Sean Bowe @eblull

Project Tachyon: Scaling Zcash with Oblivious Synchronization. seanbowe.com/blog/tachyon-s…

Zcash is hardened. No privacy breaches. ✅ No backdoors. ✅ 10 years fair distribution. ✅ Supply enforced. ✅ Mythos checked. ✅ World class dev teams. ✅ No compromises. No co-opt. No stop. Full send.

We're very grateful that OpenAI has provided our teams with assistance to protect Zcash users from these nasty bugs as well. (We also have no new issues to report!)

zooko🛡🦓🦓🦓 ⓩ @zooko

2 weeks ago

Thanks, Anthropic, for helping protect Zcash users. At Shielded Labs’s request, they ran a security audit of Zcash with Mythos. It did not find any more serious bugs in the Zcash protocol. Shielded Labs and others are continuing security hardening work. Stay tuned for updates.

91 288 2K 631K 148

x.com/i/article/2066…

Before, usage of ZKP's required trust in: - Cryptography assumptions (ECDLP is sound, hashes are collision resistant, etc) - Developers to make a sound design for what they want to prove. - Careful implementation of a circuit satisfying the design Now this should compress to: - Cryptography assumptions - A correct definition of the needed security properties. Automated proof checking will prove that your real ZKP verifier + circuit combo then satisfy the above two.

Quick update on the last ~48 hours of Zcash Ironwood! 1. Protocol devs from across all the orgs met twice to discuss specification and implementation progress. Agreement on a couple additional changes: disabling Orchard pool bundles in coinbases, anchors as auth data for migration UX with hardware wallets, and the order that ZIPs and specs will be handled. 2. Ironwood circuit and ZIP 2005 integration drafts are going through the review process. @ValarGroup has already spun up testnets and his team has done a wonderful job scoping out and implementing some of the wallet-facing changes. We are beginning an Ironwood upgrade book for eventual consumption by auditors, wallets, protocol developers, etc.. 3. Formal verification work on Ironwood continues. A collection of different individuals who either have or will continue to work on formalization efforts will be meeting tomorrow where we'll settle on the specific strategy for getting the Ironwood SNARK formally verified. I'm hosting this and will post minutes and details after. Efforts from teams will be ideally combined where useful, existing approaches and progress unified and we'll figure out the easiest path for the next couple weeks. I've paused my own work on this to do Ironwood circuit stuff, but I'll be resuming on that tomorrow. These are the big pieces, there are also some major security auditing tasks taking place in the background -- at least three major firms are auditing Orchard currently, and multiple new AI auditing suites are hammering the codebases to ensure nothing else critical is sitting around anywhere. So far so good! Really proud of how much progress is being made every hour on this by all five of our major teams/orgs and our supporters inside and outside the community. Also love the general wartime vibe shift. Let's go!

Sean Bowe @ebfull

2 weeks ago

UPDATE: The various orgs and protocol developers mentioned have agreed on the specific consensus rule changes for Ironwood, after settling the finer details. Here's a summary: 1. Ironwood introduces a new pool using the Orchard protocol, just like the existing pool. 2. The

19 71 307 152K 47

I got asked about Arc's "privacy" proposal: 1)its not private and I hope they don't say it is. A private zone is a TEE, ran by an admin, who sees and controls everything. 2) These ideas aren't knew, but a promising integration of them is great. 3) We can get better privacy.

Sergey Gorbunov @sergey_nog

2 weeks ago

Since we started the project, I’ve been telling the @circle team that this will be the last privacy solution in blockchain space. And we delivered. What we have built is not just privacy-preserving smart contracts. Instead, it's a paradigm shift in how blockchains,

3 19 114 54K 93

UPDATE: The various orgs and protocol developers mentioned have agreed on the specific consensus rule changes for Ironwood, after settling the finer details. Here's a summary: 1. Ironwood introduces a new pool using the Orchard protocol, just like the existing pool. 2. The circuit for the Orchard protocol—which applies to both the existing Orchard pool and the new Ironwood pool—will have a flag that consensus rules can toggle. This flag disables payments to *other* users within that pool, while maintaining the ability to create change notes. (This enables a privacy safeguard.) 3. The old Orchard pool will have this flag enabled after the network upgrade, and payments to the old pool will also be disabled by constraining valueBalance. 4. Because payments are disabled on the old pool, wallets must send new payments to Orchard receivers (inside existing unified addresses) via the new pool, and they should also migrate funds away from the old pool. This combination enforces a bound on the circulating supply of ZEC through the use of the existing turnstile mechanism; the amount of ZEC that anyone can transact with is no more than the amount that is supposed to exist. Meanwhile, users' wallets can migrate funds to protect them from risk, which also gradually provides evidence that counterfeiting never took place. Now that we have this decided, we'll collectively move on to the implementations, specifications, and ecosystem support/outreach. (We also have many different auditing and formal verification efforts taking place behind the scenes to provide assurance about the circuit correctness. More on that soon!)

Project Tachyon @TachyonZcash

3 weeks ago

Together with @zodl_co, @ZcashFoundation, @ValarGroup and @ShieldedLabs, we're advocating for a network upgrade that would make ZEC's circulating supply auditable, providing additional reassurance that no counterfeiting occurred in the Orchard pool before this week's bugfix.

69 103 506 182K 49

@mert @zkDragon @ebfull Dev is the goat

bug != exploit with that out of the way, the data around the shielded pool movements (or lack of movements) is extremely bullish long term invest in religious zealots working on revolutionary tech is a solid principle / see druck on why he changed his mind on bitcoin:

a @adidogCEO

3 weeks ago

the activity around the $ZEC pool the exploit was found in is the wildest data i've seen for a situation like this the only thing that would explain this behavior is that the majority of the tokens in this pool is highly concentrated to a small set of users and they don't want

15 2 27 15K 8

If you think you had a dizzying week as a Zcasher, imagine being a Bitcoiner: apparently, someone made an unusual UTXO that could technically be in violation of a future controversial BIP, so the forces of good and evil are debating the philosophy of softforks for the 68th time.

Fear of shielded ledgers due to complexity, despite breakthroughs in formal verification, is doomer / decel / techno-pessimist behavior.

mert @mert

3 weeks ago

@udiWertheimer @TachyonZcash @zodl_co @ZcashFoundation @ValarGroup @ShieldedLabs lol im afraid youve become possessed by an ai datacenter doomer / bernie sanders hybrid I told you three times now that tachyon pool will be *formally verified* and *mathematically sound*. Ai might help discover vulnerabilities in software but it turns out it ALSO helps you

2 2 52 19K 5

Zcash will prove you can remove fatal inflation risk with formal verification and simplicity or panopticon is the future. Nothing in the laws of physics mandates soundness bugs. Place your bets ladies and gentlemen.

Where can a bug come from? - Circuit spec: Never happened before - Circuit impl error: Protected by FV. - FV specs not being correct. I don't believe in risk for missing circuit spec <> FV spec guarantees. - Fatal compilation error for FV. (I believe this is impossible for R1CS - Tachyon) - FV language is wrong: Its pretty machine checkable. Have AI just also fact check the proof. - ZKP Verifier has no bugs (We will just FV it too) So the end state risk becomes just the circuit spec. But its honestly quite high-level simple? We then FV each relevant property of the high-level functions as well. Then there is the cryptography itself. EC operations / Lattices / Hashes, what-not. There lindy-ness does a lot. EC's aren't getting broken until quantum computers. Hashes have stood the ~entire history of cryptography, they will remain secure. Lattices, I have less certainty on.

Circuit code can be written in a DSL or be a horrible mess, but usually it just reduces into some polynomials the verifier uses to check the SNARK. All circuit soundness bugs actually live *here* by definition, and formal verification at this boundary is a mechanical process.

David Wong @cryptodavidw

3 weeks ago

We have some crazy formal verification engineering going on at zkSecurity and IMO it’s too little well known. Clean has been continuously worked on for almost 2 years now, and we have a big update here: blog.zksecurity.xyz/posts/clean-ve…

4 10 96 18K 35

Excellent work from @ShieldedLabs and friends in identifying and coordinating a fix for the Orchard bug in record time. Now they're working on making sure the supply has 100% integrity, even though it's very unlikely there was an exploit. Turnstyling through different shielded pools is really cool. I personally wouldn't have my money in substantial amounts in any privacy protocol that didn't have this feature.

zooko🛡🦓🦓🦓 ⓩ @zooko

3 weeks ago

x.com/i/article/2063…

9 208 926 1.8M 204

One thing that makes this work where the turnstiles only partially worked before: we're forcing the *circulating supply* of ZEC to exist only within safe pools. Any hypothetical counterfeiting is snuffed out, and Orchard transactions automatically redirect through the new pool.

Project Tachyon @TachyonZcash

3 weeks ago

Together with @zodl_co, @ZcashFoundation, @ValarGroup and @ShieldedLabs, we're advocating for a network upgrade that would make ZEC's circulating supply auditable, providing additional reassurance that no counterfeiting occurred in the Orchard pool before this week's bugfix.

69 103 506 182K 49

Another thing that makes it work is having total, mathematical confidence in the correctness of the circuit. That's where formal verification and other auditing plays a role. More details about perfect shielded pools soon.

now when you tell the girls (or boys) you hold zcash, you can just say you have some ironwood instead incredible name

Zcash Open Development Lab @zodl_co

3 weeks ago

x.com/i/article/2063…

96 146 674 252K 117

Together with @zodl_co, @ZcashFoundation, @ValarGroup and @ShieldedLabs, we're advocating for a network upgrade that would make ZEC's circulating supply auditable, providing additional reassurance that no counterfeiting occurred in the Orchard pool before this week's bugfix. tachyon.z.cash/blog/auditing-…