Key facts
- Zcash's Ironwood (NU6.3) upgrade has been activated.
- The Orchard shielded pool, containing approximately 3.66 million ZEC ($1.7 billion), has been sealed.
- A bug in the Orchard proof circuit could have allowed the creation of counterfeit ZEC.
- A 'turnstile' mechanism limits withdrawals from Orchard to verifiable deposits.
- The new shielded pool begins with zero ZEC, requiring voluntary migration.
- Ironwood includes quantum-resilient record-keeping and formally verified proof circuits.
Zcash has activated its Ironwood (NU6.3) upgrade, a significant development that seals the Orchard shielded pool, which held approximately 3.66 million ZEC valued at $1.7 billion. This upgrade addresses a critical bug discovered in Orchard's proof circuit by Shielded Labs researcher Taylor Hornby on May 29. The bug could have allowed an attacker to mint counterfeit ZEC without leaving an on-chain trace.
The Ironwood upgrade introduces a 'turnstile' mechanism at the boundary of the previous pool. This accounting rule caps total withdrawals from Orchard to the amount that has been verifiably deposited, effectively trapping any counterfeit coins within the old pool. While the bug was patched within days of its discovery, the four-year window it was active meant that the chain could not definitively prove counterfeit coins were never created.
Ironwood also brings enhanced security features, including quantum-resilient record-keeping and formally verified proof circuits for the new pool, aiming to prevent similar bugs in the future. As of the report, 1,500 ZEC had already been migrated to the new pool, which started with zero tokens. The pace of voluntary user migration will determine how quickly Zcash's private supply shifts to the newly secured pool.