Zcash has activated its Ironwood network upgrade to address a critical counterfeiting vulnerability in its old Orchard shielded pool. The upgrade seals the $1.7B pool, trapping any potential fake coins with a "turnstile" mechanism, and introduces a new, formally verified pool with quantum-resistant features. Users must now migrate their funds to the new system.
Orchard pool vulnerability
- ▪A critical vulnerability discovered in May in Zcash's Orchard shielded pool could have allowed an attacker to create counterfeit ZEC
- ▪The flaw, which existed since the Orchard pool's launch in 2022, would have left no on-chain trace if exploited
- ▪Evidence suggests the Orchard vulnerability was not exploited, as the pool's balance grew steadily while the flaw was active
- ▪The vulnerability was discovered by Shielded Labs researcher Taylor Hornby using an AI model
- ▪The discovery of the flaw caused ZEC's price to fall by over 38%, with one report stating it shed over half its value
Ironwood upgrade deployment
- ▪Zcash activated the Ironwood network upgrade (formally NU6.3) on July 28, 2026, at block height 3,428,143
- ▪The upgrade was proposed by Zcash founder Zooko Wilcox as a definitive repair for the counterfeiting vulnerability
- ▪The Ironwood upgrade replaces the compromised Orchard shielded pool with a new, secure one that started with a balance of zero ZEC
Formal verification process
- ▪The Ironwood upgrade also introduces quantum-resistant transaction records to reduce future security risks
- ▪The new Ironwood pool's protocol has undergone formal verification, a mathematical process to prove its code is correct
- ▪The verification produced a public Lean proof with over 2,700 theorems, guaranteeing "balance integrity" against counterfeiting bugs
Orchard pool sealing mechanism
- ▪A "turnstile" mechanism caps total withdrawals from the Orchard pool to the amount that was verifiably deposited
- ▪Users must voluntarily migrate their funds from the old Orchard pool to the new Ironwood pool
- ▪This turnstile system is designed to permanently trap any potential counterfeit coins inside the sealed Orchard pool
- ▪Privacy provider Nym warned that migrating funds without tools like Tor could expose a user's IP address and wallet balance
- ▪The Ironwood upgrade sealed the old Orchard pool, which held approximately 3.7 million ZEC (worth $1.7 billion) and is now closed to new deposits
Future NU7 upgrade plans
- ▪The NU7 upgrade also intends to double the shielded transaction capacity per block, resulting in a ~6x increase in throughput
- ▪Zcash's next planned upgrade, NU7, aims to reduce block times from 75 seconds to about 25 seconds
Story comments
Loading comments…