Edition #5Sunday, April 19, 2026

Zcash Weekly — April 19, 2026

Crosslink Season 1 goes live. ZODL hiring Principal Engineer R&D. Arthur Hayes names ZEC his top altcoin pick. Block time reduction to 25s gains momentum. Zebra 4.3.1 patches four vulnerabilities.

Jump to section

Crosslink Season 1 Goes Live

Shielded Labs launched Crosslink Season 1 on April 15 — the first incentivized Zcash feature net. Participants can earn real ZEC by running as miners, stakers, or finalizers in a hybrid PoW/PoS consensus environment. 25 ZEC is allocated for Season 1 rewards (500 ZEC total across all seasons).

The Crosslink desktop wallet functions as a full node and CPU miner by default — no separate node setup needed. Community participation was immediate: builders from Brazil, Turkey, and across the ecosystem jumped in within hours. The Arborist Call on April 16 confirmed the prototype phase is officially complete, and Crosslink is now in active productization toward mainnet readiness.

This is the most significant step toward Zcash's hybrid consensus future since the original Crosslink proposal. If successful, it would give Zcash faster finality through Bitcoin's PoW security without compromising shielded privacy.

launched Crosslink Season 1

ZODL is Hiring — Principal Engineer R&D

Josh Swihart posted openings at ZODL, generating significant community attention. Roles include Principal Engineer R&D ($180K–$250K + equity). Growing the core engineering team during a period of active protocol development — Crosslink, Tachyon, ZSA — is a strong ecosystem health signal. The last time ZODL expanded its R&D headcount at this level was ahead of the NU5 upgrade cycle.

posted openings

Block Time Reduction Analysis Gains Momentum

A formal analysis of reducing Zcash block times from 75 seconds to 25 seconds was published and amplified by ZODL co-founder Josh Swihart. The conclusion: reducing block times to 25s does not degrade wallet sync performance.

This matters because faster blocks mean faster payment confirmations — critical for merchant adoption and everyday use. The analysis addresses the primary technical concern (sync overhead) and finds it manageable. While no ZIP has been filed yet, the public endorsement from ZODL leadership signals this is moving from discussion to serious consideration.

Ecosystem

Zushi: One-Click Zcash Dev Environment

Community member yash25198 shipped Zushi, described as "nigiri but for Zcash." One command spins up zcashd in Docker with 101 blocks pre-mined, a funded wallet, local block explorer, Orchard/Sapling faucet, and auto-mining at mainnet cadence. A meaningful quality-of-life improvement for Zcash developers.

Zushi

Zcash Engage Server Launched

Dre_Nesthub (ZecHub contributor) launched a community initiative to coordinate engagement on Zcash-related X posts and reward participants. Forum thread.

Forum thread

Zodl 3.3.1 Maintenance Release

ZODL wallet shipped a maintenance update. Roadmap for 3.4.0 includes wallet resync without re-entering recovery phrase and birthday height for Keystone hardware wallet imports.

Zcash India First Offline Event

The first Zcash India offline meetup was held at AITR Indore, continuing the grassroots international community expansion pattern alongside Zcash Ghana and Brazil.

Arborist Call (April 16)

Full recording available. Steady progress across Zebra CI/CD automation, Crosslink prototype completion, and Z3 stack development (Zebra + Zaino + Zcash Docker tooling).

Full recording

Governance & Grants

Approved (Since Last Edition)

#270 — Istanbul Blockchain Week Marketing & Community Activation — Approved April 17.
#266 — Zcash Network School — Approved. Malaysia-based Zcash education program.
Rhea Finance Zcash Gateway — Approved async via ZCG April 13 meeting.
Women in DeFi Summit Onboarding (#247) — Approved and completed. CQ_Elzz spoke about Zcash privacy at the summit this week.

#270 — Istanbul Blockchain Week Marketing & Community Activation

Declined (Since Last Edition)

#264 ZecShield (Solana ↔ Zcash Privacy Bridge) — Declined.
#262 Zecboat Bridge (FROST-secured wSOL) — Declined.
#258 ZAP1 Protocol Hardening + Zaino Integration — Declined.

Under Review

#273 — Castle Labs Research — Professional research/advisory firm (worked with Arbitrum, Mantle, Starknet). Ready For ZCG Review.
#272 — ChainSafe #3: MetaMask Snap + webzjs Maintenance — Ready For ZCG Review.
#271 — BTCPayServer Per-Store Zcash Configuration — Ready For ZCG Review. ZCG actively calling for community feedback.
#269 — BTCPayServer Multi-Account + 0conf — Ready For ZCG Review.
#268 — ZPrivDEX: Fully Shielded AMM — Ready For ZCG Review. The most technically ambitious open proposal — proposes using frost-rerandomized (ZIP-312) for pool custody that never touches a transparent address.
#267 — Zecret Ballots 2 — Ready For ZCG Review. Gnosis Guild's second attempt at on-chain private voting.
#265 — Zcash CIS Media & Community Growth — Ready For ZCG Review.
#256 — Feature Branch Testnet + Developer Tooling — Ready For ZCG Review.
#244 — Formal Verification of Halo 2 in Lean 4 ($201.6K) — Ready For ZCG Review.

#273 — Castle Labs Research

Newly Filed

#274 — Zonp: Wallet-Native Commerce Layer for Zcash — Embeds structured commerce data (invoices, receipts, item details) into Zcash memo fields. Working prototype with ZIP-321 compatible encoding, multi-memo chunking, QR payment requests, and IPFS-based storefronts. Public docs are open for community review. No labels yet.

#274 — Zonp: Wallet-Native Commerce Layer for Zcash

Q2 Retroactive Grants

Registration is open. First application filed: gorusys' Zcash Grants Hub ($3,050). Deadline: May 14.

Protocol & Development

Coordinated Security Disclosure Patches Four Vulnerabilities

ZODL, the Zcash Foundation, and Shielded Labs published a coordinated multi-vulnerability disclosure on April 17. Four vulnerabilities were addressed across zcashd (v5.0–v6.12.0) and Zebra (v1.0–v4.3.0):

CVE-2026-40880: Transaction verification cache consensus vulnerability — a malicious miner could induce a chain split between Zebra nodes and the rest of the network
CVE-2026-40881: addr/addrv2 deserialization out-of-memory via memory over-allocation
An Orchard action-encoding crash bug that could take down nodes
A consensus enforcement gap that could trigger a chain fork between the two client implementations

All user funds are safe. ZEC supply was never at risk. None of the vulnerabilities were exploited. Mining pools holding supermajority hashrate were patched before public disclosure. Fixed in zcashd v6.12.1 and Zebra v4.3.1.

Notably, Shielded Labs issued a separate advisory urging all zcashd operators — exchanges, custodians, infrastructure providers — to place Zebra in front of zcashd as a network shield. The advisory explicitly calls out AI-assisted bug discovery as accelerating: the same researcher who found the March 2026 Sprout vulnerability, plus three independent researchers, found this batch. More disclosures are expected.

coordinated multi-vulnerability disclosure

Zebra 4.3.1 — Critical Security Patch

Zebra 4.3.1 shipped April 17. In addition to the security fixes above, it introduces a Dockerized mining setup, automated checkpoint management, and CI hardening improvements. All node operators should upgrade immediately.

Zebra 4.3.1

4-Word Address Aliases Proposed

A community proposal suggests deriving deterministic 4-word aliases from Zcash addresses using BLAKE2b and the BIP39 wordlist. The intent is anti-spoofing UX — helping users visually verify addresses and defend against clipboard malware. Not a checksum, but a human-readable sanity check.

community proposal

Zooko Asks "How Would x402 Work for Zcash?"

Zooko posted in the x402 grant thread (thread #54644), asking how the x402 protocol would work for Zcash. The x402 protocol enables pay-per-request HTTP monetization — relevant for AI agents, API access, and privacy-preserving micropayments. Founder-level attention on this space signals it's being taken seriously at the top.

posted in the x402 grant thread

Protocol Study Series Starts April 21

shieldedmark (Shielded Labs) announced a 12-session guided reading of the full Zcash Protocol Specification, co-hosted with Nate Wilcox. Session 1 starts Monday, April 21. Recorded by Zcash Brazil. A meaningful initiative for deepening the developer and researcher community.

announced

SDK Crate Versions (Unchanged)

| Crate | Latest | Released |
|-------|--------|----------|
| zcash_client_backend | 0.21.2 | Mar 10 |
| orchard | 0.12.0 | Dec 2025 |
| zcash_primitives | 0.26.4 | Dec 2025 |

No new crate releases this week. Zebra 4.3.1 is the only new release. Zaino 0.2.0 and Zallet v0.1.0-alpha.3 remain current. FROST v3.0.0 is still at RC0 — now two weeks overdue from ZF's "next week" timeline.

Tweets of the Week

"Security Disclosure: We've released zcashd v6.12.1, and the Zcash Foundation has released Zebra v4.3.1, addressing four vulnerabilities — including an Orchard action-encoding bug that could crash nodes and a related consensus-split issue between the two clients."
— @zodl_co · link

"Well structured analysis detailing the possible effects of the proposed Zcash block time reduction on wallet sync. Net: reducing block times to 25s does not degrade sync performance."
— @jswihart · link

"Every week you see headlines around data breaches and private information being public. Up until now, no one was really doing anything with it. But as soon as you apply AI to those databases, that information can really be used against you."
— @cypherpunk · link

Forum Highlights

Zebra 4.3.1 Vulnerability Discussion

Forum thread #55388 details the multi-vulnerability coordinated disclosure. User operational-anxiety4 noted how the bugs cluster around "edge cases, cross-implementation differences, and state handling" — insightful observation about where implementation complexity breeds risk.

#55388

ZPrivDEX: Shielded AMM Debate Continues

Thread #55368 remains active. hanh requested a whitepaper. dismad expressed support for ZSA-native AMM use cases. The frost-rerandomized (ZIP-312) approach to shielded pool custody is generating genuine technical interest.

#55368

Zonp Public Docs

Thread #55398 opened for review of Zonp's cryptographic architecture, memo protocol, and end-to-end transaction flow. An interesting experiment in using Zcash memo fields as a commerce data layer.

#55398

Advisory: Shield zcashd Behind Zebra

Thread #55390 from Shielded Labs is the most practically important post of the week for infrastructure operators. AI-assisted bug discovery is accelerating — this advisory is about preparing for that reality.

#55390

Privacy Corner

Why Faster Blocks Could Improve Your Privacy

A proposed change that sounds purely technical — but has real privacy implications.

Zcash currently produces a block roughly every 75 seconds. A proposal gaining traction this week would reduce that to 25 seconds. For most users, the obvious benefit is faster transaction confirmations. But there's a privacy angle that's less obvious.

The timing attack problem: When you send a shielded transaction, the time it appears in a block can be used as a correlation signal. If blocks are 75 seconds apart, an observer knows your transaction was sent within a specific 75-second window. With 25-second blocks, each block contains fewer transactions, but transactions land faster — reducing the window between "I sent this" and "it's confirmed." More importantly, faster blocks mean the shielded pool processes transactions more frequently, creating a denser stream of activity for your transaction to blend into.

The practical takeaway: Faster blocks don't automatically mean better privacy. What matters is that your transaction looks like every other transaction. But denser block production does mean:
1. Less time exposed between broadcast and confirmation
2. More frequent mixing of your transaction with others in the pool
3. Faster settlement for merchants, making shielded payments more practical for commerce

The analysis shared this week confirms wallet sync performance isn't degraded — meaning users don't pay a cost for the improvement. If this moves to a ZIP and eventually a network upgrade, it would be a subtle but meaningful win for everyday privacy.

Network Snapshot

ZEC Price

$306.36 · -16.3%

Market Cap

$5.11B · -16.2%

24h Volume

$380.7M · +3.4%

Block Height

3,313,679 · +7,965

Network Upgrade

NU6.1 (Zebra 4.3.1) · patched

Chain Size

257.4 GB · +0.2 GB

Zcash Privacy Index

Privacy Score

31 / 100 · unchanged

Shielded Pool

5,169,203 ZEC (31.0% of supply) · -4,206 ZEC

Orchard Pool

4,543,857 ZEC (87.9% of shielded) · -629,551 t-ZEC net moved

Sapling Pool

599,936 ZEC · -9,205 ZEC

Sprout Pool

25,409 ZEC · unchanged

Avg Shielded TX/Day

1,253 · -2.8%

Cross-Chain Activity (24h)

Top Inflows

Bitcoin ($952K), Ethereum ($406K), Solana ($85K)

Top Outflows

Ethereum ($1.95M), Solana ($628K), Tron ($42.5K)

All-Time Swaps

110,608 ($1.43B total volume)

Network Health

Active Nodes

263 across 37 countries · +2.7%

Tor Nodes

11 · +37.5%

Avg Ping

150 ms · -58.0%

Peers

200 · unchanged

ZEC price pulled back ~16% this week after the explosive +51% rally covered in Edition #4 — a healthy consolidation after the Winklevoss/Hayes-driven surge. Cross-chain swap volume remains elevated at $4.27M/day (550 swaps), suggesting continued real usage rather than just speculative trading. The shielded pool shed ~4,200 ZEC — likely profit-taking from the rally flowing through transparent channels. Encouragingly, Tor node count recovered from 8 to 11, and average ping improved dramatically from 357ms to 150ms, suggesting the network infrastructure hiccup flagged last week was temporary. Active nodes ticked up to 263 across 37 countries.

Explore live data →

Privacy Risk Spotlight

This week CipherScan flagged 3,769 potentially linkable shield-deshield patterns over the past 7 days. Of these, 1 was rated HIGH risk and 8 were MEDIUM risk. The most common pattern remains the same: shielding ZEC, waiting hours (not days), then deshielding a nearly identical amount to a different transparent address.

Worst example this week: 10.002 ZEC was shielded into Orchard and deshielded to a different address 3 minutes later — with the exact same amount. Risk score: 77/100. This provides almost no privacy benefit. If you're going to use the shielded pool, stay in it.

Tool Updates

CipherScan

Shipped a real-time Crosslink explorer — PoW blocks, BFT votes, and finalizer signatures visible as they happen. The first public tool tracking Crosslink Season 1 activity. cipherscan.app

CipherPay

No new features this week. Donation campaigns continue to see organic adoption — mentioned at the Women in DeFi Summit this week. cipherpay.app

What's Ahead

Apr 21Protocol Study Series Session 1 begins (shieldedmark + Nate Wilcox)
Apr 23ZODL GPG signing key transition deadline (APT users must import new key)
May 5-7Consensus Miami (Josh Swihart speaking)
May 14Q2 2026 Retroactive Grants deadline
TBDFROST v3.0.0 release (now 2+ weeks overdue from ZF's "next week" estimate)
Q3 2026Crosslink Phase 2: Feature Production Readiness target
Late 2026Tachyon mainnet deployment target
UpcomingZallet alpha.4 (P2SH support, rewind-to-chain-state)