# ZF Engineering Update — May 18–31, 2026 **URL:** \ **Category:** Zcash Foundation\ **Created:** [June 2, 2026, 4:07pm UTC](https://forum.zcashcommunity.com/t/zf-engineering-update-may-18-31-2026/55965 "2026-06-02T16:07:14Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![ZcashFoundation](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/zcashfoundation/32/21548_2.png) [@ZcashFoundation](https://forum.zcashcommunity.com/u/ZcashFoundation)\ **Post date:** [June 2, 2026, 4:07pm UTC](https://forum.zcashcommunity.com/t/zf-engineering-update-may-18-31-2026/55965/1 "2026-06-02T16:07:14Z")
Over the past two weeks we shipped two Zebra releases, [Zebra v4.5.0](https://github.com/ZcashFoundation/zebra/pull/10647) and a follow-up patch [v4.5.1](https://github.com/ZcashFoundation/zebra/pull/10657), fixed a handful of CI and infrastructure issues, and shipped two releases addressing multiple security vulnerabilities reported through the advisory process. On the FROST side, we added support for a new transaction format in the signing tool. ## Security We shipped [Zebra v4.5.0](https://zfnd.org/zebra-4-5-0-release/) and a same-day hotfix [v4.5.1](https://zfnd.org/zebra-4-5-1-security-fixes/) — together addressing 13 security issues, nearly all reported through responsible disclosure. All Zebra node operators should upgrade to v4.5.1. The issues cover a range of areas: several could allow a remote peer to crash the node through specific transaction or RPC inputs; others involved uncapped memory allocations that a peer could exploit; and there were networking bugs around peer inventory poisoning and mempool queue limits. v4.5.1 followed the same day with the [P2SH script signature count fix](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2prc-cj5x-4443). Full details on all advisories are in the [release post](https://zfnd.org/zebra-4-5-1-security-fixes/). These issues were reported by [@ipwning](https://github.com/ipwning), [@x15-eth](https://github.com/x15-eth), [@sangsoo-osec](https://github.com/sangsoo-osec), [@robustfengbin](https://github.com/robustfengbin), [@Haxatron](https://github.com/Haxatron), [@ouicate](https://github.com/ouicate), [@samsulselfut](https://github.com/samsulselfut), [@dingledropper](https://github.com/dingledropper), and [@AnticsDecoded](https://github.com/AnticsDecoded). ## Zebra — CI & Infrastructure We fixed a networking issue where our [GCP-hosted nodes weren’t advertising their correct external IP](https://github.com/ZcashFoundation/zebra/pull/10655) to peers, making them invisible to the rest of the network. We also [updated CI dependencies and cleared two build blockers](https://github.com/ZcashFoundation/zebra/pull/10619) caused by a deprecated crate and a stale dependency audit config,and [temporarily disabled the link-checking job](https://github.com/ZcashFoundation/zebra/pull/10631) which was generating constant false failures from rate-limited external sites. ## Zebra — Other Changes Alongside the security fixes, [v4.5.0](https://zfnd.org/zebra-4-5-0-release/) added support for [ZIP-213 (Shielded Coinbase)](https://github.com/ZcashFoundation/zebra/pull/10048), which allows mining rewards to go directly to a shielded address. We also [precompute the coinbase transaction](https://github.com/ZcashFoundation/zebra/pull/10170) for the next block so that when the chain tip changes, miners receive a new template immediately — this matters most when mining to a shielded address. v4.5.0 also shows a startup warning on Linux when a [TCP kernel setting](https://github.com/ZcashFoundation/zebra/pull/10513) that can slow syncing is enabled, and includes a small config rename: `testnet_parameters` is now `[network.params]`, though the old format still works. A significant amount of time this period went into investigating a [sync stall issue](https://github.com/ZcashFoundation/zebra/issues/5709). This was a major engineering effort — code-level root cause analysis, coordination with other teams, local reproduction, patch development. Several fix attempts were opened and refined during this period. Early internal testing of a targeted fix showed zero sync errors across multiple fleet nodes over 11+ hours — we expect to have more to share on this soon. ## FROST Tools We added [PCZT (Partially Created Zcash Transaction) support to the zcash-sign tool](https://github.com/ZcashFoundation/frost-tools/pull/574). PCZT is a format for transactions that are being assembled and signed in stages, and this change lets `zcash-sign` work with that format directly. ## Other Repos We released [reddsa 0.5.2](https://github.com/ZcashFoundation/reddsa/pull/261), which includes a [fix that prevents signing key material from appearing in debug output](https://github.com/ZcashFoundation/reddsa/pull/260)—a straightforward but important security improvement. In `zcash_script`, we fixed [sig\_op\_count() to match zcashd’s behavior](https://github.com/ZcashFoundation/zcash_script/pull/304), correcting a divergence in how signature operations are counted. In `z3`, we [added a CI job to run cargo tests for the rpc-router component](https://github.com/ZcashFoundation/z3/pull/40) and [updated push triggers to run from the main branch](https://github.com/ZcashFoundation/z3/pull/39). We [migrated the z.cash DNS zone to a new configuration and replaced an existing page rule](https://github.com/ZcashFoundation/infra-dns/pull/1) as part of ongoing infrastructure maintenance. ## External Contributors Thank you to everyone outside the Foundation who contributed this period! [@dingledropper](https://github.com/dingledropper) contributed two security fixes to Zebra: [capping upfront memory allocation in the shared deserializer](https://github.com/ZcashFoundation/zebra/pull/10563) so a malicious peer cannot force large memory reservations by sending a lying length prefix, and [setting protocol-level maximums for block locator and headers preallocation](https://github.com/ZcashFoundation/zebra/pull/10570) to complement that fix at the per-type level. [@zmanian](https://github.com/zmanian) fixed two bugs: a [potential panic in the address book](https://github.com/ZcashFoundation/zebra/pull/10589) that could be triggered when a misbehaving peer hit the ban threshold under certain connection configurations, and a [silent error drop in value balance calculations](https://github.com/ZcashFoundation/zebra/pull/10590) where a failed transaction calculation was being swallowed instead of propagated. [@ValarDragon](https://github.com/ValarDragon) [cleaned up variable names in the difficulty calculation function](https://github.com/ZcashFoundation/zebra/pull/10509) to make it clearer that the code is splitting a floating-point value into mantissa and exponent parts. [@dmidem](https://github.com/dmidem) [fixed several CI issues in the ZSA (Zcash Shielded Assets) branch](https://github.com/ZcashFoundation/zebra/pull/10654), including pinning action versions, restricting workflow token permissions, and separating network-sensitive tests to reduce flakiness. ---
**Author:** ![the\_zero](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/the_zero/32/45613_2.png) [@the\_zero](https://forum.zcashcommunity.com/u/the_zero)\ **Post date:** [June 4, 2026, 1:42pm UTC](https://forum.zcashcommunity.com/t/zf-engineering-update-may-18-31-2026/55965/2 "2026-06-04T13:42:55Z")
My Zebra node (zebrad 5.0.0) was about 56% synchronized 15 hours ago, and it is now at 58.1%. That means it has progressed by roughly 1.5% over the past 15 hours. The node is currently processing block 1,962,558. After the recent issue, I deleted the existing data and started synchronization from scratch for the third time. I still have a long way to go, and I could use more of your help. My system specifications are: - OS: Ubuntu Server 24.04 (VMware) - CPU: Threadripper 2950X - Memory: 16 GB ECC RAM - SSD: Intel Optane 905P 1.5 TB This system is not used for any other blockchain nodes or services. It is dedicated exclusively to Zcash.