Counterfeit Bug in Zcash found via Opus 4.8

What I Read This Week: a summary of the content that I consumed this past week…

On May 29, security researcher Taylor Hornby disclosed a critical bug in Zcash’s Orchard shielded pool, the privacy coin’s most advanced transaction layer. The flaw, present since Orchard launched on May 31, 2022, would allow an attacker to generate counterfeit ZEC within the pool without leaving any visible on-chain signature. Hornby found it using Anthropic’s Opus 4.8 model, running inside a custom audit-agent framework he built. What took years of human audits to miss, a new AI model found within 28 hours of release.

Orchard’s privacy works through a zero-knowledge proof: the spender mathematically proves they own a coin and are spending it for the first time, without revealing which coin. To prevent double-spending, every spend publishes a one-time tag called a nullifier, derived from the owner’s secret key. Each coin should have exactly one valid nullifier. The bug skipped one step of math that ties the secret key to the coin’s public address, allowing a malicious user to generate a different nullifier for the same coin each time they spend it. Hornby’s proof of concept doubled a single note’s balance repeatedly until his test wallet held 10 million ZEC, and every proof remained valid.

The Zcash Open Development Lab shipped an emergency soft fork on June 2, disabling Orchard, then activated a network upgrade on June 3, re-enabling the pool with the corrected circuit. Currently, there is no evidence of exploitation, but because Orchard hides every transaction by design, the bug is difficult to audit after the fact. No one can reconstruct the shielded history to confirm it was never used. On June 6, Shielded Labs, the Zcash Foundation, and ZODL proposed Ironwood, an upgrade that would launch a new shielded pool. Anyone running a node could then sum balances across pools and verify the supply is clean.

The Orchard flaw is the second critical Zcash bug disclosed in 90 days. The first came in March, when researcher “Sol” found a separate flaw in the legacy Sprout pool, where node software was skipping zero-knowledge proof verification under certain conditions, which had been dormant since July 2020.

On June 4, Helion Energy raised $465 million in Series G funding at a $15.5 billion post-money valuation. Total raised to date: $1.5 billion. The round funds the construction of Orion, Helion’s first commercial fusion power plant, now being built in Washington. The plant is contracted to deliver electricity to Microsoft starting in 2028.

Helion is the Sam Altman-backed fusion company pursuing a magneto-inertial approach: two field-reversed plasma rings are accelerated to over 1 million mph from opposite ends of the machine and collide in the middle, briefly reaching the temperature needed to fuse deuterium and helium-3.

In February, Polaris became the first privately funded machine to operate on deuterium-tritium fuel, reaching a plasma temperature of 150 million degrees Celsius, roughly 10 times hotter than the core of the Sun.

Helion is the first to break ground on a commercial site with a binding power-purchase agreement. They are still working on sustained net energy gain and continuous grid output with a 2028 timeline. This is the most aggressive date in the industry by roughly five years.

On June 1, Taylor Morrison agreed to be acquired by Berkshire Hathaway at $72.50 per share in cash, a 24% premium to the May 29 close of $58.50. Total equity value is $6.8 billion, and enterprise value is $8.5 billion. This is Greg Abel’s first multibillion-dollar acquisition since taking over from Warren Buffett.

Taylor Morrison is one of the top five US public homebuilders, operating across the Sun Belt and the Mountain West. Berkshire already owns Clayton Homes in manufactured housing and Berkshire Hathaway HomeServices in brokerage. Adding Taylor Morrison gives Abel a site-built builder.

“Over time, we expect to unify our site-built homebuilding operations into a combined platform enabling us to deliver the dream of homeownership to more Americans.” - Greg Abel, President and CEO of Berkshire Hathaway.

Buffett told CNBC that “Greg did that faster than I could have done it, smoother than I could have done it, and I never talked to the CEO… He has launched.” Berkshire continues to hold a record $397 billion cash pile.