Thread by @VitalikButerin

Interesting question asked at #Zcon: if someone *does* hack the ZK-SNARK scheme and print some fake coins, how should that be handled?

I see three options...

1. If N coins go into the z-address pool, N coins can come out, everyone withdraws at 1:1, except the unlucky last ones.
2. If N coins go into the z-address pool, C fakes created, N come out, everyone withdraws N/(N+C)
3. The C fake coins are accepted.

(1) seems like a more chaotic version of (2) that leads to a bank run, so (2) is better than (1). But (2) penalizes z-address use, and given that privacy is partially a public good this seems like a bad idea. (3) penalizes everyone equally.

(3) does mean that in the case of a serious attack, Zcash may have to abandon the "holy 21 million limit" (unless it wants to demurrage everyone to keep the limit at 21 million for aesthetic reasons), but IMO this result is less bad than the other two.

That said, I obviously hope that the ZK-SNARK scheme does not get hacked in the first place :)

Actually, I forgot to mention, there is option (4), roll back the chain to a point known to be before the hack started. If possible, this should be considered; it's a tradeoff.