Application for Coinholder-Directed Retroactive Grants Program (Q2 2026): Open-Source Zcash Hardware-Wallet SDK

Community Grants Retroactive Grants
11

Quick update on what landed last week:

  • enc_ciphertext recomputed on-device for every Orchard output. The companion now ships (d, pk_d, value, rseed, memo) per action; the device runs Pallas ECDH → Orchard KDF → ChaCha20-Poly1305 on-chip and constant-time compares against the action bytes (epk included). esk isn’t on the wire — derived from rseed + ρ per ZIP-212. Closes the memo-substitution path.

  • Miner fee computed on-device + explicit user confirmation. fee = t_in − t_out + value_balance with overflow/negative detection; verify() refuses to advance to VERIFIED until the user has OK’d the fee number rendered on the trusted screen. Closes value_balance-inflation.

  • Memo rendered on the Flipper screen.

Net: every component of the sighash and every byte of every output (recipient, value, memo, fee) is either recomputed on-device or rendered on the trusted screen for explicit confirmation. The only thing the companion is still trusted for is the Halo2 proof itself, and a wrong proof produces a tx the network rejects, not one that pays an attacker.

Commits:

  • libzcash-orchard-c 382419b, 47921e6, 13094d8

  • zcash-hw-wallet-sdk a29e08f, 465f6ed

  • FlipZcash paired update (memo scene + submodule bump)

Thanks again for the pushback