Suspicious spike in Zcash transactions

68k transactions within the past 24 hours. Is there something nefarious afoot?

Seeing errors like this on my node:

zebrad::components::mempool::gossip: dropped transactions before gossiping due to heavy mempool or network load skip_count=9

Since Zcash’s price started surging, I’ve been concerned that someone from the Monero community might try to undermine or sabotage it in some fashion. Is this a valid worry, or am I overthinking things?

Check out https://zcashmetro.io/ Suffice to say, the platform is full.

8 Likes

We’re seeing the same on our infra (zcashd).

How many times did that log show up for you? It looks like while there are a high number of transactions the block size itself is becoming more congested but not full except for the one around 09:30.

Block verification roughly correlates spiking up around 1.4s max, still not bad. We’re keeping an eye on it.

5 Likes

Interesting! My nodes seem to be running normally. Also every one of those high fan-out tx is paying a fee - and with high ZEC prices it ends up being tens of cents per tx, so probably - even if inorganic - it won’t be sustained.

7 Likes

Yup, it’s already calmed down from our point of view.

Looking at a block explorer for just a moment it looks like there were a lot of 0 ZEC t → t transactions, but I didn’t do a thorough dive.

2 Likes

I’ve got over 1,200 log entries for dropped transactions before gossiping due to heavy mempool or network with skip counts ranging from 1 to 400 from today alone. Prior to today, there’s been isolated incidents but nothing like now.

Here’s the first occurrence from today:
2025-11-13T02:30:39.684809Z INFO {zebrad=“VERGEN_IDEMPOTENT_OUTPUT” net=“Main”}: zebrad::components::mempool::gossip: dropped transactions before gossiping due to heavy mempool or network load skip_count=2

5 Likes

Thanks for keeping an eye on this!

I’m not too worried currently. I skimmed some details from ZIP-317, with an eye on mempool size limiting. @shieldedmark also checked both zcashd and zebra to verify that block\_unpaid\_action\_limit = 0, so I’m not feeling very worried right now.

If the ZIP-317 design holds up as intended, anyone flooding txns is paying a pretty penny. I want to personally thank all the people who worked to ship ZIP-317, both design work/specs & implementations (nodes, wallets, etc…)! Thanks for defending Zcash. :shield:

However, it is always possible in all decentralized systems to find new denial-of-service attack vectors, so it’s good to stay vigilant.

One surfaces I’d personally like to learn more about (and encourage DoS defenders to look into) is the size/cost of the UTXO set.

p.s. If you save your logs and peers.db you might be able to figure out if most of these were coming from a particular neighbor. (Note: that doesn’t mean that neighbor IP is responsible, but that the source of transactions came from “their direction”.)

7 Likes

this is something that need to be prioritized by Electric Coin Company it should not be brushed off if this is indeed a attack on zcash and no one from Electric Coin Company taks action than I want nothing to do with zcash! I work hard for my money and expect Electric Coin Company. to defend us.

for the record y

last night NY time coinbase was unable to take zcash orders because of massive orders possible denial-of-service attack ? this is something that need to be priory 1 full stop!

a new law was passed that would get U.S Regulators involved and someone get this info to proper people at ECC

1 Like

Maybe this is related to the Maya bridge that was broken and when fixed caused a rush of txs? (Pure speculation)

2 Likes

Yeah, had to shut zcashmetro down due to this issue, hundreds of transactions in the mempool (most invalid txid). I don’t want to display wrong information. Soon I’ll start zcashmetro again.

8 Likes

not quite sure about that. it seems that if you can make your tx anchored on a side fork, you can flood the mempool without paying the fee. Maybe an exploit of the current implementation.

3 Likes

What do you mean by invalid txid?

Why do you suspect that? Side forks don’t seem that common

1 Like

Another theory:

4 Likes

When using GetMempoolStream, I’m getting hundreds of transactions, example of one of them:

Transaction {
    txid: TxId(
        "00b1334166ad70ddb82131603a48800fa0df5c8fb94ce4e46acfebcf8f49fd5a",
    ),
    data: TransactionData {
        version: V4,
        consensus_branch_id: Sprout,
        lock_time: 0,
        expiry_height: BlockHeight(
            0,
        ),
        transparent_bundle: Some(
            Bundle {
                vin: [
                    TxIn {
                        prevout: OutPoint {
                            hash: TxId(
                                "0da48392186a60fc8aedcb6722a4fb63deec6a8f83d0eab276c7690981082556",
                            ),
                            n: 0,
                        },
                        script_sig: Script(
                            [
                                Ok(
                                    Good(
                                        PushValue(
                                            LargeValue(
                                                PushdataBytelength(
                                                    BoundedVec {
                                                        inner: [
                                                            111,
                                                            114,
                                                            100,
                                                        ],
                                                        witness: NonEmpty(
                                                            (),
                                                        ),
                                                    },
                                                ),
                                            ),
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        PushValue(
                                            SmallValue(
                                                OP_1,
                                            ),
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        PushValue(
                                            LargeValue(
                                                PushdataBytelength(
                                                    BoundedVec {
                                                        inner: [
                                                            97,
                                                            112,
                                                            112,
                                                            108,
                                                            105,
                                                            99,
                                                            97,
                                                            116,
                                                            105,
                                                            111,
                                                            110,
                                                            47,
                                                            106,
                                                            115,
                                                            111,
                                                            110,
                                                        ],
                                                        witness: NonEmpty(
                                                            (),
                                                        ),
                                                    },
                                                ),
                                            ),
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        PushValue(
                                            SmallValue(
                                                OP_0,
                                            ),
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        PushValue(
                                            LargeValue(
                                                PushdataBytelength(
                                                    BoundedVec {
                                                        inner: [
                                                            123,
                                                            34,
                                                            112,
                                                            34,
                                                            58,
                                                            34,
                                                            122,
                                                            114,
                                                            99,
                                                            45,
                                                            50,
                                                            48,
                                                            34,
                                                            44,
                                                            34,
                                                            111,
                                                            112,
                                                            34,
                                                            58,
                                                            34,
                                                            109,
                                                            105,
                                                            110,
                                                            116,
                                                            34,
                                                            44,
                                                            34,
                                                            116,
                                                            105,
                                                            99,
                                                            107,
                                                            34,
                                                            58,
                                                            34,
                                                            90,
                                                            69,
                                                            82,
                                                            79,
                                                            34,
                                                            44,
                                                            34,
                                                            97,
                                                            109,
                                                            116,
                                                            34,
                                                            58,
                                                            34,
                                                            49,
                                                            48,
                                                            48,
                                                            48,
                                                            34,
                                                            125,
                                                        ],
                                                        witness: NonEmpty(
                                                            (),
                                                        ),
                                                    },
                                                ),
                                            ),
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        PushValue(
                                            LargeValue(
                                                PushdataBytelength(
                                                    BoundedVec {
                                                        inner: [
                                                            48,
                                                            69,
                                                            2,
                                                            33,
                                                            0,
                                                            166,
                                                            85,
                                                            239,
                                                            151,
                                                            245,
                                                            38,
                                                            83,
                                                            79,
                                                            202,
                                                            111,
                                                            141,
                                                            49,
                                                            134,
                                                            78,
                                                            192,
                                                            237,
                                                            37,
                                                            57,
                                                            36,
                                                            77,
                                                            9,
                                                            170,
                                                            48,
                                                            141,
                                                            79,
                                                            116,
                                                            109,
                                                            111,
                                                            177,
                                                            106,
                                                            239,
                                                            127,
                                                            2,
                                                            32,
                                                            122,
                                                            178,
                                                            71,
                                                            239,
                                                            14,
                                                            51,
                                                            162,
                                                            83,
                                                            252,
                                                            102,
                                                            240,
                                                            43,
                                                            244,
                                                            229,
                                                            71,
                                                            155,
                                                            45,
                                                            7,
                                                            214,
                                                            236,
                                                            157,
                                                            176,
                                                            217,
                                                            42,
                                                            11,
                                                            70,
                                                            154,
                                                            185,
                                                            86,
                                                            189,
                                                            15,
                                                            91,
                                                            1,
                                                        ],
                                                        witness: NonEmpty(
                                                            (),
                                                        ),
                                                    },
                                                ),
                                            ),
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        PushValue(
                                            LargeValue(
                                                PushdataBytelength(
                                                    BoundedVec {
                                                        inner: [
                                                            33,
                                                            3,
                                                            244,
                                                            60,
                                                            13,
                                                            81,
                                                            161,
                                                            148,
                                                            194,
                                                            116,
                                                            156,
                                                            172,
                                                            47,
                                                            51,
                                                            25,
                                                            201,
                                                            180,
                                                            92,
                                                            7,
                                                            219,
                                                            135,
                                                            167,
                                                            93,
                                                            252,
                                                            68,
                                                            230,
                                                            37,
                                                            168,
                                                            63,
                                                            187,
                                                            58,
                                                            223,
                                                            202,
                                                            130,
                                                            173,
                                                            117,
                                                            117,
                                                            117,
                                                            117,
                                                            117,
                                                            81,
                                                        ],
                                                        witness: NonEmpty(
                                                            (),
                                                        ),
                                                    },
                                                ),
                                            ),
                                        ),
                                    ),
                                ),
                            ],
                        ),
                        sequence: 4294967295,
                    },
                ],
                vout: [
                    TxOut {
                        value: Zatoshis(
                            0,
                        ),
                        script_pubkey: Script(
                            [
                                Ok(
                                    Good(
                                        Operation(
                                            OP_DUP,
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        Operation(
                                            OP_HASH160,
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        PushValue(
                                            LargeValue(
                                                PushdataBytelength(
                                                    BoundedVec {
                                                        inner: [
                                                            112,
                                                            192,
                                                            95,
                                                            91,
                                                            112,
                                                            107,
                                                            70,
                                                            211,
                                                            241,
                                                            169,
                                                            186,
                                                            204,
                                                            23,
                                                            152,
                                                            111,
                                                            106,
                                                            136,
                                                            185,
                                                            104,
                                                            95,
                                                        ],
                                                        witness: NonEmpty(
                                                            (),
                                                        ),
                                                    },
                                                ),
                                            ),
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        Operation(
                                            OP_EQUALVERIFY,
                                        ),
                                    ),
                                ),
                                Ok(
                                    Good(
                                        Operation(
                                            OP_CHECKSIG,
                                        ),
                                    ),
                                ),
                            ],
                        ),
                    },
                ],
                authorization: Authorized,
            },
        ),
        sprout_bundle: None,
        sapling_bundle: None,
        orchard_bundle: None,
    },
}

Findings:

  • The txid does not appear in any block explorer (that’s what I mean by “invalid txid”)
  • The txin prevout txid does appear on block explorer
  • All of them are 0 value zatoshi
  • All of them has n_expiry_height of 0 (i.e. never expires)
3 Likes

It’s just one way to exploit the mempool of zebrad. I have noticed it accepts tx that could be determined invalid by zcashd.

2 Likes

@james_katz just so I understand - I DO see this prevout transaction here - Zcash Transaction 0da48392186a60fc8aedcb6722a4fb63deec6a8f83d0eab276c7690981082556

So those output notes are valid, but the transaction itself, 00b1334166ad70ddb82131603a48800fa0df5c8fb94ce4e46acfebcf8f49fd5a doesn’t appear anywhere.

That’s what you’re saying right?

Is this what @hanh suggested?

1 Like

This tx would have been immediately rejected by zcashd because the transparent outputs cannot be below the dust amount.

3 Likes

Ah yes, that’s exactly it, thanks!

@james_katz that’s not an invalid tx per se, the txid won’t appear in zcashd-backed block explorers due to the issue hanh mentioned, but it is showing up in my zebra mempool for example.

I’ll surface this to the Zebra team.

(For anyone reading, while it would be better to filter those, they’re not super harmful since they need to pay the ZIP-317 fee anyway. The dust filtering rule is not a consensus rule)

Also I’d guess this is related to the zerdinals thing

8 Likes

i belive spamming attack is about this one

1 Like

It may be silly but it is not an attack. AFAIK it is not causing anything bad in the network. If you are experiencing otherwise please inform us ASAP with details.

1 Like