Some Bitcoiners aren't afraid to throw every shitcoin in the same "scam" bucket. Some Bitcoiners are afraid to challenge shitcoin narratives at all. This series, Bitcoin is the shitcoin killer, explains how Satoshi oneshotted the Bitcoin design, and the underlying reasons why predecessor coins were unable to duplicate its success.
Today, we are slaying Shitcoin number 16: Zcash | ZEC | $483.46 | 0.0075 BTC | Mcap $8.1b
Zcash is a fork of Bitcoin's PoW & UTXO model originally designed by Satoshi. The variation is that Zcash deploys the "Zerocoin" protocol for theoretically perfect privacy. There are 4 sequential "shielded" pools where users can deposit their regular Zcash from the transparent chain.
So, why are there 4 pools? Why is there a transparent chain at all? Why did they create new tokens from genesis instead of forking Bitcoin to add their feature?
- The 4 pools are vestigial artifacts from bugs and upgrades. Zerocoin's zk privacy properties make it impossible for users to verify that counterfeit coins were not generated inside a specific shielded pool.
- The first pool required a "trusted setup" where 1 of n participants generate entropy and delete their toxic waste. We'll assume this was performed correctly, but it was an early criticism
- This pool had a bug responsibly disclosed, and silently patched
- Here is where you must have realized the purpose of the transparent chain: Inflation on the transparent chain is detectable, and it bridges all 4 pools together
- So rational holding occurs on the transparent chain, and opt in privacy occurs in, out, and within the shielded pools
- Pool 2 was killed by upgrading to remove the trusted setup
- Pool 3 was killed by a responsibly disclosed hidden inflation exploit, same as pool 1
- Pool 4 is still in development, so Zcash privacy is halted
- Oh yeah, and the shitcoiners who created the chain grease their hands by taking 20% of the block rewards directly from miners, by "consensus"
The reason the Zcash transparent chain is a boring variant of Bitcoin's purity is because the all the value should exist in the pools, and if the pool gets drained, then the transparent sister chain is a benefit for the attacker, not the victims. So now we live in a future where all the privacy concious people go broke, hackers get rich, and greedy dumbasses who use the transparent chain get protected.
Do you think a similar problem exists with all zk stuff on Bitcoin (at least when amounts are shielded)?
Or do you think there are places in Bitcoin where zkproofs could be useful?
I am not a cryptographer, but I prodded one who said yes: There is no guarantee of zk tx flow when you have complete anonymity
Why yes, thanks for asking: We use zkproofs all over different coinjoin protocols. Instead of putting the proofs on chain and making everyone verify them, you have a coordinator that constructs the zk ceremony for users to homomorphically commit their addresses to (okay fine I'll stop here).
Counterfeit inflation never gets executed on the base chain because a zero knowledge bug in the coinjoin pool just looks like an invalid transaction. Nodes reject these transactions without even checking whether or not it looks like a coinjoin.
Ok I'll have a bash at asking a question
Zk stuff is highly technical and difficult to conceptualize
So Paul Sztorc's eCash is proposing a zcash style sidechain/drivechain
My question is, if alice, Bob and charlie deposited 1 eCash each into....let's call it 'Zside'
So the exchange rate let's say is 1 eCash for 100 Zside for example
So now a, b and c have 300 Zside combined in a zk pool
Let's say a hacker creates an inflation bug in the pool and creates an extra 300 Zside
The hacker then transfers their inflated 300 Zside from the pool and the 300 Zside from a,b and c (600 total) and assuming there's zk... the eCash miners process this bridge tx from Zside to eCash without question, as they have lol, zero knowledge
So the pool is drained, a, b and c go to remove their Zside and their attempts are refused because the pool is empty
Is that a legitimate concern?
As an aside my brain kept saying, well if there was a cryptographic hash on the tx from eCash to Zside then when the parties go to redeem, they can prove the authenticity of their bag, but then that's Bitcoin publicly viewable design and defeats the object of zk 🤣
Just on reflection, would the eCash miners/nodes notice the inflation of 300 to 600 Zside when reverting back to eCash?
Because that would inflate the supply of eCash thereby invalidating the chain, correct?
Drivechain's pegouts are done via blind merged mining. This means a mining pool does not have to run a full node for any specific drivechain (but in a Nash Equilibrium, miners would bundle this drivechain operation to collect the extra marginal fee) to embed its state transitions on the base layer.
Good question!
This unit conversion is unnecessary, Drivechains are supposed to be pegged 1:1, adding a multiple on top just makes it harder to reason about.
Yes. This legitimate concern of "turnstyle" withdrawals extends to any bridged coin, even if it doesn't have extra privacy.
The key question is whether privacy systems can preserve both anonymity and verifiable supply. Bitcoin optimizes for auditability first, while Zcash tries to optimize both. The trade-offs are worth discussing instead of reducing the debate to slogans.