Editor's Note: On June 5th Beijing time, privacy project Zcash was exposed to have had a critical forgery vulnerability in its new-generation privacy pool Orchard. The price of Zcash's token ZEC plunged, at one point halving to a low near $250.
After about 10 days of development, market panic has somewhat subsided, and the price of ZEC has also recovered somewhat, climbing back to $500 today. (Recommended reading: "'Unlimited Money Printing' Vulnerability Lay Dormant for Four Years, Privacy Coin ZEC Halved in a Day")
This morning, Zcash founder Zooko Wilcox released another lengthy article in response to the market's key concerns.
He stated that it is likely the Orchard vulnerability was not previously exploited, and legitimate Orchard funds can be recovered. Currently, users cannot independently verify whether the Zcash supply exceeds the limit, but the Ironwood upgrade will seal the Orchard pool, restoring this verification capability. Ongoing audits have not revealed other forgery vulnerabilities, but complete certainty requires more work.
The recent Orchard vulnerability has raised important questions about Zcash's supply and user fund security. The discussion has mixed several different issues, making it difficult to understand the actual impact of this vulnerability on users. This article attempts to separate these issues and explain what they each mean for users.
The Orchard vulnerability raises four important questions:
1. Was the Orchard vulnerability ever exploited?
2. Can legitimate Orchard funds be recovered?
3. Can users verify that the Zcash supply has not been inflated?
4. How do we know there are no other forgery vulnerabilities?
Was the Orchard Vulnerability Ever Exploited?
Unknown. We believe it's unlikely to have been exploited previously, though it cannot be completely ruled out. We think the vulnerability likely remained unexploited for three reasons:
Despite continuous review over the years by many of the world's top cryptographers and security researchers, this vulnerability was not previously discovered. Its final discovery was not accidental; it was found by Taylor Hornby of Shielded Labs, whose goal was to proactively identify such security vulnerabilities before malicious attackers could.
Taylor used advanced AI-assisted security research techniques and custom-built tools specifically designed to find subtle flaws others missed. Doing this would be more difficult for someone not deeply familiar with the Zcash codebase.
Once discovered, Zcash developers (led by the Zcash Open Development Labs team) quickly coordinated with mining pools to temporarily freeze the Orchard pool and deploy a fix, thereby limiting any attacker's window of opportunity.
Cryptocurrency exploits are common, and attackers typically try to cash out as quickly as possible, especially after a vulnerability is made public. To profit from this vulnerability, an attacker would need to exchange forged ZEC for valuable assets, which typically requires the ZEC to leave the Orchard pool via the turnstile mechanism.
If the vulnerability had been exploited before the fix, we would expect evidence to have surfaced by now. Historically, cryptocurrency exploits are typically "smash-and-grab" operations, not strategies like "4D chess" hidden for months or even years.
Can Legitimate Orchard Funds Be Recovered?
We believe so, because we believe the vulnerability was never exploited. If this assessment is correct, all legitimate Orchard funds remain fully recoverable.
On the other hand, if forgery did occur in Orchard, the existing turnstile mechanism would limit the total migrated amount to the number of ZEC that legitimately entered the pool.
Therefore, if forged funds were migrated ahead of legitimate funds, users would be unable to recover some or all of their legitimate Orchard funds.
We consider this scenario unlikely. However, for more cautious users, it is still recommended to move their ZEC out of Orchard.
But before doing this, they should understand the following:
· Moving funds to a transparent pool (i.e., to a t-address) will reveal both the transfer amount and time, and these funds will also become publicly linked to that t-address.
· Moving funds from the Orchard pool to the Sapling pool reveals the transfer amount and time, but unlike moving to a t-address, it does not link these funds to a specific address or transaction history.
· The Sapling pool relies on a trusted setup ceremony performed in 2018. Relying on the security of that trusted setup is an additional risk users should be aware of.
· To our knowledge, YWallet and Zkool are currently the only widely used self-custody Zcash wallets that support the Sapling pool.
· Moving funds to a new wallet or custodian service introduces additional risks, including user error, software bugs, custodian risk, or other unforeseen problems.
Overall, we consider the above risks moderate.
If your funds are currently in a shielded self-custody wallet, leaving them there is a reasonable choice, given our assessment that previous forgery is unlikely. If you have a safe way to move them elsewhere, that might also be reasonable. Users may reach different conclusions based on their own circumstances.
Can Users Verify That the Zcash Supply Has Not Been Inflated?
Currently, no. The previous existence of this vulnerability meant that users cannot independently verify whether the ZEC currently circulating in the shielded pools does not exceed the correct amount.
However, as we noted in a previous post, the Ironwood upgrade restores this ability. The following diagram illustrates why.
The proposed network upgrade addresses this by adding the guarantee that "no more unknown forgery vulnerabilities exist" and by sealing the Orchard pool. New funds cannot enter, and funds within the pool can no longer circulate.
The only remaining path out is via the existing turnstile mechanism, which ensures that no more ZEC can leave the Orchard pool than legitimately entered it.
This change restores the ability to verify the soundness of the Zcash supply.
Currently, if forged funds exist in the Orchard pool, they can continue circulating within it. After the upgrade, this is no longer possible. Regardless of whether forgery occurred, anyone running a node can verify that the circulating ZEC does not exceed the correct amount.
Users do not need to wait for funds to migrate out of Orchard or infer the behavior of attackers or other users. The protocol itself provides a verifiable guarantee: excess ZEC cannot continue circulating within Orchard and inflating the supply.
This is important because Zcash's long-term credibility depends on users' ability to verify the soundness of its supply themselves. Ironwood restores users' ability to independently verify that the protocol's supply limits are being enforced.
How Do We Know There Are No Other Forgery Vulnerabilities?
We cannot be completely certain yet, but we have reasons to believe there are none. Shielded Labs and several other teams have been carefully reviewing the Zcash protocol for other forgery vulnerabilities.
This includes using a not-yet-released Mythos AI model, with help from Anthropic, to search for additional vulnerabilities shortly before Mythos was paused. We plan to share more details about this review and its findings in a follow-up blog post.
So far, no other forgery vulnerabilities have been found. The high level of expertise, effort, and advanced AI-assisted analysis involved in this search gives us greater confidence that no similar vulnerabilities remain undiscovered.
Furthermore, we are working with projects like the Tachyon Project to provide additional assurances that no more forgery vulnerabilities exist in Zcash. We will elaborate on this further in future blog posts as well.
Conclusion
The Orchard vulnerability presents four important questions: Was the vulnerability exploited? Can legitimate Orchard funds be recovered? Can users verify the Zcash supply hasn't been inflated? And are there other undiscovered forgery vulnerabilities?
We believe it's unlikely to have been exploited, so legitimate Orchard funds are recoverable, and the current Zcash supply is safe. Based on ongoing reviews by multiple independent researchers and teams, we are also growing more confident that no other undiscovered forgery vulnerabilities exist.
However, users currently cannot verify the security of the Zcash supply, and they should not have to rely on our assessment—or anyone else's.
The proposed network upgrade solves this problem. By sealing the Orchard pool, it restores users' ability to independently verify the security of the Zcash supply. Users no longer need to judge whether forgery occurred to verify that the protocol's supply limits are being honored.
