Skip to content
- Zcash developers stopped a flaw that threatened unlimited counterfeit ZEC.
- Emergency upgrades disabled Orchard transactions before restoring network functionality safely.
- Ironwood proposal introduces stronger verification and additional security audits.
Josh Swihart, Founder of Zcash Open Development Lab (ZODL), announced how the Zcash development team managed to avoid a vulnerability that could have provided the ability to create unlimited ZECs on the Zcash network. Swihart says the developers responded to the threat in a very coordinated manner and were able to neutralize the threat prior to any known exploitation.
On X, Swihart said the team followed a two-step upgrade process to ensure the network remained secure but kept the public from seeing in-depth technical information. The strategy was to minimize risk while not providing any information to prospective attackers which they could use against the protocol.
The first phase was a soft fork which temporarily halted Orchard transactions, according to Swihart. The action would allow developers to keep the vulnerability without disrupting network operations. The team deliberately did not reveal the extent of the problem in the early response phase, he said.
Also Read: Spacecoin Sets $100M Revenue Goal in Exclusive Vietnam Telecom Deal
Emergency Upgrades Blocked Potential Counterfeit ZEC Creation
The second phase was reached during the activation of the hard fork NU6.2, which happened on June 3. The upgrade fixed the underlying issue, and restored Orchard functionality throughout the network, Swihart said. The disclosure by Shielded Labs was the basis for the emergency action, as it indicated that there was a serious flaw in a Zcash’s shielded pool, called Orchard. The group noted that if exploited, the vulnerability could have allowed a hacker to create an infinite number of ZEC tokens. Shielded Labs said that the vulnerability was patched before exploitation was seen. Therefore, the organization believes that the actual attack is unlikely, it said.
Orchard is the main pool of shielded transactions for Zcash. It allows private transfers with zero-knowledge proofs and ensures validity of transactions. Therefore, the security model of the network is of great importance to any vulnerability that compromises Orchard. Swihart said external infrastructure partners played a part in the incident as a technical solution, aside from the technical fix. ZODL has been answering requests from mining pools and exchanges for independent code reviews, he says. The reviews helped to confirm what the team was doing and to further build confidence in the recovery process.
Furthermore, ViaBTC and Foundry credited mining pools as a key enabler for coordinating the network response, Swihart stated. Their involvement helped keep key ecosystem stakeholders on board during the upgrade. The announcement initially caused market uncertainty. The price of ZEC dropped from about $630 to about $303 following the announcement. Worries quickly began to surface from investors who considered Zcash’s privacy technology as one of its best aspects. Since that time, investors’ mood has turned positive. Recently, ZEC bounced off its bottom and is near $428.67 at the time of this report.
Ironwood Upgrade Proposed After Security Incident
After the incident, ZODL revealed plans for a new network upgrade called Ironwood.After the incident, ZODL made it public that it would be implementing a new network upgrade called “Ironwood”. Collaboration with Tachyon,Valar Group, Zcash Foundation, and Shielded labs are part of the proposal. Ironwood would implement formal verification and other independent audits on Orchard, adding to its capabilities. The involved organisations think that those measures can further enhance the security framework of Zcash and lessen future risks.
The incident provided Swihart with insights to help enhance the emergency response process, foster greater collaboration in the ecosystem, and better prepare the network for future upgrades. In doing so, the successful response avoided a potentially damaging counterfeit minting event and re-established trust in the network. The development of Ironwood is now underway and Zcash contributors are diligently working on strengthening the protocol’s long-term security and resilience.
Also Read: DOJ and Tech Giants Freeze $3.8M in Crypto Linked to Fraud Networks
