Zcash protocol developers and several community organizations have agreed on the specific consensus-rule changes planned for the Ironwood network upgrade, moving the proposal from broad alignment into implementation, specification, and ecosystem coordination. The plan is intended to address supply-audit concerns around the Orchard shielded pool after a recently remediated soundness bug raised the possibility of undetected counterfeit notes within that pool.
Zcash Developers Set Ironwood Upgrade Plan
Sean Bowe, a Zcash cryptographer and co-author of Project Tachyon’s Ironwood statement, wrote on X that “the various orgs and protocol developers mentioned have agreed on the specific consensus rule changes for Ironwood, after settling the finer details.” The agreement follows a June 6 joint statement from Project Tachyon and Valar Group, which said their preferred approach aligned with parallel statements from Shielded Labs and the Zcash Open Development Lab, while the Zcash Foundation had also signaled agreement.
Bowe summarized the core design as a new shielded pool that uses the Orchard protocol, alongside a consensus-controlled circuit flag affecting both the existing Orchard pool and the new Ironwood pool. “The circuit for the Orchard protocol—which applies to both the existing Orchard pool and the new Ironwood pool—will have a flag that consensus rules can toggle,” he wrote. “This flag disables payments to other users within that pool, while maintaining the ability to create change notes. This enables a privacy safeguard.”
Under the agreed plan, the old Orchard pool will have that flag enabled after the upgrade, and payments into the old pool will also be disabled by constraining valueBalance. Wallets will therefore need to send new payments to Orchard receivers inside existing unified addresses through the new Ironwood pool, while also migrating funds away from the old pool. Bowe said the arrangement “enforces a bound on the circulating supply of ZEC through the use of the existing turnstile mechanism,” adding that “the amount of ZEC that anyone can transact with is no more than the amount that is supposed to exist.”
Ironwood Plan Targets Orchard Supply Audits
The Ironwood plan is a response to a bug disclosed by ZODL after it was discovered by Taylor Hornby during security analysis funded by Shielded Labs. Project Tachyon and Valar Group described the flaw as a soundness bug in the zk-SNARK circuit used by Orchard to prove the correctness of shielded transactions, saying it “could have allowed an adversary to undetectably create counterfeit notes within the Orchard pool.” They also emphasized that the concern is about the possibility of prior exploitation before the patch, not a confirmed counterfeit event.
The proposed mitigation relies on Zcash’s existing turnstile accounting system, which publicly tallies funds entering and leaving shielded pools. Project Tachyon and Valar Group explained the mechanism this way: “Any funds that enter or leave a pool are publicly tallied such that the amount of funds supposedly within a given pool is known with certainty at all times. The Zcash protocol prohibits withdrawing more money from a pool than had entered it previously, even if we cannot ascertain how many possibly counterfeit coins exist inside of the pool.” By restricting payments in the old Orchard pool, the upgrade is designed to make any spendable funds pass through that accounting boundary before they can circulate economically.
The organizations framed Ironwood as a way to accelerate supply assurance while preserving much of the existing Orchard user and developer experience. “Our proposed approach effectively forces Orchard funds to travel through the turnstile into the new Ironwood pool before they can be used to make payments, rendering hypothetical counterfeit coins that remain in the old pool increasingly worthless,” Project Tachyon and Valar Group wrote. “This strategy is elegant because users after the network upgrade obtain immediate assurance that their wallets, and the wallets of other users, are not circulating counterfeit ZEC in the old Orchard pool.” Bowe said the next phase will focus on implementations, specifications, ecosystem support and outreach, alongside “many different auditing and formal verification efforts” intended to provide assurance about circuit correctness.
Ironwood now appears set to become the Zcash community’s coordinated path for isolating the old Orchard pool, routing new Orchard-style activity into a fresh pool, and using the turnstile mechanism to constrain circulating ZEC. The upgrade plan does not claim to prove immediately that no counterfeiting ever occurred, but it is designed to make any economically useful movement of old-pool funds auditable over time while developers complete the technical work needed for activation.
AI Transparency Note: This article was prepared with the assistance of an AI system based on the sources listed and was reviewed, edited, and approved by a human editor before publication. All quotes, data points, and factual claims are intended to be grounded in the cited source material; however, errors cannot be ruled out entirely.