Zcash has recovered much of last week’s losses, rising about 45% from the low near $300 it hit on Friday, when developers proposed a fix for the flaw that triggered the sell-off.
ZEC traded around $437 on Monday, according to data from CoinDesk, although it is still down about 22% for the week. The token plummeted after Shielded Labs, a nonprofit network developer, revealed a spoofing bug in Zcash’s Orchard pool, the part of the system that hides transaction details.
The flaw, undetected since 2022, could have allowed an attacker to create unlimited fake ZECs without anyone noticing and withdraw tokens from the protocol’s protected pool, which offers voluntary privacy.
Developers including Shielded Labs, Zcash Foundation, and Zcash Open Development Lab fixed the bug within days through emergency network updates, coordinated with the ViaBTC and Foundry mining pools. On June 6, the same groups proposed Ironwood, a plan to restore users’ ability to confirm that the currency’s supply is strong.
Ironwood would create a new privacy pool using the patched code and block the creation of new coins in the old Orchard pool. Once activated, anyone running the Zcash software could add up the pool balances and confirm that nothing more than the correct amount of ZEC exists.
Users would not have to take developers’ word for it or wait for funds to be migrated.
The plan could also reveal whether the bug was ever abused. As users remove coins from the old pool, any counterfeit ZEC would be exposed when trying to leave or become stranded and destroyed. Shielded Labs has said it believes the exploit was unlikely.
The proposal has attracted attention beyond the Zcash community. In his latest newsletter, investor Chamath Palihapitiya described Ironwood as a way for anyone running a node to count pool balances and “verify that the supply is clean.”
The developers have not given a firm timeline for the update, saying that work to build, test and coordinate it across the network could take longer than expected.
