PANews reported on June 5th that, according to an analysis by Haseeb Qureshi, a partner at Dragonfly, the recently patched Zcash Orchard privacy pool vulnerability has caused market misunderstanding. He believes that even if the vulnerability was exploited before the patch (a very low probability), attackers would need to unshield the counterfeit Shielded ZEC before selling it on exchanges. Therefore, the first to be affected would be holders in the shielded pool, not transparent ZEC holders circulating on exchanges and the market.
Haseeb points out that Zcash's transparent supply is publicly verifiable, and the protocol ensures that the total transparent ZEC supply will not exceed the maximum supply limit. Therefore, if over-minting occurs, the anomaly will first manifest as the "dilution" or depletion of assets in the privacy pool, rather than affecting the ZEC price discovery mechanism in the transparent market.
He stated that the Zcash team plans to introduce a new Turnstile mechanism and a new privacy pool in subsequent upgrades. The migration and auditing process will verify whether there are any abnormal increases in the current Orchard pool, which is equivalent to a "final inventory" of the privacy pool.
In response to market panic, Haseeb further pointed out that in the past 48 hours, the proportion of privacy pools in the total supply only decreased from 31% to 30%, with about 1% of privacy assets being deprived of privacy status. He believes that if privacy pool users who truly understand the risks are widely concerned that the vulnerability has been exploited, there should theoretically be a significant outflow of funds. Therefore, changes in the size of privacy pools can be seen as a real-time "predictive market" of the market's reaction to the vulnerability risk.
Furthermore, Haseeb believes this incident highlights the importance of formal verification. While AI is helping to discover more and more software vulnerabilities, formal verification is expected to fundamentally reduce errors at the implementation level of cryptographic protocols and improve the security of critical infrastructure in the future.
(Disclosure: Dragonfly holds ZEC, and Haseeb is an investor in ZODL.)
