PANews reported on June 6th that, regarding the recently patched Zcash vulnerability, Dragonfly Managing Partner Haseeb stated in an article on the X platform that there are many misunderstandings in the market about this incident. He believes that if the vulnerability had been exploited before the patch (a possibility he considers extremely low), attackers would have profited by forging ZEC tokens in a Shielded Pool and quickly sold them before the vulnerability was exposed.
Haseeb points out that since the main trading market for ZEC is concentrated in transparent addresses, counterfeit privacy ZEC must first undergo an "unshield" process before it can be traded on platforms like Binance and Coinbase. The total supply of ZEC in transparent addresses can be publicly verified, so any abnormal transfers exceeding the maximum supply will be detected and blocked.
In this extreme scenario, the users who truly face the risk of loss are those who hold privacy pool assets long-term, not the vast majority of investors or exchange users holding transparent ZEC. If privacy pool holders are concerned about vulnerability risks, from a game theory perspective, transferring assets back to the transparent address is virtually costless and effectively reduces risk.
Haseeb further stated that the Zcash team plans to introduce a new "Turnstile" mechanism and a brand-new privacy pool in future upgrades to verify that the current privacy pool has not experienced inflation. He likened this process to "taking attendance after a picnic to ensure no extra people sneak onto the bus." Furthermore, although this vulnerability was discovered with the assistance of AI, AI will also drive the industry to solve similar problems, with "Formal Verification" as the core direction. He stated that formally verified cryptographic systems can avoid implementation errors at the design level, which will become an important path for the future development of key software such as browsers, operating systems, and blockchain.
Haseeb also pointed out that currently about 30% of ZEC is in privacy pools, but only about 1% of the funds in these pools were de-privateized after the vulnerability was disclosed. He believes this indicates that the holders who actually bear the risk are not worried about the vulnerability being exploited, and that "the size of the privacy pool itself is a predictive market for the risk of this vulnerability." He finally disclosed that Dragonfly still holds ZEC and is also an investor in ZODL.
