Shielded Labs announced that security researcher Hornby has written a fully functional exploit tool that can generate unlimited and hard-to-detect fake ZECs in a local testing environment. According to the organization, if the same tool was run on the Zcash mainnet, it would be theoretically possible for the attacker to create an unlimited amount of fake ZEC in his own wallet.
Scope of the vulnerability and first response
According to the information shared by the company, this scenario could create serious pressure on the confidence in ZEC supply. Unnoticed inflating the amount of tokens in circulation could also directly damage the perception of market value.
Hornby reported the situation to the Zcash Open Development Lab immediately after detecting the vulnerability. ZODL coordinated an immediate fix on June 1, and the issue was closed within a few days. Zcash is known as a privacy-focused cryptocurrency network; ZEC is used as the local presence of this network.
Shielded Labs stated that they think Hornby was likely successful in his attempt to find the vulnerability before malicious actors did.
How long the deficit has been in the system has created controversy
However, the fixing of the security vulnerability did not seem to have a positive impact on the markets. One of the main reasons for this is that the bug has been present in the system since May 2022, when the Orchard upgrade took effect. In other words, the problem remained unnoticed for a long time.
Shielded Labs also admitted that it could not say for sure whether the exploit was exploited before the fix. This uncertainty created additional risk perceptions, especially for investors who are sensitive about supply integrity.
Mini dictionary: Orchard refers to Zcash’s newer protected transaction system. Shielded pool is a protected asset pool that helps hide the sender, recipient and amount information of transactions.
| Title | Information in the text |
|---|---|
| Time when the vulnerability enters the system | May 2022, Orchard activation |
| Corrections coordination | June 1 by ZODL |
| Possible impact | Unlimited and hard to detect fake ZEC production |
| abuse situation | Could not be conclusively confirmed |
New verification plan and security steps
However, the organization argued that it seemed unlikely that the vulnerability was actually used. The reason given was that the error was not discovered despite years of investigation by experienced cryptography experts, and could only be found with advanced artificial intelligence tools and targeted work by highly competent researchers. It was also noted that the vulnerability was closed in a short time after it was discovered.
The company stated that users should not rely solely on their own evaluations, so they proposed a network upgrade that would allow independent verification of the integrity of the ZEC supply.
The proposed plan includes introducing a new sandbox and implementing turnstile accounting for all coins coming from the Orchard pool. Shielded Labs stated that it may publish a detailed technical post on this topic next week.
The company also announced that it is continuing to work with Hornby, is accelerating a formal verification project aimed at mathematically proving that there are no undiscovered bugs in the Orchard circuit, and is planning new hires for chief security officer and cryptographer positions.
