# Ironwood History

Shielded Labs security researcher Taylor Hornby discovered a counterfeiting
bug in the Orchard shielded pool's ZK circuit
(https://shieldedlabs.net/the-orchard-counterfeiting-vulnerability/) through
the use of AI vulnerability analysis, described at
https://drive.google.com/file/d/1SVK41y-ip3Vw9eB69E9QRy-Qn3idTOwV/view?usp=drivesdk.
The vulnerability was quickly patched in a hard fork network upgrade days
later by the Zcash Open Development Lab (ZODL):
https://zodl.com/orchard-vulnerability-successfully-remediated/.

In the following days, Shielded Labs proposed a solution to re-establish
user guarantees about the circulating supply of ZEC: disable payments in
the Orchard shielded pool in a network upgrade and simultaneously introduce
a new pool based on a patched version of Orchard, forcing all payments to
send money through the turnstile first if they could hypothetically be
counterfeit coins. Kris Nuttycombe from ZODL provided a key refinement:
because the new pool uses the same cryptography, wallets can seamlessly
route payments to Orchard receivers into the new Ironwood pool instead,
reducing UX friction.

## Governance

The community rallied around the idea and, after some debate, Project
Tachyon, Valar Group, ZODL, Shielded Labs and the Zcash Foundation agreed
to a limited-scope NU6.3 upgrade introducing the pool. The specific
consensus rules were resolved in the days that followed.

One early area of debate was the exact mechanism for disabling payments in
the old pool. Orchard comes pre-configured with an `enableOutputs` flag
that the consensus rules can toggle to disable payments in precisely this
kind of situation, but when disabled the flag also prohibits the creation
of change notes within the pool. That complicates private migration out of
the pool, because funds are forced to leave as a sum of (a subset of) the
note values in the wallet. Valar Group was very insistent on the ability
to privately migrate, and the parties compromised on a minor circuit
change that restricts payments to either leaving the pool or being made to
the same address that spent them, permitting change notes while limiting
payments within the pool to esoteric payment protocols.

## Implementation

The implementation of the upgrade's consensus rules was largely the work
of Project Tachyon, Valar Group and ZODL.

Hardware wallet support: the ability to migrate funds from Orchard to
Ironwood using the Keystone hardware wallet was a focus of Valar Group.
After a multi-week effort to ensure migration capabilities were ergonomic,
helped in part by optimizations to the PCZT components of the `orchard`
and `librustzcash` libraries, and after laborious modifications and
testing of the Keystone firmware, Valar Group completed this work. The
Keystone firmware changes alone spanned numerous pull requests:
https://github.com/KeystoneHQ/keystone3-firmware/pulls?q=is%3Apr+author%3Aczarcas7ic+is%3Aclosed.

Ironwood circuit changes: Project Tachyon contributed the modifications to
the Ironwood circuit that enable the "cross-address restriction" needed
for disabling payments in the pool while allowing private migration:
https://github.com/zcash/orchard/pull/504.

## Formal Verification

Project Tachyon is coordinating an ongoing formal verification effort for
Ironwood. Its most recent update is at
https://tachyon.z.cash/blog/detecting-counterfeiting-in-zcash/.

## Activation

The activation height of 3428143 was chosen for NU6.3, roughly 28 July
2026. The Zcash Foundation landed NU6.3 support in Zebra:
https://zfnd.org/zebra-6-0-0-release/. Zakura, the project's fork of
Zebra, has had support for NU6.3 and the Ironwood consensus rules since
its initial 1.0.0 release.

The Ironwood overview explains how the pool works today:
https://zakura.com/ironwood/ (markdown: https://zakura.com/ironwood.md).

---

Canonical HTML version: https://zakura.com/ironwood/history/