Zcash audit finds no new critical flaws after Anthropic review

Zcash has undergone a follow-up security audit using Anthropic’s Mythos system, which, according to founder Zooko Wilcox, found no additional serious vulnerabilities in the protocol after the recent Orchard flaw disclosure.

According to Wilcox, Anthropic carried out the audit at the request of Shielded Labs following the discovery of a vulnerability that could theoretically have allowed unlimited creation of counterfeit ZEC.

In a June 13 post on X, Wilcox thanked Anthropic for helping protect Zcash users and said the review did not identify any other serious bugs in the network.

The result comes little more than a week after the Zcash ecosystem rushed to contain a flaw in Orchard, the blockchain’s primary shielded transaction pool.

According to Shielded Labs, the defect could theoretically have enabled an attacker to create an unlimited amount of counterfeit ZEC. The organization said previous exploitation appeared unlikely, while acknowledging there is no cryptographic proof showing the vulnerability was never used.

Work on fixing the issue began before the flaw became public. According to Zcash Open Development Lab founder Josh Swihart, developers first deployed a soft fork that temporarily disabled Orchard transactions while technical details remained confidential.

A second upgrade, the NU6.2 hard fork, went live on June 3 and removed the vulnerability before Orchard transactions were re-enabled.

Emergency measures contained the Orchard flaw

Details released earlier by Wilcox showed the original vulnerability was identified on May 29 by security researcher Taylor Hornby during a targeted audit using Anthropic’s Opus 4.8 model. Hornby reported the issue to Zcash Open Development Lab, which coordinated a response across ecosystem participants before the fix was deployed.

Following the fix, Wilcox said teams across the Zcash ecosystem continued reviewing the protocol for additional risks. According to his June 13 update, Shielded Labs and other contributors are now focused on further security-hardening measures and plan to release additional updates as that work progresses.

Several organizations remain involved in the effort, including the Zcash Foundation, Tachyon Group, Valar Group, Shielded Labs, and Zcash Open Development Lab, according to Wilcox.

Ironwood proposal focuses on supply verification

Alongside the audit findings, Wilcox has continued promoting the proposed Ironwood upgrade, which he said would allow users to independently verify Zcash’s circulating supply by aggregating balances held across active pools once the upgrade is activated.

According to Wilcox, Ironwood would introduce a new location for holding shielded ZEC, place restrictions on transactions that could involve counterfeit coins, and incorporate additional security measures, including AI-assisted audits. He said the timeline for activation remains uncertain and will depend on further development work and community discussions.

The Orchard disclosure triggered a sharp sell-off in ZEC. The token lost more than 50% of its value between June 4 and June 5 before rebounding to $478.70 on June 9. ZEC has since fallen back to around $417 as investors reduced exposure to risk assets amid escalating tensions between the United States and Iran.

Technical indicators also show that the post-crash recovery is facing resistance. On the four-hour chart, ZEC has fallen back below the 38.2% Fibonacci retracement level at $418.60 after failing to hold gains near $478.70 earlier this week. The token also remains below the Supertrend resistance at roughly $465, which continues to cap upside attempts.

Unless buyers reclaim the $465-$470 area, the chart points to a possible retest of support near $355, which marks the 23.6% Fibonacci retracement level. Meanwhile, the MACD histogram has slipped back into negative territory after briefly turning positive during the recovery rally, indicating that buying pressure has weakened since the June 9 peak.