CVE-2026-52733

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::poptip removed a reverted tip block but did n...

Risk of reuse of signatures across forks due to lack of chainID validation

Lines of code Vulnerability details Impact In the HolographERC20.sol contract the contract is started with the init function, during which the eip712init function is triggered : contracts/enforcer/HolographERC20.sol: 244: eip712initdomainSeperator, domainVersion; With CACHEDCHAINID = block.chaini...

Signature can be reused across forks due to lack of chainid validation

Lines of code Vulnerability details Impact The signature for GraphTokenUpgradeable.permit won't be resilient to chainsplits. In the event of a chain fork, the message will be assumed valid of both chains and this could allow replays attacks across forks. Proof of Concept The chainid for the...