- publishednullifiers - one per spent note
- publishedvalueBalance - every boundary amount
- publishedanchors - tree root at spend time
- publishedcommitments - one per output note
- publishedt-addresses - every shield and unshield endpoint
- publishedmigration amounts - quantised, since NU6.3
- hiddensender, recipient, note value (z to z only)
00 SYSTEM — shielded-pool forensics - public data only
ZCashReveal
A public instrument for the turnstile - the boundary where shielded value enters and leaves - and a public record of the two windows in which Zcash's circuits were unsound and nobody can prove nothing was minted. Nullifiers, anchors, commitments, boundary amounts, migration denominations and anonymity-set bounds: rendered as data, never as identity.
statscite
- claim
- stats
- canonical
- https://zecreveal.vercel.app/#pools
- last verified
- 2026-08-22
- confidence
- med
- CipherScan — Ironwood migration tracker CipherScan · 2026-08-22 · accessed 2026-08-22
- ZEC Stats (zecstats.com) ZEC Stats · accessed 2026-08-22
- CoinGecko — Zcash CoinGecko · accessed 2026-08-22
- Coinglass ZEC derivatives coinglass.com · accessed 2026-08-22
- Coin Metrics, State of the Network #338 Coin Metrics · 2025-11-08 · accessed 2026-08-22
The two windows
31 May 2022 to 1 Jun 2026 (4 years, 1 day)
| Interval | Sound | Approximate days | What happened |
|---|---|---|---|
| Sprout, BCTV14 | no | 731 | 28 Oct 2016 to 28 Oct 2018, about 730 days. Fixed silently at Sapling; disclosed 341 days after that. |
| Sapling era | yes | 1308 | 28 Oct 2018 to 31 May 2022. Sound as far as anyone knows. |
| Orchard, halo2 | no | 1465 | 31 May 2022 to 1 Jun 2026, 1,462 days. One missing copy constraint in the double-and-add loop. |
| NU6.2 to Ironwood | yes | 84 | 1 Jun 2026 to the tip. Fixed circuit, and a new pool that starts empty. |
About 61 per cent of the chain's life to date falls inside a window in which the property that would rule out counterfeiting did not hold. That is not an allegation that counterfeiting occurred: no one can show that it did, and - this is the whole point - no one can show that it did not. A soundness bug leaves no trace, which is what soundness means.
two-windowscite
- claim
- two-windows
- last verified
- 2026-08-22
- confidence
- high
- ECC — Zcash Counterfeiting Vulnerability Successfully Remediated (5 Feb 2019) Electric Coin Company · 2018-03-01 · accessed 2026-08-22
- ZF — Concerning the Sprout Vulnerability CVE-2019-7167 Zcash Foundation · accessed 2026-08-22
- ZIP 209, Prohibit Out-of-Range Chain Value Pool Balances Zcash Improvement Proposals · accessed 2026-08-22
- GHSA-ww9q-8r59-xv46 / CVE-2026-54496 (Orchard soundness, CVSS 9.3) GitHub · accessed 2026-08-22
- ZODL — Orchard Vulnerability Successfully Remediated (2 Jun 2026) ZODL · 2026-05-29 · accessed 2026-08-22
- Zcash Community Forum — The Orchard Counterfeiting Vulnerability—And Next Steps (4 Jun 2026) Zcash Community Forum · 2026-06-04 · accessed 2026-08-22
- Schneier on Security — Critical Zcash Vulnerability Found and Fixed (Jun 2026) Schneier on Security · accessed 2026-08-22
The pools, at the tip
HANDOFF-11 wires the live snapshot
| Pool | ZEC | Share of supply |
|---|---|---|
| Transparent | 12,500,223 | 74.0% |
| Sprout | 22,621 | 0.1% |
| Sapling | 529,015 | 3.1% |
| Orchard | 708,841 | 4.2% |
| Ironwood | 3,129,287 | 18.5% |
- Transparent - 12,500,223
- Sprout - 22,621
- Sapling - 529,015
- Orchard - 708,841
- Ironwood - 3,129,287
16,889,987 ZEC accounted for across five buckets. Transparent is not a pool - it is the absence of one - but supply accounting needs all five on one axis. ZEC ~$790.76, market cap ~$13.34 B, circulating 16.89 M / 21 M (80.4%). Shielded: roughly 26-27% (CipherScan: 25.9% at block 3,456,227; ZECStats: 26.8%) (4,530,445 ZEC). Ironwood migration 80.6% complete; ~708,841 ZEC still stranded in Orchard NU6.3 "Ironwood" — block 3,428,143. New formally verified (Lean) shielded pool; v6 tx format (ZIP 229); quantum recoverability (ZIP 2005); Orchard restricted to withdrawals only (ZIP 2006), creating the supply-verification turnstile
T2026-08-22T2026-07-28Two halves, one identity
A — the Record
Static, citable, zero-motion. The exploit ledger, the contradictions, the timeline and the promotion lattice - every entry carrying a source URL, a confidence and a last-verified date. Claim identifiers are permalinks, so a statement can be argued with rather than merely read.
B — the Instrument
Live, deterministic, chain-seeded. Turnstile balances, the Orchard drain, the ZIP 318 migration lens and the Ironwood birth curve. Transparent values are exact; shielded values are bounds on a candidate set. The page renders from the last good snapshot when the feed is down, and says how old it is.