Retroactive Grant Application - Independent Security Audit of FROST v3 (ZIP-312)

Community Grants Retroactive Grants
1

Hi all — submitting my Q4 retroactive grant application for an independent security audit of FROST v3, the threshold Schnorr scheme selected for Zcash shielded multisig (ZIP-312).

GitHub application: https://github.com/Financial-Privacy-Foundation/ZcashCoinholderGrantsProgram/issues/81

Summary

Independent, in-depth security audit of FROST v3 — covering frost-core v3.0.0, the RedPallas/RedJubjub ciphersuites, the DKG implementation, and the frost-tools application layer. Headline result, stated honestly: no critical vulnerability was found; the codebase is in excellent shape — this audit independently confirms it across 21+ investigated leads, each chased to a documented kill reason.

Requested amount: $40,000 (below the $50k KYC threshold; KYC available on request).

What was done

Round 1 — library audit (frost-core v3.0.0): 14 leads investigated, all killed with documented kill reasons. Covered nonce management (hedged generation per RFC 9591), binding factors, IncorrectCommitment scope, DKG robustness (Schnorr PoK domain separation, rogue-key defense, cheater detection default-on), challenge H2 against the Zcash spec, domain separation across all hash contexts, re-randomization (ZIP-312), and the 577-line RedPallas custom ciphersuite recovered from its pre-removal commit — the highest-risk zone.

Round 2 — application layer: one confirmed denial-of-service in frostd (memory exhaustion via unbounded recipient buffering — mechanism confirmed by source-code review and local fan-out test), filed as ZcashFoundation/frost-tools#611; ~1,270-request fuzzing campaign against the frostd HTTP state machine (release + debug builds): zero crashes, zero panics; two false positives rigorously debunked by the same methodology (Noise_K impersonation; missing cheater detection — both retracted with full errata); blind-signing design gap documented end-to-end for future wallet integrators; ywallet/Zallet integration check (neither ships FROST signing code).

The honest caveats

  • No critical vulnerability. The $150k+ Q3 security grants were for actual vulnerabilities; this does not claim that tier of impact.
  • The confirmed DoS is in frostd, explicitly demo/reference code; no production wallet was affected.
  • The audit protects a future, not a present: no production wallet uses FROST yet.
  • I am an unknown applicant in this ecosystem — which is exactly why everything is published and verifiable.

Why it is worth funding

  1. Independent assurance that FROST v3 — the foundation of shielded multisig — is sound, by someone other than the team.
  2. One real bug with a reproducible PoC the maintainers can fix (#611).
  3. A documented blind-signing design gap every future FROST wallet integrator should address before shipping.
  4. Methodological transparency, including the debunked false positives.

All reports, PoC code, and fuzzing harnesses: GitHub - metaforismo/frost-security-review: Security review of FROST, including reproducible reports and testing artifacts. · GitHub

Happy to answer any questions during the review period — including the uncomfortable ones.

2

Yeah, here’s one: an audit report is only worth it if the auditor is reputed and has something to lose. What do you have to lose here if you did the audit recklessly or had an AI do it for you?