Zcash Drops 30% Following Discovery of Long-Standing Bug by Shielded Labs

Zcash (ZEC) experienced a sharp decline of 30%, dropping to $400, following the identification of a serious vulnerability in its Orchard privacy pool. This flaw, revealed by Shielded Labs, raised alarms about the potential for unlimited counterfeit tokens to be created undetected, jeopardizing the integrity of Zcash's supply.

Vulnerability Overview

Shielded Labs reported that the bug could have allowed attackers to generate an infinite number of counterfeit ZEC tokens without being noticed, significantly undermining trust in the cryptocurrency's supply. The vulnerability was discovered by security engineer Taylor Hornby using Anthropic’s Opus 4.8 AI model on May 29, and it was addressed by June 1. Alarmingly, the issue had been present since the Orchard's activation in May 2022 and went unnoticed for four years.

• Hornby, working with Shielded Labs, confirmed that the vulnerability enabled unlimited counterfeit token creation during testing.
• Shielded Labs noted that there is no cryptographic method to verify whether the flaw was exploited prior to the fix.
• The organization is calling for a network upgrade to improve security and restore confidence in ZEC's supply.

Despite the quick remediation of the bug, market reactions were negative, likely reflecting concerns over the prolonged undetected existence of the vulnerability. Shielded Labs acknowledged the uncertainty regarding any potential prior exploitation of the flaw.

Community Response

Hornby reported the issue to the Zcash Open Development Lab (ZODL), which facilitated the rapid response to fix the vulnerability. Shielded Labs indicated that the bug had eluded detection for years, only being uncovered through advanced AI technologies and dedicated research efforts.

They believe that exploitation was unlikely due to several factors: expert scrutiny over the years and the swift identification and resolution of the issue, which minimized the window for any potential exploitation. To further enhance security, Shielded Labs is proposing a network upgrade that will allow for independent verification of ZEC's supply integrity, including the introduction of a new shielded pool and tighter accounting measures for coins originating from the Orchard pool. The organization is also looking to strengthen its security team by collaborating with Hornby and recruiting new personnel for critical security positions.

A detailed update on these developments is expected from Shielded Labs next week.