Original Authors: Jason McGee, CEO of Shielded Labs, and Zooko Wilcox, Founder of Zcash
Compiled by|Odaily Planet Daily Qin Xiaofeng (@QinXiaofeng 888 )
Editor's Note: On June 5th, Beijing time, privacy project Zcash was revealed to have had a critical counterfeiting vulnerability in its new-generation privacy pool, Orchard. The Zcash token, ZEC, briefly plummeted by half, hitting a low near $250. After about ten days of developments, market panic has somewhat subsided, ZEC's price has recovered somewhat, and it returned to $500 today.
This morning, Zcash founder Zooko Wilcox once again published a lengthy post responding to market concerns. He stated that the Orchard vulnerability was likely not previously exploited, and legitimate Orchard funds can be recovered; currently, users cannot independently verify whether the Zcash supply has been inflated, but the Ironwood upgrade will seal the Orchard pool, restoring this verification capability; ongoing audits have not discovered other counterfeiting vulnerabilities, but more work is needed to be completely certain.
The following is the original text by Zooko Wilcox, compiled by Odaily Planet Daily, enjoy~
————————————
The recent Orchard vulnerability has raised important questions about Zcash's supply and the safety of user funds. The discussion has mingled several distinct issues, making it difficult to understand the actual impact of the vulnerability on users. This article attempts to separate these questions and explain what they each mean for users.
The Orchard vulnerability raises four important questions:
- Was the Orchard vulnerability ever exploited?
- Can legitimate Orchard funds be recovered?
- Can users verify that Zcash's supply has not been inflated?
- How do we know there are no other counterfeiting vulnerabilities?
Was the Orchard vulnerability ever exploited?
Unknown. We believe it's unlikely to have been exploited before, though we cannot rule it out entirely. We think the vulnerability was likely *not* exploited for three reasons:
Despite years of ongoing review by many of the world's top cryptographers and security researchers, the vulnerability was not previously discovered. Its eventual discovery was not accidental; it was found by Taylor Hornby of Shielded Labs with the explicit purpose of proactively identifying such security vulnerabilities before a malicious attacker could. Taylor used advanced AI-assisted security research techniques and custom-built tools specifically designed to find subtle flaws that others might miss. Doing this would be even more difficult for someone not deeply familiar with the Zcash codebase.
Once the vulnerability was discovered, Zcash developers (led by the Zcash Open Development Labs team) quickly coordinated with mining pools to temporarily freeze the Orchard pool and deployed a fix, thereby limiting the opportunity window for any attack.
Cryptocurrency exploits are common, and attackers typically seek to cash out as quickly as possible, especially after a vulnerability becomes public. For an attacker to profit from this vulnerability, they would need to exchange counterfeit ZEC for valuable assets, which would typically involve ZEC leaving the Orchard pool via the turnstile mechanism. If the vulnerability had been exploited before the fix, we would expect to have seen evidence by now. Historically, cryptocurrency exploits are usually "smash-and-grab" operations, not "4D chess" strategies hidden for months or years.
Can legitimate Orchard funds be recovered?
We believe so, because we believe the vulnerability was never exploited. If this assessment is correct, all legitimate Orchard funds remain fully recoverable.
On the other hand, if counterfeiting *did* occur in Orchard, the existing turnstile mechanism would limit the total amount migrated to the amount of ZEC that legitimately entered the pool. Therefore, if counterfeit funds were migrated ahead of legitimate funds, users would be unable to recover some or all of their legitimate Orchard funds.
We consider this scenario unlikely. However, for more cautious users, moving their ZEC out of Orchard is still advised. But before doing so, they should understand the following:
- Moving funds to a transparent pool (i.e., to a t-address) reveals both the amount and the timing of the transfer, and these funds become publicly linked to that t-address.
- Moving funds from the Orchard pool to the Sapling pool reveals the amount and timing of the transfer, but unlike moving to a t-address, it does not link these funds to a specific address or transaction history.
- The Sapling pool relies on a trusted setup ceremony performed in 2018. Relying on the security of that trusted setup is an additional risk users should note.
- To our knowledge, YWallet and Zkool are currently the only widely used, self-custody Zcash wallets that support the Sapling pool.
- Moving funds to a new wallet or a custodial service introduces additional risks, including user error, software bugs, custodian risk, or other unforeseen problems.
Overall, we consider the above risks moderate. If your funds are currently in a shielded, self-custody wallet, leaving them there is a reasonable choice given our assessment that prior counterfeiting was unlikely. If you have a secure way to move them elsewhere, that could also be reasonable. Users may reasonably reach different conclusions based on their circumstances.
Can users verify that Zcash's supply has not been inflated?
Not yet. The prior existence of this vulnerability meant users could not independently verify that the ZEC circulating in the current shielded pools did not exceed the correct amount.
However, as we noted in a previous post, the Ironwood upgrade restores this capability. The diagram below illustrates why.
The proposed network upgrade addresses this by adding the guarantee that "no more unknown counterfeiting vulnerabilities exist" and by sealing the Orchard pool. New funds can no longer enter, and funds within the pool can no longer circulate. The only remaining path is to leave via the existing turnstile mechanism, which ensures that no more ZEC can leave the Orchard pool than legitimately entered it.
This change restores the ability to verify the soundness of the Zcash supply.
Currently, if counterfeit funds exist in the Orchard pool, they can continue to circulate within the pool. After the upgrade, this is no longer possible. Regardless of whether counterfeiting ever happened, anyone running a node will be able to verify that no more ZEC is in circulation than the correct amount.
Users won't need to wait for funds to migrate out of Orchard, or infer what attackers or other users might have done. The protocol itself provides a verifiable guarantee that excess ZEC cannot continue circulating within Orchard and inflating the supply.
This is important because Zcash's long-term credibility depends on users being able to independently verify the soundness of its supply. Ironwood restores users' ability to independently verify that the protocol's supply limit is being enforced.
How do we know there are no other counterfeiting vulnerabilities?
We are not yet completely certain, but we have reasons to believe there are none. Shielded Labs and multiple other teams have been carefully reviewing the Zcash protocol for additional counterfeiting vulnerabilities. This includes using a yet-to-be-released Mythos AI model to search for additional vulnerabilities, with help from Anthropic, shortly before Mythos was paused. We plan to share more details about this review and its findings in a follow-up blog post.
So far, no other counterfeiting vulnerabilities have been found. The high level of expertise, effort, and advanced AI-assisted analysis involved in this search gives us greater confidence that no similar vulnerabilities remain undiscovered.
Furthermore, we are working with projects like the Tachyon Project to provide additional assurance that there are no more counterfeiting vulnerabilities in Zcash. We will elaborate on this in future blog posts as well.
Conclusion
The Orchard vulnerability presents four important questions: Was the vulnerability exploited, can legitimate Orchard funds be recovered, can users verify that Zcash's supply has not been inflated, and are there other undiscovered counterfeiting vulnerabilities.
We believe it was likely not exploited previously, and therefore legitimate Orchard funds are recoverable and the current Zcash supply is safe. We are also increasingly confident, based on ongoing reviews by multiple independent researchers and teams, that there are no other undiscovered counterfeiting vulnerabilities. However, users currently cannot verify the safety of the Zcash supply, and they should not have to rely on our assessment—or anyone else's.
The proposed network upgrade solves this. By sealing the Orchard pool, it restores users' ability to independently verify the safety of the Zcash supply. Users no longer need to judge whether counterfeiting occurred in order to verify that the protocol's supply limits are being upheld.
