Description
All functions that require a merkle root to verify note inclusion must validate that the merkle root is valid. Otherwise, attackers can forge a merkle root that includes a fake note and steal all assets.
Recommendation
Validate that the provided Merkle Root is valid.
Status
Addressed in #5520165.