BlockBeats news, on June 5, Zcash founder Zooko posted that security researcher Taylor Hornby discovered a critical forgery vulnerability in the Zcash Orchard pool on May 29 and disclosed it to the Zcash Open Development Lab (ZODL). ZODL subsequently coordinated an emergency response across the ecosystem, and the patch was completed on June 2.
Shielded Labs stated that the vulnerability is real and exploitable; the exploit code written by Taylor in a local test environment can generate infinite, undetectable forged ZEC. Due to Orchard’s privacy properties, it is not possible to cryptographically prove whether the vulnerability was exploited prior to its patch, but they believe the likelihood of prior exploitation is low. Shielded Labs is exploring a network upgrade proposal to deploy a new shielded pool and implement turnstile accounting for all tokens from the Orchard pool, enabling anyone to verify the integrity of Zcash’s supply and prove that no forged ZEC exists within the Orchard pool.