Critical Flaw in Zcash Transaction System Patched in Emergency Upgrade
The Zcash Foundation announced Wednesday that it has quietly addressed a critical vulnerability within the privacy cryptocurrency’s core transaction system, implementing a rare emergency network upgrade. The bug, discovered by a security researcher, could have potentially allowed malicious actors to spend funds they did not possess.
The vulnerability was identified on May 29 by independent security researcher Taylor Hornby. It was located within the Orchard Action circuit, the cryptographic mechanism that powers Zcash’s most advanced privacy pool. The Orchard pool, introduced in 2022, is considered a cornerstone of Zcash’s privacy features, requiring no trusted setup and holding a substantial portion of the circulating ZEC tokens.
Hornby reported the flaw to engineers at Zcash Open Development Lab (ZODL) the same evening. Within hours, a team of protocol developers confirmed the issue and initiated a carefully managed, confidential response aimed at preventing exploitation before a fix could be deployed.
The coordinated repair process spanned five days. Initially, developers enacted an emergency soft fork, a temporary rule change that completely halted Orchard transactions while the patch was finalized. Private discussions with miners and exchanges commenced on the evening of May 31. An initial attempt to activate the fix encountered deployment challenges, but a second effort succeeded early Monday morning, effectively stopping all Orchard activity at block 3,363,426.
A permanent solution was implemented on Wednesday with a full network upgrade, designated NU6.2. This upgrade restored Orchard functionality by incorporating a corrected circuit. Such a hard fork was deemed necessary because rectifying a zero-knowledge proof system requires updating a cryptographic verifying key, a change that cannot be achieved through standard software patches.
Officials have stated that the total supply of ZEC was never compromised. Zcash’s internal “turnstile” mechanism, which monitors value across all transaction pools, confirmed that no unauthorized coins were generated. There is currently no evidence that the bug was ever exploited.
Josh Swihart, founder of ZODL, described the operation on X, stating, “Given the time available and the number of parties involved (the devs at ZODL and Zcash Foundation, miners, exchanges, others), this was the most ambitious network upgrade in Zcash’s history.”
The Foundation has urged all node operators to upgrade immediately to Zebra 5.0.0, the software release that implements the corrected network rules.
Following the upgrade, some block explorers initially appeared to show a period of network inactivity, leading to speculation about downtime. However, experts and the block explorers themselves clarified that the network remained operational. The apparent lack of activity was attributed to block explorers temporarily pausing as they upgraded their own network nodes.
CipherScan, a block explorer, explained on X, “Block explorers are just readers. They pull data from a node, parse it, and display it. If the node is upgrading or resyncing, the explorer goes stale. The chain itself kept producing blocks the entire time. Miners didn’t stop. Transactions kept confirming.”
The price of Zcash (ZEC) has shown no adverse reaction to the disclosure of the emergency upgrade. The privacy-focused coin has continued its recent upward trend, trading at approximately $629, marking a more than 10% increase over the past 24 hours and a 53% rise over the last 30 days. ZEC has surged 1,084% over the past year, reaching a recent high near $700, though it remains significantly below its all-time peak of $3,191 set in 2016.
Leave a Reply