Zcash claws back losses on the Ironwood fix

Zcash ($ZEC) has bounced more than 40% off last week's low, returning to around the $456 mark and reclaiming the number 12 spot by market capitalisation. The recovery follows a sharp sell-off triggered by the disclosure of a critical flaw in the network's Orchard shielded pool, and comes after developers unveiled a concrete plan to restore confidence in the coin's supply integrity.

What went wrong with Orchard

The vulnerability, present since Orchard's activation in May 2022, was discovered on May 29 by security engineer Taylor Hornby using Anthropic's Opus 4.8 AI model and patched in an emergency fix by June 1. The nature of the flaw meant that, in theory, an attacker could have created ZEC out of thin air without detection, a worst-case scenario for any asset that depends on a fixed, verifiable supply as a core part of its value proposition.

There is no evidence the vulnerability was exploited, no evidence of impact to user funds, and no evidence of any change to the total ZEC supply. However, the privacy properties of Orchard mean users currently cannot verify for themselves whether the vulnerability was ever exploited. That uncertainty was enough to rattle markets. ZEC traded around $437 on Monday, though it remains down roughly 22% over the week.

Ironwood: the proposed fix

Following the discovery and emergency remediation, ZODL, working alongside Tachyon, Valar Group, the Zcash Foundation, and @ShieldedLabs, formally proposed Ironwood, a new shielded pool designed to restore every user's ability to independently verify that Zcash's circulating supply is sound.

Ironwood creates a new shielded pool using the Orchard circuit with the counterfeiting vulnerability fixed. The existing Orchard pool gets closed to new deposits and internal transactions, meaning funds sitting in that pool can only move forward, through a turnstile, before entering Ironwood. The turnstile tracks exactly how much ZEC has entered and exited each pool and rejects any transaction that attempts to move out more ZEC than legitimately went in, giving users an immediate, trustless guarantee that no more than the correct amount of ZEC can be circulating.

The proposal is backed by formal verification, independent audits, and AI-assisted security review, a significantly more rigorous assurance framework than what underpinned the existing Orchard pool. In his latest newsletter, investor Chamath Palihapitiya described Ironwood as a way for anyone running a node to tally the balances across pools and verify the supply is clean.

The proposal targets activation for late July 2026, following the Zcash end-of-support at block height 3,417,100. Developers have not given a firm timeline for the upgrade, saying the work to build, test, and coordinate it across the network could take longer than expected. $ZEC remains well below the highs it hit earlier this year before the Orchard disclosure upended its rally.

Sources:
CoinDesk: Zcash bounces ~45% as developers propose Ironwood upgrade
The Merkle: Zcash Proposes Ironwood, A New Shielded Pool to Restore Supply Verification
Crypto Times: Zcash Unveils Ironwood Plan Following Orchard Vulnerability