Zakura has merged code intended to limit how much Zcash (ZEC) payment history a future attack on a published swap address could reveal, although the protection is not active in wallets.
The Oct. 14 change to Zakura’s wallet libraries supports a distinct incoming viewing key for each address used in a NEAR Intents swap. The design remains under review, so the code merge does not mean people using those wallets have the safeguard.
The proposal addresses an exposure created by the way swaps handle addresses. When someone swaps ZEC for an asset on another chain, a refund address is written to NEAR’s public chain as the deposit registers, even if the swap completes without a refund. Receiving addresses for swaps into ZEC can likewise appear on a public chain. Those addresses may otherwise share an incoming viewing key, which a wallet uses to identify and read payments it receives.
Zakura says a sufficiently powerful future quantum computer could theoretically recover that key from a published address, exposing incoming payments associated with it. The key would not allow an attacker to spend the ZEC. By giving each posted swap address its own incoming viewing key, the proposed design would confine any such disclosure to payments received at that address. It would not protect every part of Zcash from future quantum attacks.
That narrower exposure comes with more work for wallets. A restored wallet would need a way to find payments connected to earlier swaps despite the use of separate keys. For swaps out of ZEC, Zakura’s design puts an encrypted memo containing a refund index in the transaction’s change output, allowing the wallet to find the refund address later.
A swap into ZEC has no corresponding change output. In those cases, the wallet would first check candidate addresses against downloaded filters. It would then use private information retrieval to look up addresses the filters indicate were paid, without disclosing the queried addresses to the lookup server.
Zakura expects compatible software wallets to integrate the feature over the coming weeks. Hardware wallets would also need firmware changes. Zakura has given no firm launch date.
