Zcash has rebounded after a sharp drop last week following the disclosure of a counterfeit coin vulnerability. The development team has recently proposed an upgrade called Ironwood, which plans to migrate users to a new, patched privacy pool and allow users running the Zcash software to verify the total circulating supply of ZEC themselves.
Prices rebounded, but the weekly chart remains under pressure.
According to CoinDesk data, ZEC briefly returned to around $437 on Monday, rebounding about 45% from its low of nearly $300 last Friday. However, on a weekly basis, ZEC is still down about 22%.
Previously, Shielded Labs disclosed a critical vulnerability in Zcash's Orchard privacy pool. This vulnerability, which had remained undiscovered since 2022, could theoretically allow attackers to forge an unlimited number of fake ZECs and withdraw assets from the protected pool undetected.
Ironwood plans to launch a new privacy pool.
On June 6, Shielded Labs, the Zcash Foundation, and the Zcash Open Development Lab jointly proposed the Ironwood solution. The core approach is to implement a new privacy pool with fixed code, while simultaneously stopping the generation of new coins in the old Orchard pool.
After the upgrade takes effect, any user running the Zcash software can aggregate the balances in each pool to confirm that the total amount of ZEC in the network has not been over-issued. This eliminates the need for users to rely solely on the development team's explanations or wait until all funds have been migrated before determining if the supply is normal.
Migrating old pools or exposing anomalous tokens
According to the plan, users will gradually transfer their funds from the old pool to the new pool. If counterfeit ZEC tokens are indeed present in the old pool, these tokens will either be exposed when attempting to transfer them out, or they will be unable to migrate and will eventually remain in the old pool and become invalid.
The development team stated that this process may also help outsiders determine whether the vulnerability has been actually exploited. Shielded Labs previously stated that current indications suggest the vulnerability is unlikely to have been abused.
The upgrade time has not yet been determined.
Prior to Ironwood's report, the team had coordinated with mining pools such as ViaBTC and Foundry to patch the vulnerability within days through an emergency network upgrade.
However, the developers have not yet provided a clear timeline for Ironwood's release. They stated that the solution still needs to complete development, testing, and network-wide coordination, and the actual implementation time may be longer than expected.
