GitHub application: Retroactive Grant Application - Ledger Zcash App Vulnerability Disclosure: Memo Crash and Device Wipe (GHSA-376f-cc2v-g94c) · Issue #106 · Financial-Privacy-Foundation/ZcashCoinholderGrantsProgram · GitHub
Hi all, I’m Rowan (piatoss3612 on GitHub). I’m asking coinholders for $37,500 for a completed vulnerability disclosure in Ledger’s official Zcash app.
Summary
In September I found that the Zcash app on Ledger devices (version 3.9.3) crashed whenever a shielded transaction carried a memo with any character outside plain ASCII: an emoji, Korean text, an accented letter, even a line break. The crash happened before the review screen, so there was nothing for the user to reject. On my own Ledger Stax it did more than crash. The device rebooted into factory setup and had to be restored from the recovery phrase.
I traced the root cause, verified a fix and reported it privately to Ledger on Sep 21. About 13 hours later Ledger shipped the fix in 3.9.4 for all five device models and published the advisory, GHSA-376f-cc2v-g94c, at Critical severity, crediting me as the reporter. That was two days before Ledger announced native shielded Zcash support, so users arriving with the launch installed the fixed app.
Why it mattered
- Ordinary input triggered it. Anyone writing a memo in a non-Latin script, adding an emoji or pressing Enter would hit it.
- Someone else could trigger it. A payment request (a
zcash:URI or QR code) carries a memo chosen by the payee, and wallets prefill it for the payer. - Funds were at stake. A user without a tested recovery-phrase backup would have lost access to their funds.
Ledger’s regression test for the memo I reported now carries the comment “These five bytes are what wiped the reporter’s device” (source).
Why I’m asking coinholders
The Zcash app is not among the apps covered by Ledger’s bug bounty program, and Ledger told me that no separate reward process applies. ZCG’s bounty program did not cover Ledger apps and had already closed.
Why $37,500
I used the payout table of the former ZCG Security & Vulnerability Disclosure Initiative as a reference, as earlier security applications here have. A Ledger device app is outside that table’s categories. The closest one is Supporting Infrastructure, which is capped at High with a base payout of $37,500, and the table lists “Non-distributed denial of service against an individual node or wallet” among its High examples. I am not asking for the table’s optional bonus.
Disclosure
I work as a frontend engineer at Vizor, a Zcash wallet that supports Ledger signing. I’m applying as an individual, with Vizor’s knowledge and support, and the award would go to me personally. Any application Vizor submits to this program for its wallet work is separate and does not cover this finding.