In August, Zebra published GHSA-xr93-pcq3-pxf8 / CVE-2026-40881. Deserializing addr/addrv2 messages allocated vectors sized from a number the sending peer chose — up to 233,016 entries against a real protocol limit of 1,000 — before checking that limit. Remote OOM abort. It was fixed in 4.3.1 by lowering max_allocation() for the two affected types.
That closed the instance. It did not close the class.
Since then the same shape has been found and fixed four more times, one site at a time: two by dingledropper, one by me, one by the Zebra team. Nobody has a list of where else it lives. There is no written invariant for reviewers to check against, and no CI guard. Each instance has needed someone to independently rediscover the pattern.
This grant funds the sweep: a published inventory of every place in zebra-chain and zebra-network where a peer-supplied count sizes an allocation or a batch of work before it is validated, upstream PRs for the unbounded sites, and a regression guard so the fifth instance gets caught in review instead of in an advisory.
Issue #10566 is one known open instance. While writing the application I found a second facet of the same handler — peer/connection.rs builds Vec::with_capacity(ids.len()) from the same unvalidated getdata list, so the allocation happens before the mempool lookup that issue is about.
GitHub application: Grant Application - Zebra: auditing and closing the peer-supplied-count allocation class · Issue #430 · ZcashCommunityGrants/zcashcommunitygrants · GitHub
What it is not: no new repository, no fork to maintain, no rewrite. Everything lands upstream through Zebra’s normal review process and its acknowledge-before-PR gate. This is not a general audit of the node — it is one bug class, swept properly.
Where I stand honestly: my Zebra history is one PR, #11420, open since September 10 and not yet reviewed. My merged open-source record is mostly Python, TypeScript and Move. What I am claiming is the finding pattern, not general Zebra expertise, and the work is scoped to a shape I have already executed in this codebase.
Happy to take scrutiny on any of it here.
Forum: DrVelvetFog
GitHub: @DrVelvetFog
Applicant: Antoni Jagodka (individual, not an organisation)
Amount: $28,000 (startup $4k, milestones $5k / $13k / $6k)
Zebra PR: fix(chain): bound upfront allocation in zcash_deserialize_bytes_external_count by DrVelvetFog · Pull Request #11420 · ZcashFoundation/zebra · GitHub