Zcash Just Crashed 40% in 1 Day. Is It Still a Buy?

Privacy is a great feature in financial technology. But if a system is private, so might be some of its faults, and therein lies a freshly revealed whopper of a problem for Zcash (CRYPTO: ZEC).

A four-year-old bug in the privacy-focused cryptocurrency, disclosed on June 5 by security researchers, could have theoretically enabled the undetectable minting of an unlimited quantity of counterfeit Zcash. Developers patched the flaw within days, but the asset shed 40% of its value in the 24 hours after disclosure, and investor trust has cratered. Is this coin still worth buying on the dip, or is it game over?

Image source: Getty Images.

Bugs don't get much worse than this

The point of Zcash is that it's possible to park your coins in a "shielded pool" of funds, wherein transaction details and user identities are hidden from prying eyes. The coin's maximum supply of 21 million ZEC, which is configured to work very similarly to Bitcoin's supply policies, does not change regardless of how much of that supply is held in the shielded pools or outside of them.

So in theory, once 100% of the coin's possible supply has been mined (which hasn't yet happened), all of the ZEC in the shielded pools plus all of the ZEC outside of those pools should equal 21 million ZEC, unless something has gone badly wrong. The issue here is that it is no longer possible to be fully confident that this calculation will provide the correct result.

Zcash's flagship privacy pool is called Orchard, and it uses a type of cryptography called zero-knowledge proofs (ZKPs) that let one party prove a statement is true without revealing the underlying data. The flaw, discovered on May 29 via an AI-assisted code review, would have let a hacker forge ZEC inside the Orchard pool. An attacker could have spent the same counterfeit ZEC multiple times inside Orchard, draining the balances of other holders in the pool with no trace anyone could verify.

Thankfully for investors, Zcash has a "turnstile" mechanism that caps each shielded pool's outflow at the amount that entered it, meaning the supply ceiling was never at risk. Emergency upgrades patched the issue between June 1 and June 3. But what makes a cryptocurrency like Zcash hold its value is its scarcity and privacy, and now holders cannot cryptographically prove that no counterfeit ZEC was ever created during the four-year window when the bug existed.

And that's devastating for the network's reputation, not to mention being a serious breach of trust in one of the coin's most important features.

Zcash's path back to good standing might not take long

On June 6, a coalition including the Zcash Open Development Lab (ZODL), Shielded Labs, and the Zcash Foundation proposed an upgrade called Ironwood, which is a new shielded pool slated for activation in late July. Ironwood uses the patched Orchard protocol, adds formal verification (a process that mathematically proves the code does what it claims), plus independent supply audits, and it routes every coin migrated from Orchard through a turnstile that anyone can use to audit the total supply.

If Ironwood ships on schedule and its formal verification holds up under rigorous independent third-party scrutiny, and the turnstile migration produces a public count anyone can verify, holders will be able to breathe a sigh of relief, because those factors taken together will mean that no hacker was ever able to actually exploit the bug to fraudulently mint more ZEC. Several of those conditions could be met within the next few months.

Nonetheless, there's simply no getting around the fact that Zcash's reputation is very badly tarnished. That said, this vulnerability was publicly disclosed by the developers themselves and patched as soon as they found it. A more comprehensive repair process will soon provide at least a bit of clarity on whether attackers found the gap in the armor earlier than that; if they did, Zcash is most likely going to lose a lot more value in a hurry.

Until that clarity and the Ironwood update arrive, assuming they do, the best approach for investors here is to stay on the sidelines or consider selling. Watch the Ironwood rollout closely. If it delivers what it promises with credible independent verification of the coin's supply, the door to investing in Zcash will reopen, perhaps in a few months. If the new audits surface anything else, expect this coin to struggle for a couple of years rather than a couple of quarters.

Alex Carchidi has positions in Bitcoin and Zcash. The Motley Fool has positions in and recommends Bitcoin. The Motley Fool has a disclosure policy.