# Zcash Ecosystem Security Lead **URL:** \ **Category:** Applications\ **Created:** [June 6, 2022, 11:45pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090 "2022-06-06T23:45:22Z")\ **Posts on this page:** 15\ **Page:** 5
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [June 8, 2023, 10:39pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/89 "2023-06-08T22:39:32Z")
May highlights: - Audited most of @hanh’s Ledger code, I just have some of the heavy cryptographic stuff (like the elliptic curve implementation) left to audit. - Audited Nighthawk’s lightwalletd deployment scripts. - Figured out how `bridgetree` works and convinced myself wallets can update their witnesses efficiently in private (yay!). - I also spent a lot of time on Dev Fund related discussions (which I’m not billing for!) 🙂 June is going to be a bunch of audit wrap-up stuff, hopefully getting as many things as possible to a stage where I can talk about them in my Zcon talk (which was accepted!). ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [July 17, 2023, 3:25am UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/90 "2023-07-17T03:25:57Z")
I made this chart for my Zcon4 talk but I figured I’d post it here to give the community a summary of the bugs I’ve found through the funding that ZCG has given me. Here’s a breakdown of bugs the I’ve discovered over the past ~year: ![Bugs Discovered, by Type](https://global.discourse-cdn.com/zcash/original/3X/6/2/6202bc1ee05406413b84dddae854332e08345911.png) The bug categories should be somewhat self-explanatory. The bug severities are somewhat subjective, and I define them as follows: > A “Critical” issue is a vulnerability that can definitely be exploited to impact many users with devastating consequences. “High” means a vulnerability that is likely to have a severe impact on many users. “Medium” means a vulnerability of moderate impact or one that may only be exploitable in special circumstances. “Low” means a vulnerability whose exploitation would have very little impact on any user or is is unlikely to ever be exploited in practice. > > “Critical” and “High”-severity issues must be fixed as soon as possible to protect users. “Medium”-severity issues are sometimes safe to defer, and “Low”-severity issues are almost always safe to defer. In total, I found 83 bugs, 41 of which are rated as medium or above, and 23 of which are rated high or above. ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [August 24, 2023, 8:26pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/91 "2023-08-24T20:26:52Z")
Update for the months of June and July: - Zcon4! My talk about security engineering [can be seen here](https://www.youtube.com/watch?v=fgkFrxiB14g). - Wrapped up my audit of Hanh’s hardware wallet (good coverage of everything except the elliptic-curve implementations). - Looked at audit reports to give a quick security sanity check to ZecHub on using DAODAO. - Started on auditing Zingo. - Put up a [warning about the milk sad vulnerability](https://zecsec.com/posts/milk-sad/) ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [September 9, 2023, 8:39pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/92 "2023-09-09T20:39:07Z")
Here’s the current status of audit reports on the road to being published: ![image](https://global.discourse-cdn.com/zcash/original/3X/6/8/68c372d99ec3aaf054f45a49b6362dc2a822d628.png) ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [September 11, 2023, 5:17pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/93 "2023-09-11T17:17:12Z")
August update: I’ve mainly been focused on wrapping up existing audits (see the table above), and also working on an audit of Zingo. I’ve quickly reviewed Zingo’s mobile app codebase (which is mostly GUI code) and I’m currently working through the zingolib repo where all of the actual scanning and wallet logic lives. ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [September 15, 2023, 1:42am UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/94 "2023-09-15T01:42:13Z")
The report from my mini audit of Free2Z (back in February) is posted here: [Free2Z Security Audit Results | ZecSec: Zcash Ecosystem Security](https://zecsec.com/posts/free2z-security-audit/) ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [September 21, 2023, 10:23pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/95 "2023-09-21T22:23:22Z")
The results of auditing @hanh’s Ledger app are now out! [Results of Auditing Hanh's Shielded Zcash Ledger App | ZecSec: Zcash Ecosystem Security](https://zecsec.com/posts/security-audit-of-hanhs-ledger-app/) ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [September 23, 2023, 3:59pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/96 "2023-09-23T15:59:12Z")
zecwallet-lite-cli audit report: [Security Audit of zecwallet-lite-cli | ZecSec: Zcash Ecosystem Security](https://zecsec.com/posts/zecwallet-lite-cli-security-audit/) ---
**Author:** ![David\_Heisenberg](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/david_heisenberg/32/18956_2.png) [@David\_Heisenberg](https://forum.zcashcommunity.com/u/David_Heisenberg)\ **Post date:** [September 25, 2023, 9:56pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/98 "2023-09-25T21:56:09Z")
Imitation game? > [@David\_Heisenberg](#): > > FWIW, in this case, I do not mind the more open ended style. Taylor has a super long track record from what I know, finding many of the most critical bugs in the Zcash protocol. ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [September 26, 2023, 4:58pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/99 "2023-09-26T16:58:19Z")
Starting in October, I will be stepping away from my role as the Zcash community’s resident security auditor, more details on my blog: > **[The Future of Zcash Ecosystem Security](https://zecsec.com/posts/future-of-zcash-ecosystem-security/)** > > Starting in October, I will be stepping away from my role as the Zcash community’s resident security auditor and entering a sabbatical year to give more of my time to friends and family and to work on some hobbies outside of the cryptocurrency... ---
**Author:** ![SexDrugsAndZcash](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@SexDrugsAndZcash](https://forum.zcashcommunity.com/u/SexDrugsAndZcash)\ **Post date:** [September 27, 2023, 9:57am UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/100 "2023-09-27T09:57:46Z")
just watched your zc0n4 talk, huge thanks for your care and contribution!! ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [November 24, 2023, 5:41pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/101 "2023-11-24T17:41:38Z")
In September/October I wrapped up the grant with: - A quick audit of Zingo - A quick audit of Nighthawk - Helping respond to centralized mining pools - Other wrap-up tasks like preparing a handoff package for the next person/org to take on this role, reviewed the Nym grant application, updated my ecosystem overview page, etc. ---
**Author:** ![pkr](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/pkr/32/29938_2.png) [@pkr](https://forum.zcashcommunity.com/u/pkr)\ **Post date:** [November 24, 2023, 5:48pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/102 "2023-11-24T17:48:31Z")
Thank you for your service 🫡 ---
**Author:** ![pacu](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/pacu/32/15383_2.png) [@pacu](https://forum.zcashcommunity.com/u/pacu)\ **Post date:** [November 28, 2023, 7:21pm UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/103 "2023-11-28T19:21:36Z")
We will miss you 😢 thanks for all the work you’ve done for the Zcash Ecosystem. ---
**Author:** ![earthrise](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/earthrise/32/11887_2.png) [@earthrise](https://forum.zcashcommunity.com/u/earthrise)\ **Post date:** [January 5, 2024, 7:23am UTC](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090/104 "2024-01-05T07:23:01Z")
I just posted the results of auditing ZGo (from April of last year). There were some interesting issues there, thanks to the ZGo folks for an awesome security response! > **[ZGo Security Audit Results](https://zecsec.com/posts/zgo-security-audit/)** > > In April of last year, I performed a security audit of ZGo, a payment processing platform built on Zcash. The report is linked below. > My review found several critical security vulnerabilities. For example, one vulnerability allowed an attacker to... [Previous page](https://forum.zcashcommunity.com/t/zcash-ecosystem-security-lead/42090.md?page=4)