The developers of Zcash have proposed launching a new shielded pool called Ironwood following the recent discovery of a vulnerability that raised concerns in the community about the possible existence of undetected counterfeit ZEC coins.
The Zcash Open Development Lab (ZODL) team reported that it is working on a network upgrade together with Tachyon, Valar Group, Zcash Foundation and Shielded Labs.
One of the tasks will be to strengthen oversight of the Orchard protocol. Additional checks and independent audits are planned for it. Anonymous transfers in the Zcash network take place through Orchard, where data about the sender, recipient, and transaction amount remain hidden.
See also: The Crypto Fear and Greed Index Fell to 12 Points Amid Intensified Global Sell-Off
If the proposal is approved, the current Orchard pool will stop accepting new deposits and internal transfers. Before moving to Ironwood , funds will go through a special turnstile mechanism. This stage is needed for additional coin verification when moving between pools.
A few days earlier, the Zcash Foundation reported that auditors had found a vulnerability in Orchard. According to the developers, there were no signs of theft or changes in the total ZEC supply.
Nevertheless, Shielded Labs specialists noted that in theory, the bug could have allowed the creation of additional coins within Orchard without being detected by existing control mechanisms.
Ironwood May Help Clarify the Situation
In a separate post on X, representatives of Shielded Labs stated that the transition to Ironwood could indirectly show whether the discovered vulnerability was exploited in practice.
At the same time, the launch of the upgrade does not depend on whether a final answer to this question can be obtained.
The logic is fairly simple. If users transfer funds to the new pool and no extra coins appear, this will be a strong argument that the vulnerability was not exploited.
If, during migration, an excess of ZEC is detected, the turnstile mechanism will not allow such coins to move to Ironwood. They will remain in the old pool and will not enter circulation.
This is the main point around which the community discussion has developed.
Some believe that it is impossible to prove the vulnerability was not exploited without additional control tools. Others are confident that after Orchard is decommissioned, the problem will lose relevance because any extra coins will be locked in the old pool.
Former Ripple CTO David Schwartz also shared his opinion.
On X he wrote that if no one exploited the bug, then ZEC holders have nothing to worry about regardless of whether they transfer funds to Ironwood or not.
According to Schwartz, users who leave coins in Orchard will likely end up in a sparsely populated pool, but will retain full access to their funds.
Zcash price chart for the last 24 hours. Source: CoinGecko.
At the time of publication, ZEC was trading around $429. After news of the vulnerability emerged, the price dropped sharply. On Friday, the price fell below $303, although shortly before that it had exceeded $600.
At ZODL they expect to activate Ironwood at the end of July 2026. Before that, developers still need to conduct testing, complete checks, and coordinate the upgrade with Zcash ecosystem participants.
For now, Ironwood remains just a proposal, but discussion about the upgrade is already gaining momentum. The community is debating not so much the new pool itself as how serious the discovered problem was.
Some users believe that if the vulnerability really existed, it will be extremely difficult to check for its use after some time. Others respond that this is exactly why the turnstile transition mechanism is needed, which will not allow extra coins to enter the new pool.
See also: Canton Network Topped Fee Rankings Thanks to Institutional Investor Activity in Q1 2026
The developers themselves continue to emphasize that they have not found any signs of the vulnerability being exploited so far. According to them, it is a potential attack vector, not a confirmed incident.
At the same time, the story has once again drawn attention to the security of privacy cryptocurrencies. Such projects use complex cryptographic mechanisms, so their audits usually take much longer compared to regular blockchain networks.
Some community members consider what happened a good example of how checks should work in major projects. The bug was discovered during an audit, and information about it appeared before any signs of problems in the network.
For now, Orchard continues to operate as usual. If the proposal is supported, users will later be given instructions on how to transition to Ironwood and told whether any additional actions are required with their wallets.
