Zcash Deploys Emergency Upgrade to Patch Critical Double-Spending Vulnerability
Zcash has successfully patched a critical vulnerability within its privacy-focused infrastructure that could have potentially allowed for double-spending. The network underwent an emergency upgrade to prevent any exploitation of the flaw.
Critical Bug Discovered in Orchard Pool
On Wednesday, the Zcash Foundation announced that developers had resolved a significant vulnerability affecting the Orchard shielded pool. This flaw could have permitted invalid state transitions, thereby enabling the double-spending of funds within the pool.
The vulnerability was reportedly discovered on May 29 by Zcash researcher Taylor Hornby, who is conducting an ongoing protocol audit for Shielded Labs. Hornby identified a critical soundness vulnerability in the Orchard zero-knowledge proof circuit and immediately disclosed the issue to Zcash Open Development Lab (ZODL) core engineers on the same day.
“A soundness vulnerability is one that could allow the system to accept something it should reject,” the foundation explained. “In this case, successful exploitation could have allowed the Orchard pool to accept invalid state transitions, potentially permitting double-spending of funds within Orchard, though with no ability to inflate the total ZEC supply, which is protected by Zcash’s turnstile mechanism.”
Coordinated Response and Network Upgrade
Following the discovery, Zcash developers, miners, and infrastructure operators collaborated in a private, coordinated effort to develop and deploy a fix. Details were kept confidential to mitigate the risk of exploitation.
An initial soft fork attempt encountered technical challenges. However, engineers swiftly released a revised patch that was successfully activated on June 2, temporarily suspending Orchard-related transactions. On June 3, the network completed a full hard fork upgrade, designated NU6.2, which restored Orchard functionality with the corrected code, permanently resolving the vulnerability.
The Foundation stated that there is no evidence the bug was exploited, as no unauthorized value creation was detected. They also affirmed that the total ZEC supply remains secure and that the issue did not compromise the privacy of funds held in any Zcash pool.
Network Confusion Amidst Upgrade
Following the upgrade, reports of the Zcash network being offline circulated on social media, causing confusion among community members. Some claimed that Zcash had failed to produce blocks for over four hours.
However, Mert Mumtaz, CEO of Solana infrastructure firm Helius, refuted these claims, stating that the network was never down and that explorer applications were connected to a faulty node.
CipherScan, a Zcash blockchain explorer, confirmed the issue via a series of posts on X, explaining that its nodes were undergoing upgrades to support the recent NU6.2 network upgrade. “What actually happened: Zcash pushed a coordinated network upgrade (NU6.2) that required all node operators to update. During that transition, some block explorers, including ours, showed stale or missing data while we upgraded,” the post stated. “That’s the explorer being out of sync, not the blockchain being broken. Important distinction. (…) Block explorers are just readers. They pull data from a node, parse it, and display it. If the node is upgrading or resyncing, the explorer goes stale.”
ZEC Price Resilience Amidst Market Volatility
Despite the temporary confusion, ZEC’s price demonstrated resilience, rallying over 8% intraday on Wednesday morning to retest the $636 level. The cryptocurrency had surged approximately 20% over the preceding two days while the broader market experienced declines.
After failing to sustain the $630 resistance level, ZEC saw a brief dip toward the $600 support before rebounding. As of this writing, Zcash is trading at $612, marking a 9.5% increase over the past week.
Leave a Reply