Zooko Wilcox Says Zcash (ZEC) Supply Is Verifiable: How Ironwood Blocks Secret Inflation
2026/08/02 13:00:00
Zcash’s Ironwood upgrade has reshaped the debate over whether the ZEC supply remains verifiable following the discovery of a critical vulnerability in the retired Orchard shielded pool. Although there is no known evidence of mainnet exploitation, Orchard’s privacy protections prevent investigators from conclusively proving that counterfeit notes were never created.Zcash co-founder Zooko Wilcox says users can now verify the protocol-accounted supply independently. By making Orchard exit-only, tracking pool balances and routing withdrawals through the Zcash turnstile, Ironwood prevents hypothetical excess value from circulating or escaping into the wider Zcash economy. However, the upgrade strengthens current ZEC supply integrity without proving that the Orchard vulnerability was never exploited.
Zooko Wilcox Says Zcash Supply Can Be Verified Locally
Zcash co-founder Zooko Wilcox says users can independently verify the ZEC supply on a local computer following the Ironwood network upgrade, which activated on July 28, 2026. In a July 29 post on X, he reported that a fully synchronized node showed a chain-supply snapshot of 16,848,458 ZEC, or about 80.23% of Zcash’s fixed 21 million maximum supply. The figure is not permanent because mining rewards continue to add new ZEC under the protocol’s issuance schedule.
Ironwood made the original Orchard shielded pool exit-only, preventing new deposits and ordinary transfers within the pool. Funds leaving Orchard must pass through a protocol-level accounting mechanism that limits withdrawals to the amount of ZEC verifiably deposited. By running a fully synchronized Zcash node and using the getblockchaininfo RPC, users can inspect the chainSupply and valuePools fields without relying on developers, exchanges or third-party block explorers.
The node-reported chain supply may differ from market circulating-supply estimates because protocol accounting can include issued ZEC held in restricted or deferred pools, while data providers may exclude assets they consider unavailable for trading. Wilcox’s figure should therefore be understood as a locally verifiable blockchain snapshot, not the amount of ZEC actively circulating in the market.
How Ironwood and the Zcash Turnstile Block Secret ZEC Inflation
The Zcash Ironwood upgrade addresses a specific weakness created by the former Orchard design: a counterfeit note could theoretically exist and continue changing hands privately inside the shielded pool even if the network prevented excess value from crossing into another pool. Ironwood resolves that problem by combining strict restrictions on Orchard activity with the Zcash turnstile’s public accounting rules. The result is a protocol boundary that stops hypothetical counterfeit ZEC from remaining economically active inside Orchard or entering the wider Zcash economy.
Ironwood Turns the Orchard Shielded Pool Into an Exit-Only System
Before Ironwood, Orchard functioned as an active shielded pool in which users could receive funds, make private payments and transfer value without revealing individual amounts or addresses. This privacy depended on the soundness of Orchard’s zero-knowledge circuit, which was later found to contain an under-constrained element that could theoretically accept counterfeit notes as valid. Ironwood changes Orchard’s role at the consensus level instead of relying only on the corrected circuit. New value can no longer enter the old pool, coinbase rewards cannot create Orchard outputs, and ordinary cross-address payments inside Orchard are disabled. Legitimate holders can still move their funds out, including transactions that require self-directed change, but Orchard can no longer operate as an independent private economy where ZEC repeatedly circulates between different users. New shielded activity is directed into the separate Ironwood pool, allowing Orchard’s remaining balance to decline over time while preventing additional funds or newly issued ZEC from entering the retired system.
How the Zcash Turnstile Limits Orchard Withdrawals
The Zcash turnstile is an on-chain accounting mechanism that tracks the aggregate value entering and leaving each shielded pool without revealing the private transactions taking place inside it. Individual Orchard balances, addresses and transfers remain hidden, but movements across the pool boundary create publicly verifiable changes in its total value.
Every full node maintains this chain-value balance and rejects a block if a transaction attempts to withdraw more ZEC from Orchard than the amount that legitimately entered through recorded deposits and protocol-authorized flows. The turnstile does not need to identify which individual notes are legitimate or counterfeit. Instead, it enforces a cumulative withdrawal ceiling for the entire pool. If hypothetical counterfeit ZEC was created through the former Orchard vulnerability, that excess value would have no corresponding deposit in the public accounting record and therefore could not be transferred into Ironwood, Sapling or the transparent pool once the legitimate withdrawal limit was reached. This distinction is important because the turnstile existed before Ironwood, but Orchard users could previously continue transferring notes privately within the pool. Ironwood closes that internal circulation route, making the turnstile the only economically meaningful path forward.
Why Ironwood Does Not Require Every Orchard Holder to Migrate
The protection against secret ZEC inflation does not depend on every legitimate Orchard balance moving into Ironwood. Once the new consensus restrictions became active, Orchard could no longer accept deposits or support ordinary payments between different users, while its only exit remained subject to the turnstile’s verified withdrawal limit. Any ZEC that never migrates whether because of lost private keys, abandoned wallets, testing funds or uneconomical dust balances remains isolated in a pool that cannot expand or function as an active payment network. For this reason, the Orchard-to-Ironwood migration may never reach a literal 100%, but an incomplete migration does not allow excess value to circulate. Migration progress can still provide useful evidence about the earlier vulnerability: a continuing flow of legitimate withdrawals without the turnstile reaching its limit would strengthen the assessment that large-scale counterfeiting probably did not occur. If withdrawal claims eventually exceeded the pool’s verified deposits, the network would reject the excess and expose a measurable inconsistency. That evidence would be important, but it is separate from the immediate supply protection created when Orchard became exit-only.
Ironwood Creates a Separate and Independently Accounted Shielded Pool
Ironwood does not inherit Orchard’s internal state or hidden note history. It began as a separate shielded pool with its own chain-value balance, note-commitment tree, nullifier set and transaction history, creating a clean accounting boundary between the retired system and future private ZEC activity. Funds entering Ironwood must arrive through a consensus-authorized transaction whose value is reflected in the public pool accounting, preventing unverified Orchard value from silently carrying forward. The new pool uses the corrected Orchard-based circuit together with additional security analysis and formal verification focused on balance integrity. This layered design means the Zcash network does not rely solely on assumptions about whether the earlier bug was exploited. Instead, Ironwood restricts the old pool, subjects every exit to cumulative turnstile accounting and records new shielded value inside a separately monitored system. Under the network’s consensus rules and stated cryptographic assumptions, hypothetical counterfeit Orchard notes cannot secretly become spendable ZEC elsewhere, which is the central mechanism through which Ironwood protects ZEC supply integrity.
What Ironwood Proves About the Orchard Bug, ZEC Migration and Remaining Risks
Ironwood provides a forward-looking guarantee about Zcash supply integrity, but it does not retroactively reconstruct every private Orchard transaction or establish with certainty that the earlier vulnerability was never exploited. Understanding this distinction is essential when assessing the Orchard bug, the purpose of ZEC migration and the security protections introduced through formal verification. The strongest accurate conclusion is that Ironwood prevents any hypothetical excess Orchard value from remaining part of the usable Zcash economy, while the historical question of whether counterfeit notes were created before remediation remains unresolved.
Was the Zcash Orchard Bug Ever Exploited?
There is currently no known evidence that the Orchard vulnerability was exploited on Zcash mainnet, and the organizations involved in the investigation have said prior exploitation appears unlikely. Security researcher Taylor Hornby demonstrated that the flaw was real by creating a working exploit in a local regtest environment, but a successful test does not establish that another party discovered or used the same method against the live network. Developers reported no confirmed unauthorized value creation, user losses or privacy compromise connected to the vulnerability. Observed Orchard activity also did not show the aggressive withdrawals typically associated with cryptocurrency exploits, in which attackers attempt to convert counterfeit assets into liquid value before a vulnerability is patched. These observations support the assessment that exploitation probably did not occur, but they remain circumstantial evidence rather than cryptographic proof. Because Orchard concealed transaction amounts, senders, recipients and the relationships between private notes, investigators cannot replay its complete internal economic history and conclusively determine whether an attacker created counterfeit notes that were never withdrawn or publicly monetized.
What Ironwood’s Formal Verification Actually Proves
Project Tachyon published a machine-checked formal verification of Ironwood’s balance integrity on July 28, 2026. The work contains more than 2,700 Lean theorems and required three teams of researchers and cryptographers working for more than a month. It examines whether Ironwood’s proof system and ledger rules enforce the conditions needed to prevent undetectable counterfeiting. This includes showing that valid spends correspond to previously created notes, values remain within the permitted range, nullifiers prevent the same note from being spent repeatedly and hidden inputs and outputs remain balanced against the publicly declared value entering or leaving the pool. The verification also analyzes the knowledge soundness of Ironwood’s zero-knowledge proof system, connecting accepted proofs to valid underlying witnesses under stated cryptographic assumptions. This is significantly stronger than an ordinary software review because the security properties are expressed mathematically and checked by a proof assistant rather than depending only on human inspection or a limited set of test cases.
Formal verification should nevertheless be described according to its actual scope. The completed work focuses on balance integrity and counterfeiting resistance, not every possible property of the Zcash network. It does not prove Ironwood’s privacy guarantees, eliminate operational mistakes in wallets or establish that all future software will be free from implementation bugs. The proof also relies on recognized cryptographic assumptions involving discrete logarithms, random-oracle modeling and signature unforgeability. Project Tachyon argues that implementation deviations from the formally analyzed verifier would leave publicly replayable evidence because accepted proofs are recorded in the blockchain, but this does not mean every security risk has disappeared. Ironwood’s ZIP 2005 feature should also be described carefully: it creates quantum-recoverable note records intended to support future fund recovery if current cryptography is weakened, but it does not make Zcash fully resistant to quantum computing today.
What the Orchard-to-Ironwood Migration Can Reveal
Migration activity may provide additional evidence about whether the Orchard vulnerability was exploited, even though it cannot deliver a perfect historical answer. Approximately 176,000 ZEC, then worth around $81 million, entered Ironwood during its first day, equal to roughly 5% of Orchard’s balance at activation. Continued withdrawals by legitimate holders reduce the amount remaining in Orchard and test whether recognized claims can be processed without an accounting conflict. If substantial balances move successfully over time and no attempt exceeds the pool’s permitted withdrawal capacity, confidence that large-scale counterfeiting did not occur should increase. Conversely, if valid-looking withdrawal claims eventually surpass the amount available under Orchard’s accounting limit, the rejected excess would provide publicly observable evidence that more private claims existed than legitimate deposits could support.
The migration process cannot conclusively prove that every Orchard note was legitimate because some balances will probably never move. Private keys may be lost, wallets may be abandoned and very small balances may remain uneconomical to transfer. A hypothetical attacker could also leave counterfeit notes untouched rather than risk revealing an inconsistency. Therefore, migration data should be treated as a developing source of evidence rather than a countdown to a single moment when historical uncertainty disappears. Articles should avoid claiming that the Zcash community will obtain a definitive verdict when migration reaches 100%, since complete migration may never occur. The more defensible interpretation is that orderly migration can narrow the practical uncertainty and strengthen confidence in legitimate Orchard balances without rewriting the pool’s private transaction history.
Remaining Risks for Orchard Holders and Wallet Users
The most serious remaining theoretical risk concerns the recoverability of legitimate Orchard balances if counterfeiting occurred before the vulnerability was fixed. Shielded Labs considers this scenario unlikely, but if counterfeit funds existed and were withdrawn ahead of legitimate users, later holders could eventually encounter the pool’s withdrawal ceiling. The protocol cannot distinguish a counterfeit note from a legitimate note based on ownership history once both were accepted under the former vulnerable circuit; it can only enforce the aggregate amount permitted to leave. No evidence currently indicates that Orchard holders are facing this outcome, and early migration activity has not established an accounting shortfall. Nevertheless, describing this tail risk is necessary because “no evidence of exploitation” and “proof that exploitation never occurred” are materially different conclusions.
Users also face practical migration risks involving wallet compatibility, service availability and privacy. A wallet must support the Ironwood network rules and the Orchard-to-Ironwood migration process before funds can be moved safely. Exchanges, custodians and wallet providers may temporarily pause ZEC deposits or withdrawals while upgrading their infrastructure, which can make a balance temporarily inaccessible without indicating that the funds have been lost. Migration also exposes the amount and timing of value crossing between pools, even though shielded transaction activity inside each pool remains private. A remote wallet service may additionally associate a migration request with the user’s IP address, creating a network-level privacy risk. Users should verify official wallet support, protect recovery information, retain secure backups and consider privacy-preserving network tools such as Tor or Nym where supported. Ironwood substantially strengthens ZEC supply integrity, but secure migration still depends on reliable wallet software, careful user behavior and transparent support from the broader Zcash ecosystem.
Conclusion
Zooko Wilcox’s statement that the Zcash supply is already verifiable reflects the most important outcome of the Ironwood upgrade: users no longer need to rely entirely on developer assurances or wait for every Orchard balance to migrate before assessing the soundness of the usable ZEC supply. Ironwood creates a clean shielded pool, isolates the uncertainty associated with Orchard and applies consensus rules that prevent hypothetical excess value from continuing to function as circulating ZEC. Its formally verified balance-integrity properties provide additional assurance that the new pool is designed to prevent the type of undetectable counterfeiting vulnerability discovered in Orchard.
The accurate conclusion is not that Ironwood proves the Orchard bug was never exploited. Historical exploitation remains unknown, although no evidence currently indicates that counterfeit ZEC was created on mainnet. What Ironwood proves is that any hypothetical excess Orchard value cannot continue circulating secretly or move freely into the rest of the Zcash ecosystem. Migration data may gradually strengthen confidence in legitimate balances, but wallet compatibility, privacy exposure and the theoretical recoverability risk for late Orchard withdrawals still require attention. For ZEC holders, the upgrade represents a major improvement in supply verifiability while also demonstrating why precise language, independent verification and careful security practices remain essential in privacy-focused cryptocurrency systems.
|
KuCoin is celebrating its 9th anniversary with a special platform campaign filled with exclusive rewards, trading activities, and limited-time offers. Don’t miss the chance to participate and enjoy the benefits as the exchange marks nine years of growth and innovation. Visit the official campaign page now:
|
Frequently Asked Questions
Is Ironwood a New Zcash Token or a Separate Cryptocurrency?
No. Ironwood is a new shielded value pool introduced through the Zcash NU6.3 network upgrade, not a separate cryptocurrency, blockchain or replacement token. ZEC remains the native asset of the Zcash network, and its ticker, monetary policy and ownership rules have not changed. Holders do not need to exchange ZEC for an “Ironwood token,” claim an airdrop or send funds to a token contract. Any website or social-media account offering a special Ironwood coin conversion should be treated with caution because legitimate migration occurs through compatible Zcash wallet software.
Which ZEC Holders Need to Complete an Orchard-to-Ironwood Migration?
Migration is relevant primarily to users holding ZEC inside the retired Orchard shielded pool. ZEC held in the transparent pool, Sapling, a custodial platform account or a wallet already using Ironwood does not require the same Orchard migration process. Self-custody users should check their wallet’s pool-level balance breakdown before taking action because a single wallet may contain funds in more than one Zcash value pool. Orchard funds remain associated with their legitimate owner, but an updated wallet must support the migration transaction before those funds can be moved into Ironwood.
Do Custodial Platform Users Need to Migrate ZEC Manually?
Users holding ZEC through a centralized trading platform or custodian generally do not perform the technical Orchard-to-Ironwood migration themselves because the service controls the underlying wallet infrastructure. The provider is responsible for updating its nodes, wallet software and deposit or withdrawal systems. However, users should check the platform’s current Zcash network status before transferring funds, as deposits and withdrawals may be temporarily suspended during an infrastructure upgrade. A service pause does not automatically indicate lost funds, but users should wait for official confirmation that Ironwood transactions are supported before initiating a withdrawal.
Is There a Deadline for Moving ZEC Out of Orchard?
The Ironwood design does not impose a universal deadline that automatically confiscates or expires legitimate Orchard balances. Migration is voluntary and may continue over an extended period because wallet providers, custodians and individual holders will move at different speeds. Some funds may remain indefinitely because their private keys have been lost or their balances are too small to transfer economically. Nevertheless, Orchard no longer functions as the current destination for normal shielded activity, so holders who want to use their funds should eventually migrate through supported wallet software rather than assuming every older wallet will remain operational indefinitely.
How Can Users Check Whether a Zcash Wallet Supports Ironwood?
Users should review the wallet developer’s official release notes or support documentation for explicit references to NU6.3, Ironwood or ZIP 318 Orchard migration support. The wallet should be downloaded or updated only through its verified website, official application-store listing or authenticated software repository. A compatible version may display separate Orchard and Ironwood balances or provide a built-in migration option. Before moving ZEC, users should confirm that their recovery phrase or wallet backup is secure and consider testing the process with a smaller balance where practical. Existing Zcash addresses may remain usable, but correct routing into Ironwood depends on updated wallet implementation.
Does Ironwood Change Transparent or Sapling ZEC Balances?
No. Transparent, Sapling, Orchard and Ironwood are separate value pools within the same Zcash blockchain, and the Ironwood upgrade does not automatically convert or invalidate ZEC held in the other pools. Transparent balances continue to operate with publicly visible transaction details, while Sapling remains an older shielded option. However, wallet and service support can differ across pools, so users should verify which transaction types their chosen software supports. Moving ZEC from one pool to another is an on-chain transaction rather than a change in the underlying asset.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency prices are highly volatile, so readers should verify current data and conduct independent research before making financial decisions.