I suggest storing ZEC in wallets built by experienced teams committed to Zcash beyond collecting swap fees, with the engineering expertise to maintain and secure their own codebase.
ZEC swaps on NEAR Intents are currently paused while completing their migration to the new Zcash network upgrade.
We'll inform as soon as Swaps & CrossPay are live again in @Zodl_app.
You may also monitor NEAR's status and subscribe for updates below.
https://t.co/J14qpHdIPi
Here are some counterpoints:
1. Coordination capacity isn't the same as control. If ZODL's intentions were bad, they couldn't have shipped this unilaterally. The Zcash Foundation maintains Zebra, an entirely separate node implementation, and any malicious patch would have required ZF, Shielded Labs, ECC, miners, and exchanges to all collude.
The capacity that made this response possible is the same capacity you want in any network facing a soundness bug. Bitcoin has it (used it for CVE-2018-17144).
2. Public discourse before patch deployment hands the attacker the bug spec while the window is still open. This is the standard responsible-disclosure pattern for every protocol-level security issue: Bitcoin (CVE-2018-17144), Ethereum, Monero, all have the same playbook.
3. A rational exploiter would have extracted aggressively before disclosure: both because the patch window is the only realization window, and because they'd fear another exploiter beating them to it. We'd see the pattern in unshielding flows. We don't.
Turnstiles is also consensus code that's been live since 2018, audited extensively, in completely different code paths. It's very unlikely to contain bugs.
Some people are saying it's riskier now for zcash that an exploit was found. Some people are saying it's less risky for zcash since the exploit was fixed. I am of the opinion that nothing has materially changed at all besides the risk awareness of market participants.
My number one risk for zcash (even beyond regulatory) is an exploited inflation bug. When @robustus was saying bitcoin and zcash are complimentary I think this is a good reason why, and agree with him. Last week we could never know that an inflation bug wasn't exploited. Today we can never know if the inflation bug in question wasn't exploited. Tomorrow we also will not know if an inflation bug will be exploited.
I think it's highly likely that someone didn't exploit it because of on chain behavior, but we can't ever truly know with certainty! (unless an attacker completely drains orchard) That is exactly the same truth as it was last week.
I think the risk of future exploits will continue trending towards 0, and the new @TachyonZcash shielded pool will be even safer from what it appears, but it will never be completely risk-free, because nothing is.
Life is risk. There are infinite number of risk that could happen to anything in crypto that could cause you to lose a fuckload of money. Just be aware of that. Maybe don't put 100% of your life savings in one spot? Up to you though to make those decisions for yourself.
Conversely if zcash is important to you, recognize the risk, and be responsible. I for one was managing these risk before the exploit was acknowledged, and since nothing has materially changed, will not be moving funds out of it. Nothing worth having in this world is risk-free to obtain. I made this post because I see a lot of people hand wave it away, or act in a manner of yelling fire in a crowded movie theatre. As usual, I believe the truth is somewhere in the middle.
This is right.
Miners will look at, and compile the code before deploying. They question everything. It's in the own self-interest. It's how decentralization works - incentive alignment, without requiring trust.
This is why a soft fork was necessary before the hard fork. Miners knew there was a potential issue and agreed to stop mining Orchard txs for a time for the long term health of their own operations.
We couldn't immediately hard fork because they would have been able to see the issue in the code, which risked an exploit.
So, soft fork with majority hash rate to exclude Orchard transactions, then a hard fork a few hours later, where the fix was visible to miners, but not exploitable.
Thoughts from a nontechnical observer:
- The efficiency with which Zcash devs & miners acted here is impressive.
- It’s hard to build privacy, even on “dumb” chains. That’s bearish for projects seeking to tack privacy features onto otherwise transparent smart contract chains.
- XMR and BTC also have patched vulnerabilities. Their communities’ efforts to spread fake news about this patch suggests they feel threatened.
Hyperliquid Zcash spot now commanding a $15 premium relative to other exchanges, all while there is zero depth for zcash on centralized exchanges.
Zodl with me lads