Zcash has rebounded strongly, recovering around 45% from its recent low near $300. The recovery follows a proposal from developers to fix a vulnerability that triggered a massive sell-off last week. As of Monday, Zcash (ZEC) was trading at around $437, according to CoinDesk data, although it remains down around 22% for the week.
The token plunged after Shielded Labs, a non-profit developer of the network, revealed a counterfeiting bug in Zcash’s Orchard pool. This part of the system is responsible for hiding transaction details. The flaw had gone undetected since 2022 and could have allowed an attacker to create an unlimited number of fake ZECs without anyone noticing, then withdraw tokens from the protocol’s protected pool.
Emergency Fix and Ironwood Proposal
Developers including Shielded Labs, the Zcash Foundation, and the Zcash Open Development Lab fixed the bug within days with emergency network upgrades. These were coordinated with the ViaBTC and Foundry mining pools. On June 6, the same groups proposed Ironwood, a plan to restore users’ ability to confirm that parts supply is robust.
Ironwood would create a new privacy pool using the repaired code and block the creation of new coins in the old Orchard pool. Once enabled, anyone running the Zcash software can add up the pool balances and confirm that no more than the correct amount of ZEC exists. Users would not have to trust developers’ word or wait for funds to migrate.
Operation verification
The plan could also reveal whether the bug has already been abused. As users withdraw coins from the old pool, any counterfeit ZEC would either be exposed when trying to leave or blocked and destroyed. Shielded Labs said it believed exploitation was unlikely.
The proposal has attracted attention beyond the Zcash community. In his latest newsletter, investor Chamath Palihapitiya described Ironwood as a way for anyone operating a node to tally pool balances and “verify that the supply is clean.”
Uncertain timeline
The developers haven’t given a firm timeline for the upgrade. They say the work of building, testing and coordinating across the network could take longer than expected.
