Zcash upgrades after Orchard vulnerability, no funds lost

Developers of the privacy-focused cryptocurrency Zcash executed an emergency network upgrade this week after a critical security vulnerability was discovered in its core transaction system. The flaw, found in the Orchard shielded pool, could have theoretically allowed for double-spending, though officials confirmed no funds were lost or exploited.

Independent security researcher Taylor Hornby identified the vulnerability on May 29 and reported it to engineers at the Zcash Open Development Lab (ZODL) that same evening. The issue resided in the Orchard Action circuit, the cryptographic component that validates private transactions using zero-knowledge proofs. This type of flaw, known as a soundness bug, could have allowed an attacker to submit transactions the network would accept as valid despite containing invalid state transitions, potentially enabling double-spending within the shielded pool.

In response, developers orchestrated a two-stage fix over five days. The first step was an emergency soft fork implemented on June 2, which temporarily disabled all Orchard transactions to contain the vulnerability. The permanent solution was a full network upgrade, designated NU6.2,...