Upstream
Zcash libraries, protocol specifications and servers that Brave Wallet’s source actually depends on, compared with what Brave builds today. Upstream releases are not changes to Brave: a release only matters to users once Brave adopts it and ships a build.
Readiness and server-side switches
Next network upgrade: NU7 (ZIP 259, Draft)
Testnet activation: 4465026 · Mainnet: TBD (To be set on OCT 20)
Brave: its pinned librustzcash fork does not define the final consensus branch ID 0x77190AD9 (NU7 exists only behind an unstable build flag). Fork source
Upstream librustzcash main: defines it. Upstream source
Brave takes the consensus branch ID for signing from the light-client server at runtime (GetLightdInfo), so the practical effect at activation depends on that path as well. Checked .
ZEC swaps and bridges (gate3 backend)
Zcash routing is turned off in the public code
app/api/swap/constants.py @ 173a2408: SWAP_DISABLED_CHAINS includes Chain.ZCASH.
This is the public repository of Brave’s swap backend. The deployed service could differ; deployment timing is not public. It applies to every platform and browser version.
Field-trial studies touching Zcash (brave-variations)
- ZCashStudy_EnabledWithShieldingOnNewVersions: Every enrolled client (all cohorts alike): enables BraveWalletZCash, zcash_shielded_transactions_enabled=true.
- ZCashStudy_DisabledOnOldVersions: Every enrolled client (all cohorts alike): disables BraveWalletZCash.
- iOSWalletWebUIStudy_ZcashEnabledWithShielding: Every enrolled client (all cohorts alike): enables BraveWalletZCash, zcash_shielded_transactions_enabled=true.
- iOSWalletWebUIStudy_ZcashEnabledWithShielding: Every enrolled client (all cohorts alike): enables BraveWalletZCash, zcash_shielded_transactions_enabled=true.
Studies override compiled-in defaults at runtime when their filters match a build. Read at 86c21c7c.
Rust crates: Brave’s resolved versions vs upstream
Brave’s versions come from third_party/rust/chromium_crates_io/Cargo.lock at each channel build’s brave-core tag and at master. When Brave’s Zcash crate links several versions of a crate, each is listed, highest first; “possible” marks a version the dependency graph could neither confirm nor rule out. “Path” means the crate is built from Brave’s own fork of librustzcash rather than crates.io, so version labels inside the fork are nominal.
| Crate | Impact | Brave master | Brave v1.98.47 (desktop/beta) | Brave v1.96.62 (ios/release) | Brave v1.99.44 (ios/beta) | Brave v1.98.52 (android/beta) | Brave v1.100.5 (desktop/nightly, android/nightly) | Brave v1.99.45 (github/beta) | Brave v1.97.59 (desktop/release) | Brave v1.100.7 (ios/nightly) | Brave v1.98.58 (github/release) | Brave v1.100.9 (github/nightly) | Brave v1.97.57 (android/release) | Upstream stable | Upstream newest | Adoption |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| orchardOrchard/Ironwood note encryption, bundles and proving (circuit feature) in Brave's zcash Rust crate | high |
|
|
|
|
|
|
|
|
|
|
|
|
0.16.0 | 0.16.0 | behind latest stable (0.16.0) |
| zcash_primitivesTransaction components and merkle tree (built from Brave's librustzcash fork) | high |
|
|
|
|
|
|
|
|
|
|
|
|
0.30.1 | 0.31.0-pre.2 | behind latest stable (0.30.1) · built from Brave’s librustzcash fork |
| zcash_protocolConsensus/network constants (built from Brave's librustzcash fork) | high |
|
|
|
|
|
|
|
|
|
|
|
|
0.10.6 | 0.11.0-pre.1 | behind latest stable (0.10.6) · built from Brave’s librustzcash fork |
| zcash_client_backendShardtree serialization (built from Brave's librustzcash fork) | high |
|
|
|
|
|
|
|
|
|
|
|
|
0.24.0 | 0.25.0-pre.2 | behind latest stable (0.24.0) · built from Brave’s librustzcash fork |
| zcash_encodingSerialization helpers (built from Brave's librustzcash fork) | medium |
|
|
|
|
|
|
|
|
|
|
|
|
0.5.0 | 0.5.0 | behind latest stable (0.5.0) · built from Brave’s librustzcash fork |
| zcash_note_encryptionBatch trial decryption used during scanning | high |
|
|
|
|
|
|
|
|
|
|
|
|
0.5.1 | 0.5.1 | behind latest stable (0.5.1) |
| shardtreeNote commitment tree storage used by sync | high |
|
|
|
|
|
|
|
|
|
|
|
|
0.8.0 | 0.8.0 | behind latest stable (0.8.0) |
| incrementalmerkletreeCommitment tree primitives | medium |
|
|
|
|
|
|
|
|
|
|
|
|
0.9.0 | 0.9.0 | behind latest stable (0.9.0) |
| zip32HD key derivation (transitive via orchard) | medium |
|
|
|
|
|
|
|
|
|
|
|
|
0.3.0 | 0.3.0 | behind latest stable (0.3.0) |
| halo2_proofsProving system (transitive via orchard circuit feature) | medium |
|
|
|
|
|
|
|
|
|
|
|
|
0.4.0 | 0.4.0 | behind latest stable (0.4.0) |
| halo2_gadgetsCircuit gadgets (transitive; subject of CVE-2026-54496) | medium |
|
|
|
|
|
|
|
|
|
|
|
|
0.6.0 | 0.6.0 | behind latest stable (0.6.0) |
| pasta_curvesCurve arithmetic (transitive) | low |
|
|
|
|
|
|
|
|
|
|
|
|
0.6.1 | 0.6.1 | behind latest stable (0.6.1) |
| reddsaSignatures (transitive) | low |
|
|
|
|
|
|
|
|
|
|
|
|
0.6.1 | 0.6.1 | behind latest stable (0.6.1) |
| sinsemillaHash (transitive) | low |
|
|
|
|
|
|
|
|
|
|
|
|
0.2.0 | 0.2.0 | behind latest stable (0.2.0) |
librustzcash fork: brave-core pins brave/librustzcash@f01f50d642 (brave_ironwood_support). Compared with zcash/librustzcash main: 2 commits ahead, 1023 behind; merge base 54efc30cd6 (). Compare on GitHub
Security advisories
From the GitHub Advisory Database (by package) and RustSec. Each advisory’s vulnerable ranges are compared with Brave’s resolved versions at master and current channel builds.
-
GHSA-932p-ww36-57vg medium
Public GetAddressUtxos requests can overfetch backend UTXOs and degrade normal wallet requests
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.5.4). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns GetAddressUtxos; Brave Wallet’s Zcash client calls GetAddressUtxos.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.5.4
- Patched: github.com/zcash/lightwalletd none
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-m7j5-wvx3-qj6j low
lightwalletd can serve old-fork and new-fork blocks in one live GetBlockRange response during reorg repair
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.5.2). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns GetBlockRange; Brave Wallet’s Zcash client calls GetBlockRange.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.5.2
- Patched: github.com/zcash/lightwalletd 0.5.3
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-pwwg-h8q5-hq28 low
lightwalletd cache can stitch old-fork and new-chain blocks after restart
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.4.19). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.4.19
- Patched: github.com/zcash/lightwalletd 0.5.0
Published
-
GHSA-9p9r-mggr-8q9g medium
lightwalletd GetMempoolTx holds shared mempool mutex across client-controlled streaming sends
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd >= 0.4.13, <= 0.5.1). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns GetMempoolTx, which Brave Wallet’s Zcash client does not call (it calls 9 CompactTxStreamer methods), so Brave Wallet’s own requests do not use the affected method; effects on a shared backend cannot be ruled out.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd >= 0.4.13, <= 0.5.1
- Patched: github.com/zcash/lightwalletd 0.5.2
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-f9pw-q493-7qvh medium
Deadlock and Uncontrolled Resource Consumption in github.com/zcash/lightwalletd
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd >= 0.4.13, <= 0.5.1). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd >= 0.4.13, <= 0.5.1
- Patched: github.com/zcash/lightwalletd 0.5.2
Published
-
GHSA-9x94-88pq-6v7h high
Lightwalletd cancelled block-range streams leak worker goroutines
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.4.19). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.4.19
- Patched: github.com/zcash/lightwalletd 0.5.0
Published
-
GHSA-4x4j-5972-376r high
lightwalletd GetMempoolTx can crash a targeted node when a mempool transaction disappears
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.4.19). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns GetMempoolTx, which Brave Wallet’s Zcash client does not call (it calls 9 CompactTxStreamer methods), so Brave Wallet’s own requests do not use the affected method; effects on a shared backend cannot be ruled out.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.4.19
- Patched: github.com/zcash/lightwalletd 0.5.0
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-4hp3-3494-3f2m medium
lightwalletd GetMempoolTx large exclude suffix lists amplify CPU and heap under the method mutex
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.5.0). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns GetMempoolTx, which Brave Wallet’s Zcash client does not call (it calls 9 CompactTxStreamer methods), so Brave Wallet’s own requests do not use the affected method; effects on a shared backend cannot be ruled out.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.5.0
- Patched: github.com/zcash/lightwalletd 0.5.1
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-6ppp-r2gc-9q6v high
lightwalletd SendTransaction oversized raw transactions can OOM a targeted node before backend rejection
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.5.0). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns SendTransaction; Brave Wallet’s Zcash client calls SendTransaction.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.5.0
- Patched: github.com/zcash/lightwalletd 0.5.1
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-q2c2-hpp9-58hm high
lightwalletd GetTreeState oversized block hashes can OOM a targeted node before backend rejection
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= 0.5.0). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns GetTreeState; Brave Wallet’s Zcash client calls GetTreeState.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= 0.5.0
- Patched: github.com/zcash/lightwalletd 0.5.1
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-x4m7-3gpp-xc36 high
lightwalletd transparent-address gRPC resource-exhaustion DoS
Brave: Affects lightwalletd servers (github.com/zcash/lightwalletd <= v0.4.19). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public.
Ranges and checks
- Vulnerable: github.com/zcash/lightwalletd <= v0.4.19
- Patched: github.com/zcash/lightwalletd 0.5.0
Published
-
GHSA-5h96-xw2v-jxgq high
Goroutine Leak in GetBlockRange
Brave: Affects lightwalletd servers (zcash/lightwalletd <= v0.4.19). Brave Wallet does not ship lightwalletd; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns GetBlockRange; Brave Wallet’s Zcash client calls GetBlockRange.
Ranges and checks
- Vulnerable: zcash/lightwalletd <= v0.4.19
- Patched: zcash/lightwalletd v5.0
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-ww9q-8r59-xv46 CVE-2026-54496 critical
Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
Brave: Affects rust:zebrad, rust:halo2_gadgets, rust:orchard, rust:zcash_primitives. Brave's pins of halo2_gadgets, orchard, zcash_primitives are outside the vulnerable ranges at every checked build (master and 11 channel builds (v1.98.47, v1.96.62, v1.99.44, v1.98.52, v1.100.5, v1.99.45, v1.97.59, v1.100.7, v1.98.58, v1.100.9, v1.97.57)); zebrad is not present in Brave's Cargo.lock at any checked build (master and 11 channel builds (v1.98.47, v1.96.62, v1.99.44, v1.98.52, v1.100.5, v1.99.45, v1.97.59, v1.100.7, v1.98.58, v1.100.9, v1.97.57)). zcash_primitives 0.29.0 is a version label in Brave's librustzcash fork, so comparing it with the vulnerable ranges is nominal: the code need not match the upstream release with that number.
Ranges and checks
- Vulnerable: zebrad <= 4.5.1
- Vulnerable: halo2_gadgets < 0.5.0
- Vulnerable: orchard < 0.14.0
- Vulnerable: zcash_primitives < 0.28.0
- Patched: zebrad 5.0.0
- Patched: halo2_gadgets 0.5.0
- Patched: orchard 0.14.0
- Patched: zcash_primitives 0.28.0
- v1.98.47 (desktop/beta): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.98.47 (desktop/beta): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.98.47 (desktop/beta): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- master: halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- master: orchard 0.15.0 is outside the vulnerable range < 0.14.0
- master: zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.96.62 (ios/release): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.96.62 (ios/release): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.96.62 (ios/release): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.99.44 (ios/beta): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.99.44 (ios/beta): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.99.44 (ios/beta): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.98.52 (android/beta): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.98.52 (android/beta): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.98.52 (android/beta): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.100.5 (desktop/nightly, android/nightly): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.100.5 (desktop/nightly, android/nightly): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.100.5 (desktop/nightly, android/nightly): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.99.45 (github/beta): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.99.45 (github/beta): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.99.45 (github/beta): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.97.59 (desktop/release): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.97.59 (desktop/release): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.97.59 (desktop/release): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.100.7 (ios/nightly): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.100.7 (ios/nightly): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.100.7 (ios/nightly): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.98.58 (github/release): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.98.58 (github/release): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.98.58 (github/release): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.100.9 (github/nightly): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.100.9 (github/nightly): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.100.9 (github/nightly): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- v1.97.57 (android/release): halo2_gadgets 0.5.0 is outside the vulnerable range < 0.5.0
- v1.97.57 (android/release): orchard 0.15.0 is outside the vulnerable range < 0.14.0
- v1.97.57 (android/release): zcash_primitives 0.29.0 (version label in Brave's librustzcash fork) is outside the vulnerable range < 0.28.0
- zebrad: not present in Brave's Cargo.lock at v1.98.47 (desktop/beta); master; v1.96.62 (ios/release); v1.99.44 (ios/beta); v1.98.52 (android/beta); v1.100.5 (desktop/nightly, android/nightly); v1.99.45 (github/beta); v1.97.59 (desktop/release); v1.100.7 (ios/nightly); v1.98.58 (github/release); v1.100.9 (github/nightly); v1.97.57 (android/release)
Published
-
GHSA-j3f2-h3wv-wfr9 low
send_raw_transaction Forwards Unvalidated Hex to Validator
Brave: Affects Zaino servers (zingolabs/zaino <=0.4.2). Brave Wallet does not ship Zaino; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns send_raw_transaction, which Brave Wallet’s Zcash client does not call (it calls 9 CompactTxStreamer methods), so Brave Wallet’s own requests do not use the affected method; effects on a shared backend cannot be ruled out.
Ranges and checks
- Vulnerable: zingolabs/zaino <=0.4.2
- Patched: zingolabs/zaino 0.5.0
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-h268-r3v6-jqj6 low
get_treestate Proxies Arbitrary Hashes to Validator Without Validation
Brave: Affects Zaino servers (zingolabs/zaino <=0.4.2). Brave Wallet does not ship Zaino; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public. The advisory concerns get_treestate, which Brave Wallet’s Zcash client does not call (it calls 9 CompactTxStreamer methods), so Brave Wallet’s own requests do not use the affected method; effects on a shared backend cannot be ruled out.
Ranges and checks
- Vulnerable: zingolabs/zaino <=0.4.2
- Patched: zingolabs/zaino 0.5.0
- Brave master calls: GetAddressUtxos, GetBlockRange, GetLatestBlock, GetLatestTreeState, GetLightdInfo, GetTaddressTxids, GetTransaction, GetTreeState, SendTransaction
Published
-
GHSA-55pv-cqqp-mwj3 medium
Validator Fork Acceptance — Height Equality Used as Sync Truth (No Hash/Work Check)
Brave: Affects Zaino servers (zingolabs/zaino <=0.4.2). Brave Wallet does not ship Zaino; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public.
Ranges and checks
- Vulnerable: zingolabs/zaino <=0.4.2
- Patched: zingolabs/zaino 0.5.0
Published
-
GHSA-3whf-vgf2-9w6g high
Non-Finalized State Reorg — No Cycle Detection or Depth Limit
Brave: Affects Zaino servers (zaino-state zaino-state v0.2.0). Brave Wallet does not ship Zaino; it connects to a Brave-operated proxy (zcash.wallet.brave.com) whose backend software and version are not public.
Ranges and checks
- Vulnerable: zaino-state zaino-state v0.2.0
- Patched: zaino-state none
Published
Light-client protocol and servers
Brave Wallet syncs Zcash through the lightwalletd CompactTxStreamer gRPC protocol. Endpoints compiled into brave-core master: https://3xpl.com/zcash/transaction, https://blockexplorer.one/zcash/testnet/tx, https://testnet.zec.rocks/, https://zcash.wallet.brave.com/. The mainnet endpoint is a Brave-operated proxy; which server software runs behind it is not public.
- lightwalletd high — Light-client server protocol Brave speaks (CompactTxStreamer over gRPC); Brave takes the consensus branch ID from GetLightdInfo
- lightwallet-protocol high — Canonical .proto definitions mirrored in Brave's zcash_grpc_data.proto
- Zaino medium — Alternative indexer implementing the same CompactTxStreamer API; no reference in brave-core
Protocol specifications (ZIPs)
Recent upstream releases
- zcash_client_backend 0.25.0-pre.2 (pre-release) crates.io
- zcash_primitives 0.31.0-pre.2 (pre-release) crates.io
- zcash_protocol 0.11.0-pre.1 (pre-release) crates.io
- lightwalletd v0.5.5 release
- zcash_client_backend 0.25.0-pre.1 (pre-release) crates.io
- zcash_primitives 0.31.0-pre.1 (pre-release) crates.io
- zcash_client_backend 0.25.0-pre.0 (pre-release) crates.io
- zcash_primitives 0.31.0-pre.0 (pre-release) crates.io
- zcash_protocol 0.11.0-pre.0 (pre-release) crates.io
- orchard 0.16.0 crates.io
- shardtree 0.8.0 crates.io
- zcash_note_encryption 0.5.1 crates.io
- Zaino 0.10.1 release
- zcash_note_encryption 0.5.0 crates.io
- Zaino 0.10.0 release
- zcash_protocol 0.10.6 crates.io
- Zaino 0.9.0 release
- lightwalletd v0.5.4 release
- zcash_client_backend 0.24.0 crates.io
- zcash_primitives 0.30.1 crates.io
- zcash_protocol 0.10.5 crates.io
- Zaino 0.8.0 release
- Zaino 0.7.0 release
- lightwalletd v0.5.3 release
- zcash_client_backend 0.24.0-rc.7 (pre-release) crates.io
- zcash_protocol 0.10.4 crates.io
- orchard 0.15.5 crates.io
- Zaino 0.7.0-rc.1 (pre-release) release
- lightwalletd v0.5.2 release
- zcash_client_backend 0.24.0-rc.6 (pre-release) crates.io
- zcash_protocol 0.10.3 crates.io
- zcash_client_backend 0.24.0-rc.5 (pre-release) crates.io
- zcash_protocol 0.10.2 crates.io
- lightwalletd v0.5.1 release
- zcash_client_backend 0.24.0-rc.4 (pre-release) crates.io
- zcash_client_backend 0.24.0-rc.3 (pre-release) crates.io
- lightwalletd v0.5.0 release
- zcash_client_backend 0.24.0-rc.2 (pre-release) crates.io
- zcash_primitives 0.30.0 crates.io
- zcash_protocol 0.10.1 crates.io
Watch topics
Research and proposals that could matter to Brave Wallet later. They are tracked as upstream work unless Brave’s own source shows adoption. Performance figures belong to their publishers and were not measured in Brave Wallet.
-
Zakura full node (Zebra fork) and Zakura Common crypto crates
Rust Zcash full node forked from Zebra, with "Zakura Common" forks of librustzcash/orchard/halo2. Its sync, proving and verification speed-ups are self-reported by the project. Latest release: v1.7.0-rc1.
Claims from zakura.com and the zakura-core/zakura README; not independently verified and not measured in Brave Wallet. Last activity .
Brave adoption: none found — No zakura packages in brave-core Cargo.lock or DEPS (master); 0 brave-browser/brave-core issue or PR search hit(s) for "zakura".
-
zakura-core/wallet-libraries (pczt, client backend, client sqlite forks)
Renamed forks of librustzcash wallet crates rewired onto Zakura Common; published as release candidates on crates.io. Last commit: Let a transport stop recovery on its own budget without losing the round (#227).
Description from the repository README. Last activity .
Brave adoption: none found — No wallet-libraries packages in brave-core Cargo.lock or DEPS (master); 5 brave-browser/brave-core issue or PR search hit(s) for "wallet-libraries".
-
zkDragon (X/Twitter handle, not a code project)
No zkDragon repository or library exists; the name is an X/Twitter handle cited in Zcash ecosystem digests. It is not monitored live because X is not publicly readable without an account.
Mentions come from third-party ZecHub newsletters and are unconfirmed.
Brave adoption: none found — No zkdragon packages in brave-core Cargo.lock or DEPS (master); 0 brave-browser/brave-core issue or PR search hit(s) for "zkdragon".