Zcash Ironwood upgrade: What’s changed after the Orchard bug?

Zcash has completed its Ironwood network upgrade, replacing its vulnerable Orchard shielded pool with a formally verified alternative designed to prevent undetectable counterfeiting while beginning the migration of shielded funds into the new pool.

According to Project Tachyon and the Zcash development team, Ironwood activated as scheduled at block height 3,428,143 through the NU6.3 network upgrade on Tuesday, introducing a new shielded pool that developers say restores confidence in Zcash’s supply integrity after concerns surrounding Orchard. 

The activation followed months of work across multiple Zcash organizations after researchers disclosed a flaw that could theoretically have enabled counterfeit ZEC to be created without public detection.

While Ironwood is now active, Orchard has entered an exit-only phase. Users can still withdraw funds from the older shielded pool at their discretion, but it no longer accepts new shielded activity. Data from Zcash’s migration tracker shows roughly 40,207 ZEC have already moved into Ironwood, while nearly 3.6 million ZEC remain inside Orchard awaiting migration.

ZEC (ZEC) briefly fell about 9% to around $460 after the upgrade before recovering to roughly $475, according to the crypto.news price page. The token had already experienced significant volatility after the Orchard vulnerability became public, losing more than half of its value before later rebounding from about $45 in September last year to nearly $700 by year-end.

Ironwood adds a new accounting boundary

The new shielded pool replaces Orchard after researchers identified what became known as the Orchard “infinity” bug. According to Shielded Labs, researcher Taylor Hornby discovered the flaw in late May inside Orchard’s zero-knowledge circuit. Developers said the issue could theoretically have allowed an attacker to mint counterfeit ZEC without immediate detection, although they also stated they found no evidence the vulnerability had ever been exploited.

Emergency upgrades in early June temporarily disabled Orchard before developers deployed corrected circuit code through the NU6.2 hard fork. Even after patching the flaw, developers said Zcash’s privacy model prevented anyone from proving with certainty that hidden inflation had never occurred, prompting work on a replacement shielded pool instead of relying solely on the patched Orchard implementation.

Ironwood introduces a separate accounting system with its own note commitment tree, nullifier set, and chain value pool, allowing nodes to track the new shielded pool independently. According to the project’s technical documentation, the upgrade also installs a public accounting checkpoint known as a turnstile, allowing funds to leave Orchard while preventing more value from exiting than was legitimately entered into the older pool.

Developers have said the mechanism is intended to trap any hypothetical counterfeit coins inside Orchard while allowing independent verification that Zcash’s circulating supply continues to respect the network’s 21 million ZEC issuance limit.

Formal verification has strengthened Ironwood’s security model

Alongside the network activation, Project Tachyon announced that researchers completed a machine-checked mathematical proof covering Ironwood’s balance integrity, providing additional assurance that the new shielded pool cannot create value beyond what has publicly entered it under its stated cryptographic assumptions.

According to Project Tachyon, the proof was written in the Lean programming language and consists of more than 2,700 theorems developed over more than a month by three teams of researchers and cryptographers.

The researchers said their work formally verifies the components required for balance integrity, including Ironwood’s zero-knowledge proof system, circuit rules and ledger-level accounting. They also clarified that the verification does not extend to Ironwood’s separate privacy guarantees.

Commenting on the work, Zcash co-founder Sean Bowe said the cross-team effort eliminated sources of undetectable counterfeiting bugs from the new Ironwood protocol.

The new shielded pool also incorporates ZIP 2005 quantum-recoverable notes, allowing a future recovery mechanism if advances in quantum computing eventually weaken current cryptographic protections. According to the ZIP specification, the feature does not make present-day Zcash transactions quantum secure because a separate recovery protocol would still need to be designed and activated in the future.

Ecosystem teams coordinated the rollout

Ironwood was developed through collaboration between Shielded Labs, the Zcash Open Development Lab (ZODL), Project Tachyon, Valar Group and the Zcash Foundation.

Shielded Labs, co-founded by Zcash founder Zooko Wilcox, initially proposed replacing Orchard to restore verifiable supply accounting after the vulnerability became public.

Meanwhile, ZODL Executive Director Josh Swihart said on X that engineers from his organization contributed 82% of the merged changes across Zcash’s protocol and wallet repositories during the Orchard replacement effort. Swihart added that Orchard had been patched within five days before developers completed the replacement process in about 60 days.

The NU6.3 upgrade also completes another long-planned transition across the network. According to the Zcash Foundation, the older zcashd node software no longer supports the new consensus rules, making Zebra the required node implementation after activation.

Before Ironwood reached the network, Shielded Labs Executive Director Jason McGee had warned that exchanges, wallet providers and mining pools were simultaneously preparing to migrate from zcashd to the new Z3 software stack while also upgrading for Ironwood. McGee said some infrastructure operators needed additional time, although no decision was ultimately made to postpone the network upgrade.

With Ironwood now live and the Orchard migration underway, the focus has shifted to moving remaining shielded funds through the turnstile while the network gradually retires the older pool under the new accounting model.