Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness. A soundness vulnerability in the variable-base scalar multiplication gadget of halo2gadgets allowed a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point.
Vuln-watch · relayed from the GitHub Advisory Database; see Source & attribution below
Summary
A soundness vulnerability in the variable-base scalar multiplication gadget of halo2gadgets allowed a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point.
Affected
- zebrad (rust) <= 4.5.1 — fixed in 5.0.0
- halo2_gadgets (rust) < 0.5.0 — fixed in 0.5.0
- orchard (rust) < 0.14.0 — fixed in 0.14.0
- zcash_primitives (rust) < 0.28.0 — fixed in 0.28.0
Severity
Critical, as rated by the upstream advisory.
Recommended actions
- Upgrade zebrad to 5.0.0 or later
- Upgrade halo2_gadgets to 0.5.0 or later
- Upgrade orchard to 0.14.0 or later
- Upgrade zcash_primitives to 0.28.0 or later
Source & attribution
This 0xCERT advisory summarises GHSA-ww9q-8r59-xv46 / CVE-2026-54496 from the GitHub Advisory Database, credited upstream to defuse, nuttycom, daira, conradoplg, mpguerra: https://github.com/advisories/GHSA-ww9q-8r59-xv46. Details may change; refer to the original source for the authoritative record.
References
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-07-06 · last updated 2026-10-08
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0212/signed.txt | gpg --verify