The Zcash Arborist Calls are bi-weekly protocol development meetings focused on tracking upcoming protocol deployment logistics, consensus node implementation issues, and protocol research.
This summary focuses on the last call that took place on 04/02/2026.
Security (CVE fixes)
Two critical CVEs were fixed:
one with potential to cause a chain split
another that could take down vulnerable nodes entirely
Zebra is no longer “just another node”… it’s becoming core infrastructure
ZIP 235 is now implemented, meaning Zebra is staying tightly aligned with protocol evolution
Dev layer also improved:
regtest block propagation fixed
founders reward RPC (pre-Canopy) corrected
ZIP 316 (Revision 2) is now live for review:
It introduces improved unified address design, including support for P2SH viewing keys
Also defines two address types:
ZU for fully shielded usage
TU for mixed (transparent + shielded) flexibility
This is a meaningful step in refining address standards.
Another important piece for NU7:
ZIP 248 (Extensible Transaction Format) is currently under review
This upgrade is expected to play a key role in future protocol flexibility
Community feedback is actively being requested.
A critical vulnerability in zcashd has been patched
The issue could have allowed invalid Sprout proofs to be introduced by a malicious miner
Disclosure was coordinated, and mining pools were patched before public release
Notably, Zebra helped analyze the scope reinforcing its growing role in network security.
Serious integration testing is underway:
The team is generating historical wallets across the full upgrade timeline Sprout → Overwinter → Sapling → Orchard
Using old zcashd versions and regtest environments
This ensures Zallet can handle real-world wallet history, not just ideal conditions.
Progress on the Z3 stack continues:
Work is ongoing to integrate Zaino with the latest Zcash primitives, alongside pending PRs needed for completion
At the same time, Zallet’s full block scanning built on Zaino is nearing completion\
The pieces are steadily coming together.
Zaino continues to mature steadily:
library release is now out, with zainod aligned to the current GitHub release version
The stack is now in a state where most core functionality works, allowing the team to shift focus
From building features to improving usability, documentation, and reducing technical debt.
What comes next for Zaino:
Upgrade to Zebra v4.3 is underway, bringing important improvements including pre-Canopy indexing support
Some required methods for Zallet are still being finalized, alongside ongoing RPC work for block explorer support
Next release is expected soon with a stronger focus on stability and developer experience.
Zcashd deprecation work continues to deepen:
Focus is shifting toward Zaino <> lightwalletd parity, with integration, tests being developed to compare outputs across both systems
This is critical to ensure a smooth transition as legacy infrastructure is gradually phased out.
A clearer security direction is emerging:
Zebra is increasingly viewed as safer than zcashd, not just because it’s newer and written in Rust
But because its design reduces attack surface and has proven easier to analyze under modern security techniques
This is becoming a key driver behind the migration.
The bigger picture behind deprecation:
Legacy components like Sprout still introduce long-standing attack surfaces, especially in older C++ code.
The long-term goal is clear reduce complexity, remove technical debt, and evolve toward a leaner, more secure protocol
This transition is careful, but necessary.
Progress on Zcash Shielded Assets (ZSA) is moving toward completion:
The Orchard ZSA implementation (PR 471) has been updated, reviewed, and is now close to finalization
Key improvements include better issuance handling and added visibility needed for Zebra integration
Now awaiting continued review.
Core libraries are being aligned to support ZSAs:
Updates to Sapling crypto ensure compatibility with the newer note encryption interface, while preserving existing note structures
At the same time, Librustzcash and test vectors have been brought closer to upstream
This is critical groundwork for stable integration.
State management for issued assets in Zebra is largely complete, with the implementation now synced close to the latest releases
ZSA-related changes are under active review, with future adjustments expected alongside ZIP 248
Progress on the Network Sustainability Mechanism (NSM) continues:
ZIP 235 has now been merged and released behind a compile-time flag, marking a key milestone
Remaining work is focused on ZIP 234 and a dependent refactor PR, which is currently blocking progress
Next step: review and unblock the final pieces.
Crosslink (trailing finality layer) is moving toward its milestone:
An incentivized testnet is planned, with a workshop scheduled for April 15
Current focus is on stability, especially around new networking components for syncing
Collaboration with multiple teams is ongoing.
Specification work for Crosslink has begun:
Initial ZIP drafts are in progress, with the design expected to be modular rather than monolithic
This reflects the structure of the system itself, combining BFT mechanisms, block header changes, and finality logic.
A major shift in direction for Dynamic Fees:
The initial ZIP has been withdrawn after not making it into the NU7 sentiment poll
The focus is now moving toward a UX-first, research-driven approach
More time is being taken to properly understand how fees should work in practice.
The new approach centers on real-world data:
Teams are engaging wallet providers (Unstoppable,Zodl, Zingo, Edge, others) to understand user experience with fees
Mainnet data is being treated as the primary source of truth
The goal is to design a system grounded in actual usage, not assumptions.
A key shift in coordination this week:
Strad is on a 3-month sabbatical and some critical work now depends on the community to move forward
This includes ongoing efforts around Zaino chain index integration and related PRs
This is one of those moments where contributors can directly shape the stack.
Interesting discussion on Crosslink design:
There’s growing curiosity around alternative BFT models like Avalanche and DAG-based approaches
But concerns remain especially around finality guarantees and analyzability
The direction seems clear: keep Crosslink modular, while prioritizing strong, verifiable finality.
On the research side, one thing stood out:
Recent Google paper on quantum computing suggests timelines may be closer than expected
It may have missed key details around how attacks could affect systems like Zcash
This is already shaping thinking around a fully post-quantum Zcash design sooner than many anticipated