The headline this period is Zebra v6.0.0, which adds full support for NU6.3 “Ironwood” — the next Zcash network upgrade, bringing a new shielded pool and transaction format — and sets its Mainnet activation height. All node operators should upgrade before activation. Alongside the release we fixed several security issues, made block template creation much faster for mining pools, and carried Ironwood support into the wider ecosystem with wallet-side changes in librustzcash and updates to our DNS seeder. We also had a strong run of help from external contributors.
Security
As part of preparing v6.0.0 we fixed a number of issues that could let a misbehaving peer or a crafted request disrupt a node: one where a single peer could crowd out other peers’ transactions on their way to the mempool, one where a specific RPC request could crash the node, one where a peer could trick the node into discarding its mempool, and one where non-standard transactions caused unnecessary verification work. All of these fixes ship in Zebra v6.0.0, and we recommend all operators upgrade; the linked pull requests have the details. We also refreshed our security policy with up-to-date contact details and a process for less critical reports.
CI / DevOps
We tightened the checks that run on every Zebra pull request: a single required gate now verifies the PR title, detects unannounced breaking changes to our published library crates, and makes sure user-visible changes come with a changelog entry.
Other Zebra work
We shipped Zebra v6.0.0, which supports NU6.3 “Ironwood”. The core support covers parsing and verifying the new v6 transaction format, validating and storing the new shielded pool’s data, and the RPC methods wallets and indexers need to use the new pool, and was hardened through several rounds of internal review. The release activates Ironwood on Mainnet at block 3,428,143, so nodes must upgrade before that height to stay on the network.
For miners and pools, we made repeated getblocktemplate calls reuse the block’s coinbase transaction instead of rebuilding its proof every time, cutting roughly six seconds of CPU work per call down to almost nothing on a live pool. Blocks mined with Zebra now carry a small zebra marker in the coinbase, so block explorers and hashrate monitors can tell which blocks Zebra produced. We also added a block_notify_command option — the equivalent of zcashd’s -blocknotify — that runs a command of your choice whenever the chain tip changes.
We fixed a networking bug where Zebra could disconnect well-behaved peers once it reached the chain tip, and a race in the block stream that serves other tools reading Zebra’s state (such as the Zaino indexer) that caused repeated errors and log flooding.
Work on other repositories
We contributed wallet-side Ironwood support to librustzcash. Wallet sync now fetches the Ironwood pool’s subtree roots so notes stay spendable, and wallets handle the Ironwood pool correctly when rewinding after a chain reorganisation. We also fixed a bug where some transparent-to-shielded transactions could fail to build, and fixed two bugs in the tree data structure wallets use to track notes that could corrupt wallet state during sync.
On the Zallet wallet, we fixed a bug where keys imported into a running wallet weren’t picked up by the sync engine until a restart, leaving balances at zero.
Our DNS seeder, zeeder, got a release pipeline that publishes signed Docker images and binaries — modelled on Zebra’s — along with a v1.4.0 release, and its testnet zone now serves only peers that are ready for NU6.3. In z3, our Docker Compose stack for running a Zcash node and wallet together, the default setup is now Zebra plus Zallet (with the Zaino indexer available as an opt-in), and the wallet’s encryption identity is now generated inside the container, removing a manual host-side setup step. We also continued improving the infrastructure behind our public status page (status.zfnd.org).
On frost-tools, we reworked the FROST client’s coordinator so other applications can use it as a library rather than only through the command line.
Thanks to external contributors
@nuttycom helped get Zebra ready for Ironwood by setting the final NU6.3 consensus constants and moving Zebra onto the published NU6.3 releases of the librustzcash crates. @dingledropper hardened the RPC server’s cookie authentication by switching it to a constant-time comparison. @Cosmos-Harry fixed very slow catch-up after reconnects in the block stream that wallets and indexers use to read Zebra’s state. @dannywillems raised the workspace’s minimum supported Rust version to 1.88. And our fix for the mempool issue mentioned in the Security section built on an initial pull request from @ValarDragon, who found and reported the problem.