access to users' coins, allowing a hostile participant to crash a node, slow it down, or cut it off from honest peers.

The vulnerabilities included the ability to forge checkpoint blocks, process invalid scripts without penalty, and exploit the quadratic cost of signature hashes. A crafted transaction could also tie up a node's CPU for minutes or cause it to crash during disconnection.

The foundation notes that none of the flaws allowed access to other people's coins. The issues were instead focused on the stability and performance of the network's infrastructure.

Node operators and wallet updates

For retail investors, the most critical action is updating their wallet apps. The Zodl wallet, formerly known as Zashi, requires users to update to version 3.19.0 before November 5 to continue using the app after the upgrade.

The upgrade will render transactions in the old version 4 format invalid, primarily affecting the oldest shielded pool, Sprout. Users with balances in Sprout will no longer be able to move them after activation, rendering those balances unspendable.

The foundation advises users with old desktop wallets to transfer their Sprout balances to a newer pool or a current wallet before the deadline. Modern wallets such as Zodl do not use the Sprout pool, so this primarily affects long-term holders who have not interacted with their wallets in years.

Users should only download updates from official app stores or the manufacturer's website. Links in direct messages or supposed support emails are known attack vectors during network upgrades.

Timeline for activation

Activation is tied to a block height rather than a fixed clock time. As of November 4, the blockchain stood at block 3,540,980, leaving 2,425 blocks until activation.

With an average block time of 75.5 seconds, NU7 is expected to activate in approximately 50.8 hours, around 3:40 a.m. German time on November 6. The timing could shift by a few minutes to a few hours depending on miner hash rate fluctuations.

The Zcash Foundation has named block height 3,543,405 as the target, though the official upgrade page at z.cash still lists the height as unset. The foundation will only support Zebra 7.0.0 for eight weeks instead of the usual twelve, following the upgrade with the next mandatory update.