Zcash Ironwood hard fork seals Orchard pool July 28 after 4-year bug

Zcash will activate the Ironwood hard fork on July 28 at block 3,428,143, sealing the Orchard shielded pool after a soundness bug that went undetected for four years.

"The turnstile mechanism ensures the supply of ZEC is mathematically and publicly verifiable by anyone running node software," Zooko Wilcox, co-founder and lead developer of Zcash, said.

The bug, discovered May 29 by Shielded Labs researcher Taylor Hornby, had been live since Orchard activated in May 2022. Developers patched the vulnerability via the NU6.2 hard fork on June 3, but zero-knowledge proofs leave no on-chain record of past transactions, making it impossible to confirm whether counterfeit ZEC was ever minted. Ironwood's turnstile caps withdrawals from the old pool at the total amount of legitimate deposits, trapping any forged coins inside permanently.

Node operators, exchanges and wallet providers must upgrade before the activation block or risk falling off the canonical chain. The upgrade arrives alongside Zakura, a new full node from Zcash founding cryptographer Sean Bowe and Osmosis co-founder Dev Ojha, which achieves a four-hour sync time through pruning and snapshot support.

The turnstile is not new to Zcash — the network used a similar mechanism during earlier pool migrations — but applying it to Orchard marks a more aggressive containment step. The old pool will accept no new deposits after the fork. Funds can only exit through the turnstile gateway, which enforces a strict balance check: only the total amount of ZEC that provably entered the pool over its lifetime can leave. Any excess, whether from the bug or otherwise, stays locked.

Zakura, released July 16 at version 1.0.0, is maintained independently of the Zcash Foundation. It is a pruned fork of the Foundation's Zebra node software and includes a compatibility mode that reproduces the interface of the legacy zcashd client, which reached end of life on July 18. The team behind Zakura — funded by private ZEC donations rather than a foundation or company — has broader ambitions: matching Visa- and Mastercard-level throughput of more than 50,000 transactions per second through recursive proofs under Project Tachyon and private information retrieval techniques from Valar Group.

For now, the immediate test is the July 28 activation. Exchanges and wallet providers that support ZEC have been given additional preparation time after the activation was pushed back one week from the original target. Users managing ZEC through private wallets may see their Orchard balances temporarily appear unavailable as nodes process the transition between the old and new pools.

This article is for informational purposes only and does not constitute investment advice.