CVE-2019-11636
📋 TL;DR
CVE-2019-11636 is a denial-of-service vulnerability in Zcash cryptocurrency software that allows attackers to cheaply fill transaction blocks with spam, preventing legitimate transactions from being processed. This affects all Zcash users and network participants running vulnerable versions. The attack exploits the low cost of creating certain types of transactions in the Sapling protocol.
💻 Affected Systems
- Zcash
📦 What is this software?
Zcash by Z.cash
Zcash by Z.cash
⚠️ Risk & Real-World Impact
Worst Case
Complete network paralysis where no legitimate transactions can be confirmed, effectively halting the Zcash blockchain and causing financial disruption.
Likely Case
Periodic transaction delays and increased fees as attackers intermittently spam the network, degrading performance and reliability.
If Mitigated
Minimal impact if patched quickly; temporary transaction delays if attack occurs before patching.
🎯 Exploit Status
Attack demonstrated publicly via 'Sapling Wood-Chipper' tool; requires minimal resources to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Zcash 2.0.7-1 and later
Vendor Advisory: https://github.com/zcash/zcash/issues/3955
Restart Required: Yes
Instructions:
1. Stop Zcash daemon. 2. Backup wallet.dat. 3. Download and install Zcash 2.0.7-1 or later from official source. 4. Restart Zcash daemon.
🔧 Temporary Workarounds
Transaction fee adjustment
allIncrease minimum transaction fees to make spam attacks more expensive
zcash-cli setminfee 0.0001
🧯 If You Can't Patch
- Monitor network for spam transactions and temporarily increase transaction fees
- Consider using alternative cryptocurrency networks until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check Zcash version: zcash-cli --versionCheck Version:
zcash-cli --versionVerify Fix Applied:
Verify version is 2.0.7-1 or higher and monitor for successful transaction processing📡 Detection & Monitoring
Log Indicators:
- High volume of low-value transactions
- Transaction confirmation failures
- Block fill rate approaching 100%
Network Indicators:
- Unusual spike in transaction volume
- Increased orphaned blocks
- Network latency spikes
SIEM Query:
source="zcash.log" AND "mempool size" > 10000