Zcash patches Orchard flaw with Ironwood network upgrade

Zcash activated its Ironwood network upgrade on July 28, 2026, creating a new shielded pool and effectively sealing the older Orchard pool after a critical vulnerability in its zero-knowledge circuit could have allowed the undetectable creation of counterfeit tokens. The upgrade, designated NU6.3, went live at block height 3,428,143.

The move follows the late-May discovery by independent researcher Taylor Hornby of a soundness flaw in Orchard's Halo 2 proving system. The bug resided in the elliptic-curve components and theoretically permitted counterfeit notes inside the private pool. Because Orchard transactions hide amounts and participants, cryptographic methods alone could not confirm whether the flaw had ever been exploited.

What the Ironwood upgrade changes

Orchard is now restricted to withdrawals. New deposits and internal transfers within the pool are blocked. Roughly 3.6 million ZEC remained in Orchard at activation, and early migration figures showed tens of thousands of tokens already moving to the new pool.

Funds leaving Orchard must pass through Zcash's turnstile mechanism before entering Ironwood. This accounting checkpoint enforces a simple rule: the amount exiting cannot exceed the quantity verifiably deposited. It creates an independently auditable boundary on circulating supply, sidestepping the question of whether past exploitation occurred.

Ironwood reuses a patched version of the Orchard protocol but maintains separate note commitment trees, nullifier sets, value pools, and transaction history. The Zcash team says it incorporates formal verification, independent audits, and additional assurance measures to reduce the risk of similar issues.

How the vulnerability was handled

Developers moved fast after Taylor Hornby flagged the issue during security analysis supported by Shielded Labs. An emergency soft fork temporarily restricted Orchard activity. The subsequent NU6.2 hard fork corrected the underlying circuit and restored functionality. Ironwood then provided the structural fix: a clean pool with no legacy exposure.

No evidence of exploitation, user fund loss, or ZEC supply inflation has been reported. But the nature of privacy coins means absence of evidence is not evidence of absence. The turnstile's accounting guarantee now replaces reliance on forensic confidence.

Quantum-recoverable notes and wallet compatibility

Ironwood also implements quantum-recoverable notes under relevant ZIP specifications. This offers a potential recovery path should future quantum computing advances threaten current elliptic-curve cryptography. It's a hedge, not an immediate fix, but it signals the protocol is thinking beyond the current threat model.

Compatible wallets continue supporting existing addresses and receiver structures. New shielded payments route automatically to Ironwood where possible. Users holding Orchard balances are encouraged to migrate via updated software. The process is designed to be straightforward, though full voluntary transfer will determine how quickly private supply consolidates in the new pool. Node operators must run software supporting NU6.3 to stay on the main chain.

What this means for Zcash's credibility

Orchard had become Zcash's dominant shielded pool, holding a large majority of private holdings. Sealing it is not trivial. But the alternative, trusting that a theoretically exploitable bug was never actually exploited, is worse for a protocol whose entire value proposition rests on cryptographic guarantees.

The upgrade involved coordinated work across the Zcash Open Development Lab, Shielded Labs, Project Tachyon, and the Zcash Foundation. By forcing all shielded activity through Ironwood and its auditable entry point, the upgrade restores the ability to independently verify that ZEC respects supply rules. Whether that's enough to maintain user confidence in a competitive privacy coin market is another question.

Source: Crowdfund Insider