(In contrast, Zcash did have duplicated code in the prototype we inherited, but we rewrote that entirely well before the Zcash launch.)
[Edit: I confirmed that the duplicated validation code in main.cpp was not present in libzerocoin. Some of the code in main.cpp including some stale comments, appears to have been pasted from https://github.com/Zerocoin/libzerocoin/blob/master/Tutorial... , but that tutorial code does not have the bug. So it appears that it was introduced by the Moneta/Zcoin developers.]
Disclosure of interest: I am a Zcash developer.
[1] https://github.com/zcoinofficial/zcoin/commit/b20c177032de3c...
[2] https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d...
But that change appears to do exactly what the variable name suggests setting it to zero would to : stop zcoin tx's from being included in a block.
That strongly suggests someone attempted to fix the issue by simply disabled all private transactions.
But this certainly is a bug. And it would allow you to steal funds.
How would you minimize these type of errors by design or best practice?
I guess languages with a lack of higher order abstractions and no strong type system might be more prone to this type of errors.
(Just to be clear, this is about Zcoin, not Zcash/Zerocash. The two are completely different)
The fix is here. https://github.com/zcoinofficial/zcoin/commit/33796c839f7d4d... What happened?
First, some stylized facts about ZCoin:
0) ZCoin is a fork of Bitcoin that uses a 4 year old academic research library, libzerocoin, to make anonymous payments using the Zerocoin protocol.
1) Unlike Zcash/Zerocash, the Zerocoin protocol has only fixed value coins.
2) To get multiple denominations, you have completely separate instances of the anonymous currency that just happen to live on the same blockchain as the other denominations.
3) Zerocoin has its own bitcoin like non anonymous base currency. Call it basecoin.
4) You spend basecoins to get zerocoins.
5) When you spend zerocoins, you get basecoins.
6) ZQ_WILLIAMSON and ZQ_PEDERSEN are denominations, worth 100 and 50 respectively, defined in libzerocoin.
So what went wrong?
When you convert a zerocoin into 100 basecoin, the ZCoin code forked from bitcoin checked if the coin was a valid instance of ZQ_PEDERSEN (worth 50 ) not ZQ_WILLIAMSON (worth 100). So you paid 50 for the zcoin,got it into the instance for ZQ_PEDERSEN, but got back 100. Free money.
Why did this happen? Well, it looks like in order to support the multiple denominations libzerocoin offers, the ZCoin developers wrote some code for one denomination and then duplicated it for each remaining denomination. There are five in total, ZQ_LOVELACE=1,ZQ_GOLDWASSER=10, ZQ_RACKOFF = 25, ZQ_PEDERSEN = 50,ZQ_WILLIAMSON = 100.
But on the last one, ZQ_PEDERSEN was not changed to ZQ_WILLIAMSON in a few places. This caused the bug.
Caveat: I have nothing to do with ZCoin. However, I am an author of the zerocoin protocol, libzerocoin, the zerocash protocol, and am involved with Zcash.