# Closing the ZCG Vulnerability Bounty Program **URL:** \ **Category:** Community Grants\ **Created:** [May 26, 2026, 9:40pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855 "2026-05-26T21:40:09Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![shieldedonly](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/shieldedonly/32/43931_2.png) [@shieldedonly](https://forum.zcashcommunity.com/u/shieldedonly)\ **Post date:** [June 10, 2026, 1:33am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/59 "2026-06-10T01:33:13Z")
Even if it isn’t the full amount outlined in the official Bug Bounty program, it would be great to receive some form of recognition for the time and effort we put in. As I mentioned before, I don’t think anyone who submitted reports before the official Bug Bounty program launched is expecting a $150,000 payout. That said, an appreciation payment would be a nice gesture and would go a long way toward acknowledging those contributions. ---
**Author:** ![sangsoo](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/sangsoo/32/44722_2.png) [@sangsoo](https://forum.zcashcommunity.com/u/sangsoo)\ **Post date:** [June 10, 2026, 4:43am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/60 "2026-06-10T04:43:32Z")
I think so ---
**Author:** ![sangsoo](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/sangsoo/32/44722_2.png) [@sangsoo](https://forum.zcashcommunity.com/u/sangsoo)\ **Post date:** [June 10, 2026, 9:04am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/61 "2026-06-10T09:04:29Z")
I think I was missed in this payout(GHSA-pvmv-cwg8-v6c8) too ---
**Author:** ![fivelittleducks](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/fivelittleducks/32/45575_2.png) [@fivelittleducks](https://forum.zcashcommunity.com/u/fivelittleducks)\ **Post date:** [June 15, 2026, 10:18pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/62 "2026-06-15T22:18:38Z")
@ZCG @artkor I’m following up on GHSA-pvmv-cwg8-v6c8. I’m an accepted reporter in the GitHub advisory credits for this GHSA (Zebra, Critical), and I was also thanked by name in the v4.4.1 release. I’ve checked every available channel — email, GitHub, and this forum — but have not received any verification or payout request. @ZCG / @artkor: could you please confirm whether @fivelittleducks is included in the payout review/request for this GHSA? If yes, please send instructions to [fivelittleducks2021@gmail.com](mailto:fivelittleducks2021@gmail.com). If not, could you please let me know the reason? @conradoplg: could you help confirm whether the remediation , ZCG payout handoff for this GHSA included @fivelittleducks? ---
**Author:** ![Skydancer](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/skydancer/32/45761_2.png) [@Skydancer](https://forum.zcashcommunity.com/u/Skydancer)\ **Post date:** [June 17, 2026, 9:40pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/63 "2026-06-17T21:40:24Z")
@Shawn Is this bounty program still ongoing? Also how do i post my grant proposal? ---
**Author:** ![Shawn](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/shawn/32/187_2.png) [@Shawn](https://forum.zcashcommunity.com/u/Shawn)\ **Post date:** [June 17, 2026, 9:57pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/64 "2026-06-17T21:57:27Z")
The bounty program is closed per the OP of this thread. ---
**Author:** ![Skydancer](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/skydancer/32/45761_2.png) [@Skydancer](https://forum.zcashcommunity.com/u/Skydancer)\ **Post date:** [June 18, 2026, 11:59am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/66 "2026-06-18T11:59:13Z")
Alright thanks. ---
**Author:** ![ZcashFoundation](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/zcashfoundation/32/21548_2.png) [@ZcashFoundation](https://forum.zcashcommunity.com/u/ZcashFoundation)\ **Post date:** [June 18, 2026, 3:10pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/67 "2026-06-18T15:10:43Z")
Thank you for following up. GHSA-pvmv-cwg8-v6c8 was reported independently by two researchers: @sangsoo on May 2 and @fivelittleducks on May 3. Both reports were correct, high-quality, and actionable, and both reporters were credited on the advisory and in the v4.4.1 release notes in recognition of their independent discovery. Under the program terms, where multiple researchers report the same underlying issue, the reward goes to the disclosure that actually enables the team to begin remediation. @sangsoo’s report was received first and remediation was already underway when @fivelittleducks’ submission arrived the following day. Since @sangsoo’s disclosure was the one the team acted on to begin the fix, their report is the one eligible for the bounty payout. @fivelittleducks’ submission (GHSA-vwgm-g748-q95m) was classified as a duplicate accordingly. We understand this is frustrating, particularly when the reports were only one day apart and both were high-quality independent discoveries of a genuine Critical vulnerability. We did incorrectly miss out GHSA-pvmv-cwg8-v6c8 from our report sent to ZCG and we’re following up with them to recommend payout. ---
**Author:** ![fivelittleducks](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/fivelittleducks/32/45575_2.png) [@fivelittleducks](https://forum.zcashcommunity.com/u/fivelittleducks)\ **Post date:** [June 19, 2026, 10:24am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/69 "2026-06-19T10:24:34Z")
Thank you for the detailed and transparent response, and for crediting the independent discovery in the advisory and the v4.4.1 release notes — both are appreciated. I’d like to raise one point for your consideration. My submission was an independent, reproducible, and correct identification of a Critical issue, acknowledged as such in the advisory and release notes. You also noted that GHSA-pvmv-cwg8-v6c8 had been inadvertently omitted from the report sent to ZCG, and that you’re following up to recommend payout. In that same spirit, would ZF/ZCG be open to a partial or discretionary payout in recognition of an independent, high-quality Critical duplicate, rather than treating the classification as zero-value? For context, the publicly visible timeline is: - 2026-05-01 15:11 UTC: PR #10510 was merged and shipped in v4.4.0. The PR described validation of the caller-provided input index and previous-output alignment, but it did not add the v5 SIGHASH\_SINGLE corresponding-output guard. As of the public v4.4.0 release, the issue I reported was still present in shipped code. - 2026-05-03 10:22 UTC: I submitted GHSA-vwgm-g748-q95m, identifying that v4.4.0 still lacked the SIGHASH\_SINGLE corresponding-output guard. - 2026-05-04 19:01 UTC: PR #10542 was opened, then merged at 20:09 UTC and released as v4.4.1 at 20:14 UTC. This was the public PR/release path that added the missing guard. ---
**Author:** ![zancas](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/zancas/32/42011_2.png) [@zancas](https://forum.zcashcommunity.com/u/zancas)\ **Post date:** [June 21, 2026, 8:42pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/70 "2026-06-21T20:42:42Z")
I had no insight or input into the ZCG Bounty program before its launch. I did not evaluate [your finding on Zaino](https://github.com/zingolabs/zaino/security/advisories/GHSA-3whf-vgf2-9w6g). Given that @AloeareV marked it “Moderate” severity and from the description, I believe that it was a valuable (though out-dated) finding. That said, a bug that requires a malicious validator to cause a DOS in Zaino, doesn’t even meet the criteria of “_ **vulnerability** _” if that criterion is intended to refer to a functional Zcash stack. If you’re interested in contributing to the zaino project, it’s open source, and we accept thoughtful improvements to the codebase. If you can produce a working demonstration of your bug that does NOT involve a malicious validator, I think that is more likely to qualify for a bounty. As I said, I had no input into the bounty program, so my opinion isn’t authoritative. Thanks for your work on the Zcash ecosystem. I hope we can find ways to collaborate more efficiently going forward! ---
**Author:** ![fivelittleducks](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/fivelittleducks/32/45575_2.png) [@fivelittleducks](https://forum.zcashcommunity.com/u/fivelittleducks)\ **Post date:** [June 25, 2026, 4:18am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/72 "2026-06-25T04:18:19Z")
@ZCG @artkor — following up on a Zcash-repository / zcashd report, separate from my earlier Zebra note above. I am the reporter credited in the v6.12.3 release notes for [GHSA-fqr9-fxpx-rfpf,](https://github.com/zcash/zcash/security/advisories/GHSA-fqr9-fxpx-rfpf#event-675468) which was remediated in zcashd v6.12.3. The advisory was published on 2026-05-08, and the report was submitted and disclosed during the ZCG Security Vulnerability Disclosure Initiative, before the program’s closure. I understand from the earlier note that reports in the Zcash repository would be handled separately from the Zebra round once remediation is complete and public advisories can be properly coordinated. To date, I have not received any contact, verification request, or status update regarding this report through email, GitHub, or the forum. I would just like to confirm: 1. Is GHSA-fqr9-fxpx-rfpf included in the separate Zcash-repository review process? 2. What is the appropriate administrative channel for this report, and what information do you need from me to proceed? I am happy to provide whatever is required. Thanks for coordinating this. ---
**Author:** ![sangsoo](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/sangsoo/32/44722_2.png) [@sangsoo](https://forum.zcashcommunity.com/u/sangsoo)\ **Post date:** [July 1, 2026, 7:53pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/73 "2026-07-01T19:53:33Z")
we’d appreciate it if ZCG could share any updates 👀 ---
**Author:** ![iamfadhlu](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/iamfadhlu/32/45051_2.png) [@iamfadhlu](https://forum.zcashcommunity.com/u/iamfadhlu)\ **Post date:** [July 10, 2026, 4:38am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/76 "2026-07-10T04:38:17Z")
Hello @artkor Is there an update on lightwalletd issues? I have an accepted high severity and a medium one ---
**Author:** ![artkor](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/artkor/32/28573_2.png) [@artkor](https://forum.zcashcommunity.com/u/artkor)\ **Post date:** [July 17, 2026, 10:40am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/79 "2026-07-17T10:40:27Z")
> [@ouicate](#): > > @artkor multiple times. I can see that my messages have been viewed, but I haven’t received any response. Well, I’ve decided not to reply to your private messages anymore, since you’re using them to make things public without my consent. > [@Zaino Release Stabilization](https://forum.zcashcommunity.com/t/zaino-release-stabilization/56268/3): > > Zaino is not yet ready for use software. As far as I know, not a single team has switched to Zaino. In that case, I do not consider it at all appropriate to talk about identifying bugs of varying degrees of seriousness, except for the most serious ones, which may affect the operation of the higher-level infrastructure. Quote from the program terms and conditions: " \* Supporting Infrastructure — Zallet, Zaino, and lightwalletd. Findings are capped at High, since defects in these repositories ca… As for substantive responses, I’ve already shared my perspective on the vulnerabilities in Zaino, and besides, ZCG hasn’t received any additional updates from the teams working on the infrastructure, so I don’t really have anything else to add. Speaking for myself, I can say that this sort of exchange doesn’t encourage me to reply: whenever I do reply, I’m immediately bombarded with the same questions, just rephrased. I don’t see any point in this sort of interaction. And even if you write about this more often, the situation is unlikely to change. ---
**Author:** ![fivelittleducks](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/fivelittleducks/32/45575_2.png) [@fivelittleducks](https://forum.zcashcommunity.com/u/fivelittleducks)\ **Post date:** [July 17, 2026, 1:44pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/81 "2026-07-17T13:44:31Z")
1. @ZCG @artkor — following up on my June 25 post above regarding my zcashd (Zcash repository) report, which has not received a response yet. This is separate from my earlier Zebra notes. I am raising it again today because zcashd reaches end of support on July 18, and I want to make sure this report does not fall through the cracks during the transition. I am the reporter credited in the zcashd v6.12.3 release notes for GHSA-fqr9-fxpx-rfpf: “The vulnerability was reported under the ZCG Security Vulnerability Disclosure Initiative by fivelittleducks.” The report was submitted through the program before its closure, and the advisory was published on 2026-05-08. My understanding from earlier in this thread is that Zcash-repository reports would be handled separately from the Zebra round once remediation was complete and public advisories could be properly coordinated. With v6.12.3 released and the advisory public for over two months, both conditions appear to be met. I would like to confirm: 2. For identity verification, whatever is convenient works: the email address used for the original submission, the GitHub account credited in the advisory, or a DM to the X account listed on my GitHub profile. Even a simple acknowledgment that the report is in the queue would be appreciated. Thanks for coordinating this. ---
**Author:** ![daira](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/daira/32/43253_2.png) [@daira](https://forum.zcashcommunity.com/u/daira)\ **Post date:** [July 18, 2026, 9:13pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/82 "2026-07-18T21:13:39Z")
The report will not fall through the cracks. But speaking for myself, I have no bandwidth at all to deal with this until after NU6.3 activation on the 28th. ---
**Author:** ![iamfadhlu](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/iamfadhlu/32/45051_2.png) [@iamfadhlu](https://forum.zcashcommunity.com/u/iamfadhlu)\ **Post date:** [July 19, 2026, 5:45am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/83 "2026-07-19T05:45:07Z")
Are you saying researchers who found accepted vulnerabilities in the supporting infrastructure codebases wouldn’t get paid? ---
**Author:** ![sangsoo](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/sangsoo/32/44722_2.png) [@sangsoo](https://forum.zcashcommunity.com/u/sangsoo)\ **Post date:** [August 2, 2026, 2:40am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/87 "2026-08-02T02:40:42Z")
I guess it’s still being worked on. there are still undisclosed GHSAs, and the collaborator changes are still there as well ---
**Author:** ![ipwning](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/ipwning/32/44924_2.png) [@ipwning](https://forum.zcashcommunity.com/u/ipwning)\ **Post date:** [August 13, 2026, 6:59pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/91 "2026-08-13T18:59:02Z")
Hello @ZCG @artkor, I also sent a message via the @ZCG account, but I’m leaving a comment here as well in case you didn’t see it. It appears that the six lightwalletd vulnerability advisories I reported have been made public. Of course, these are vulnerabilities I reported during the bug bounty program, and they’re all independent reports and have been confirmed! I have absolutely no intention of rushing you. I fully understand that you’re all busy, and putting myself in your shoes, I realize that while I’ve sent just one message, you likely have dozens or even hundreds of messages piling up. However, I’ll leave the details of the lightwalletd vulnerability reports I submitted here, so I’d appreciate it if you could take a look. **High:** zcash/lightwalletd/security/advisories/GHSA-q2c2-hpp9-58hm zcash/lightwalletd/security/advisories/GHSA-6ppp-r2gc-9q6v zcash/lightwalletd/security/advisories/GHSA-4x4j-5972-376r **Medium:** zcash/lightwalletd/security/advisories/GHSA-4hp3-3494-3f2m **Low:** zcash/lightwalletd/security/advisories/GHSA-pwwg-h8q5-hq28 zcash/lightwalletd/security/advisories/GHSA-m7j5-wvx3-qj6j ---
**Author:** ![zerodartz](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/zerodartz/32/26722_2.png) [@zerodartz](https://forum.zcashcommunity.com/u/zerodartz)\ **Post date:** [August 25, 2026, 11:02am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/94 "2026-08-25T11:02:11Z")
Here’s a short update of what I know. (but I’m not the closest to all of this work) A third-party reviewer has delivered the majority of the GHSA details to ZCG, but it hasn’t been quite finalized yet. Payments will be made once everything has been finalized and collected. In my view the main reason for the delay has been that core developers were stretched thin across development work, Ironwood, and other priorities. Things started moving in the right direction again a few weeks ago once the 3rd party reviewer began their work. Even though the total bounties value will be higher than the initial program was set to, all eligible bounties that were submitted during the program will be paid once everything is finalized. Maybe someone else can give some sort of timeline, but I personally don’t know how long it will take. [Previous page](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855.md?page=2) [Next page](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855.md?page=4)