Zcash Foundation has published a progress update and security advisory as node operators prepare for the NU7 mainnet upgrade — currently targeted for around Nov. 5. What’s happened - Zebra 7.0.0 was released on Oct. 22; the Foundation’s engineering update (covering Oct. 20–Nov. 2) summarizes remaining NU7 prep and security fixes. - Zebra 7.0.0 includes seven security patches affecting the zebrad node software: five advisories are rated high severity and two medium. The vulnerabilities (summary) - Six issues could allow a peer to stall synchronization, tie up verification resources, or cause honest peers to be banned. The seventh could crash zebrad. - High-severity items include: - Two checkpoint synchronization failures that can stall a syncing node. - Inadequate penalties for invalid transparent scripts. - Expensive signature calculations that can exhaust verification resources. - A transaction check that can occupy verification threads. - Medium-severity items include: - A bug that can stop Zebra when disconnecting a busy peer. - A case where a node could ban an honest peer for relaying a transaction whose lock-time becomes valid at the next block. Key technical details and impact - One checkpoint bug allowed an unauthenticated peer to send a forged block body that left a syncing node unable to progress until restart — the node mistakenly treated missing blocks as already downloaded and stopped requesting valid copies. Impact was limited: no invalid blocks were written to disk, no chain fork occurred, and funds were unaffected. Nodes already synced were not affected. - A related vulnerability could desynchronize the checkpoint verifier after a failed commit; restarting restored progress but later syncs could stall again. - The Foundation says these issues affect node availability and resource use, rather than consensus or funds. Urgent action for operators - Operators must upgrade Zebra before block 3,543,405 to stay on the consensus chain. After NU7 activation, upgraded nodes will disconnect older versions; incompatible nodes may follow a different chain. - The upgrade performs a database migration: stored state moves from format v28 → v29 on first startup. Zebra 6.x cannot read v29; downgrading requires a full resynchronization. Back up your state/v28 directory before upgrading. Operational notes - Monitoring changes: peer metrics no longer include per-address and user-agent labels. Dashboards and alerts that rely on those fields must be updated. - Support window for Zebra 7.0.0 is eight weeks (shorter than the usual 12). - Seeder (Zeeder) v1.8.0 advertises the NU7 protocol version so upgraded nodes continue to accept it after activation. Seeder operators are urged to deploy this release before NU7 goes live. - The team is evaluating optional block pruning to save disk space while keeping full-chain storage as default. Protocol changes in NU7 (ZIP 218) - Target block spacing will drop from 75 seconds to 25 seconds. That reduces confirmation wait times affecting payments, exchange deposits and cross-chain ops. - Daily ZEC issuance stays the same: per-block rewards are adjusted for the faster block cadence. The proposal does not recommend fewer confirmations. - NU7 preserves the four-year halving schedule and the 21 million ZEC supply cap. - NU7 also introduces a fee reserve: 60% of transaction fees are removed from circulation for future rewards, while 40% go to miners. Performance improvements (alpha) - In response to Zcon7 feedback about slow template creation, block acceptance and relay, the Foundation published Zebra Ándale (7.1.0-alpha.0) on Oct. 31. - Ándale replaces polling delays with event-driven responses to verified transactions and mempool changes. Developer-reported benchmarks show a large transaction burst that previously took >8 minutes to reach a mining template now reached it in ~4 seconds. (These are alpha results; real-world behavior may vary.) Bottom line Node operators should prioritize upgrading Zebra (and Zeeder) ahead of block 3,543,405, back up the v28 state directory, update monitoring dashboards, and be aware of the shorter support window. The fixes reduce availability and resource risks ahead of NU7’s faster block cadence and protocol changes that preserve ZEC’s issuance schedule while introducing a fee reserve. Read more AI-generated news on: https://app.chaingpt.org/news