🚨Critical - Zebra (Zcash) Consensus Divergence via P2SH Sigop Undercount (CVE-2026-52735) Zebra's P2SH sigop counter uses a pure-Rust path (zcash_script) whose parser treats disabled opcodes like OP_CODESEPARATOR as an error and short-circuits via try_fold, returning zero for any sigops after the disabled opcode. zcashd counts through disabled opcodes in static analysis, so the two implementations disagree on the block-wide MAX_BLOCK_SIGOPS = 20,000 limit. An attacker with no mining power or privileges - just transaction fees - can broadcast transactions spending P2SH outputs with malicious redeem scripts. When a Zebra miner includes them in a block, Zebra validators accept it while zcashd rejects it with bad-blk-sigops, splitting the network into diverging chains with no config-level workaround. 👉Upgrade zebrad to the patched release (4.5.0 / zebra-script 7.0.0).
Post summary
The post highlights a critical consensus divergence flaw in Zcash’s P2SH sigop counter and advises users to upgrade to the patched zebrad release.