Zcash Concedes the Presence of a Major Glitch that Could have been Exploited

A major error was found in a seminal cryptography paper which has served as the foundation of several virtual coins including Zcash. The paper describes certain mathematical theories regarding “zero-knowledge” proofs. It had served as the breakthrough of several cryptocurrencies by providing the privacy features. It had helped currency projects including the Zcash.

Zcash company erased an openly available document and explained that the file was deleted by accident.

 “To exploit the counterfeiting vulnerability, an attacker would have needed to possess information found in the large MPC protocol transcript that was made available shortly after the launch of Zcash. This transcript had not been widely downloaded and was removed from public availability immediately upon discovery of the vulnerability to make it more difficult to exploit. The Zcash Company adopted and maintained a cover story that the transcript was missing due to accidental deletion.”

Bryce “Zooko” Wilcox, CEO and co-founder of the Zcash company, said that the error had been taken care of by his team in October.

“We don’t believe that there was any exploitation of the vulnerability.”

He added that there was no continued activity in this regard as there were very few experts who knew the nuances well enough to have taken advantage of the glitch. Furthermore, there were no huge transactions to suggest a break in.

Zcash had a market value of over $1 billion at the time of the revelation has since dropped down to as low as $150 million in the sidelines of a global cryptocurrency market rout.

“We’d like to thank the Zcash team for disclosing their technical concerns and for the coordination work,” said Maurizio Binello, a Horizen team member, after the issue was fixed through a software replacement in January. “We see this as an important sign of maturity for the whole industry.”

“We didn’t want to disclose to more parties until the majority of the exposed market cap had already been protected,” Mr. Wilcox said when he was asked why the Bitcoin Private was left out of the main discussion said.

Outside advice

Emin Gün Sirer, a Cornell University professor who specializes in blockchain research, suggested the use of Hippocratic Oath as the guiding principle. “The principle of utmost importance is to minimize harm and to minimize financial loss,” he said.

Neha Narula, executive director of the Digital Currency Initiative said that the mere knowledge of the existence of a threat is a big challenge in itself, “Knowing a vulnerability exists means you’re in a position where you can pretty easily and anonymously exploit it,” she said.

“It’s not clear yet what the best or right thing to do is,” Narula said. “I think I have to work out standards and procedures as a community, and that’s still in flux.”