Zebra P2SH sigop counter consensus divergence via short-circuit (CVE-2025-52725)

Vulnerability Overview Vulnerability Name: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser Vulnerability ID: GHSA-g9fr-m956-97qx CVE ID: CVE-2025-52725 Severity: Critical Publication Date: May 29, 2025 Reporters: samussetfut, mpguerra Description Zebra's P2SH sigop counter uses a pure Rust code path that short-circuits when encountering disabled opcodes (such as ), returning zero for all subsequent sigop counts. The reference implementation (zcashd) correctly calculates the number of sigops after disabled opcodes during static analysis, leading to a consensus divergence: when the threshold is crossed by a block's width on one side, Zebra accepts the block while zcashd rejects it. Attackers do not need mining capabilities; they only need to broadcast a P2SH output transaction containing a malicious redeem script to trigger this vulnerability. Scope of Impact Affected Software: - (Rust): Affected versions <= 6.0.1, Fixed version 7.0.0 - (Rust): Affected versions <= 4.4.1, Fixed version 4.5.0 Affected Users: - Any user running zealir 4.4 or earlier versions - Users validating blocks on any network where both Zebra and zcashd nodes participate (mainnet, testnet, etc.) Default Configuration: All default configurations are affected, requiring no special feature flags, non-default settings, or special build options. Remediation Patch Version: Zebra 4.4.2 Fix Method: The fix routes the P2SH sigop counter to the same C++ FFI as the legacy sigop counter. Workarounds There are no configuration-level workarounds. All Zebra nodes validating blocks on networks shared with zcashd are affected. It is recommended to upgrade to the patched version as soon as possible. Impact Chain Split: An attacker broadcasts a spending transaction referencing a P2SH output, where the redeem script contains a disabled opcode followed by or opcodes. When Zebra miners (estimated at ~30% of current network hashrate) include these transactions in blocks, Zebra validators accept the blocks, while zcashd validators reject them with . This causes a network split, with each subsequent block extending the Zebra-side tip inheriting the fork. The attacker does not require mining capabilities, RPC access, or any special permissions. The cost is limited only to funds and transaction fees for the spending transaction. References ZIP-244: Transaction Identifier and Signature Validation CWE-682: Incorrect Calculation CWE-697: Incorrect Comparison Zebra at : Affected P2SH sigop counter. Zebra at : consensus check. : short-circuits on disabled opcode error. Code Snippets

Goal Reached Thanks to every supporter — we hit 100%!

Zebra P2SH sigop counter consensus divergence via short-circuit (CVE-2025-52725)

More from this source