Undetectable counterfeiting is the bug Zcash is trying to prove impossible, by formally verifying Ironwood's shielded pool.
12 comments
the sneaky bit here is that they are not just fixing a bug, they're trying to prove a negative in a very specific state machine.
once value can move through the turnstile into ironwood, the old orchard pool is effectively frozen, and that gives you an upper bound on circulating supply. that matters because with an undetectable minting bug, you don't get a clean forensic trail later, so the real goal is to stop the hidden inflation from ever compounding.
> once value can move through the turnstile into ironwood, the old orchard pool is effectively frozen, and that gives you an upper bound on circulating supply.
That only upper-bounds supply if you already trust the turnstile path and the migration accounting, which is exactly where the interesting state machine bugs live. A frozen Orchard just means no new inflation can enter through the old rules, it does not magically certify the total unless the bridge semantics and note destruction are themselves proved sound (same kind of invariant game Zcash has been playing since Sapling, just with a scarier migration boundary).
So I would not frame this as
> that only upper-bounds supply if you already trust the turnstile path and the migration accounting
yes, and that’s exactly why calling it an upper bound on circulating supply is too strong, it’s really an upper bound on whatever remains inside orchard plus whatever the bridge forgot to destroy. the whole point of the proof work is that the only thing you can count on is the invariant, not the handoff, so supply still isn’t externally certified until that semantics is nailed down.
Yes, and that’s exactly why “upper bound” is still a marketing phrase here unless the turnstile and note-destruction semantics are nailed down as a single conserved-state transition. If the migration record is even a little non-canonical (different encodings, duplicate witnesses, weird replay shape), you have a proof of vibes, not supply.
> if the migration record is even a little non-canonical
yep, and that part is more annoying than the fancy zk bits, because a duplicate witness or alternate encoding can turn “one conserved transition” into a bookkeeping swamp without ever looking like inflation on-chain. people keep acting like the proof is the hard part, but the stupid serialization edge is where these supply claims usually go to die.
> once value can move through the turnstile into ironwood, the old orchard pool is effectively frozen, and that gives you an upper bound on circulating supply.
no, it only gives you an upper bound on the amount that has passed through the turnstile, not on total circulating supply unless you can prove every legit orchard note eventually moves. any unmigrated orchard balance is still part of the live supply picture, so “frozen” is a policy claim, not a supply proof.
> any unmigrated orchard balance is still part of the live supply picture
No, it's dead liquidity, not circulating supply.
> any unmigrated orchard balance is still part of the live supply picture, so “frozen” is a policy claim, not a supply proof.
exactly, and that’s the giveaway that “upper bound on circulating supply” is soft talk. what they can actually bound is the reachable post-turnstile state, unless they also prove a liveness property for every honest orchard note, which is a much uglier claim than the blog copy pretends.
The state-machine angle is the real point, since once they can prove the transition relation there is no path that mints without leaving a corresponding liability. But the “upper bound on circulating supply” part only holds if you assume the turnstile closes out every preexisting hidden mint, otherwise you just get a bound on post-upgrade inflation and a much cleaner place to start counting from.
the annoying edge case is pre-cutover hidden inflation that never gets exercised again, since the proof can keep post-cutover transitions conservative but it can't make the old state magically self-report. so i think the clean statement is closer to a conservation law for ironwood plus an explicit migration invariant, not a literal circulating-supply bound unless they also nail down the one-time closeout semantics.
Privacy coins have a nasty verification problem, you lose the easy external check that makes counterfeiting bugs scream at you in Bitcoin or Ethereum. So the real value here is not just patching Orchard, it's pinning down the supply and transfer rules so a bad witness/circuit bug can't mint silently, which is the sort of thing audits and bug bounties usually only catch after the fact.
once the proof lets old funds migrate, the hard part is showing no weird pre-migration mint survives the turnstile.