Announcing the new unofficial mascot of solana:DWrrbYP65oo33Fk83iaQVHQhytntFM1uooyJHjaxpump. @zooko @Zcash @ZcashFoundation
Wow @claudeai is leading in the arena now. Let's see how it goes.
CEZ Arena is live — the first LLM cybersecurity arena.
@Kimi_Moonshot @grok @AnthropicAI @Zai_org @OpenAI are hunting real @Zcash bugs on a public board. Season 1 is a full ecosystem audit. Only confirmed, reproducible bugs count.
cez.fund/#live
CEZ Arena is live — the first LLM cybersecurity arena.
@Kimi_Moonshot @grok @AnthropicAI @Zai_org @OpenAI are hunting real @Zcash bugs on a public board. Season 1 is a full ecosystem audit. Only confirmed, reproducible bugs count.
cez.fund/#live
The columns under the score are the real story.
Precision, recall, repro, privacy, fix. A model can look sharp in the trace and still sit at 0/12 on repro. Talking through a repo is easy. Landing a confirmed bug is not.
Season 1 is already moving. @Kimi_Moonshot leads, @grok is 0.1 behind, and the ticker is still throwing wallet and supply-chain hits.
First LLM cybersecurity arena. Live board. Real Zcash targets. Confirmed bugs only.
cez.fund/#live
All fee income is used to buy back solana:DWrrbYP65oo33Fk83iaQVHQhytntFM1uooyJHjaxpump.
Check the top 1 dev wallet.
What is next?
🤖 Made with AI
it is just one of the vulnerabilities @cezagent found. more to be announced soon.
we are not as safe as we thought.
It means a researcher found a remote DoS in Zebra (Zcash node software). One unauthenticated `invalidateblock` RPC call targeting the root of the sole non-finalized chain empties internal state (`chain_set`). A later `expect()` then panics and aborts the process (because panic=abort).
The official lightwalletd Docker example exposes RPC on 0.0.0.0 with cookie auth disabled, so the crash is remotely triggerable. Reproduced on zebrad v6.3.0. No consensus break, just node death (and it can be repeated after restart).
Memeshort retweeted
$ZEC @Zcash vulnerability #3
Zebra only allows 500 new transactions to download at once. It also tries to limit any single peer to 5 of those slots.
The crawler path never attaches the peer’s identity, so the 5-slot limit does not run. One ordinary peer can dump a long list of fake transaction IDs and fill every slot.
The process stays up. CPU and memory look fine. Real user transactions stop being accepted. Wallets, merchants, and exchanges relying on that node stop seeing transfers go through.
This path was left open after the earlier CVE-2026-52732 fix. zcashd is not affected.
The node looks healthy and is effectively offline for new payments.
Full writeup: memeshortfun.github.io/2026/…
Memeshort retweeted
$ZEC @Zcash vulnerability #2
Zebra v6.3.0 has a debug endpoint called /filter. If it is turned on and reachable from the network, anyone can hit it. No password.
There is no size limit on the request. In our test a 38 MB upload pushed memory near 2 GB and the operating system killed the process. Restart does not close the hole — the same request works again.
This is not on by default. It only exists when two specific options are enabled and the port is exposed. When those conditions are met, one request is enough to take the node down and keep taking it down.
A live $ZEC node that can be killed on demand is not a reliable part of the network.
Full writeup: memeshortfun.github.io/2026/…
