Security PSA: Observed risks in Zcash mining pool distribution

Security PSA: Observed risks in Zcash mining pool distribution

Coinbase recently detected the emergence of a single mining pool that gained over half of Zcash’s hash power. To protect our users, Coinbase increased our Zcash network confirmation requirement, moved our Zcash trading markets into limit-only mode, and engaged directly with the Zcash team and mining pool operator to mitigate potential risks to the broader community.

Background

Blockchain Security at Coinbase

In line with our ongoing commitment to security, decentralization, and compliance with our digital asset listing standards, Coinbase’s Blockchain Security team continuously assesses risks within the digital assets we support. This blog post will focus on a recent discovery related to a significant imbalance in hash power distribution within the Zcash network. We will elaborate on the centralization risks in the Zcash network and discuss our interactions with the Electric Coin Company (the company that launched Zcash) and ViaBTC (a blockchain mining operator) to address these concerns. We’ll also explain the general risks of centralization in Proof-of-Work (PoW) blockchain networks and share the safeguards we’ve put in place to protect our users.

Centralization Risks in PoW Networks

In a Proof-of-Work (PoW) blockchain, miners compete to solve intricate mathematical problems to validate transactions and add new blocks to the blockchain. Although essential for ensuring network security and trust, if a single miner or mining pool gains over 51% of the network’s hash power, it can introduce serious security vulnerabilities. With a majority of computational power, such an entity could manipulate the blockchain in various ways — such as executing doublespend attacks or censoring transactions, potentially leading to a loss of user and exchange funds.

Security Controls for Third Party Blockchain Networks

Before adding any blockchain to our exchange, our Blockchain Security team conducts a comprehensive security assessment. One key criterion is to ensure that no single entity exercises centralized control over the network. This involves checks for central authorities that can transfer or burn funds, or arbitrarily revert previous transactions. 

Coinbase also continuously monitors existing blockchain networks for material changes that could impact a blockchain’s security assessment. For PoW networks, we employ specialized hash power heuristics designed to detect significant shifts in mining power. Should a network’s hash power become excessively centralized, we implement appropriate measures to protect Coinbase users.

Additional Details on Zcash

Immediate Actions to Protect Our Users

Recently, we discovered that a single mining pool, ViaBTC, controls more than 51% of Zcash’s network hash power. In response, our team has deployed several mitigations:

  • Increased the Zcash confirmation requirement to 110 blocks to reduce risk of double-spending or fraudulent transactions. This increases deposit time from ~40 minutes to ~2.5 hours.
  • Moved our Zcash markets into a limit-only state to reduce impact of any volatility.
  • Engaged in discussions with Electric Coin Company, the team behind Zcash, and ViaBTC for broader distribution of mining. We shared our concerns around the risks of mining centralization and provided recommendations for various options that either party could implement to reduce the risk of a 51% attack. 

The Path Forward

Coinbase ultimately hopes for decentralized Zcash mining. In the meantime, we believe the mitigations we have taken adequately protect our users. In particular, we are optimistic about our engagement with our external partners as we collectively focus on securing all participants in the cryptoeconomy.