Zcash will activate the Ironwood hard fork on July 28 to “seal” the problematic Orchard shielded pool and close a window of uncertainty created by a recently discovered cryptographic bug.
What’s happening
- Ironwood (NU6.3) is scheduled to activate at block 3,428,143 on July 28. The upgrade retires the current Orchard pool and brings in a new shielded pool built from the corrected cryptographic circuit.
- Rather than trying to identify or freeze individual coins, the upgrade effectively locks the old Orchard pool and limits how much ZEC can leave it using a “turnstile” mechanism that prevents more ZEC exiting the pool than legitimately entered.
Why this matters
- A security researcher, Taylor Hornby, discovered the Orchard flaw on May 29. The bug could, in theory, have allowed an attacker to create counterfeit ZEC inside Orchard without leaving an obvious public trace.
- Zcash developers patched the vulnerability and temporarily disabled Orchard, then restored it via the NU6.2 hard fork with corrected cryptography. The team says exploitation is “unlikely,” but because Orchard transactions are private, users cannot independently prove that no counterfeit ZEC was ever created.
- Ironwood does not attempt to retroactively detect or remove any potential counterfeit coins. Instead, it addresses the unresolved supply-question by trapping any hypothetical excess value inside the retired Orchard pool and limiting what may flow into broader circulation.
Practical effects for users and operators
- Ordinary users do not need to take immediate action before the fork. However, wallets, exchanges and other providers may temporarily suspend deposits, withdrawals or related services while they update software.
- After activation, funds cannot be sent or received inside the old Orchard pool. They can only leave via the turnstile; moving funds into the new pool will require wallets to add migration support. Wallets that don’t implement the required tools may show funds as temporarily unavailable.
- Node operators can verify that circulating ZEC does not exceed the network’s monetary rules once the new pool is in place.
Broader follow-up work
- The Orchard incident spurred wider security work across the Zcash ecosystem. An AI-assisted review using Anthropic’s Mythos system found no additional serious vulnerabilities after the original disclosure.
- Developers are pursuing independent audits and formal verification of the updated cryptographic system to reduce the risk of future hidden counterfeiting flaws and to give users stronger ways to verify supply rules.
Summary
Ironwood is a defensive, forward-looking upgrade: it doesn’t prove whether the bug was previously exploited, but it prevents any hypothetical counterfeit ZEC from escaping the sealed Orchard pool and entering wider circulation. Zcash users and service providers should watch for provider-specific guidance and prepare for temporary service interruptions as the network and ecosystem complete the migration.
Read more AI-generated news on: undefined/news
