Dragonfly Partner: Only 1% of Zcash privacy pool funds have been released from privacy status, indicating that holders do not believe the vulnerability has been exploited BlockBeats News: On June 6th, Haseeb Qureshi, Managing Partner of Dragonfly, explained in a post the recently fixed Zcash vulnerability, stating that if the vulnerability is exploited before it is fixed, its manifestation will be more like a privacy pool being drained. If an attacker forges a forged privacy ZEC, they will need to quickly sell it before others discover the same vulnerability; But the main trading markets for ZEC are almost all transparent ZEC, not private ZEC. Attackers cannot directly sell newly minted private ZEC on Binance or Coinbase, and must first lift the privacy status. In this case, the truly vulnerable ones are the stationary privacy holders, and the transparent ZEC part is completely visible, so it is easy to force the transparent ZEC not to exceed the maximum supply. If someone attempts to lift their privacy status and transfer ZEC exceeding the supply limit, they will be blocked at the exit. For users holding transparent ZEC, including exchange users and users participating in ZEC price discovery, this vulnerability will not have a marginal impact and the losses will be entirely borne by privacy holders. The team will deploy new turnstiles and privacy pools in the upcoming upgrade to confirm that the privacy pool has not been inflated. He likened it to 'counting the number of people at the end of an outing' to ensure that no extra people got on board. Haseeb also stated that although AI discovered the vulnerability, it will also bring a repair path for the entire category, namely formal verification. He is optimistic that formal verification will become the direction for strengthening all software in the industry, and believes that cryptography based on formal verification will not have implementation vulnerabilities in its structure. The market is panicking, but privacy holders who may actually face losses are not panicking. At present, only 1% of the 30% privacy pools have their privacy status lifted, which in its view is the clearest signal that those who are truly at risk do not believe that the vulnerability has been exploited. It states that the size of the privacy pool is the predicted market for the vulnerability. [Original link]