OneKey Zcash Hardware Support with Unified Wallet Architecture (Transparent + Shielded)

[Jenny0115]

OneKey envisions a future where all cryptocurrency users can prioritize privacy and security without compromise. We aim to drive broader adoption of the Zcash network by providing the most robust, secure, and user-friendly solution for managing ZEC’s unique features.

Proposed Problem

This proposal funds full Zcash support (transparent and shielded, post-NU6) within the OneKey hardware ecosystem to address a distribution and resilience gap in Zcash’s privacy stack.

Zcash’s long-term success depends on broad hardware-level shielded access. Today, shielded functionality remains unavailable across meaningful segments of the global hardware wallet market, limiting adoption among security-focused self-custody users.

OneKey serves 300K+ monthly active users and nearly 1 million users globally. Enabling shielded Zcash within this ecosystem immediately expands privacy-capable distribution across 166 countries.

This grant diversifies Zcash’s hardware implementations, reducing vendor concentration risk while strengthening privacy accessibility at the device level.

This is a targeted ecosystem investment: expanding hardware-level privacy reach, increasing distribution efficiency, and reinforcing Zcash’s core mission where it matters most — secure self-custody.

Proposed Solution

We propose to release a new firmware with transparent and Orchard support, which will allow users to securely manage shielded ZEC from OneKey Wallet Desktop.

Please check the full proposal here: OneKey Zcash Hardware Support with Unified Wallet Architecture (Transparent + Shielded) · Issue #228 · ZcashCommunityGrants/zcashcommunitygrants · GitHub

Requested Grant Amount (USD): $45,000

Solution Format

The solution consists of:

• Firmware-level Zcash implementation covering transparent and Orchard transaction signing

• PCZT format parsing and on-device transaction validation

• Clear signing implementation displaying transaction details (addresses, amounts, memo, fees) on the hardware screen before user confirmation

• Automated regression testing

• External security audit

• Production release with documented derivation paths

• Licensing

  • OneKey’s firmware is fully open source. The license terms are available at: https://github.com/OneKeyHQ/firmware-pro/blob/main/LICENSE.md All Zcash-specific code produced under this grant will be released under the same license and publicly available in OneKey’s existing open-source repositories.

Success Metrics

• Successful on-device signing of all four transaction types (transparent, shielding, deshielding, fully shielded) via PCZT workflow

• Clear Signing correctly displays all transaction details including memo content before user confirmation

• No key material exposure during the entire transaction lifecycle

• No asset migration blockers (contrast with Ledger history)

• Recovery works via standard BIP-39 seed with correct ZIP-32 Orchard derivation

• Regression tests pass across firmware versions without breaking existing chain support

• External security audit passes with no critical vulnerabilities

Milestone Details

Milestone: 1

Core Zcash Hardware Support (Transparent + Orchard with PCZT & Clear Signing)

Amount (USD): 25K

Expected Completion Date: 2026-07-30

Deliverables:

OneKey hardware firmware implementation:

• Add Pallas and Vesta curve support to the cryptographic stack

• ZIP-32 Orchard key derivation

• Transparent address generation and transaction signing

• Orchard address generation (Unified Addresses with transparent + Orchard receivers)

• UFVK export

• PCZT parsing engine: validate transaction structure, extract outputs, fees, and memo fields

• Clear Signing implementation: on-device display of recipient addresses, amounts, fees, memo content, and transaction type before user confirmation

• Memo field parsing and display for shielded outputs

• Support for all four transaction types: transparent, shielding, deshielding, fully shielded

• Unified firmware implementation (no per-asset firmware splitting)

• Documentation of derivation paths, PCZT integration protocol, and signing model

Acceptance Criteria:

• Device correctly derives Orchard keys and generates Unified Addresses from BIP-39 seed

• All four transaction types can be signed on-device via PCZT workflow

• Clear Signing UI displays complete transaction details (addresses, amounts, fee, memo, type) and requires physical confirmation

• ZEC transactions are signed exclusively by hardware; no key material leaves the device

• Recovery via standard BIP-39 seed produces identical addresses

• No firmware splitting introduced for Zcash

• Independent testers complete end-to-end transactions without key exposure

Milestone 2

Security Hardening and Maintainability

Amount (USD): 10K

Expected Completion Date: 2026-09-30

Deliverables

Modular Zcash transaction components separated from hardware-specific code

Internal security review covering:

• Orchard signing flows (Pallas correctness, randomness quality)

• ZIP-32 key derivation (path isolation, key material handling)

• PCZT parsing (input validation, buffer overflow prevention, malformed transaction rejection)

• Clear Signing integrity (display-what-you-sign guarantee)

External security audit focused on:

• Orchard cryptographic implementation

• PCZT parsing attack surface

• Key isolation within device

Regression test suite covering:

• All four transaction types

• PCZT edge cases (malformed data, oversized memos, maximum input/output counts)

• Firmware upgrade compatibility testing

Public maintenance documentation

Acceptance Criteria

• No critical vulnerabilities found in external audit

• Regression tests pass across firmware versions

• Orchard transaction signing is stable under stress testing

• PCZT parser correctly rejects all malformed or invalid transaction data

• Firmware upgrades do not break existing ZEC accounts or other chain support

• Display-what-you-sign property verified: signed transaction matches what was shown on screen

Milestone 3

Production Stability and Migration Safety

Amount (USD): free

Expected Completion Date: -

Deliverables

• Cross-device testing (supported OneKey models).

• Migration validation tests (standard BIP-39).

• Firmware upgrade compatibility matrix.

• Public release notes and known limitations disclosure.

• Final production release.

Acceptance Criteria

• Migration from standard BIP-39 seeds works without incompatibility.

• Firmware upgrades do not invalidate ZEC accounts.

• No critical post-release issues during the stabilization window.

• Community testing confirms transparent + shielded functionality.

[ZCG]

@Jenny0115 at the most recent meeting, ZCG voted to approve this proposal. Congratulations!

To keep the community informed, ZCG requests that you provide monthly updates via the forum in this thread.

Please check your forum inbox for a direct message from FPF with important next steps, including a link to the Milestone Payment Request Form and your unique validation code for submitting payment requests.

[Jenny0115]

OneKey × Zcash — Progress Update

Project: OneKey hardware wallet Zcash support (Unified Wallet Architecture, Transparent + Shielded)

Target device: OneKey Pro2
Grant: Zcash Community Grants #228 / Zcash Community Forum proposal

Background

This update covers progress on Milestone 1: Core Zcash Hardware Support (Transparent + Orchard, with PCZT & Clear Signing) committed under the Zcash Community Grant.

The core principles of the solution remain unchanged:

• Unified wallet architecture: a single mnemonic manages all chains and assets; Zcash keys are derived and isolated within the unified firmware, with no separate app and no firmware splitting.

• Keys never leave the device: only the UFVK and addresses are exported; all signing happens inside the hardware.

• Orchard + Transparent, Sapling excluded: covering all four transaction types (transparent / shielding / deshielding / fully shielded).

• Fully open source: all Zcash‑related code will be released to OneKey’s public repositories under the same open‑source license as the existing firmware.

Status Overview

The table below maps each Milestone 1 deliverable to its current status.

Deliverable (Milestone 1)	Status
SE‑level cryptographic primitives (RedPallas, Orchard primitives)	Done
ZIP‑32 Orchard key derivation	Done
Unified Address generation (Transparent + Orchard receivers)	Done
UFVK export (Transparent + Orchard)	Done
Seed fingerprint export	Done
Correctness verification of the above	Done
PCZT signing (Transparent + Orchard)	Built, in testing
End‑to‑end signing of all four transaction types	In testing
Clear Signing (on‑device display of address / amount / fee / tx type)	In progress
Documentation (derivation paths, PCZT integration protocol, signing model)	Pending

Completed (built and correctness‑verified)

1. Secure Element foundation The Orchard cryptographic foundation on the Secure Element has been completed on the OneKey Pro2, providing support for RedPallas and the Orchard primitives so that key derivation, address generation, and signing can all run inside the secure chip. This is the prerequisite for delivering Orchard support under a “keys never leave the device” standard.

2. Key & address derivation

• Unified Address (Transparent + Orchard): generates Unified Addresses containing both a transparent (P2PKH) receiver and an Orchard receiver.

• UFVK export (Transparent + Orchard): only the Unified Full Viewing Key and addresses are exported; spending keys and other key material always remain on the device.

• Seed fingerprint export: supports exporting the seed fingerprint, allowing companion software to identify and associate accounts without ever touching the seed.

3. Correctness verification The outputs of the above key derivation and address / UFVK generation have been correctness‑verified (consistent with the Zcash specifications) and reproduce reliably from a standard BIP‑39 seed. This meets the Milestone 1 acceptance criterion of “correctly deriving Orchard keys and generating Unified Addresses from a BIP‑39 seed.”

In Testing

PCZT signing (Transparent + Orchard) The PCZT (Partially Created Zcash Transaction) signing path has been built and is currently under test. Companion software constructs the unsigned PCZT; the device receives it, parses and validates its structure, signs on‑device, and returns the signed PCZT to the companion software for finalization and broadcast.

Test coverage targets all four transaction types:

• Transparent: t‑addr → t‑addr

• Shielding: t‑addr → Orchard (move funds into the shielded pool)

• Deshielding: Orchard → t‑addr (move funds out of the shielded pool)

• Fully Shielded: Orchard → Orchard

Next Steps

1. Complete and integrate Clear Signing: display recipient address(es), amount, fee, and transaction type in full on the hardware screen, requiring physical confirmation; reject any PCZT whose parsed data is incomplete or inconsistent (preserving the “sign what you see” guarantee).

2. Finalize PCZT testing: round out regression tests across the four transaction types and edge cases (malformed data, maximum input/output counts).

3. Open‑source release: once stable, merge and publish the SE‑side Orchard / UFVK / PCZT implementation to the public OneKeyHQ/firmware-pro repository.

4. Documentation: write up the derivation paths, PCZT integration protocol, and signing model.

5. Enter Milestone 2: modular separation, internal security review and third‑party security audit, and firmware‑upgrade compatibility testing (target 2026‑09‑30).

Milestones & Timeline

Milestone	Scope	Target
Milestone 1	Core hardware support (Transparent + Orchard, PCZT + Clear Signing)	2026‑07‑01
Milestone 2	Security hardening & maintainability (internal review + external audit + regression tests)	2026‑09‑30
Milestone 3	Production stability & migration safety (cross‑device testing, BIP‑39 migration validation, production release)	Post‑release stabilization

Summary: The Milestone 1 cryptographic foundation and key/address derivation (UA, UFVK, seed fingerprint) are built and correctness‑verified; PCZT (Transparent + Orchard) signing is built and now in testing. Next we focus on Clear Signing and regression testing, then publish the code open source as planned.

[adaptiveresilience]

Hey @Jenny0115 how does Ironwood upgrade affect your plan and milestone targets?