feat(utxo-lib): add ZEC NU6.2 consensus branch id

Zcash NU6.2 activated on mainnet at block 3364600, introducing a new
consensus branch id 0x5437f330 (re-enabling Orchard with a corrected
circuit after the GHSA-ghc3-g8w4-whf9 emergency soft fork). The builder
previously defaulted to NU6.1 (0x4dec4df0), so transactions built for
heights >= 3364600 carried a stale branch id and were rejected by
upgraded nodes.

Add VERSION4/5_BRANCH_NU6_2 markers (457/552) and the 0x5437f330 branch
id, wire it through getDefaultConsensusBranchIdForVersion,
getDefaultVersionGroupIdForVersion, setPsbtDefaults, and both
setDefaultsForVersion switches. Bump the mainnet default build version
to NU6.2; testnet stays on NU6.1 because its NU6.2 activation
(block 4052000) has not been reached.

Regenerate the zcash PSBT signing fixtures: the consensus branch id
feeds the transaction sighash, so the serialized PSBTs and signatures
change with the new default.

Refs: T1-3519

Author: OttoAllmendinger

modules/utxo-lib/src/bitgo/transaction.ts

@@ -154,8 +154,8 @@ export function createPsbtFromTransaction(tx: UtxoTransaction<bigint>, prevOuts:
 }
 
 export function getDefaultTransactionVersion(network: Network): number {
-  // Use NU6_1 version for both mainnet and testnet
-  // https://zips.z.cash/zip-0255
+  // Mainnet activated NU6.2 at block 3364600; testnet has not (activation 4052000),
+  // so testnet still builds NU6.1 transactions.
   if (network === networks.zcashTest) {
     return ZcashTransaction.VERSION4_BRANCH_NU6_1;
   }
@@ -167,7 +167,7 @@ export function getDefaultTransactionVersion(network: Network): number {
     case networks.ecash:
       return 2;
     case networks.zcash:
-      return ZcashTransaction.VERSION4_BRANCH_NU6_1;
+      return ZcashTransaction.VERSION4_BRANCH_NU6_2;
     default:
       return 1;
   }
@@ -219,9 +219,11 @@ export function setPsbtDefaults(
           ZcashTransaction.VERSION4_BRANCH_NU5,
           ZcashTransaction.VERSION4_BRANCH_NU6,
           ZcashTransaction.VERSION4_BRANCH_NU6_1,
+          ZcashTransaction.VERSION4_BRANCH_NU6_2,
           ZcashTransaction.VERSION5_BRANCH_NU5,
           ZcashTransaction.VERSION5_BRANCH_NU6,
           ZcashTransaction.VERSION5_BRANCH_NU6_1,
+          ZcashTransaction.VERSION5_BRANCH_NU6_2,
         ].includes(version)
       ) {
         throw new Error(`invalid version`);

modules/utxo-lib/src/bitgo/zcash/ZcashPsbt.ts

@@ -122,12 +122,14 @@ export class ZcashPsbt extends UtxoPsbt<ZcashTransaction<bigint>> {
       case ZcashTransaction.VERSION4_BRANCH_NU5:
       case ZcashTransaction.VERSION4_BRANCH_NU6:
       case ZcashTransaction.VERSION4_BRANCH_NU6_1:
+      case ZcashTransaction.VERSION4_BRANCH_NU6_2:
         this.setVersion(4);
         break;
       case 5:
       case ZcashTransaction.VERSION5_BRANCH_NU5:
       case ZcashTransaction.VERSION5_BRANCH_NU6:
       case ZcashTransaction.VERSION5_BRANCH_NU6_1:
+      case ZcashTransaction.VERSION5_BRANCH_NU6_2:
         this.setVersion(5);
         break;
       default:

modules/utxo-lib/src/bitgo/zcash/ZcashTransaction.ts

@@ -25,6 +25,8 @@ const CANOPY_BRANCH_ID = 0xe9ff75a6;
 const NU5_BRANCH_ID = 0xc2d6d0b4;
 const NU6_BRANCH_ID = 0xc8e71055;
 const NU6_1_BRANCH_ID = 0x4dec4df0; // https://zips.z.cash/zip-0255
+// NU6.2 emergency hard fork re-enabling Orchard with a corrected circuit (mainnet block 3364600).
+const NU6_2_BRANCH_ID = 0x5437f330;
 
 export class UnsupportedTransactionError extends Error {
   constructor(message: string) {
@@ -38,18 +40,20 @@ export function getDefaultVersionGroupIdForVersion(version: number): number {
     case 450:
     case 455:
     case 456:
+    case 457:
       return SAPLING_VERSION_GROUP_ID;
     case 500:
     case 550:
     case 551:
+    case 552:
       return ZIP225_VERSION_GROUP_ID;
   }
   throw new Error(`no value for version ${version}`);
 }
 
 export function getDefaultConsensusBranchIdForVersion(network: ZcashNetwork, version: number): number {
-  // Use NU6.1 version for testnet, activated on mainnet in block 2726400
-  // https://zips.z.cash/zip-0255
+  // Testnet has not yet activated NU6.2 (testnet activation block 4052000), so keep
+  // defaulting to NU6.1 there. Mainnet activated NU6.2 at block 3364600.
   if (network === networks.zcashTest) {
     if (version === 4 || version === 5) {
       return NU6_1_BRANCH_ID;
@@ -74,12 +78,16 @@ export function getDefaultConsensusBranchIdForVersion(network: ZcashNetwork, ver
     case ZcashTransaction.VERSION5_BRANCH_NU6:
       // https://zips.z.cash/zip-0253
       return NU6_BRANCH_ID;
-    case 4:
-    case 5:
     case ZcashTransaction.VERSION4_BRANCH_NU6_1:
     case ZcashTransaction.VERSION5_BRANCH_NU6_1:
       // https://zips.z.cash/zip-0255
       return NU6_1_BRANCH_ID;
+    case 4:
+    case 5:
+    case ZcashTransaction.VERSION4_BRANCH_NU6_2:
+    case ZcashTransaction.VERSION5_BRANCH_NU6_2:
+      // NU6.2 — emergency hard fork re-enabling Orchard, mainnet block 3364600
+      return NU6_2_BRANCH_ID;
   }
   throw new Error(`no value for version ${version}`);
 }
@@ -93,9 +101,11 @@ export class ZcashTransaction<TNumber extends number | bigint = number> extends
   static VERSION4_BRANCH_NU5 = 450;
   static VERSION4_BRANCH_NU6 = 455;
   static VERSION4_BRANCH_NU6_1 = 456;
+  static VERSION4_BRANCH_NU6_2 = 457;
   static VERSION5_BRANCH_NU5 = 500;
   static VERSION5_BRANCH_NU6 = 550;
   static VERSION5_BRANCH_NU6_1 = 551;
+  static VERSION5_BRANCH_NU6_2 = 552;
 
   // 1 if the transaction is post overwinter upgrade, 0 otherwise
   overwintered = 0;

modules/utxo-lib/src/bitgo/zcash/ZcashTransactionBuilder.ts

@@ -74,12 +74,14 @@ export class ZcashTransactionBuilder<TNumber extends number | bigint = number> e
       case ZcashTransaction.VERSION4_BRANCH_NU5:
       case ZcashTransaction.VERSION4_BRANCH_NU6:
       case ZcashTransaction.VERSION4_BRANCH_NU6_1:
+      case ZcashTransaction.VERSION4_BRANCH_NU6_2:
         this.setVersion(4);
         break;
       case 5:
       case ZcashTransaction.VERSION5_BRANCH_NU5:
       case ZcashTransaction.VERSION5_BRANCH_NU6:
       case ZcashTransaction.VERSION5_BRANCH_NU6_1:
+      case ZcashTransaction.VERSION5_BRANCH_NU6_2:
         this.setVersion(5);
         break;
       default: