S17 E50: Daira-Emma Hopwood on Zcash at 10, Halo, ZSAs and the Fight Over Grants

We recorded this conversation in Mexico, at an undisclosed location, during the celebrations for Zcash's 10th anniversary. Daira-Emma Hopwood has been with the project for 11 years, since before launch, and came to it through Zooko and the Tahoe-LAFS community. Daira-Emma reviewed the code for the 2016 ceremony and designed the ceremony protocol, later co-authored the Halo paper with Sean Bowe and Jack Grigg, which led to Orchard and Halo 2 without a trusted setup, and has been a strong voice for Zcash Shielded Assets (ZSAs). Today Daira-Emma is Head of Research and Assurance at ZODL, the Zcash Open Development Lab, which the former Electric Coin Company staff started the day after they handed in their notice.

On the table next to us was the ceremony laptop we bought from Peter Todd: the keyboard, the motherboard burned with a blowtorch, and the discs that held the software and the transcript. Daira explains what went wrong with Sprout: the flaw was not the ceremony itself but the BCTV14 proof system, whose setup put values in the transcript that were not necessary and could have leaked the toxic waste.

From there we go through the codebase Zcash inherited from Bitcoin Core 0.11.2 and why Daira-Emma is relieved that zcashd is no longer a consensus node on the network, the Equihash parameter mistake that brought ASICs in sooner and pushed GPU hobbyists out, and why Daira-Emma designs for the long term instead of trusting today's mining pool distribution.

The second hour gets more personal and more political. Daira-Emma declares an interest as a founder who received part of the founders reward, defends the Dev Fund and the ZCG grant slice, and explains why the coin-weighted poll should not, in Daira-Emma's view, override the rest of the community, both on grants and on ZSAs. The conversation covers harassment on X, why sex workers were a constituency Daira-Emma had in mind when joining Zcash, and the call for crypto to fix its credibility problem with the left.

We close on AI: how the Orchard vulnerability was found by a person using a publicly released model, how ZODL switched Orchard off within 48 hours, the worry about developer burnout and upgrades every few months, and why understanding what we build is not optional.

What we cover:

- Where Daira was during the 2016 ceremony, and the Sprout counterfeiting bug inherited from BCTV14
- Halo and the move to Orchard and Halo 2 without a trusted setup
- Designing an MPC ceremony with very little Bitcoin experience
- Moving from zcashd's C++ to Zebra and Rust, and why precise specs help AI check implementations
- Block times, NU7 and propagating zk-SNARK transactions
- What Daira-Emma would change before launch: the Equihash parameters
- Crosslink, objective finality and partitioning attacks
- Removing the transparent side and private by default addresses
- The end of ECC and the start of ZODL
- Monero, ring signatures and competition between privacy protocols
- Network privacy: Tor, Nym, Dandelion++ and multisig for hardware wallets
- The ZCG grant controversy, ZSAs and coin-weighted polls
- AI, the Orchard vulnerability, post-quantum work and assurance

This episode is sponsored by Cake Wallet, SideShift, Orange Rock, eCash and Braiins Hashpower.

The full archive of the Bitcoin Takeover podcast, with every season and every transcript we have published, is at bitcoin-takeover.com.

Time Stamps:
0:00 Intro
0:45 Welcome: Zcash's 10th anniversary in Mexico
1:34 Where Daira was during the 2016 ceremony
2:31 The Sprout counterfeiting bug and where it came from
3:29 Halo: getting rid of the trusted setup
4:31 Zooko, Sean Bowe, Daira: dropouts or not?
5:32 Hands-on with the destroyed ceremony laptop
7:57 Designing the ceremony with little Bitcoin experience
10:35 What's good and bad about Bitcoin Core's codebase
12:15 From C++ to Rust: how different is Zcash today?
14:35 Block time, issuance and propagating big zk-SNARKs
16:56 Sponsors: Cake Wallet, SideShift, Orange Rock
18:24 What Daira would change in Zcash before launch
21:15 Crosslink: hybrid proof of work and proof of stake
25:33 Mining centralization: Foundry, China, hostile governments
27:06 Sponsors: eCash, Braiins Hashpower
29:00 Why Daira stayed with Zcash for 10 years
32:42 Projects built on Zcash cryptography
36:38 Removing the transparent side: private by default?
39:22 ECC dissolves, ZODL is born
45:11 Dandelion++, Tor and network-level privacy
47:57 VPNs, censorship and Iran
49:30 Hardware wallet hacks and self-custody setups
54:21 Slush, Trezor and Zooko
55:11 Any regrets about money?
55:35 The ZCG controversy and sex workers
1:05:27 Dealing with online harassment
1:09:37 Ironwood and Hopwood: who picked the name?
1:10:57 Zcash Shielded Assets (ZSAs): worth it?
1:23:20 Will Bitcoin ever adopt Zcash-style privacy?
1:25:17 Move fast and break things?
1:27:44 Why Zcash keeps its cypherpunk developers
1:30:50 Zcash 10 years from now
1:32:43 Daira's inventions and inspiration in cryptography
1:39:42 What gets Daira out of bed
1:41:31 AI, podcasts and training data
1:46:47 AI and the Orchard vulnerability
1:55:11 Head of Research and Assurance at ZODL
1:57:15 AI vs. training apprentices
1:59:35 Music, books and Zcash upgrade names
2:01:08 Amber, the Zcash color
2:01:58 Anything we missed?
2:03:48 Thank you and goodbye