The developers behind the privacy-focused Zcash cryptocurrency have disclosed a now-fixed flaw that could have allowed hackers to create an infinite number of counterfeit tokens.
Detailed by developers Josh Swihart, Benjamin Winston and Sean Bowe in a blog post today, the flaw could have brought down what is currently the world’s 21st most popular cryptocurrency, one that was previously higher-ranked. That could have resulted in a massive cryptocurrency crisis.
Zcash was founded in 2016 with a privacy focus often popular with those operating on the dark side. For example, it’s the cryptocurrency of choice of the notorious hacking group Shadow Brokers, to name but one Zcash fan. The dark web aside, Zcash is also used by legitimate companies, JPMorgan Chase the most prominent.
The serious vulnerability was discovered in last March by Ariel Gabizon, an engineer at the Zerocoin Electric Coin Co., the firm behind Zcash. From there the vulnerability was limited to four people in the know until it was fixed in October last year.
“The counterfeiting vulnerability was fixed by the Sapling network upgrade that activated on Oct. 28, 2018,” the blog post said. “The vulnerability was specific to counterfeiting and did not affect user privacy in any way. Prior to its remediation, an attacker could have created fake Zcash without being detected. The counterfeiting vulnerability has been fully remediated in Zcash and no action is required by Zcash users.”
Despite the fact that the flaw not only existed to begin with and its fix was covered up until now, Zcash is not without fans — National Security Agency leaker Edward Snowden among them.
“A lot of people wonder why I like #Zcash despite the Founder’s Reward,” Snowden wrote on Twitter in response to the news. “Here’s a reason: that tax funds a quality team that catches and kills serious bugs in-house, before they get exploited. Some other projects learn about bugs like this only AFTER people have lost money.”
The price of Zcash, also known as ZEC, dropped on the news. According to Coingecko, it fell 1.5 percent over the last 24 hours.
Image: Marco Verch/Flickr
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.