Four Questions on the Zcash Orchard Vulnerability: Was It Exploited? Can Funds Be Recovered? Is the Supply Verifiable? And Are There Others?

Original Authors: Jason McGee, CEO of Shielded Labs; Zooko Wilcox, Founder of Zcash

Compiled | Odaily Planet Daily Qin Xiaofeng (@QinXiaofeng 888 )

Editor's Note: On June 5th, Beijing time, the privacy project Zcash was reported to have had a critical forging vulnerability in its new-generation privacy pool, Orchard. The price of Zcash's native token, ZEC, plummeted by nearly half, hitting a low of around $250. After about ten days of developments, market panic has somewhat subsided, and the price of ZEC has rebounded, returning to $500 today.

This morning, Zcash founder Zooko Wilcox published another lengthy article responding to key market concerns. He stated that it is highly likely the Orchard vulnerability was not previously exploited, and legitimate Orchard funds can be recovered. Currently, users cannot independently verify whether the Zcash supply exceeds its limit, but the upcoming Ironwood upgrade will seal the Orchard pool, restoring this verification capability. Ongoing audits have not uncovered other forging vulnerabilities, but absolute certainty requires more work.

Below is the full text by Zooko Wilcox, compiled by Odaily Planet Daily, enjoy~

————————————

The recent Orchard vulnerability has raised critical questions about Zcash's supply and user fund safety. The discussion has conflated several distinct issues, making it difficult to understand the practical impact of the vulnerability on users. This article attempts to separate these questions and explain what each means for users.

The Orchard vulnerability raises four major questions:

1. Was the Orchard vulnerability ever exploited?
2. Can legitimate Orchard funds be recovered?
3. Can users verify that the Zcash supply has not been inflated?
4. How do we know there aren't other forging vulnerabilities?

Was the Orchard vulnerability ever exploited?

Unknown. We consider it unlikely that it was exploited previously, though we cannot rule it out entirely. We believe the vulnerability likely went unused for three reasons:

Despite years of continuous scrutiny by top cryptographers and security researchers worldwide, the vulnerability was not previously discovered. Its discovery was not accidental; it was found by Taylor Hornby of Shielded Labs with the express purpose of proactively identifying such security flaws before malicious actors could. Taylor used advanced AI-assisted security research techniques and custom-built tools specifically designed to find subtle flaws others might miss, a task that would be more difficult for those not deeply familiar with the Zcash codebase.

Upon discovery, Zcash developers (led by the Zcash Open Development Labs team) quickly coordinated with mining pools to temporarily freeze the Orchard pool and deployed a fix, limiting any potential attack window.

Cryptocurrency exploits are common, and attackers typically cash out as quickly as possible, especially after a vulnerability is made public. For an attacker to profit from this vulnerability, they would need to exchange forged ZEC for valuable assets, which usually involves moving ZEC out of the Orchard pool via the turnstile mechanism. Had the vulnerability been exploited before the fix, we would expect evidence to have surfaced by now. Historically, cryptocurrency exploits tend to be "smash-and-grab" operations rather than "4D chess" strategies hidden for months or years.

Can legitimate Orchard funds be recovered?

We believe so, because we believe the vulnerability was never exploited. If this assessment is correct, all legitimate Orchard funds remain fully recoverable.

Conversely, if forging did occur within Orchard, the existing turnstile mechanism limits the total migrated amount to the number of ZEC that legitimately entered the pool. Therefore, if forged funds are migrated before legitimate funds, users may be unable to recover some or all of their legitimate Orchard funds.

We consider this scenario unlikely. However, for more cautious users, moving their ZEC out of Orchard is still advised. Before doing so, they should understand the following:

• Moving funds to a transparent pool (i.e., to a t-address) exposes both the transaction amount and the time of the transaction, and the funds become publicly linked to that t-address.
• Moving funds from the Orchard pool to the Sapling pool exposes the transaction amount and time, but unlike moving to a t-address, it does not link these funds to a specific address or transaction history.
• The Sapling pool relies on a trusted setup ceremony conducted in 2018. Relying on the security of this trusted setup is an additional risk users should be aware of.
• To our knowledge, YWallet and Zkool are currently the only widely used, self-custodial Zcash wallets that support the Sapling pool.
• Moving funds to a new wallet or custodial service introduces additional risks, including user error, software bugs, custodian risk, or other unforeseen issues.

Overall, we consider these risks moderate. If your funds are currently in a shielded, self-custodial wallet, leaving them there is a reasonable choice, given our assessment that prior forging is unlikely. If you have a secure way to move them, that may also be reasonable. Users may arrive at different conclusions based on their own circumstances.

Can users verify that the Zcash supply has not been inflated?

Not currently. The prior existence of the vulnerability prevents users from independently verifying that the ZEC circulating in the current shielded pools does not exceed the correct amount.

However, as we indicated in our previous post, the Ironwood upgrade restores this ability. The diagram below illustrates why.

The proposed network upgrade addresses this by adding a guarantee that "no further unknown forging vulnerabilities exist" and by sealing the Orchard pool. New funds cannot enter, and funds within the pool cannot circulate. The only remaining path is exiting via the existing turnstile mechanism, which ensures that no more ZEC leaves the Orchard pool than legitimately entered it.

This change restores the ability to verify the soundness of Zcash's supply.

Currently, if forged funds exist within the Orchard pool, they can continue to circulate within it. After the upgrade, this is no longer possible. Regardless of whether forging occurred, anyone running a node can verify that no more ZEC is circulating than the correct amount.

Users don't need to wait for funds to migrate out of Orchard or speculate on potential actions by attackers or other users. The protocol itself provides a verifiable guarantee: excess ZEC cannot continue circulating within Orchard to inflate the supply.

This is crucial because Zcash's long-term credibility depends on users' ability to independently verify the soundness of its supply. Ironwood restores users' ability to independently verify that the protocol's supply limit is enforced.

How do we know there aren't other forging vulnerabilities?

We can't be completely certain yet, but we have reason to believe none exist. Shielded Labs and multiple other teams have been meticulously auditing the Zcash protocol for other forging vulnerabilities. This includes using a not-yet-released Mythos AI model, with assistance from Anthropic, to search for additional vulnerabilities shortly before Mythos was paused. We plan to share more details about this audit and its findings in a future blog post.

So far, no other forging vulnerabilities have been found. The high level of expertise, effort, and advanced AI-assisted analysis involved in this search gives us increased confidence that no similar vulnerabilities remain undiscovered.

Furthermore, we are collaborating with projects like the Tachyon Project to provide additional assurance that no more forging vulnerabilities exist in Zcash. We will elaborate on this in future posts as well.

Conclusion

The Orchard vulnerability presents four key questions: Was it exploited? Can legitimate Orchard funds be recovered? Can users verify Zcash's supply hasn't been inflated? And are there other undiscovered forging vulnerabilities?

We believe prior exploitation is unlikely, therefore legitimate Orchard funds are recoverable, and the current Zcash supply is safe. Based on ongoing audits by multiple independent researchers and teams, we are also increasingly confident that no other undiscovered forging vulnerabilities exist. However, users cannot currently verify the security of Zcash's supply, and they shouldn't have to rely on our assessment—or anyone else's.

The proposed network upgrade solves this. By sealing the Orchard pool, it restores users' ability to independently verify the security of Zcash's supply. Users no longer need to judge whether forging occurred to verify that the protocol's supply limit is being obeyed.