Loading proposals…
OLA (ola_olu)
The Zcash Daily is a sourced, opinionated editorial digest covering what happened in the Zcash ecosystem each day and why it matters. 50+ editions published to the Zcash forum between August 27 and November 3, 2026, with 417 inline source links, a structured log.json, and an automated publishing pipeline. Every edition is publicly verifiable. This is a retroactive request for work already completed.
Andrew Arnott (nerdcash)
Kept Nerdbank.Cryptocurrencies, the ZF-funded .NET Zcash light wallet library, working through NU6, Ironwood and NU7. Built faster sync and view-only wallet support in the nerdcash/librustzcash fork that powers it.
asafmod (independent security researcher)
I am the original reporter of GHSA-j4cw-58mj-7w6v, a High-severity (CVSS 3.1 7.5) Zebra vulnerability fixed in Zebra 7.0.0: one permissionless 2 MB transaction could stall block verification for minutes, because the transparent signature-hash cost of a transaction grows with the square of its input count. I reported it privately to the Zcash Foundation on 17 September 2026 with a working, reproducible proof of concept, and I am asking for $25,000 — my equal share of ZCG's…
Xifeng Jin
I am requesting a provisional $25,000 retroactive grant for my independent report of the malformed v6 transaction crash documented in GHSA-h5rr-8pqv-grp9. The Zcash Foundation rates the vulnerability High and fixed it in Zebra 6.4.2. Google OSS-Fuzz made the original automated finding; @v12security and I independently rediscovered the issue. My previous submission (issue #82) covers three other Zebra findings. This request is separate and does not duplicate any finding or…
Xifeng Jin
I am requesting $75,000 for my shares of three completed, publicly acknowledged Zebra security disclosures: one rated High and two rated Medium by the Zcash Foundation. The findings were fixed in Zebra 7.0.0; this request uses shared-reporter portions of the former Core Node payout amounts as reference points, with no bonus.
Individual — Independent security researcher
Independent, in-depth security audit of FROST v3 (Flexible Round-Optimized Schnorr Threshold Signatures) as specified for Zcash shielded multisig in ZIP-312 — covering frost-core v3.0.0, the RedPallas/RedJubjub ciphersuites, the DKG implementation, and the frost-tools application layer. Headline result, stated honestly: no critical vulnerability was found; the codebase is in excellent shape — this audit independently confirms it across 21+ investigated leads, each chased to…
Dmytro Sysoliatin
Void Market is an open-source sealed-bid auction application that combines confidential bid comparison with Zcash shielded payments. It demonstrates a workflow for selecting an eligible winning bid and settling the resulting transaction without publicly exposing bid amounts or the seller’s reserve price.
@x15-eth
In plain terms: Zebra 7.0.0, the release every node needs for NU7, fixed four High-severity bugs that credit me. Before the fixes, a single connected peer could make any Zebra node burn its CPU for as long as it kept sending, slow its block verification, or stop its initial sync, and was never banned. I am asking for $100,000: my equal share of ZCG's published High rate on the three of them where ZF names what my report contributed. I claim nothing for the fourth,…
ouicate (Quorint)
I found and privately reported two Zebra vulnerabilities in how nodes handle forged block bodies served under genuine block hashes. GHSA-jq45-ghw5-v37x (High), which I reported independently of @x15-eth, let one connected peer hold a syncing node behind the chain tip without ever being banned. GHSA-3c94-hf7p-g5mf (Medium, sole reporter) made nodes verify every proof in blocks that could never be committed. The Zcash Foundation fixed both in released Zebra (7.0.0 and 6.4.0).…
ouicate (Quorint)
I found and privately reported two Critical consensus vulnerabilities in the code headed for Zebra's next release: one would have let anyone split the Zcash network with a single transaction, and the other would have let any miner do it with a single block. The Zcash Foundation made them a release blocker, fixed both within six days (PR #11387), and shipped Zebra 6.4.0 without them, crediting me for "identifying and mitigating what would have been a nasty consensus bug in…
tidelit4 (independent open-source contributor)
Thirteen merged security and correctness fixes to Zcash-ecosystem infrastructure: eleven to the ZecHub Bounty Board backend (ZecHub/zec-bounties), one restoring the ZEC price feed on the Namada metrics dashboard, and one repairing broken documentation links in the ZecHub wiki. Every fix was reviewed and merged by the projects' maintainers.
sangsoo-osec
I am requesting $37,500 for GHSA-3jg6-49c6-q99v, a completed Medium severity disclosure concerning a V4 Sapling transaction parsing mismatch between zcashd and Zebra. This application follows the discussion in my High severity application #74 and presents a separate Medium finding as a concrete case for considering how severity ratings and practical impact should inform retroactive security rewards.
sangsoo-osec
I am requesting $75,000 for my initial report of CVE-2026-40880, a completed and publicly documented High severity Zebra vulnerability disclosure. Following Q3's recognition of critical vulnerability research, this application also invites coinholders to discuss whether High, Medium, and Low severity findings merit retroactive rewards and how those contributions should be valued.
RUH Youth Sports Foundation
In an innovative effort to fund our non-profit youth sports scholarship program, we secured donors to build a small crypto farm and its infrastructure. We seek reimbursement for the completed $650k infrastructure ($65k donated infrastructure + $350k donated for asics) that already supports up to 100x Z15 Pros and will enable us to phase out DOGE to exclusive decentralized Zcash mining.
shieldedonly (security researcher)
I'm applying for a $150,000 retroactive grant for discovering and responsibly disclosing CVE-2026-44499, a Critical Zebra vulnerability that allowed a single unauthenticated peer connection to permanently halt a targeted node's block discovery. I privately reported it on April 14, 2026; the maintainers fixed it in Zebra 4.4.0 and published the advisory on May 5.
Maya Protocol
Maya Protocol runs live cross-chain swaps with transparent and shielded ZEC. This application covers completed work since our Q1 2026 grant: two upstream contributions to librustzcash and Zebra, NU6.2 and NU6.3 (Ironwood) support on Maya mainnet, the move from zcashd to stock Zebra, and hardening of ZEC threshold signing, reorg recovery and shielded scanning.
j12s team, linceu.xyz.
I found and privately reported a High-severity denial-of-service in Zebra (GHSA-7jp4-mq53-4cvq): any connected peer could stall a node's verification with one crafted, unsigned transaction, at no cost and without being banned. The Zcash Foundation confirmed it, fixed it in zebrad 7.0.0, and published the advisory crediting me as the reporter.