GitHub application: #82
Hello Zcash community. I am requesting a $75,000 retroactive grant for my shares of three completed Zebra security disclosures. The Zcash Foundation published all three advisories and shipped the fixes in Zebra 7.0.0.
What I reported
-
GHSA-2w9f-9wx8-f5c8, High: A forged checkpoint block body followed by an invalid block could leave the checkpoint verifier ahead of state, stopping initial sync until restart. I submitted an end-to-end P2P proof of concept with a negative control. @x15-eth independently reported the issue. I thank @arya2 for implementing the checkpoint recovery and requeueing fixes, @mpguerra for coordination, and @conradoplg and @oxarbitrage for remediation review.
-
GHSA-6v36-c42v-v98p, Medium: Disconnecting a peer during a blocked outbound send could abort zebrad under specific timing conditions. The advisory credits my report and @professorsolderin’s independent report. I thank @conradoplg for implementing and testing the fix, @jvff for reviewing it, and @mpguerra for coordinating the advisory.
-
GHSA-5h3r-fpmj-483w, Medium: A node one block behind could ban an honest peer for relaying a transaction valid at the peer’s tip. I supplied a two-node reproduction; @sangsoo-osec independently reported it publicly. I thank @oxarbitrage for implementing and testing the fix, @conradoplg for reviewing and merging it, and @mpguerra for coordinating the advisory.
Why $75,000
I use the former ZCG Core Node reference amounts as a guide, with no bonus: $37,500 for my proposed share of the High finding and $18,750 for each Medium finding. These are proposed shares, not guaranteed awards. @x15-eth’s application #79 separately requests the other $37,500 share of GHSA-2w9f.
The Zcash Foundation’s Zebra 7.0.0 announcement acknowledges my reports. My separate application #83 concerns GHSA-h5rr-8pqv-grp9, a different finding fixed in Zebra 6.4.2; no finding or requested amount overlaps.
I welcome questions about the findings, evidence, and proposed amounts during the review period.
