Closing the ZCG Vulnerability Bounty Program

Community Grants
57

Oh i just checked my message request. I have seen your message

Will respond to he designated mail included in the message

Thanks!

1 Like
58

@artkor
I am also waiting for clarification on payout.

For example, I was credited on this published Zebra security advisory:

GHSA-pvmv-cwg8-v6c8

Severity: Critical / 9.3

I have not received any payout information or payment verification request yet.

thanks

59

Even if it isn’t the full amount outlined in the official Bug Bounty program, it would be great to receive some form of recognition for the time and effort we put in. As I mentioned before, I don’t think anyone who submitted reports before the official Bug Bounty program launched is expecting a $150,000 payout. That said, an appreciation payment would be a nice gesture and would go a long way toward acknowledging those contributions.

3 Likes
60

I think so

61

I think I was missed in this payout(GHSA-pvmv-cwg8-v6c8) too

1 Like
62

@ZCG @artkor

I’m following up on GHSA-pvmv-cwg8-v6c8. I’m an accepted reporter in the GitHub advisory credits for this GHSA (Zebra, Critical), and I was also thanked by name in the v4.4.1 release.

I’ve checked every available channel — email, GitHub, and this forum — but have not received any verification or payout request.

@ZCG / @artkor: could you please confirm whether @fivelittleducks is included in the payout review/request for this GHSA? If yes, please send instructions to fivelittleducks2021@gmail.com. If not, could you please let me know the reason?

@conradoplg: could you help confirm whether the remediation , ZCG payout handoff for this GHSA included @fivelittleducks?

3 Likes
63

@Shawn Is this bounty program still ongoing? Also how do i post my grant proposal?

64

The bounty program is closed per the OP of this thread.

1 Like
66

Alright thanks.

67

Thank you for following up.

GHSA-pvmv-cwg8-v6c8 was reported independently by two researchers: @sangsoo on May 2 and @fivelittleducks on May 3. Both reports were correct, high-quality, and actionable, and both reporters were credited on the advisory and in the v4.4.1 release notes in recognition of their independent discovery.

Under the program terms, where multiple researchers report the same underlying issue, the reward goes to the disclosure that actually enables the team to begin remediation. @sangsoo’s report was received first and remediation was already underway when @fivelittleducks’ submission arrived the following day. Since @sangsoo’s disclosure was the one the team acted on to begin the fix, their report is the one eligible for the bounty payout. @fivelittleducks’ submission (GHSA-vwgm-g748-q95m) was classified as a duplicate accordingly.

We understand this is frustrating, particularly when the reports were only one day apart and both were high-quality independent discoveries of a genuine Critical vulnerability. We did incorrectly miss out GHSA-pvmv-cwg8-v6c8 from our report sent to ZCG and we’re following up with them to recommend payout.

2 Likes
69

Thank you for the detailed and transparent response, and for crediting the independent discovery in the advisory and the v4.4.1 release notes — both are appreciated.

I’d like to raise one point for your consideration. My submission was an independent, reproducible, and correct identification of a Critical issue, acknowledged as such in the advisory and release notes. You also noted that GHSA-pvmv-cwg8-v6c8 had been inadvertently omitted from the report sent to ZCG, and that you’re following up to recommend payout. In that same spirit, would ZF/ZCG be open to a partial or discretionary payout in recognition of an independent, high-quality Critical duplicate, rather than treating the classification as zero-value?

For context, the publicly visible timeline is:

  • 2026-05-01 15:11 UTC: PR #10510 was merged and shipped in v4.4.0. The PR described validation of the caller-provided input index and previous-output alignment, but it did not add the v5 SIGHASH_SINGLE corresponding-output guard. As of the public v4.4.0 release, the issue I reported was still present in shipped code.
  • 2026-05-03 10:22 UTC: I submitted GHSA-vwgm-g748-q95m, identifying that v4.4.0 still lacked the SIGHASH_SINGLE corresponding-output guard.
  • 2026-05-04 19:01 UTC: PR #10542 was opened, then merged at 20:09 UTC and released as v4.4.1 at 20:14 UTC. This was the public PR/release path that added the missing guard.
2 Likes
70

I had no insight or input into the ZCG Bounty program before its launch.

I did not evaluate your finding on Zaino.

Given that @AloeareV marked it “Moderate” severity and from the description, I believe that it was a valuable (though out-dated) finding.

That said, a bug that requires a malicious validator to cause a DOS in Zaino, doesn’t even meet the criteria of “vulnerability” if that criterion is intended to refer to a functional Zcash stack.

If you’re interested in contributing to the zaino project, it’s open source, and we accept thoughtful improvements to the codebase.

If you can produce a working demonstration of your bug that does NOT involve a malicious validator, I think that is more likely to qualify for a bounty. As I said, I had no input into the bounty program, so my opinion isn’t authoritative.

Thanks for your work on the Zcash ecosystem. I hope we can find ways to collaborate more efficiently going forward!

2 Likes
Zaino Release Stabilization
72

@ZCG @artkor — following up on a Zcash-repository / zcashd report, separate from my earlier Zebra note above.

I am the reporter credited in the v6.12.3 release notes for GHSA-fqr9-fxpx-rfpf, which was remediated in zcashd v6.12.3. The advisory was published on 2026-05-08, and the report was submitted and disclosed during the ZCG Security Vulnerability Disclosure Initiative, before the program’s closure.

I understand from the earlier note that reports in the Zcash repository would be handled separately from the Zebra round once remediation is complete and public advisories can be properly coordinated.

To date, I have not received any contact, verification request, or status update regarding this report through email, GitHub, or the forum. I would just like to confirm:

1. Is GHSA-fqr9-fxpx-rfpf included in the separate Zcash-repository review process?

2. What is the appropriate administrative channel for this report, and what information do you need from me to proceed?

I am happy to provide whatever is required. Thanks for coordinating this.

1 Like
73

we’d appreciate it if ZCG could share any updates :eyes:

1 Like
76

Hello @artkor

Is there an update on lightwalletd issues?

I have an accepted high severity and a medium one

1 Like
79

Well, I’ve decided not to reply to your private messages anymore, since you’re using them to make things public without my consent.

As for substantive responses, I’ve already shared my perspective on the vulnerabilities in Zaino, and besides, ZCG hasn’t received any additional updates from the teams working on the infrastructure, so I don’t really have anything else to add.

Speaking for myself, I can say that this sort of exchange doesn’t encourage me to reply: whenever I do reply, I’m immediately bombarded with the same questions, just rephrased. I don’t see any point in this sort of interaction. And even if you write about this more often, the situation is unlikely to change.

81

  1. @ZCG @artkor — following up on my June 25 post above regarding my zcashd (Zcash repository) report, which has not received a response yet. This is separate from my earlier Zebra notes. I am raising it again today because zcashd reaches end of support on July 18, and I want to make sure this report does not fall through the cracks during the transition. I am the reporter credited in the zcashd v6.12.3 release notes for GHSA-fqr9-fxpx-rfpf: “The vulnerability was reported under the ZCG Security Vulnerability Disclosure Initiative by fivelittleducks.” The report was submitted through the program before its closure, and the advisory was published on 2026-05-08. My understanding from earlier in this thread is that Zcash-repository reports would be handled separately from the Zebra round once remediation was complete and public advisories could be properly coordinated. With v6.12.3 released and the advisory public for over two months, both conditions appear to be met. I would like to confirm:

    1. Is GHSA-fqr9-fxpx-rfpf included in the separate Zcash-repository review process, and is there a rough timeline reporters should expect?

    2. What is the appropriate administrative channel, and what information do you need from me to proceed?

    @nuttycom — apologies for the direct ping; one narrow question for the maintainers’ side, since the wind-down is imminent: could you confirm whether the zcashd team’s summary of qualifying reports — including GHSA-fqr9-fxpx-rfpf — has been handed over to ZCG for that separate review, or if not, whether the handoff can be completed before the team stands down? I understand payout decisions rest entirely with ZCG; this is only about the handoff.

  2. For identity verification, whatever is convenient works: the email address used for the original submission, the GitHub account credited in the advisory, or a DM to the X account listed on my GitHub profile. Even a simple acknowledgment that the report is in the queue would be appreciated. Thanks for coordinating this.

82

The report will not fall through the cracks. But speaking for myself, I have no bandwidth at all to deal with this until after NU6.3 activation on the 28th.

3 Likes
83

Are you saying researchers who found accepted vulnerabilities in the supporting infrastructure codebases wouldn’t get paid?

87

I guess it’s still being worked on. there are still undisclosed GHSAs, and the collaborator changes are still there as well

1 Like