Zcash Weekly — April 19, 2026
Your weekly digest of Zcash ecosystem news, protocol updates, and privacy insights. Edition #5//Top Stories
Crosslink Season 1 Goes Live
Shielded Labs launched Crosslink Season 1 on April 15 — the first incentivized Zcash feature net. Participants can earn real ZEC by running as miners, stakers, or finalizers in a hybrid PoW/PoS consensus environment. 25 ZEC is allocated for Season 1 rewards (500 ZEC total across all seasons).
The Crosslink desktop wallet functions as a full node and CPU miner by default — no separate node setup needed. Community participation was immediate: builders from Brazil, Turkey, and across the ecosystem jumped in within hours. The Arborist Call on April 16 confirmed the prototype phase is officially complete, and Crosslink is now in active productization toward mainnet readiness.
This is the most significant step toward Zcash's hybrid consensus future since the original Crosslink proposal. If successful, it would give Zcash faster finality through Bitcoin's PoW security without compromising shielded privacy.
ZODL is Hiring — Principal Engineer R&D
Josh Swihart posted openings at ZODL, generating significant community attention. Roles include Principal Engineer R&D ($180K–$250K + equity). Growing the core engineering team during a period of active protocol development — Crosslink, Tachyon, ZSA — is a strong ecosystem health signal. The last time ZODL expanded its R&D headcount at this level was ahead of the NU5 upgrade cycle.
Block Time Reduction Analysis Gains Momentum
A formal analysis of reducing Zcash block times from 75 seconds to 25 seconds was published and amplified by ZODL co-founder Josh Swihart. The conclusion: reducing block times to 25s does not degrade wallet sync performance.
This matters because faster blocks mean faster payment confirmations — critical for merchant adoption and everyday use. The analysis addresses the primary technical concern (sync overhead) and finds it manageable. While no ZIP has been filed yet, the public endorsement from ZODL leadership signals this is moving from discussion to serious consideration.
//Ecosystem
- Zushi: One-Click Zcash Dev Environment — Community member yash25198 shipped Zushi, described as "nigiri but for Zcash." One command spins up zcashd in Docker with 101 blocks pre-mined, a funded wallet, local block explorer, Orchard/Sapling faucet, and auto-mining at mainnet cadence. A meaningful quality-of-life improvement for Zcash developers.
- Zcash Engage Server Launched — Dre_Nesthub (ZecHub contributor) launched a community initiative to coordinate engagement on Zcash-related X posts and reward participants. Forum thread.
- Zodl 3.3.1 Maintenance Release — ZODL wallet shipped a maintenance update. Roadmap for 3.4.0 includes wallet resync without re-entering recovery phrase and birthday height for Keystone hardware wallet imports.
- Zcash India First Offline Event — The first Zcash India offline meetup was held at AITR Indore, continuing the grassroots international community expansion pattern alongside Zcash Ghana and Brazil.
- Arborist Call (April 16) — Full recording available. Steady progress across Zebra CI/CD automation, Crosslink prototype completion, and Z3 stack development (Zebra + Zaino + Zcash Docker tooling).
//Governance & Grants
Approved (Since Last Edition)
- #270 — Istanbul Blockchain Week Marketing & Community Activation — Approved April 17.
- #266 — Zcash Network School — Approved. Malaysia-based Zcash education program.
- Rhea Finance Zcash Gateway — Approved async via ZCG April 13 meeting.
- Women in DeFi Summit Onboarding (#247) — Approved and completed. CQ_Elzz spoke about Zcash privacy at the summit this week.
Declined (Since Last Edition)
- #264 ZecShield (Solana ↔ Zcash Privacy Bridge) — Declined.
- #262 Zecboat Bridge (FROST-secured wSOL) — Declined.
- #258 ZAP1 Protocol Hardening + Zaino Integration — Declined.
Under Review
- #273 — Castle Labs Research — Professional research/advisory firm (worked with Arbitrum, Mantle, Starknet). Ready For ZCG Review.
- #272 — ChainSafe #3: MetaMask Snap + webzjs Maintenance — Ready For ZCG Review.
- #271 — BTCPayServer Per-Store Zcash Configuration — Ready For ZCG Review. ZCG actively calling for community feedback.
- #269 — BTCPayServer Multi-Account + 0conf — Ready For ZCG Review.
- #268 — ZPrivDEX: Fully Shielded AMM — Ready For ZCG Review. The most technically ambitious open proposal — proposes using
frost-rerandomized(ZIP-312) for pool custody that never touches a transparent address. - #267 — Zecret Ballots 2 — Ready For ZCG Review. Gnosis Guild's second attempt at on-chain private voting.
- #265 — Zcash CIS Media & Community Growth — Ready For ZCG Review.
- #256 — Feature Branch Testnet + Developer Tooling — Ready For ZCG Review.
- #244 — Formal Verification of Halo 2 in Lean 4 ($201.6K) — Ready For ZCG Review.
Newly Filed
- #274 — Zonp: Wallet-Native Commerce Layer for Zcash — Embeds structured commerce data (invoices, receipts, item details) into Zcash memo fields. Working prototype with ZIP-321 compatible encoding, multi-memo chunking, QR payment requests, and IPFS-based storefronts. Public docs are open for community review. No labels yet.
Q2 Retroactive Grants
Registration is open. First application filed: gorusys' Zcash Grants Hub ($3,050). Deadline: May 14.
//Protocol & Development
Coordinated Security Disclosure Patches Four Vulnerabilities
ZODL, the Zcash Foundation, and Shielded Labs published a coordinated multi-vulnerability disclosure on April 17. Four vulnerabilities were addressed across zcashd (v5.0–v6.12.0) and Zebra (v1.0–v4.3.0):
- CVE-2026-40880: Transaction verification cache consensus vulnerability — a malicious miner could induce a chain split between Zebra nodes and the rest of the network
- CVE-2026-40881: addr/addrv2 deserialization out-of-memory via memory over-allocation
- An Orchard action-encoding crash bug that could take down nodes
- A consensus enforcement gap that could trigger a chain fork between the two client implementations
Notably, Shielded Labs issued a separate advisory urging all zcashd operators — exchanges, custodians, infrastructure providers — to place Zebra in front of zcashd as a network shield. The advisory explicitly calls out AI-assisted bug discovery as accelerating: the same researcher who found the March 2026 Sprout vulnerability, plus three independent researchers, found this batch. More disclosures are expected.
Zebra 4.3.1 — Critical Security Patch
Zebra 4.3.1 shipped April 17. In addition to the security fixes above, it introduces a Dockerized mining setup, automated checkpoint management, and CI hardening improvements. All node operators should upgrade immediately.4-Word Address Aliases Proposed
A community proposal suggests deriving deterministic 4-word aliases from Zcash addresses using BLAKE2b and the BIP39 wordlist. The intent is anti-spoofing UX — helping users visually verify addresses and defend against clipboard malware. Not a checksum, but a human-readable sanity check.
Zooko Asks "How Would x402 Work for Zcash?"
Zooko posted in the x402 grant thread (thread #54644), asking how the x402 protocol would work for Zcash. The x402 protocol enables pay-per-request HTTP monetization — relevant for AI agents, API access, and privacy-preserving micropayments. Founder-level attention on this space signals it's being taken seriously at the top.
Protocol Study Series Starts April 21
shieldedmark (Shielded Labs) announced a 12-session guided reading of the full Zcash Protocol Specification, co-hosted with Nate Wilcox. Session 1 starts Monday, April 21. Recorded by Zcash Brazil. A meaningful initiative for deepening the developer and researcher community.
SDK Crate Versions (Unchanged)
| Crate | Latest | Released |
|---|---|---|
zcash_client_backend | 0.21.2 | Mar 10 |
orchard | 0.12.0 | Dec 2025 |
zcash_primitives | 0.26.4 | Dec 2025 |
//Tweets of the Week
"Security Disclosure: We've released zcashd v6.12.1, and the Zcash Foundation has released Zebra v4.3.1, addressing four vulnerabilities — including an Orchard action-encoding bug that could crash nodes and a related consensus-split issue between the two clients."
"Well structured analysis detailing the possible effects of the proposed Zcash block time reduction on wallet sync. Net: reducing block times to 25s does not degrade sync performance."
"Every week you see headlines around data breaches and private information being public. Up until now, no one was really doing anything with it. But as soon as you apply AI to those databases, that information can really be used against you."
//Forum Highlights
- Zebra 4.3.1 Vulnerability Discussion — Forum thread #55388 details the multi-vulnerability coordinated disclosure. User
operational-anxiety4noted how the bugs cluster around "edge cases, cross-implementation differences, and state handling" — insightful observation about where implementation complexity breeds risk.
- ZPrivDEX: Shielded AMM Debate Continues — Thread #55368 remains active. hanh requested a whitepaper. dismad expressed support for ZSA-native AMM use cases. The
frost-rerandomized(ZIP-312) approach to shielded pool custody is generating genuine technical interest.
- Zonp Public Docs — Thread #55398 opened for review of Zonp's cryptographic architecture, memo protocol, and end-to-end transaction flow. An interesting experiment in using Zcash memo fields as a commerce data layer.
- Advisory: Shield zcashd Behind Zebra — Thread #55390 from Shielded Labs is the most practically important post of the week for infrastructure operators. AI-assisted bug discovery is accelerating — this advisory is about preparing for that reality.
//Privacy Corner: Why Faster Blocks Could Improve Your Privacy
A proposed change that sounds purely technical — but has real privacy implications.Zcash currently produces a block roughly every 75 seconds. A proposal gaining traction this week would reduce that to 25 seconds. For most users, the obvious benefit is faster transaction confirmations. But there's a privacy angle that's less obvious.
The timing attack problem: When you send a shielded transaction, the time it appears in a block can be used as a correlation signal. If blocks are 75 seconds apart, an observer knows your transaction was sent within a specific 75-second window. With 25-second blocks, each block contains fewer transactions, but transactions land faster — reducing the window between "I sent this" and "it's confirmed." More importantly, faster blocks mean the shielded pool processes transactions more frequently, creating a denser stream of activity for your transaction to blend into. The practical takeaway: Faster blocks don't automatically mean better privacy. What matters is that your transaction looks like every other transaction. But denser block production does mean: 1. Less time exposed between broadcast and confirmation 2. More frequent mixing of your transaction with others in the pool 3. Faster settlement for merchants, making shielded payments more practical for commerceThe analysis shared this week confirms wallet sync performance isn't degraded — meaning users don't pay a cost for the improvement. If this moves to a ZIP and eventually a network upgrade, it would be a subtle but meaningful win for everyday privacy.
//Network Snapshot
| Metric | Value | 7d Change |
|---|---|---|
| ZEC Price | $306.36 | -16.3% |
| Market Cap | $5.11B | -16.2% |
| 24h Volume | $380.7M | +3.4% |
| Block Height | 3,313,679 | +7,965 |
| Network Upgrade | NU6.1 (Zebra 4.3.1) | patched |
| Chain Size | 257.4 GB | +0.2 GB |
//Zcash Privacy Index
Powered by CipherScan — live data from the Zcash blockchain.| Metric | Value | 7d Change |
|---|---|---|
| Privacy Score | 31 / 100 | unchanged |
| Shielded Pool | 5,169,203 ZEC (31.0% of supply) | -4,206 ZEC |
| Orchard Pool | 4,543,857 ZEC (87.9% of shielded) | -629,551 t-ZEC net moved |
| Sapling Pool | 599,936 ZEC | -9,205 ZEC |
| Sprout Pool | 25,409 ZEC | unchanged |
| Avg Shielded TX/Day | 1,253 | -2.8% |
| Metric | Value |
|---|---|
| Volume | $4.27M across 550 swaps |
| Top Inflows | Bitcoin ($952K), Ethereum ($406K), Solana ($85K) |
| Top Outflows | Ethereum ($1.95M), Solana ($628K), Tron ($42.5K) |
| All-Time Swaps | 110,608 ($1.43B total volume) |
| Metric | Value | 7d Change |
|---|---|---|
| Active Nodes | 263 across 37 countries | +2.7% |
| Tor Nodes | 11 | +37.5% |
| Avg Ping | 150 ms | -58.0% |
| Peers | 200 | unchanged |
//Privacy Risk Spotlight
Powered by CipherScan's privacy risk detection API.This week CipherScan flagged 3,769 potentially linkable shield-deshield patterns over the past 7 days. Of these, 1 was rated HIGH risk and 8 were MEDIUM risk. The most common pattern remains the same: shielding ZEC, waiting hours (not days), then deshielding a nearly identical amount to a different transparent address.
Worst example this week: 10.002 ZEC was shielded into Orchard and deshielded to a different address 3 minutes later — with the exact same amount. Risk score: 77/100. This provides almost no privacy benefit. If you're going to use the shielded pool, stay in it.//Tool Updates
CipherScan: Shipped a real-time Crosslink explorer — PoW blocks, BFT votes, and finalizer signatures visible as they happen. The first public tool tracking Crosslink Season 1 activity. cipherscan.app CipherPay: No new features this week. Donation campaigns continue to see organic adoption — mentioned at the Women in DeFi Summit this week. cipherpay.app//What's Ahead
- Apr 21 — Protocol Study Series Session 1 begins (shieldedmark + Nate Wilcox)
- Apr 23 — ZODL GPG signing key transition deadline (APT users must import new key)
- May 5-7 — Consensus Miami (Josh Swihart speaking)
- May 14 — Q2 2026 Retroactive Grants deadline
- TBD — FROST v3.0.0 release (now 2+ weeks overdue from ZF's "next week" estimate)
- Q3 2026 — Crosslink Phase 2: Feature Production Readiness target
- Late 2026 — Tachyon mainnet deployment target
- Upcoming — Zallet alpha.4 (P2SH support, rewind-to-chain-state)