Zcash Patches Critical Bug Before Any Exploitation

To understand the severity of what Zcash patched this week, it helps to understand what zero-knowledge proofs are supposed to guarantee. In Zcash’s shielded pools, transactions are validated cryptographically without revealing sender, receiver, or amount. The system accepts a transaction only if its zero-knowledge proof is valid, meaning the underlying math confirms the transaction is legitimate without exposing any of its contents. Soundness is the property that makes this work: a sound system only accepts proofs for true statements. A soundness bug breaks that guarantee.

The vulnerability discovered by independent security researcher Taylor Hornby on May 29 was precisely this kind of flaw, located in the Orchard Action circuit, the cryptographic comp...