I’m reaching out because bountyzcash.org is live, an idea from 2022, but now it has been born: ZCG Grant Idea Thread - #19 by Michae2xl
That’s the proof of concept. Now I want to scale it.
In March 2026, Alex “Scalar” Sol discovered a critical vulnerability in zcashd v3.1.0–v6.11.x: Sprout proof verification was silently skipped during block connection for nearly 6 years, exposing ~25,424 ZEC to a potential drain. Private disclosure, 72-hour coordinated patch across all 4 major mining pools, 200 ZEC reward paid. Zero exploitation window.
What I’m building
A unified bug bounty program for the Zcash ecosystem. One place for researchers to submit, one clear methodology (OWASP Risk Rating), one trusted coordinator. Your infrastructure is covered without you needing to run the operation.
Two things, and two things only:
-
Scope
Just tell me the name of your organization, the programs you run, and the repos you want covered. That’s it. A list is enough. -
Budget
How much ZEC are you willing to pay per severity tier for findings in your scope? You keep the ZEC. You pay researchers directly when a valid finding comes in. Nothing moves through me.
That’s it. You define the exposure.
Who is in? @ZcashFoundation, @joshs , @aquietinvestor
What I handle:
- Real-time email alert: you get notified the moment a report touches your scope via a dedicated address (e.g., zfnd@bountyzcash.org or shieldedlabs@bountyzcash.org), listed publicly on the site
- Submission intake and triage routing to your team
- Researcher communication
- Public disclosure and Hall of Fame documentation after the embargo expires
- Site maintenance, updates, and program coordination
The only cost is a flat maintenance fee for coordination and site operation. Your entire budget goes directly to researchers protecting your infrastructure and is never left with you.
→ bountyzcash.org
→ Hall of Fame — bountyzcash.org
Happy to answer any questions.
