# Closing the ZCG Vulnerability Bounty Program **URL:** \ **Category:** Community Grants\ **Created:** [May 26, 2026, 9:40pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855 "2026-05-26T21:40:09Z")\ **Posts on this page:** 20\ **Page:** 4
**Author:** ![ouicate](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/ouicate/32/49801_2.png) [@ouicate](https://forum.zcashcommunity.com/u/ouicate)\ **Post date:** [August 25, 2026, 12:35pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/95 "2026-08-25T12:35:09Z")
Thanks for the clarification, I really appreciate you taking the time to share what you know. It’s reassuring to have a bit more context on the situation, and I completely understand that things have been busy. Hopefully everything can be wrapped up smoothly when the time is right. Thanks again for the update! ❤ ---
**Author:** ![haxonittech](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/haxonittech/32/47516_2.png) [@haxonittech](https://forum.zcashcommunity.com/u/haxonittech)\ **Post date:** [August 29, 2026, 4:37pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/96 "2026-08-29T16:37:41Z")
Hi, I also wanted to ask for clarification regarding a lightwalletd report I submitted before the bounty program was closed. The vulnerability was confirmed, fixed, and later publicly disclosed, and I received full researcher credit for it. Since the report was submitted while the ZCG vulnerability bounty program was still active, could ZCG clarify whether it is still being evaluated for a bounty under the previous program terms, and who is responsible for the final severity and payout decision? Thanks! ---
**Author:** ![haxonittech](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/haxonittech/32/47516_2.png) [@haxonittech](https://forum.zcashcommunity.com/u/haxonittech)\ **Post date:** [August 29, 2026, 8:37pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/97 "2026-08-29T20:37:11Z")
@ZCG Forget to tag ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [September 2, 2026, 9:54pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/98 "2026-09-02T21:54:51Z")
Hi ouicate, were you credited for this? You can through the replies and mentions in that GitHub. Seems Zcash team will clarify who owns the report in due time. > **[Valid one-hash FindBlocks response discarded, causing false close-to-tip...](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h8m8-844p-v3m9)** > > \# Valid one-hash FindBlocks response discarded, causing false close-to-tip status and a false /ready result while behind the chain tip > > | Field | Value | > |---|---| > | Severity | Medium | > | CVSS... ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [September 2, 2026, 10:13pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/99 "2026-09-02T22:13:17Z")
@ouicate I think you should look at this again `GHSA-h8m8-844p-v3m9` . What do you think? In terms of credit, I can clearly see my name been credited for the report. I am just saying, maybe Zcash team will clarify more, don’t you think it will be nice to get more clarification? I will also need more clarification and how it works. ---
**Author:** ![ouicate](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/ouicate/32/49801_2.png) [@ouicate](https://forum.zcashcommunity.com/u/ouicate)\ **Post date:** [September 3, 2026, 8:55am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/100 "2026-09-03T08:55:44Z")
I think the credit is actually pretty clear in the advisory @prince. It says the issue was reported by you with a PoC, while the false close-to-tip status and false readiness result were independently reported by me. This is pretty normal and has happened multiple times with other GHSAs and researchers when closely related issues are found, but with different attack vectors or root causes. They can be bundled into a single advisory while still crediting each researcher separately, and in many cases, the bounty is split accordingly. So I think it’s best to let the @ZCG work it all out. As @zerodartz explained earlier, they’re already working on it, so there’s no need to rush. I trust they’re handling it properly, and if you can be a little patient, I’m sure it’ll work out well for you. Congrats again! 🙌 ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [September 3, 2026, 11:35am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/101 "2026-09-03T11:35:07Z")
@ouicate Thanks brother, hopefully they sort everything soon.your work rate is impressive. ---
**Author:** ![fivelittleducks](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/fivelittleducks/32/45575_2.png) [@fivelittleducks](https://forum.zcashcommunity.com/u/fivelittleducks)\ **Post date:** [September 14, 2026, 8:35pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/102 "2026-09-14T20:35:53Z")
Hi @zerodartz @daira,@ZCG , just following up on the bounty rewards. It has now been more than three months, and we still haven’t received a clear update on when the rewards will be assigned. Could you please let us know the current status and, if possible, provide an expected timeline? We would really appreciate some clarity on this. Thanks! ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [September 22, 2026, 3:34pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/104 "2026-09-22T15:34:08Z")
Hi @zerodartz @ZCG, I know you people are still working on the bounty issues, but I think little update from the team will go a long way for us. Right now we don’t even know our faith or how things will be. Just give us an update. Thanks ---
**Author:** ![Alen](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@Alen](https://forum.zcashcommunity.com/u/Alen)\ **Post date:** [September 27, 2026, 6:29pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/105 "2026-09-27T18:29:51Z")
Hi [@ZcashGrants](https://forum.zcashcommunity.com/groups/zcashgrants) We know you guys are still working through the bounty related stuff and I don’t want to rush anything here I just wanted to ask if there are any updates on the bounty payments for reports under the “Supporting infrastructure” scope, especially the disclosed reports affecting lightwalletd. I am only asking for a quick status update, since it’s now been exactly 4 months since the bug bounty program was closed. I’d also really appreciate it if you could share an expected timeline, if there is one. Thanks and best regards! ---
**Author:** ![haxonittech](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/haxonittech/32/47516_2.png) [@haxonittech](https://forum.zcashcommunity.com/u/haxonittech)\ **Post date:** [September 28, 2026, 10:32pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/106 "2026-09-28T22:32:02Z")
Hey team, I wanted to ask if there’s any update on when security researchers who reported vulnerabilities in lightwalletd through the bounty program (bountyzcash .org, which ended in May) can expect to receive their bounty payments It’s been around 4 months and we still haven’t heard anything. Could you please share any update or at least an estimated timeline if exact dates are not possible yet? ---
**Author:** ![haxonittech](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/haxonittech/32/47516_2.png) [@haxonittech](https://forum.zcashcommunity.com/u/haxonittech)\ **Post date:** [October 4, 2026, 2:30am UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/107 "2026-10-04T02:30:29Z")
Any help please? ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [October 5, 2026, 4:27pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/108 "2026-10-05T16:27:16Z")
Hi @ZCG some people just received DM messages about payment especially ZODL, please I didn’t receive the message,could there be a reason? I am still waiting for response for my disclosure ---
**Author:** ![ZCG](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/zcg/32/33712_2.png) [@ZCG](https://forum.zcashcommunity.com/u/ZCG)\ **Post date:** [October 5, 2026, 5:34pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/109 "2026-10-05T17:34:47Z")
@Prince Thank you for your message. The contact information we received for you was your X account, so we sent you a message there earlier today. To verify that the address comes from the correct person, we’re only contacting reporters through the contact information provided to us. ~FPF on behalf of ZCG ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [October 5, 2026, 6:02pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/110 "2026-10-05T18:02:23Z")
Please just help me clarify, because I did not receive the message. Thanks @ZCG for the reply, please I just need clarification, the set of messages you out today was it for Zebra or Lightwalletd? Because if it’s for Zebra which I have a confirmed bug (**GHSA-h8m8-844p-v3m9), I didn’t receive any message.** This is my X (@maakayjunior) I didn’t receive, please verify, you can also check my GitHub linked to the issue above to verify. ---
**Author:** ![ZCG](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/zcg/32/33712_2.png) [@ZCG](https://forum.zcashcommunity.com/u/ZCG)\ **Post date:** [October 5, 2026, 6:28pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/111 "2026-10-05T18:28:23Z")
My apologies, it looks like it is a different Prince that I was referring to as they have a different X account listed on their GitHub profile. ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [October 5, 2026, 6:40pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/112 "2026-10-05T18:40:59Z")
Thank you so much, @ZCG , I really appreciate, please any update Zebra payment? Any hope at all? ---
**Author:** ![Prince](https://avatars.discourse-cdn.com/v4/letter/p/ba9def/32.png) [@Prince](https://forum.zcashcommunity.com/u/Prince)\ **Post date:** [October 6, 2026, 3:50pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/114 "2026-10-06T15:50:02Z")
Please @ZCG I will appreciate if can help me share a little light on this question. For zebra disclosures any update ? Please help thanks ---
**Author:** ![shieldedonly](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/shieldedonly/32/43931_2.png) [@shieldedonly](https://forum.zcashcommunity.com/u/shieldedonly)\ **Post date:** [October 6, 2026, 4:27pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/115 "2026-10-06T16:27:53Z")
Is it too late to submit a grant proposal for the security reports I submitted to the official Zebra security program a while back? It looks like several researchers were able to receive rewards for their findings, including findings submitted before the bug bounty program officially started. I had to step away pretty abruptly due to health issues, so I wasn’t able to follow up on mine at the time. I currently have **1 accepted CRITICAL, 1 HIGH, and 1 MODERATE** severity finding. Would I need to wait until the Q4 coinholder grant voting period to submit a proposal? Or is there another process I should follow given that these reports were already submitted and accepted? If anyone has any guidance or has gone through a similar process, I’d really appreciate it! @ZCG ---
**Author:** ![FPF](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/fpf/32/30829_2.png) [@FPF](https://forum.zcashcommunity.com/u/FPF)\ **Post date:** [October 6, 2026, 4:32pm UTC](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855/116 "2026-10-06T16:32:12Z")
FYI, the CDRGP Q4 call for proposals period will begin October 30th if you decide to go that route. [Previous page](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855.md?page=3) [Next page](https://forum.zcashcommunity.com/t/closing-the-zcg-vulnerability-bounty-program/55855.md?page=5)