Zcash Bug Could Leak Full Nodes with Shielded IP Addresses

A bug present in all Zcash (ZEC) source code forks could leak metadata—making it possible for IP address of the full nodes’ with shielded addresses (zaddr) to be found.

Duke Leto, a core developer at Komodo (KMD), recently published a blog on his personal website revealing that, “A bug has existed for all shielded addresses since the inception of Zcash and Zcash Protocol.” Leto explained, “That is, Alice giving Bob a zaddr to be paid, could actually allow Bob to discover Alice’s IP address. This is drastically against the design of Zcash Protocol.”

A Common Vulnerabilities and Exposures (CVE) code has already been assigned to track the issue on Sept. 27.

According to Leto, everyone who has published or provided their zaddr to a third party is vulnerable—with the exception of users who have only used their zaddr over the Tor Onion Routing network or just to send funds. Leto warns that users should consider their “IP address and geo-location information associated with it as tied to their zaddr.”

Not just Zcash

Leto provided a non-exhaustive list, claiming that Zcash is not the only cryptocurrency affected by the bug. The cryptocurrencies included in the list are— Zcash, Hush, Pirate, Komodo smart chains with zaddr enabled by default, Safecoin, Horizen, Zero, VoteCoin, Snowgem, BitcoinZ, LitecoinZ, Zelcash, Ycash, Arrow, Verus, Bitcoin Private, ZClassic and Anon.

Leto added a historical note, “ KMD was vulnerable to this <bug> in the past, but is no longer, since it no longer supports zaddrs. Safecoin (SAFE) took a similar route, and has disabled zaddrs, so they were vulnerable in the past but no longer.

Image via Shutterstock