Zebra Malformed v6 Transaction Crash (GHSA-h5rr-8pqv-grp9)

Terms and Conditions

• I agree to the Grant Agreement terms if funded
• I agree to Provide KYC information if funded above $50,000 USD
• I agree to disclose conflicts of interest
• I understand that this grant program is only eligible for completed work, as it is a retroactive grant program. Applications for planned or partially completed work will not be considered. All completed work will be verified and accepted by its intended users or their representatives, who will confirm that the outputs meet the required quality, functionality, and usability before the work is listed as an option for Coinholder voting.
• I agree that for any new open-source software, I will create a CONTRIBUTING.md file that reflects the high standards of Zcash development, using the librustzcash style guides as a primary reference.
• I understand when contributing to existing Zcash code, I am required to adhere to the project specific contribution guidelines, paying close attention to any merge, branch, pull request, and commit guidelines as exemplified in the librustzcash repository.
• I understand all grants are valued in USD but will be disbursed in Shielded ZEC. I acknowledge and accept that disbursement amounts may fluctuate based on the ZEC/USD exchange rate at the time of payment.

Application Owners (@octocat, @octocat1)

@SphereDonout

Organization or Individual Name

Xifeng Jin

Additional Team Members

N/A

How did you learn about the Lockbox: Coinholder Retroactive Grants Program?

Zcash Community Forum

Requested Grant Amount (USD)

25000

Category

Research & Development

Project Summary

I am requesting a provisional $25,000 retroactive grant for my independent report of the malformed v6 transaction crash documented in GHSA-h5rr-8pqv-grp9. The Zcash Foundation rates the vulnerability High and fixed it in Zebra 6.4.2. Google OSS-Fuzz made the original automated finding; @v12security and I independently rediscovered the issue.

My previous submission (issue #82) covers three other Zebra findings. This request is separate and does not duplicate any finding or amount in that application.

Project Description

At a glance

The completed finding

Zebra 6.4.0 and 6.4.1 could parse a v6 transaction carrying a consensus branch ID from before NU6.3, then abort while trying to re-serialize it. An unauthenticated peer could trigger the crash with one tx message and repeat it after restart. The advisory records the conditions, impact, original OSS-Fuzz finding, independent rediscoveries, and fix. The Zcash Foundation's 6.4.2 announcement confirms the emergency fix and the recall of Zebra 6.4.0 and 6.4.1.

Basis for the amount

The former ZCG Security & Vulnerability Disclosure Initiative published a $75,000 High reference amount for a Core Node finding. For this separate coinholder-directed retroactive grant request, I propose $25,000: one third of that reference amount, acknowledging all three discovery credits in the advisory, including OSS-Fuzz's original automated finding. This is a conservative proposed allocation, not a formal program formula or a statement that OSS-Fuzz is a grant applicant. I claim only my independent report, request no bonus, and make no claim on behalf of OSS-Fuzz or @v12security. Coinholders may weigh the timing and remediation value of each report differently.

Technical Approach (how you did it)

I used LLM-based vulnerability discovery tool to scan the core logic components to find these issues, followed by carefully manual review to triage these findings.

For this finding, I compared v6 transaction parsing with re-serialization and traced how a peer-supplied transaction reaches Zebra's serialized-size calculation. The analysis identified a version and consensus-branch combination accepted by the parser but rejected by the writer, turning an assumed-infallible operation into a process abort in Zebra 6.4.0 and 6.4.1. The published advisory documents the vulnerability analysis, reproduction conditions, and reporter credit.

Time Period of Work Completion

September 2026. GHSA-h5rr was fixed and published with Zebra 6.4.2 on September 25.

Total Budget (USD)

0

Budget Breakdown

This is an outcome-based retroactive award request for a completed disclosure, rather than reimbursement of itemized expenses. The requested grant amount is $25,000; the expense budget entered here is $0.

Previous Funding

No

Previous Funding Details

None. I have not received funding from the Coinholder Grants Program.

Other Funding Sources

No

Other Funding Sources Details

None. I have not received funding from other sources for this finding.

Success Metrics

• The published High-severity advisory credits Google OSS-Fuzz with the original automated finding and @v12security and @SphereDonout with independent rediscoveries.
• Zebra 6.4.2 shipped the fix and the Zcash Foundation acknowledged my report by name. Affected Zebra 6.4.0 and 6.4.1 releases were recalled.
• The fix removes an unauthenticated, repeatable node crash caused by a malformed peer-supplied v6 transaction. The advisory defines the affected conditions and impact.
• The $25,000 request is limited to my proposed share. The original OSS-Fuzz finding and @v12security's independent report are stated above so coinholders can assess the allocation.

Proof of completion

• Zebra 6.4.2 release. The advisory links the affected code and remediation.

Publication

• GHSA-h5rr-8pqv-grp9

Deployment/Release

• Zcash Foundation's Zebra 6.4.2 announcement

Other Evidence

• My previous grant submission (issue #82) requests funding for GHSA-2w9f-9wx8-f5c8, GHSA-6v36-c42v-v98p, and GHSA-5h3r-fpmj-483w. It does not include GHSA-h5rr-8pqv-grp9.

Conflict of Interest Disclosure

I have no employment, contracting or governance relationship with the Zcash Foundation, FPF, ZCG, ZODL, Shielded Labs or any keyholder organization.

Community Forum Posting

• I understand it is my responsibility to post a link to this issue on the Zcash Community Forums after this application has been submitted so the community can give input. I understand this is required in order for the community to discuss and vote on this grant application. Note: If you are unable to post on the forum (for example, due to new user restrictions), please leave a comment below, and we will adjust your posting permissions.