Zcash developers propose Ironwood shielded pool with turnstile to address Orchard vulnerability

Zcash developers are proposing a new shielded pool called Ironwood, designed to add formal verification and independent audits to the Orchard protocol following a recently patched vulnerability that auditors said could have enabled the creation of counterfeit ZEC without detection. The Zcash Open Development Lab (ZODL) said Saturday that it is working with Tachyon, Valar Group, the Zcash Foundation and Shielded Labs on the network upgrade, which would close the current Orchard pool to new deposits and internal transactions and require funds to pass through a "turnstile" accounting checkpoint before entering Ironwood. ZODL said it is targeting Ironwood activation for late July 2026, pending testing, review and coordination across the Zcash ecosystem.

The Zcash Foundation said Wednesday that auditors discovered a vulnerability in the Orchard shielded pool, which lets users move ZEC without revealing transaction details. Developers said there was no evidence that user funds were affected or that Zcash's total supply changed. Auditors at Shielded Labs said the flaw could have allowed attackers to create an infinite amount of counterfeit ZEC within Orchard, prompting the patch and a broader review of the protocol's supply-verification mechanisms.

Shielded Labs said in a separate X post that Ironwood may produce evidence about whether the Orchard bug was ever exploited, though the proposal does not depend on proving the issue retroactively. If users migrate from Orchard to Ironwood and no excess ZEC tries to leave the old pool, that would be strong evidence that the vulnerability was never exploited. If excess ZEC tries to leave, the turnstile would reject it, effectively preventing counterfeit coins from entering the supply. The question of whether Zcash can demonstrate that the bug was not exploited has been a source of community discussion, with some members questioning whether such verification would imply the existence of a backdoor.

David Schwartz, Ripple's former chief technology officer, said on X that if there were no exploits, users would remain safe whether or not they move their coins. He said users who stay in Orchard may be "lonely" there, but their funds would remain safe and accessible. ZEC traded at $429 at the time of writing, according to CoinGecko, after falling as low as $303 from above $600 when traders reacted to the vulnerability disclosure on Friday.