The Vulnerability: Under-Constrained Circuit
Published 6/8/2026, 1:33:26 PM
The Zcash Orchard protocol counterfeit bug, discovered on May 29, 2026, was a critical "soundness" vulnerability that could have allowed for the undetectable creation of unlimited ZEC. The Zcash Open Development Lab (ZODL) team, in coordination with the Zcash Foundation and Shielded Labs, resolved the issue through a two-phase emergency response involving a soft fork followed by a permanent hard fork.
The Vulnerability: Under-Constrained Circuit
The bug was located within the Orchard zero-knowledge proof circuit, specifically in the halo2_gadgets crate [Source: https://forum.zcashcommunity.com/].
- Technical Cause: The circuit contained an "under-constrained" element in an elliptic curve multiplication check. This allowed arbitrary false inputs to pass the check, enabling invalid state transitions.
- Discovery: Security researcher Taylor Hornby identified the flaw using Anthropic’s Opus 4.8 AI model to review the Orchard circuit code [Source: https://www.blockhead.co/].
- Impact: Because the Orchard pool is fully private, counterfeit tokens would have been indistinguishable from legitimate ones, making the exploit invisible on the public blockchain [Source: https://www.coindesk.com/].
The ZODL Team's Fix
The ZODL team, led by engineers Daira-Emma Hopwood, Kris Nuttycombe, and Jack Grigg, implemented a rapid remediation strategy to protect the network.
| Phase | Date (2026) | Action | Technical Implementation |
|---|---|---|---|
| Phase 1 | June 2 | Emergency Soft Fork | Activated at block 3,363,426 to temporarily disable all Orchard actions and prevent exploitation [Source: https://coinmarketcap.com/]. |
| Phase 2 | June 3 | NU6.2 Hard Fork | Activated at block 3,364,600 to re-enable the pool with a corrected circuit that properly constrained elliptic curve checks [Source: https://www.blockhead.co/]. |
Integrity and Verification
To address concerns regarding whether the bug was exploited prior to discovery, the ZODL team utilized Zcash's "turnstile" accounting mechanism. This system tracks the total value moving between different shielded pools. The team confirmed that no unauthorized value had exited the Orchard pool, suggesting that even if counterfeiting occurred, the funds remained trapped within that specific pool [Source: https://forum.zcashcommunity.com/].
As a long-term solution, a future upgrade is planned to migrate funds to a new shielded pool, effectively "flushing out" any potential counterfeit ZEC by enforcing strict accounting on all exiting coins [Source: https://www.coindesk.com/].
Evidence Ledger Status
- c1 (Counterfeit bug existed): RESOLVED. [Source: https://www.coindesk.com/]
- c2 (ZODL team responsibility): RESOLVED. [Source: https://www.blockhead.co/]
- c3 (Technical fix resolved vulnerability): RESOLVED. [Source: https://coinmarketcap.com/], [Source: https://forum.zcashcommunity.com/]
Next Steps:
- Would you like to monitor the Zcash network for the activation of the proposed "Supply Verification Upgrade" migration?
- I can perform a technical analysis of ZEC's price action following the NU6.2 hard fork to assess market recovery.