- Zcash core developer announced that the Zcash testnet will be updated for the Ironwood upgrade tomorrow.
- Shielded Labs also confirmed that Zcash’s Ironwood upgrade is moving as per the plan, as security is its “primary concern.”
- Ironwood upgrade will introduce a new shielded pool in order to fix a major counterfeiting bug found inside the Orchard shielded pool.
In the latest post shared on X (formerly Twitter), core Zcash developer Dev has revealed that the Zcash testnet is being updated for the Ironwood upgrade tomorrow. According to a post shared on X, the update has two independently developed consensus implementations, including Valar Group and Zcash Foundation. However, the Valar version of consensus implementation is currently going through an audit.
In the post, Dev writes, “We have a desktop wallet fork with migration code you can try! If you have a Keystone dev device, you can even update your firmware to try it out on the testnet! Sign 11+ txs with one QR code. This is a record for Zcash testnet readiness to my knowledge!”
In the latest statement today, Shielded Labs, an independent, non-profit Swiss Association, also confirmed that the Zcash Ironwood upgrade is moving forward as planned, as security is its “primary concern.” The organization is also working closely with other partners on testing and conducting audits to ensure the security of the upgrade before the final implementation on the mainnet.
According to the official ETA, the Ironwood upgrade is planned to take place on mainnet around late July 2026 at the block height of 3,417,100, following the deprecation of zcashd.
What is Ironwood?
Ironwood is a major network upgrade developed to introduce a new shielded pool, which will give users the ability to independently verify the soundness of Zcash’s circulating supply. This upgrade is developed on top of the Orchard privacy protocol by bringing new fixes, formal verification of zero-knowledge circuits, independent security audits, and others. The major highlight of this Ironwood upgrade is a “turnstile” mechanism for supply accounting.
Zooko, founder of Zcash, stated in the official post that “The objective of Ironwood is to restore each Zcash user’s ability to verify the supply integrity of Zcash. This verifiability was impaired by the existence of the counterfeiting vulnerability. Immediately upon activation, users will be able to independently verify that the circulating supply of Zcash is sound, just by running a node.”
The upgrade is planned in July to align with the end-of-support for the older zcashd client. Once the Ironwood upgrade goes live, the existing Orchard pool will close to new deposits and certain internal transactions.
Apart from this, user funds will migrate through the turnstile into the Ironwood pool. Turnstile is a cryptographic validation process. This will allow anyone running a node to simply sum active pool balances to confirm the total supply, which will provide a strong guarantee against undetected counterfeits.
Zcash’s 4-Year-Old Counterfeiting Bug Shakes Users’ Trust
The Ironwood upgrade is coming after a major counterfeiting bug was found in May inside Zcash’s Orchard shielded pool. The bug has existed in the shielded pool for around 4 years. This bug was so critical as it could have allowed an attacker to mint unlimited fake $ZEC tokens without any kind of detection. If exploited, this bug could have compromised the network’s supply integrity, which is a major feature of Zcash’s privacy features.
After this bug came to light, developers implemented an emergency soft fork to turn off all vulnerable activities. After that, they have implemented a hard fork to stabilize operations. No exploitation was reported by any user. However, Zooko confirmed that the bug was “real and exploitable.”
Zooko said, “There are several reasons we are not overly concerned that counterfeiting occurred before this vulnerability was remediated.”
However, the community reacted quickly after the bug came to light and took all measures to protect all users of the privacy token on the network.
“While no one wants to discover a vulnerability like this, we’re confident that Zcash is well positioned to recover. We stand ready to continue to help the other Zcash development groups and the Zcash community as a whole in how they want to move forward,” Zooko said.
The bug has sparked panic among $ZEC token holders. In just 48 hours after the bug came to light, the $ZEC token dropped by more than 50%, falling from above $600 to $255. However, as of now, $ZEC is giving signs of recovery amid the excitement around the Ironwood upgrade. At the time of writing this, $ZEC is currently trading at around $434 with a market capitalization of around $7.26 billion, according to CoinMarketCap.
