I usualy update zebra with cargo
cargo install --locked zebrad
But it’s giving me version 4.5.1
$ zebrad --version
zebrad 4.5.1
How do I upgrade to v4.5.3?
1 Like
…or the result of vibe coding. These AI developments are a double-edged sword.
2 Likes
Thanks for everyone’s hard work on this.
On twitter I see multiple ZODL members saying “There’s no exploit” and “No evidence of any exploit”.
Quick clarification: How is the word “exploit” defined/used?
Is something only considered an exploit if there’s evidence it was used?
For example if there was an inflation bug that theoretically could have been used but nobody is aware of someone taking advantage of said inflation bug, would that bug be considered an exploit or no?
I’m not sure what the standard definition threshold is when a bug is deemed an exploit or not.
Try `cargo install --git https://github.com/ZcashFoundation/zebra.git --tag v4.5.3`, adjust if necessary
It will eventually merge into main and you command will work again
2 Likes
For example the ability to take nodes offline, would be an attack but not an exploit since it can’t change the attacker’s balance.
Notes for Zodl users:
1 Like
A vulnerability is a software flaw that could be targeted by an attacker, whereas an exploit is the actual program or code that makes use of one or more vulnerabilities to force the system to behave differently than intended.
For example, if an attacker wants to secretly turn a smartphone into a listening device, they might first need to achieve remote code execution in an installed app. Then, they would need privilege escalation, because a standard app doesn’t have hidden access to the microphone. Finally, they would need to gain persistence to ensure the malware survives a reboot without being blocked by the hardware’s root of trust. The “exploit” is the actual code written to execute this chain.
An exploit can be a harmless proof-of-concept created by a researcher (in the case of an inflation bug, this would probably be tested on a private testnet) or an “in-the-wild” exploit used maliciously by attackers. In-the-wild exploits can sometimes be difficult to detect, though known malware might be caught by a virus scan.
When this current issue is fully patched, we will likely see a full post-mortem. Then we can see what technical evidence exists to show that no exploitation of an inflation bug occurred. This has happened before in Zcash’s history.
6 Likes
Appreciate the reply. So technically the previous sprout inflation bug would have been considered an exploit or no?
Definitely agree that regardless it’s the post mortem that really will clarify things.
1 Like
I don’t think there is any evidence that the inflation bug in the Sprout pool was ever exploited. In fact, the reality that all these years later there are still some funds left in the pool is decent evidence to the contrary. That said, it would be nicer if there were stronger technical evidence and we didn’t have to rely solely on analyzing the incentives of a hypothetical attacker. I’m talking here about the issue discovered by @arielgabizon in 2018. My understanding is that the evidence that the bug discovered by @scalar this year was not exploited is significantly stronger. But I’m a bit out of my depth here.
1 Like
I am trying to upgrade the Nix flake for Zebra and v4.5.3 is not available in crates.io
Correct. The original Sprout vuln (CVE-2017-7167) was a soundness failure in the cryptographic verification algorithm (zero-knowledge proof) itself, so there is no way to determine using just cryptography whether a transaction under that old verification algorithm counterfeited ZEC or not.
Like you said up-thread, we have strong on-chain evidence based not on cryptography but on game theory that it wasn’t exploited: nobody has ever tried to move more coins out of the Sprout pool than should be in there. (And if they did, the turnstile would limit it to exactly the amount of coins in the Sprout pool, so it would not inflate the overall ZEC supply.)
In contrast, in the recent Sprout vuln that was discovered and responsibly reported by Scalar, the failure was outside of the cryptographic verification but in the blockchain-layer transaction validation, so you can inspect all the transactions in the blockchain and confirm that none of them exploited that vuln. (And current zcashd and zebra do this for you.)
12 Likes
Yeah, that was my understanding about Sprout. I was more just getting at what is the implication when someone in a realtime unfolding event like today communicates “There is no exploit” - if you can draw a realtime conclusion from that, like that it’s not a new similar soundness bug in Orchard where it’s based on game theory over time and lack of evidence to the contrary…or if that phrase specifically means we can already in realtime directly verify for a certainty it wasn’t exploited like in your latter example by inspecting all the transactions to confirm it wasn’t.
1 Like
hmm interesting
1 Like
Are we done with this?
Good news… Waiting for the new Zebra release.
5 Likes
Okay, problem solved. In the age of AI, it’s not a question of if AI will find a flaw in your favorite cryptocurrency, but when.
I wonder if this will lead to a slight delay in the implementation of Taychon, allowing for a more in-depth audit and minimizing risks as much as possible.
Reposted some moments ago…
1 Like
Great to see! In particular, their work on formal verification is how we might break out of the AI arms race between attackers and defenders.
2 Likes
I upgraded Cipherscan to zebra 5.0, it’s resyncing from scratch, Cipherscan will be out for the day imo.
Congrats to all for the reactivity! 
3 Likes