Zcash Bug Could Have Let Attackers Print Cryptocurrency Out of Thin Air

zcash

Zcash (ZEC) activated an emergency hard fork on Wednesday to address a critical bug in its Orchard shielded transaction pool. This vulnerability stems from a robustness issue in the zero-knowledge proof circuits that validate private transactions. In theory, this could allow the creation of additional ZEC inside the pool, opening the door to unknown inflation or invalid state changes sanctioned by the network.

On Wednesday, the Zcash Foundation Said “There is no evidence of unauthorized price creation.” However, due to the privacy design, it remains difficult for outside observers to confirm the absence of any hidden inflation. Independent researcher Taylor Hornby identified the problem during a protocol audit conducted for Shielded Labs on May 29. according to CoinDesk.

Developers moved quickly through private coordination with miners and exchanges, and an emergency soft fork implemented in Zebra 4.5.3 temporarily disabled all operations on the affected conservatory pool, known as Orchard. A hard fork was then activated on Wednesday at block height 3,364,600, re-enabling protected transactions with the fix.

This is the second time Zcash has suffered from a bug capable of creating new units of its currency in a way that is difficult to verify, as an earlier flaw in 2018 allowed theoretically unlimited counterfeiting. The Zcash team kept the knowledge strictly restricted and improved in upgrades, as covered Luck The bug was revealed around the same time.

The latest incident has drawn sharp commentary on the risks to both the soundness of the monetary system of the Zcash cryptocurrency and the governance process associated with the reaction, which some consider too centralized. Peter Todd, who has been a researcher in the blockchain field since its early days, was accused in an HBO documentary last year of being Bitcoin creator Satoshi Nakamoto. debated on x Secrecy at the consensus level poses unique threats. “Bitcoin has never been exploited by the kind of inflation that could destroy a currency’s value,” he wrote. “Zcash’s privacy makes inflation exploits more dangerous.” He said that about 30% of the ZEC supply sits in shielded pools and any unscheduled inflation or forced freezing of those funds would be a major blow to holders, including himself. Todd, who was also involved in Zcash’s initial trusted setup function, has used the episode to question the wisdom of attempting to implement similar privacy features directly on Bitcoin’s base layer.

Seth For Privacy, COO of privacy-focused crypto wallet Cake Wallet, criticized the coordination as overly centralized. In a x postHe described ZODL, a for-profit entity backed by venture capital, which “secretly coordinated the entire soft and hard fork of a network” while marketing the results. He said his team only learned about the bug through a public X post, ignored questions for days, and only got meaningful information a few hours before the hard fork went live. He argued that wallets and other ecosystem participants were forced to update at the last minute or face broken functionality. “This is not the way a decentralized network should be run,” he wrote, calling the handling “an abuse of the insider access that ZODL possesses.”

ZODL founder Josh Swihart pushed back at this characterization. said“It doesn’t seem like you know how responsible disclosure works. I don’t have time to explain it to you.”

Of course, questions about centralization in the crypto industry extend far beyond Zcash. critics have a lot of time Pointed stablecoins with single issuers And networks like Coinbase, which appear to be designed to capture value for traditional financial institutions rather than preserve the decentralized, cyberpunk principles many associate with Bitcoin’s original design. A stablecoin issuer recently suffered a hack exploited a point of vulnerability In the design of its on-chain smart contracts. In April, Entities linked to the Iranian regime have had $344 million of their USDT (stablecoin issued by Tether) seized. Additionally, Circle, the issuer of USDC, raised $222 million specifically to develop its own blockchain infrastructure, which is a step forward. Their stablecoin operations can be viewed more and more like traditional financial rails.

Zcash itself has been one of crypto’s strong performers in recent years, as the cryptocurrency has gained more than 900% at some points in the past twelve months amid a renewed focus on privacy features. That said, much of the price action appears to be driven by traders spinning in the narrative rather than measurable growth in the real-world use of Zcash for privacy-seekers. For use cases where privacy is most at stake, such as ransomware payments and darknet market commerce, Monero remains the dominant choice. Analysis of new darknet marketplaces launched in 2024 revealed that nearly half used Monero exclusively, while Zcash appeared much less frequently.

Notably, NSA whistleblower Edward Snowden, who, like Todd, was also involved in Zcash’s initial trustless setup ceremony, has been a longtime public supporter of Zcash, describing one 2017 CoinDesk Interview As the most interesting Bitcoin alternative. On the other hand, the Chief Strategy Officer of the Human Rights Foundation is Alex Gladstein Continued focus on Bitcoin Citing its established assets as a store of value and improved privacy on secondary protocol layers, as the main tools for financial sovereignty and resistance to surveillance or censorship.

This episode leaves Zcash once again with a functioning custodial pool, but it also raises questions about how well any future inflation can be shrugged off and how much coordination power a small group of entities has. The latter of those two issues is a problem found in effectively all crypto projects that are still trying to find growth outside of the initial, niche userbase.



<a href

Leave a Comment