Zcash Shielded News is a community article format based on the weekly Zcash Ecosystem Digest Newsletter.
Providing insight on current events and informing the community about important news in the Zcash ecosystem.
Check out the best Highlights below!
📅 Subscribe to the Zcash Event Calendar!
💡 Fact of the Week
A turnstile is Zcash’s on-chain accounting mechanism for tracking how much ZEC moves between different value pools.
In simple terms, Zcash’s consensus rules use value pool accounting to reject transactions that would move more ZEC out of a pool than legitimately entered it.
This matters for proposals like Ironwood, because funds leaving the old Orchard pool would need to pass through this accounting checkpoint as they move out of that pool.
That helps users verify the integrity of Zcash’s circulating supply across pools without needing to inspect every private transaction inside a shielded pool.
📩 In today’s edition: 🛡️ Zcash Completes Security Upgrade for Orchard• The Zcash ecosystem completed a coordinated security upgrade to address the Orchard vulnerability, with no evidence of exploitation, no impact to user funds, no privacy impact, and no detected change to the total ZEC supply. ⚙️ Ironwood: Making Zcash Supply Verifiable Again• Following the Orchard update, Shielded Labs, ZODL, the Zcash Foundation, Tachyon Group, and Valar Group are working on Ironwood, a proposed network upgrade designed to make Zcash’s circulating supply independently verifiable again. 🦓 Zcash Foundation: Engineering Update May 18–31, 2026• ZF shipped Zebra v4.5.0 and v4.5.1, addressing 13 security issues while improving node reliability, mining support, infrastructure, and developer tooling across the Zcash stack. 🔐 Tachyon & Ragu: A Stronger Foundation for Zcash Privacy• Sean Bowe and Tal Derei shared an update on Tachyon and Ragu, outlining work on scalable shielded privacy, recursive zk-SNARKs, formal verification, fuzzing, and high-assurance cryptographic engineering. 🌎 Subduing the World. Zcash Update.• In this week’s ZODL update, Josh Swihart reflected on the emergency upgrade from an operational perspective, highlighting coordination, trust, communication, and the ecosystem’s ability to act quickly under pressure, alongside the latest ZODL mobile, core, and ecosystem updates
Zcash Completes Security Upgrade for Orchard 🛡️
On June 1, Zcash went through a coordinated network upgrade to address a vulnerability in Orchard, the network’s latest shielded pool.
Most importantly, there is no evidence that the issue was exploited. User funds remained safe, privacy was not affected, and no unauthorized creation of ZEC was detected. The total supply cap of 21 million ZEC remains intact.
To reduce risk while the fix was being prepared, Orchard-related transactions were temporarily paused for about 24 hours. The network first activated a soft fork to stop new Orchard activity, followed by a hard fork that applied the full protocol-level fix and restored normal Orchard functionality.
Only Orchard was affected. Sapling and transparent transactions continued to work as usual, and ZEC held on exchanges was not affected and remained tradable. Because the fix required a consensus change, it could not be handled through a simple software patch.
The vulnerability was discovered by Taylor Hornby during a security audit and responsibly disclosed. The response involved developers, miners, node operators, exchanges, wallet providers, the Zcash Foundation, and other independent ecosystem participants. The upgrade was completed successfully on June 3, restoring Orchard transactions.
The broader takeaway is that Zcash’s security depends on more than audits alone. It also depends on responsible disclosure, deep protocol expertise, and the ability of the ecosystem to coordinate quickly when it matters.
Ironwood: Making Zcash Supply Verifiable Again
Following the previous update, Shielded Labs, ZODL, the Zcash Foundation, Tachyon Group, and Valar Group are working on Ironwood, a proposed Zcash network upgrade focused on restoring user-verifiable supply integrity.
Ironwood is the proposed next step: giving users a way to independently check that Zcash’s circulating supply is correct. Since Orchard is a shielded pool, users cannot directly inspect all activity inside it. Ironwood addresses this by creating a new shielded pool using the Orchard circuit with the recent vulnerability fixed, while making transactions that create new outputs in the current Orchard pool invalid after activation.
From there, funds in the old Orchard pool would only be able to move forward through Zcash’s turnstile mechanism, which acts as an accounting checkpoint between pools. This would let users verify the circulating supply immediately after Ironwood activation by running a node and checking the balances of the active pools, without waiting for all Orchard funds to migrate.
For users, existing Orchard receivers are expected to remain valid, and wallets supporting Orchard are expected to help with migration. The upgrade is also expected to include independent audits, AI-assisted review, and formal verification.
ZODL is contributing to wallet and SDK support, Zebra rollout, zcashd deprecation work, and ecosystem coordination. The current activation target is late July 2026, after zcashd end-of-support at block height 3,417,100, though timing still depends on development, testing, review, and ecosystem readiness.
The goal is simple: make Zcash supply integrity independently checkable again, instead of something users simply have to trust.
Zcash Foundation: Engineering Update May 18–31, 2026
Over the past two weeks, Zcash engineering teams shipped Zebra v4.5.0 and the follow-up patch v4.5.1, addressing 13 security issues reported mostly through responsible disclosure.
The main takeaway is simple: all Zebra node operators should upgrade to v4.5.1.
What changed:
Security fixes: Zebra is now more resilient against malformed inputs, misbehaving peers, memory allocation issues, networking bugs, and edge cases that could crash nodes.
Mining support: Zebra v4.5.0 added support for ZIP-213, also known as Shielded Coinbase, allowing mining rewards to be sent directly to a shielded address.
Faster block templates: Block template handling was improved so miners can receive updated templates faster when the chain tip changes.
Infrastructure cleanup: The team fixed CI issues, improved node visibility on the network, and continued work on developer tooling.
Sync stability: Investigation continued into a sync stall issue, with early internal testing showing multiple fleet nodes running for more than 11 hours without sync errors.
Other updates:
zcash-signadded PCZT support,reddsareceived a security fix,zcash_scriptaligned signature counting withzcashd,z3gained CI coverage, andz.cashreceived DNS maintenance.
The result is a more stable Zebra release, better support for miners, and continued cleanup across the Zcash developer stack.
Tachyon & Ragu: A Stronger Foundation for Zcash Privacy
On June 7, Sean Bowe and Tal Derei shared an update on Tachyon, a new shielded protocol being developed for Zcash, and Ragu, the Rust-based zk-SNARK toolkit behind its cryptography.
Tachyon is aimed at helping Zcash scale private transactions without weakening the privacy guarantees that make Zcash distinct. Ragu provides the cryptographic toolkit for that work.
What makes the approach notable is that it does not start from scratch. Ragu builds on tools already used in Zcash, including the Pasta curve cycle, Poseidon, and polynomial commitment techniques deployed with Orchard. That gives the design a familiar foundation and makes it easier to reason about and review.
Security is a major focus before production. The work includes audits, fuzzing, AI-assisted review, extensive testing, and Lean-based formal verification. This is not just about checking whether the code runs, but about building confidence that the underlying components behave as intended.
Documentation is also part of the process. Detailed specifications are being written alongside the code, which should make the design easier to review and eventually move through the ZIP process.
Tachyon is a longer-term part of Zcash’s privacy roadmap. The focus is not only on faster or more scalable shielded transactions, but on building them with a stronger foundation for security, review, and long-term reliability.
Subduing the World. Zcash Update.
In this week’s ZODL update, Josh shared a brief behind-the-scenes look at the Orchard emergency upgrade, focusing less on the technical details and more on what the response revealed about Zcash’s ability to coordinate under pressure.
The incident tested more than the protocol itself. It tested trust, communication, and the ability of teams across the ecosystem to move quickly without losing focus.
For Zcash, the upgrade was not just a fix. It strengthened incident response processes, deepened working relationships, and showed that the network can coordinate effectively when it matters.
Zodl Mobile Wallet
Coinholder Polling 3.5.0 went live on Android, completing the cross-platform launch of in-wallet shielded coinholder voting on a Zcash mobile wallet.
Zodl shipped a fast stabilization cycle with three Android releases (3.5.0, 3.5.2, 3.5.3) and two iOS releases in one week. These included server-selection redesigns, ballot submission fixes, polling UI improvements, and removal of decommissioned lightclient endpoints ahead of the June 7 cutoff.
The default lightclient server moved to zec.rocks on both platforms after a benchmark across 50 countries and nearly 9,000 RPC calls. jp.zec.stardust.rest and eu2.zec.stardust.rest are queued for removal.
Android FOSS builds with Memory Tagging reached QA, while the iOS Tor stream-timeout sync error fix and Automatic Server Switch reached Ready for Testing.
Mobile Roadmap
- Upcoming mobile work includes shipping Zodl 3.5.2 on iOS and 3.5.3 on Android, plus continuing Zodl 3.6.0 development around multi-server transaction submission, multi-currency conversion, SDK chain-tip tree-state optimization, and Valar Group collaboration.
Zodl Analytics
🍎 iOS reached 43.6k unique installs and 52.1k total downloads, up 1.1k and 1.5k over two weeks, with a 4.9★ App Store rating.
🤖 Android reached a 16k install base and 52k total installs including Open Beta, up 0.2k and 1.3k over two weeks, with a 4.25★ Play Store rating.
Zcash Core
The emergency NU6.2 network upgrade shipped through
zcashd v6.20.0at mainnet block 3,364,600, around 03:00 UTC on Wednesday, June 3.A time-critical
zcashd v6.12.5release shipped alongside the soft fork at mainnet block 3,363,426, around 02:00 UTC on Tuesday, June 2, fixing a coinbase value-balance desync that could crash a node from a single valid proof-of-work block and temporarily turning off Orchard actions until NU6.2 activated.The Zallet RPC review queue was cleared, including cookie-file JSON-RPC authorization,
z_importviewkey,z_shieldcoinbase, and a lightwalletd darkside bugfix.Scoping started for a ZODL fork of Zebra, plus ZODL-operated lightwalletd and Zaino infrastructure.
halo2_gadgetsbackports were also filed as part of post-NU6.2 cleanup.
Core Roadmap
- Core work continues on the next accelerated network upgrade, ZODL’s Zebra/lightwalletd/Zaino infrastructure plans, Zallet alpha.4, and critical Zallet functionality.
Collaborations
Coinholder and ZCAP polling for NU7 has been delayed because of Ironwood plans.
ZODL Summit invitations and details were sent to approved participants, with waitlist follow-up planned as confirmations arrive.
Blockchain Association membership was submitted, and Paul Brigner represented ZODL at the BA Law Enforcement fly-in, where Kyle Schneps from DCG mentioned Zcash during the congressional briefing.
ZODL signed the Solana Policy Institute Founder/CEO Coalition Letter on Developer Protections.
Outside counsel onboarding is underway with Accrediv and Arktouros, and ZODL is hiring.
A layperson-friendly explanation of formal verification and what comes next for Zcash protocols was published after Shielded Labs recommended a new pool and ZODL agreed on scope the following day.