{
  "id": "ironwood",
  "name": "Ironwood",
  "type": "Shielded pool (Zcash NU7, pre-launch)",
  "parent": "zcash",
  "reviewed": "2026-06-25",
  "summary": "Ironwood is Zcash's new shielded pool, carried by the NU7 upgrade (targeted ~late July 2026 — pre-launch and not yet on mainnet as of June 2026). It was built to fix an Orchard circuit counterfeiting bug and add supply verifiability, and it reuses Orchard's cryptography unchanged — so it introduces ZERO post-quantum protection. Its proofs (Halo 2 / IPA over the Pasta curves), note commitments (Sinsemilla), and note encryption (ZIP-212 ECDH) are all Shor-breakable; only the transparent, no-trusted-setup property passes. The exact opposite of STRK20 on Starknet, whose STARK proofs and Poseidon commitments are post-quantum-safe. Its added \"quantum-recoverable note\" format only helps re-secure funds after a quantum break — it does not protect confidentiality, so harvest-now-decrypt-later still applies. Deep-research-verified against the Ironwood Book, ZIP-224/212 and the NU7 upgrade page (June 2026).",
  "links": {
    "NU7 upgrade": "https://z.cash/upgrade/nu7/",
    "Ironwood Book": "https://github.com/zcash/ironwood",
    "Supply audit": "https://tachyon.z.cash/blog/auditing-orchard-supply/"
  },
  "assessment": {
    "1.1": { "verdict": "fail", "scheme": "RedPallas (RedDSA over Pallas)", "why": "Shielded spend authorization uses RedPallas (RedDSA over the Pallas elliptic curve), reused from Orchard's authorization structure — a Shor-breakable EC signature.", "sources": ["https://zips.z.cash/zip-0224", "https://zips.z.cash/zip-0312"] },
    "1.2": { "verdict": "na", "scheme": "", "why": "Generic Zcash wallet custody, not something the pool defines." },
    "1.3": { "verdict": "na", "scheme": "", "why": "Threshold / MPC signing is not part of the pool." },
    "1.4": { "verdict": "na", "scheme": "", "why": "Zcash is non-programmable; there is no account-abstraction layer." },
    "1.5": { "verdict": "na", "scheme": "", "why": "Passkeys / session keys are not part of the pool." },
    "1.6": { "verdict": "na", "scheme": "", "why": "No naming / identity layer." },
    "1.7": { "verdict": "na", "scheme": "", "why": "No governance mechanism of its own." },
    "2.1": { "verdict": "na", "scheme": "", "why": "Zcash has no smart-contract layer; spending is authorized by the shielded proof and spend signature, not in-contract verification." },
    "2.2": { "verdict": "na", "scheme": "", "why": "Proof verification is protocol-level (scored at 3.2), not app verifier contracts." },
    "2.3": { "verdict": "na", "scheme": "", "why": "No oracle feeds." },
    "2.4": { "verdict": "na", "scheme": "", "why": "No on-chain verifiable randomness / beacon." },
    "2.5": { "verdict": "na", "scheme": "", "why": "No verifiable delay function." },
    "3.1": { "verdict": "na", "scheme": "", "why": "Block ordering is Zcash's Equihash PoW — captured by Settlement." },
    "3.2": { "verdict": "fail", "scheme": "Halo 2 (IPA over Pasta curves)", "why": "Reuses Orchard's Halo 2 proving system, whose inner-product-argument commitments live over the Pasta curves and rest on EC discrete-log — Shor-breakable. Transparent does not mean post-quantum.", "sources": ["https://zips.z.cash/zip-0224", "https://zcash.github.io/halo2/background/pc-ipa.html", "https://github.com/zcash/ironwood"] },
    "3.3": { "verdict": "pass", "scheme": "Transparent (Halo 2)", "why": "Halo 2 is transparent — no trusted setup, so there is no setup secret for a quantum computer to recover. This is the pool's only post-quantum-safe property; the proofs themselves are still EC-breakable (see 3.2).", "sources": ["https://zcash.github.io/halo2/background/pc-ipa.html", "https://zips.z.cash/zip-0224"] },
    "3.4": { "verdict": "na", "scheme": "", "why": "Zcash publishes whole blocks — captured by Settlement." },
    "3.5": { "verdict": "fail", "scheme": "Sinsemilla (over Pallas)", "why": "Ironwood keeps its own note-commitment tree but uses Orchard's Sinsemilla hash over the Pallas curve, whose binding reduces to EC discrete-log — Shor-breakable, not a hash-based commitment like Poseidon.", "sources": ["https://github.com/zcash/ironwood", "https://zips.z.cash/zip-0224", "https://zcash.github.io/orchard/design/commitments.html"] },
    "3.6": { "verdict": "na", "scheme": "", "why": "No general-purpose VM." },
    "4.1": { "verdict": "na", "scheme": "", "why": "Zcash Equihash PoW consensus — captured by Settlement." },
    "4.2": { "verdict": "na", "scheme": "", "why": "No sync committee; light clients follow PoW headers — captured by Settlement." },
    "4.3": { "verdict": "fail", "inherited": true, "scheme": "Settlement = Zcash", "why": "Ironwood is a pool on Zcash, so it inherits Zcash as its settlement layer. Under the settlement rule this passes only if the host chain is fully (100%) quantum-safe; Zcash is not, so it fails. A pool can be no safer than the chain beneath it.", "sources": ["https://z.cash/upgrade/nu7/"] },
    "4.4": { "verdict": "na", "scheme": "", "why": "No canonical bridge of its own." },
    "4.5": { "verdict": "na", "scheme": "", "why": "No restaking / AVS." },
    "4.6": { "verdict": "na", "scheme": "", "why": "No payment channels." },
    "4.7": { "verdict": "na", "scheme": "", "why": "No builder-relay / PBS market." },
    "5.1": { "verdict": "na", "scheme": "", "why": "Node-to-node transport is Zcash's — captured by Settlement." },
    "5.2": { "verdict": "na", "scheme": "", "why": "Node identity is the chain's — captured by Settlement." },
    "5.3": { "verdict": "na", "scheme": "", "why": "RPC / wallet transport is the chain's — captured by Settlement." },
    "5.4": { "verdict": "fail", "scheme": "ZIP-212 ECDH (over Pallas)", "why": "Reuses Orchard's ZIP-212 note encryption, deriving the symmetric key via elliptic-curve Diffie-Hellman over Pallas — Shor-breakable, so harvest-now-decrypt-later retroactively de-anonymizes shielded transfers. Ironwood's added \"quantum-recoverable note\" format only helps re-secure funds after a break; it does not protect confidentiality.", "sources": ["https://github.com/zcash/ironwood", "https://zips.z.cash/zip-0212"] },
    "5.5": { "verdict": "fail", "scheme": "Halo 2 + ECDH (Orchard)", "why": "Confidentiality rests on the Halo 2 proofs and ECDH note encryption — neither post-quantum. No PQ confidentiality ships; the harvest-now-decrypt-later fix (Project Tachyon) is a separate ~2027 effort.", "sources": ["https://github.com/zcash/ironwood", "https://zips.z.cash/zip-0224"] }
  }
}