Pengembang Zcash (ZEC) Menyelesaikan Patch Darurat pada 2 Juni untuk Celah Orchard yang Ditemukan lewat AI

COINOTAG - FASTEST CRYPTO NEWS · 2026-09-20T07:43:35.000Z

• SeedLabs mengungkapkan celah soundness pada Orchard circuit Zcash (ZEC) pada 29 Mei. • Celah ini dapat memungkinkan pembuatan ZEC palsu tanpa batas yang tidak terdeteksi. • Audit menggunakan Claude Opus 4.8 milik Anthropic dan agen audit khusus. Emergency Patch Menutup Jendela Pemalsuan ZEC Pengembang Zcash menyelesaikan patch darurat pada 2 Juni untuk celah pada protokol privasi Orchard circuit yang, jika dibiarkan terbuka, berpotensi memungkinkan pencetakan tanpa terdeteksi dari ZEC palsu dalam jumlah tak terbatas — salah satu risiko pasokan teoritis paling berpengaruh yang pernah terdokumentasi untuk protokol privasi Zcash. Temuan ini diumumkan pada 29 Mei oleh SeedLabs, yang melaporkan bahwa cacat tersebut muncul selama audit keamanan berbantuan AI, bukan melalui peninjauan manual konvensional. Audit tersebut memasangkan model Claude Opus 4.8 milik Anthropic dengan agen audit yang dibuat khusus, dan cacat diklasifikasikan sebagai “kegagalan soundness”: kondisi verifikasi di dalam zero-knowledge proof tidak cukup dibatasi, yang berarti penyerang dapat menyusun data yang berpura-pura sebagai bukti valid dan menghasilkan ZEC palsu tanpa memicu aturan validasi jaringan. Respons tim mengikuti risiko yang telah dibuktikan. Peneliti SeedLabs tidak berhenti pada tahap teoretis — mereka menulis kode serangan yang benar-benar bekerja di lingkungan uji lokal dan mengonfirmasi bahwa ZEC palsu memang dapat diproduksi, mengubah temuan dari kerentanan di kertas menjadi jalur eksploitasi yang terbukti. Tim pengembangan Zcash kemudian menangani masalah ini sebagai hal yang mendesak, dengan pernyataan pengungkapan bahwa pekerjaan perbaikan telah selesai pada 2 Juni. Orchard adalah pool terlindungi tempat transaksi privat Zcash hidup, itulah sebabnya cacat pada proof di sana menyerang inti jaminan penerbitan mata uang. Untuk aset yang berfokus pada privasi, integritas penerbitan adalah satu-satunya properti yang paling menopang beban, dan celah itu menyentuhnya secara langsung. Yang belum dibereskan oleh patch adalah pertanyaan eksploitasi: jalur pembuatan ZEC palsu hanya diverifikasi pada pengaturan uji lokal, dan tidak ada apa pun dalam catatan publik yang mengonfirmasi bahwa celah tersebut pernah disalahgunakan di mainnet. Perbedaan itulah — kerentanan ditemukan, eksploit dibuktikan secara lokal, penyalahgunaan mainnet belum dikonfirmasi — yang menjadi kerangka agar setiap angka dalam kisah ini harus dibaca.

• SeedLabs disclosed a Zcash (ZEC) Orchard circuit soundness flaw on May 29.
• The flaw could allow unlimited undetected counterfeit ZEC generation.
• The audit used Anthropic's Claude Opus 4.8 and custom audit agents.
Emergency Patch Closes ZEC Counterfeit Window
Zcash developers completed an emergency patch on June 2 for a flaw in the privacy protocol's Orchard circuit that, left open, could have allowed the undetected minting of unlimited counterfeit ZEC — among the most consequential theoretical supply risks ever documented for the Zcash privacy protocol. The finding was announced on May 29 by SeedLabs, which reported that the defect surfaced during an AI-assisted security audit rather than a conventional manual review. That audit paired Anthropic's Claude Opus 4.8 model with custom-built audit agents, and the defect was classified as a “soundness failure”: the verification conditions inside the zero-knowledge proof were not sufficiently constrained, meaning an attacker could construct data that masquerades as a valid proof and generate forged ZEC without tripping the network's validation rules. The team's response tracked the demonstrated risk. SeedLabs' researchers did not remain at the theoretical stage — they wrote working attack code in a local test environment and confirmed that counterfeit ZEC could in fact be produced, converting the finding from a paper vulnerability into a demonstrated exploit path. The Zcash development team then treated the issue as urgent, with the disclosure stating that the corrective work was finished by June 2. Orchard is the shielded pool where Zcash's private transactions live, which is why a proof defect there strikes at the core of the currency's issuance guarantee. For a privacy-focused asset, issuance integrity is the single most load-bearing property, and the flaw touched it directly. What the patch does not settle is the exploitation question: the counterfeit-generation path was verified only in the local test setting, and nothing in the public record confirms the flaw was ever abused on mainnet. That distinction — vulnerability found, exploit demonstrated locally, mainnet abuse unconfirmed — is the frame through which every figure in this story should be read.
How the Orchard Soundness Flaw Worked
The mechanism at stake is narrow but fundamental. A soundness failure in a zero-knowledge proof system means the checks that verify a proof are too loose: a statement that should be false can be dressed up to look proven. In Zcash's Orchard circuit, that looseness translated into a direct issuance threat, because notes the pool accepts as valid feed straight into the accounting of circulating supply that every node on the network re-verifies. Unlimited counterfeit ZEC would not be a market glitch; it would silently corrupt the issuance guarantee a Layer 1 protocol exists to enforce. Two structural safeguards are worth noting. The Orchard pool operates under an issuance cap, and the Ironwood pool introduction was designed so that even if a zero-knowledge proof error occurred, the total funds able to escape the shielded zone are limited — supply verification was already reinforced against exactly this class of failure. On the interpretation the disclosure itself offers, AI did not break the cryptography: it rapidly narrowed in on a logic error that public code had carried for years without human researchers catching it, then validated that the error was attackable. The case is therefore not one of cryptography broken, but of a long-missed logic error surfaced and validated quickly. That is the real significance of the episode — public code and transaction automation systems are now legitimate targets for this kind of automated attack analysis. As of this writing, spot ZEC is down 8.0% over the last 24 hours, and nothing in the on-chain record ties the move to the disclosure.
What the Patch Has Changed
COINOTAG's assessment is that the June 2 patch changed the technical ground truth while the evidence ledger stays deliberately thin. There is no attacker transaction hash to cite and no drained amount to verify on-chain, because on-chain data shows no confirmed mainnet exploitation; the SeedLabs disclosure itself serves as the post-mortem, naming an unconstrained verification condition in the Orchard circuit as the root cause and the completed emergency patch as remediation. What remains unaddressed is equally plain: no independent timeline of any counterfeit attempt on mainnet has been published. Against that clean record, institutional interest has kept building — Grayscale's 3-for-1 ZCSH split and Garret Jin's $320M ZEC stash frame a market that treated the incident as contained, and readers weighing exposure can follow our step-by-step guide to buying Zcash.