Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability
Published Mar 27, 2019
7.5
HIGHCVSS 3.0
EPSS 2.18%
Description
Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.
Affected products
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
AV:N/AC:L/Au:N/C:N/I:P/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 2.18% (0.02183) | 81.74th | v5 (v2026.06.15) |
| Sep 8, 2026 | 2.18% (0.02183) | 81.22th | v5 (v2026.06.15) |
| Jul 20, 2024 | 0.23% (0.00231) | 61.68th | v3 (v2023.03.01) |
| Mar 20, 2024 | 0.23% (0.00231) | 60.51th | v3 (v2023.03.01) |
| May 8, 2023 | 0.17% (0.00169) | 52.38th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.13% (0.00131) | 46.29th | v3 (v2023.03.01) |
| Mar 6, 2023 | 0.95% (0.00954) | 36.37th | v2 (v2022.01.01) |
| Sep 2, 2022 | 0.95% (0.00954) | 34.50th | v2 (v2022.01.01) |
| Apr 1, 2022 | 0.95% (0.00954) | 32.50th | v2 (v2022.01.01) |
| Feb 4, 2022 | 5.74% (0.05736) | 77.22th | v2 (v2022.01.01) |
| Feb 3, 2022 | 3.63% (0.03630) | 71.73th | v1 |
| Jan 6, 2022 | 3.63% (0.03630) | 71.48th | v1 |
| Sep 1, 2021 | 0.83% (0.00833) | 57.50th | v1 |
| Apr 14, 2021 | 0.83% (0.00833) | 0.00th | v1 |
References (3)
- http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/ x_refsource_MISCPress/Media CoverageThird Party Advisory
- https://github.com/JinBean/CVE-Extension x_refsource_MISC
- https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/ x_refsource_MISCVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/ | x_refsource_MISCPress/Media CoverageThird Party Advisory | |
| https://github.com/JinBean/CVE-Extension | x_refsource_MISC | |
| https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/ | x_refsource_MISCVendor Advisory |
Change history (0)
No recorded changes yet.