Zcash Fixes Critical Vulnerability As ZEC Holds $600 Support

Zcash has patched a dangerous vulnerability in its privacy-focused infrastructure that could have enabled double-spending, deploying an emergency network upgrade to prevent exploitation.

Zcash Fixes Critical Bug With Emergency Upgrade

On Wednesday, the Zcash Foundation revealed that developers had fixed a serious vulnerability in its Orchard shielded pool, which could have allowed invalid state transitions, potentially enabling double-spending within the pool.

According to the report, Zcash researcher Taylor Hornby, who is conducting an ongoing protocol audit on behalf of Shielded Labs, discovered a critical soundness vulnerability in the Orchard zero-knowledge proof circuit on May 29 and disclosed the issue to Zcash Open Development Lab (ZODL) core engineers that same day.

“A soundness vulnerability is one that could allow the system to accept something it should reject. In this case, successful exploitation could have allowed the Orchard pool to accept invalid state transitions, potentially permitting double-spending of funds within Orchard, though with no ability to inflate the total ZEC supply, which is protected by Zcash’s turnstile mechanism,” the foundation explained.

After identifying the vulnerability, Zcash developers, miners, and infrastructure operators coordinated privately to prepare a fix, keeping details confidential to avoid potential exploits.

The first soft fork attempt faced technical challenges, but engineers quickly released a revised patch that successfully activated on June 2, temporarily disabling Orchard-related transactions. On June 3, the network completed a full hard fork upgrade, NU6.2, restoring Orchard functionality with the corrected code and permanently resolving the vulnerability.

The Foundation said there was no evidence that the bug was exploited, as no unauthorized value creation was detected. In addition, they affirmed that the total ZEC supply remains safe and the issue did not affect the privacy of funds held in any Zcash pool.

ZEC Holds Key Support Amid Network Confusion

Following the upgrade, news that the network was offline circulated on social media, creating confusion among community members. Some reports claimed that Zcash had failed to produce blocks for over four hours.

However, Mert Mumtaz, CEO of Solana infrastructure firm Helius, dismissed these reports, affirming that the network was never down and that explorer apps were connected to a bad node.

In a series of X posts, Zcash blockchain explorer CipherScan confirmed the issue, explaining that its nodes were upgrading to support the recent NU6.2 network upgrade.

“What actually happened: Zcash pushed a coordinated network upgrade (NU6.2) that required all node operators to update. During that transition, some block explorers, including ours, showed stale or missing data while we upgraded,” the post stated.

“That’s the explorer being out of sync, not the blockchain being broken. Important distinction. (…) Block explorers are just readers. They pull data from a node, parse it, and display it. If the node is upgrading or resyncing, the explorer goes stale,” the explorer continued.