The Zcash network has transitioned to Ironwood: how a vulnerability threatening the entire supply was closed.
On July 28, at block #3,428,143 on the Zcash mainnet, the Ironwood hard fork was activated. This update became critically important for network security: it introduces a new private transaction pool that replaces Orchard — where a dangerous vulnerability was discovered at the end of May.
The Problem That Could Have Shattered Trust
Security engineer Taylor Hornby from Shielded Labs, using the Opus 4.8 AI model from Anthropic, found a bug in the Orchard pool code. The error had existed since its launch in May 2022. Theoretically, it allowed an attacker to secretly mint fake ZEC. In the test network, the researcher successfully generated counterfeit coins using a working exploit.
Developers responded promptly: in early June, the issue was fixed in two stages — first with a soft fork that temporarily disabled transactions in Orchard, then with a hard fork that restored functionality. No signs of a real attack were found. However, the architecture of the private pool is such that transfer amounts are hidden by design. This means it is cryptographically impossible to prove that no counterfeit coins were minted — we simply cannot be 100% certain.
How Ironwood Solves the Problem
Ironwood introduces a verification mechanism at the pool boundary. Orchard has been placed in a restricted mode: new funds no longer enter it, and coins already there are locked for internal transfers. The only way to withdraw ZEC from the old pool is through a "turnstile" into Ironwood.
At the protocol level, a mechanism is embedded that ensures no more coins can be withdrawn from Orchard than were ever deposited into it. This allows verifying the integrity of the supply without access to private transaction data. Ironwood operates on a corrected Orchard protocol, has undergone formal verification, and passed a third-party security audit.
What Users Should Do
The migration is implemented at the wallet level. Applications supporting Ironwood will prompt users to transfer funds from the old storage. There is no need to create a new wallet or change addresses — incoming transfers to existing Orchard addresses are automatically directed to the new pool.
In the Zodl wallet, migration is already available in manual mode; an automatic option is promised later. For those who have no assets in Orchard, simply updating the application is sufficient.
Market Reaction
The upgrade launch did not cause significant fluctuations in the ZEC price — the date was known in advance, announced as early as June 9. Over the past 24 hours, the coin has dropped by 4.3% to $468. Recall that after the vulnerability disclosure in early June, ZEC plummeted by 48% to $302.48.
Expert opinion: Ironwood is not just a routine update but an existential step for Zcash. The Orchard incident showed how fragile security can be even in cryptographically complex systems. A successful migration and the absence of new incidents will strengthen trust in the network, but the very existence of a two-year "black hole" in the supply is a serious blow to reputation. Now all attention is on the pace of fund migration and the absence of hidden consequences.