Zcash founder Zooko Wilcox has defined how the community’s July 28 Ironwood laborious fork will handle uncertainty round a essential flaw within the Orchard shielded pool.
Abstract
- Zcash will seal the outdated Orchard pool, limiting how a lot ZEC can go away after Ironwood.
- Ironwood can’t determine pretend cash individually however can cease extra hidden provide from escaping Orchard.
- Momentary alternate and pockets disruptions could happen as suppliers put together for Zcash’s July 28 improve.
The improve won’t determine or freeze particular person counterfeit cash. As a substitute, it would seal the outdated pool and restrict how a lot ZEC can go away.
In a July 19 put up on X, Wilcox defined how the deliberate improve would take care of any hidden extra provide if the flaw was exploited earlier than builders patched it. As a result of Orchard hides transaction particulars, the community can’t show that counterfeit ZEC was by no means created.
Ironwood will seal the susceptible Orchard pool
Ironwood, also called NU6.3, is scheduled to activate at block 3,428,143 on July 28. The improve will retire the present Orchard pool and introduce a brand new shielded pool primarily based on the corrected circuit.
In keeping with Zcash’s official Ironwood consumer replace, customers will not be capable of ship or obtain ZEC contained in the outdated Orchard pool after activation. Funds can go away solely via the turnstile, which prevents extra ZEC from exiting than legitimately entered.
The Zcash workforce stated it believes the flaw was “unlikely to have been exploited,” however customers can’t independently show no counterfeit ZEC was created. Ironwood goals to lure any extra worth contained in the outdated pool quite than enable it to enter wider circulation.
Orchard bug left a provide query Zcash couldn’t show away
Safety researcher Taylor Hornby found the Orchard flaw on Could 29 whereas auditing the shielded system. The bug might have allowed an attacker to create counterfeit ZEC inside Orchard with out leaving an apparent public document.
As reported by crypto.information, builders first disabled Orchard exercise after which restored it via the NU6.2 laborious fork with corrected cryptography. No proof of unauthorized worth creation was discovered, however Orchard’s privateness means previous exploitation can’t be dominated out with full certainty.
Crypto.information later reported that Ironwood would create a recent shielded pool and use the turnstile to manage worth leaving the outdated one. Node operators can then confirm that circulating ZEC doesn’t exceed the quantity permitted by the community’s financial guidelines.
Wallets and exchanges could briefly pause providers
Zcash customers don’t must take instant motion earlier than the laborious fork. Nevertheless, wallets, exchanges and different suppliers could briefly droop deposits, withdrawals or associated providers whereas finishing software program upgrades.
The official community steerage says Orchard customers will finally want pockets assist to maneuver funds into the brand new pool. Funds could stay briefly unavailable in wallets that haven’t added the required migration instruments.
The July 28 activation additionally follows Zcash’s transfer away from the legacy zcashd shopper. Suppliers nonetheless finishing that migration might have extra time earlier than totally supporting Ironwood.
Zcash provides extra safety checks after the flaw
The Orchard incident led to wider safety work throughout the Zcash ecosystem. As reported by crypto.information, an AI-assisted evaluate utilizing Anthropic’s Mythos system discovered no further severe vulnerabilities after the unique flaw was disclosed.
Builders are additionally pursuing unbiased audits and formal verification for the up to date cryptographic system. The work goals to scale back the danger of one other hidden counterfeiting flaw and provides customers stronger methods to confirm Zcash’s provide guidelines.
Ironwood addresses the unresolved provide query quite than the already-fixed bug itself. By sealing Orchard and controlling withdrawals via the turnstile, the laborious fork goals to stop any hypothetical counterfeit ZEC from getting into circulation.
