Orchard Pool Fix Incoming: Zcash Schedules Ironwood Upgrade for July Deployment

Zcash developers have confirmed the final consensus changes for the Ironwood upgrade, with activation expected in late July at block height 3,417,100. The upgrade is designed to resolve a critical vulnerability in the Orchard shielded pool that could have allowed unlimited counterfeit ZEC to be minted.

Ironwood introduces a new shielded pool, reinforces supply integrity using the existing turnstile mechanism, and blocks any new incoming transactions into the compromised Orchard pool. These updates are supported by formally verified zero-knowledge proof circuits and independent third-party security audits.

The Orchard Vulnerability and Ironwood’s Fix

The Orchard pool, launched in May 2022 as part of the NU5 upgrade, integrated the Halo 2 proof system and represented Zcash’s next-generation privacy layer. It enables fully shielded transactions by concealing amounts and participant identities without requiring a trusted setup.

However, a flaw identified in early 2026 exposed a weakness in the circuit design. If exploited, it could have enabled the creation of counterfeit ZEC without leaving any detectable on-chain evidence.

As a result, the total supply within the Orchard pool was not strictly enforced. The same privacy architecture that protects users also made unauthorized issuance effectively invisible—even to the Zcash development team.

The issue was discovered through an AI-assisted external audit, prompting a discreet patch and coordinated disclosure ahead of the Ironwood proposal.

Turnstile Enforcement and Supply Verification

Ironwood is being developed through a collaborative effort involving ZODL, Tachyon, Valar Group, the Zcash Foundation, and Shielded Labs, highlighting a multi-stakeholder governance approach.

At its core is a redesigned Orchard circuit that includes a mechanism to restrict payments within a pool while still allowing change outputs, preserving privacy protections.

Once activated, this restriction will be permanently applied to the legacy Orchard pool. All new transactions will be automatically redirected to the replacement pool, while constraints on the valueBalance field ensure supply limits are enforced.

The upgrade relies on the existing turnstile mechanism to maintain accurate supply accounting. Any ZEC exiting the old Orchard pool must pass through the turnstile before entering the new pool, ensuring that the amount transferred cannot exceed the amount originally deposited.

This structure guarantees that circulating supply remains within intended bounds. After migration, full nodes will be able to independently verify that no counterfeit ZEC has entered the new pool, restoring trustless supply validation at the protocol level.

The planned activation coincides with the end-of-support for zcashd at block height 3,417,100. Before deployment on mainnet, the upgrade will undergo testnet validation, ecosystem coordination, and final security reviews. Wallet providers are expected to introduce simplified migration tools, and the new pool is designed to retain compatibility with existing Orchard addresses, eliminating the need for key rotation.