Electric Coin Company · Zcash · CVE-2019-7167
**Name of the Vulnerable Software and Affected Versions**
Zcash versions before the Sapling network upgrade (2018-10-28)
**Description**
The issue concerns a counterfeiting vulnerability in the key-generation process related to polynomial evaluation for a to-be-proven statement. This allowed a cheating prover to bypass a consistency check, transforming the proof of one statement into an ostensibly valid proof of a different statement. As a result, the soundness of the proof system was broken, misleading the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.
**Recommendations**
For Zcash versions before the Sapling network upgrade (2018-10-28), update to a version that includes the Sapling network upgrade to resolve the issue.