# Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling

Zebra's FFI refactor dropped the C++ sighash hash-type validation for V4/V5 transparent transactions, letting Zebra accept blocks zcashd rejects and split consensus.

- Payout: Research
- Severity: critical
- Program: Zebra
- Found by: sangsoo-osec
- Disclosed: 2026-04-18
- CVE: CVE-2026-41583
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-8m29-fpq5-89jj
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-8m29-fpq5-89jj
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:research platform:ghsa sev:critical tech:rust technique:regression technique:source-review vuln:business-logic vuln:crypto

**Target:** Zcash full node transparent transaction script verification (FFI boundary)
**Root cause:** Refactoring moved transaction parsing to Rust but left the consensus rule restricting sighash hash types in the C++ verifier, so the Rust caller never enforced it; V4 sighash also used the canonicalized hash type instead of the raw value.
**Steps:**
1. Identify that transparent script verification is called from Rust into C++ via FFI with a callback.
2. Note the C++ side no longer parses the whole transaction, so hash-type validation must be done by the Rust caller.
3. Craft a V5 transaction with an invalid sighash hash type; Zebra accepts it while zcashd rejects it.
4. Craft a V4 transaction relying on raw vs canonical hash type; Zebra computes a different sighash than zcashd.
5. Submit the transaction and mine/relay a block that Zebra accepts but zcashd considers invalid.
**How found:** Reviewer noticed the FFI refactor moved parsing out of C++ and reasoned that consensus checks previously enforced inside the C++ verifier now had to be re-implemented by the Rust caller; auditing the caller revealed the hash-type rule was missing.
**Exploitation:** Attacker submits a V4 or V5 transaction with an invalid hash type; Zebra nodes accept and may mine a block zcashd rejects, partitioning the network and enabling potential double-spends against affected nodes.
**Escalation:** Consensus split between Zebra and zcashd nodes enables network partitioning and double-spend attempts; impact currently limited because most miners run zcashd.
**Insight:** When consensus-critical validation is refactored across an FFI boundary, enumerate every check the old monolithic code performed and verify each is re-enforced on the new caller side; also check raw-vs-canonical value handling in sighash computation.