Equilibrium / Selected work / Ziggurat — Zcash

Ziggurat — Zcash

Foundational P2P network-testing and stability framework for Zcash that discovered and responsibly disclosed critical network-layer vulnerabilities, and spawned the Ziggurat methodology.

Completed
runziggurat/zcash
Client Zcash Community Grants
Ecosystems Zcash
Stack Rust
Delivered by Equilibrium Labs (now Equilibrium)

Overview

Equilibrium built Ziggurat, the foundational peer-to-peer network-testing and stability framework for Zcash, funded by Zcash Community Grants (the grant body formerly ZOMG). Across multiple grants (Ziggurat → 2.0 → 3.0) it grew from single-node P2P testing into network-wide analysis. Built in Rust, it tests both Zcash node implementations, zcashd and zebrad, across roughly 20 Bitcoin-derived P2P message types (Zcash inherited Bitcoin’s network protocol).

Ziggurat is organized as three testing layers: conformance to spec, performance under scale, and resistance to malicious actors, driven by a methodology of reverse-engineering the network protocol and exercising it with lightweight “synthetic” nodes. That methodology became the Ziggurat methodology, later applied to XRPL, Algorand and, most extensively, Solana.

Deliverables

  • P2P test suite for local Zcash networks (zcashd, zebrad).
  • Network crawler.
  • Network visualizer tool.
  • Automated nightly CI workflows.
  • Red-team exercises on the Zcash testnet.
  • The Ziggurat 3.0 grant proposal and execution.

Network & protocol testing

  • Surfaced major network-layer behavioral differences between zcashd and zebrad, starting at the initial handshake, across the ~20 Bitcoin-style message types.
  • Produced what the project describes as the most comprehensive specification of the Zcash network layer: before Ziggurat, Zcash had no network spec beyond what it inherited from Bitcoin, and the work highlighted the need for a formal cross-implementation network specification.

Security testing

  • Discovered, investigated and responsibly disclosed critical network-layer bugs and security vulnerabilities to both node teams: 13 credited issues (10 in zebrad, 3 in zcashd) plus further confirmed issues.
  • Red-team exercises on testnet, with a red-team exercise document that remains a reference for deciding when to re-test after protocol upgrades.

Status

Completed (this phase Jan–Oct 2022). The runziggurat GitHub organization remains a public reference, and the approach has advanced significantly in later Solana engagements.