Zcash has rebounded sharply, recovering about 45% from its recent low near $300. The recovery follows a proposal by developers to fix a vulnerability that triggered a sell-off last week. On Monday, Zcash (ZEC) traded at around $437, according to CoinDesk data, although it remains down roughly 22% over the week.
The token plunged after Shielded Labs, a nonprofit developer on the network, disclosed a counterfeiting bug in Zcash’s Orchard pool. This part of the system is responsible for hiding transaction details. The flaw had been undetected since 2022 and could have potentially allowed an attacker to create unlimited fake ZEC without anyone noticing, then withdraw tokens from the protocol’s shielded pool.
Emergency Patch and Ironwood Proposal
Developers, including Shielded Labs, the Zcash Foundation, and the Zcash Open Development Lab, patched the bug within days through emergency network upgrades. These were coordinated with mining pools ViaBTC and Foundry. On June 6, the same groups proposed Ironwood—a plan aimed at restoring users’ ability to confirm the coin’s supply is sound.
Ironwood would create a new privacy pool using the repaired code and block the creation of new coins in the old Orchard pool. Once activated, anyone running the Zcash software could add up balances across pools and confirm that no more than the correct amount of ZEC exists. Users would not have to trust the developers’ word or wait for funds to migrate.
Checking for Exploitation
The plan could also reveal whether the bug was ever abused. As users move coins out of the old pool, any counterfeit ZEC would either be exposed when it tries to leave or be stranded and destroyed. Shielded Labs has said it believes exploitation was unlikely.
The proposal has drawn attention beyond the Zcash community. In his latest newsletter, investor Chamath Palihapitiya described Ironwood as a way for anyone running a node to tally the balances across pools and “verify the supply is clean.”
Timeline Uncertain
Developers have not given a firm timeline for the upgrade. They say the work to build, test, and coordinate it across the network could take longer than expected.
