What is the turnstile in Zcash?

The turnstile is Zcash's on-chain accounting mechanism for tracking ZEC as it moves between the network's different value "pools": transparent funds, and the shielded pools such as Sapling, Orchard, and the new Ironwood.

Zcash's shielded pools deliberately hide the details of individual transactions. But whenever value crosses from one pool into another, the amount moving across is revealed publicly on the blockchain, even though who is sending and receiving stays private.

This lets the network maintain a running, public tally of how much ZEC has entered and left each pool.

The rule it enforces

That tally is enforced by one simple rule: a pool can never release more ZEC than has entered it. If a transaction tried to move more out of a pool than that pool legitimately holds, every node on the network would reject it as invalid.

This is what makes the turnstile so useful for privacy-preserving money. Because shielded transactions are hidden, counterfeit ZEC created inside a pool could not be spotted directly.

But the moment anyone tried to move it out, the pool's public balance would come up short and the network would refuse the transfer. The turnstile therefore protects the integrity of Zcash's total supply without compromising anyone's privacy.

It is not a new idea, either: the same mechanism was used years ago when Zcash migrated funds from its original Sprout pool to Sapling.

Why this matters now

Earlier this year, security researchers discovered and responsibly fixed a soundness flaw in the Orchard shielded pool that could, in theory, have allowed counterfeit ZEC to be created without detection.

There is no evidence it was ever exploited, no evidence that any user funds were affected, and no evidence that the total ZEC supply changed. But because shielded pools are private by design, that cannot be proven simply by looking inside the pool.

Ironwood, a new pool built on the same Orchard technology and strengthened with formal verification and independent audits, was created to settle the question for good.

How the turnstile makes that possible

Now that Ironwood has activated, the old Orchard pool can no longer receive payments, so the funds inside it can only move forward, through the turnstile, into Ironwood.

The turnstile will never let more ZEC leave Orchard than legitimately entered it. Any counterfeit ZEC that might hypothetically exist in the old pool therefore cannot escape to become spendable: only the correct amount is ever allowed through, leaving genuine ZEC to migrate across and anything illegitimate stranded and unusable.

The result is an immediate, trustless guarantee. Anyone running a Zcash node can verify from the network's own rules that no more than the correct amount of ZEC can be circulating, without trusting anyone and without waiting for anyone else to migrate.

For the practical steps, see our guide 'Ironwood: steps for Zodl users'.