Zcash disclosed a serious vulnerability in its Orchard shielded pool which sent its market value crashing. Traders reacted swiftly, causing ZEC to plummet by up to 38%. The drop resulted in ZEC hitting lows of $442.60 as investors rushed to minimize their losses.
The flaw was identified on May 29 by a security researcher during an audit conducted by Shielded Labs. It had been embedded within Zcash's code for approximately four years unnoticed. The vulnerability had the potential to allow an attacker to create unlimited ZEC from the Orchard pool without detection. Essentially, it raised the alarming possibility that an undetected money-making operation could have been functioning invisibly since May 2022.
Zcash's Orchard shielded pool was introduced in May 2022 as part of the project's dedication to enhancing transaction privacy. It was designed to be a secure evolution from prior shielded pools. However, the detected bug fundamentally jeopardized the core principle of any currency: the assurance that supply remains finite and traceable.
Upon receiving the report from the researcher, Zcash's team promptly took action. They implemented emergency fixes between June 2 and June 3, including a hard fork and a temporary deactivation of the Orchard functionality. The patch was successfully deployed just prior to the public announcement on June 5.
This timeframe is critical. The Zcash team had only a week to address the issue before disclosing it to the public. During that week, there were concerns whether the flaw had already been exploited, and given the design of Zcash's privacy features, it is uncertain if any exploitation had occurred in the preceding years.
The market's reaction was immediate and severe. Alongside a staggering 38% decline in ZEC's value, trading volumes fell by up to 57% as liquidity rapidly decreased. One notable trader, Arthur Hayes, who co-founded BitMEX, sold his entire ZEC holdings in response to the news.
For investors holding ZEC, the pressing question is whether the supply was actually inflated within the four-year period. If counterfeit coins were indeed minted, the existing ZEC holders would face dilution without their awareness. While the Zcash team has indicated that there is no on-chain evidence of such exploitation, a lack of evidence does not equate to evidence of absence, particularly in a system structured to conceal such information.