Coinholder Retroactive Grants Q3

Built and shipped an open-source unified grants platform aggregating ZCG, Coinholder Grants, and ZecHub DAO proposals into a single interface, with filtering/sorting, grant detail pages, analytics views, GitHub-based submission UX improvements, and ZecHub DAO participation guidance — completed April 2026.

A free, no-tracker, cypherpunk-styled Zcash block explorer for blocks, transactions, cross-chain transfers, shielded pools, and network analytics (charts, tables, Sankey diagrams), plus a free keyless API.

Open-source Zcash developer toolkit for a local Zebra regtest environment and reusable CI workflow. This retroactive request covers post-M3 work improving documentation, installability, reliability, and maintainability.

zcashto.cash lets anyone exchange ZEC for fiat via 100+ geographies and 6 fiat apps (Cash App, Chime, Monzo, Revolut, Venmo, Zelle), non-custodial via the Peer protocol. Funded by the new ZcashLabs program managing Coinholder Retroactive Grants.

Completed open-source Rust CLI that reconstructs Orchard and Ironwood value-pool changes from raw public Zcash block data and compares calculated balances with Zebra's reported balances. v1.0.0 release includes offline-verifiable evidence archives, deterministic reports, and reproduction instructions.

A Zcash-native community quest platform where members earn shielded ZEC rewards without upfront wallet setup — live in closed beta with 38 weekly active users, 33 mainnet transactions spanning the Ironwood upgrade, and upstream contributions to Nozy Wallet.

A complete, self-hosted, self-sovereign Zcash testnet faucet (own Zebra node, Zallet wallet, Zaino indexer, solo miner) with shielded z-to-z payouts, an honest control plane, two upstream Crosslink bug-fix PRs, and the zsnap snapshot tool.

A free, no-account site for watching ZEC and CYPH: live prices, shielding and Ironwood stats, treasury, network stats, and an on-device portfolio.

A read-only shielded wallet accounting CLI (Unified Full Viewing Key, key never leaves device) producing cost-basis/gain-loss reports, payment reconciliation, privacy checks, and ZIP-321 payment request generation — verified against a real 108-transaction mainnet wallet — plus ZecLedger Web, a public network dashboard.

An independent Rust implementation of the Zcash light-client server (caching proxy between zebrad and shielded wallets), built June–August 2026, implementing all 20 CompactTxStreamer gRPC methods, public under MIT, CI-tested, and benchmarked against the Go reference implementation.

A privacy-preserving credential issuance service allowing applications to issue and verify one-time anonymous credentials without tracking users, using BLS12-381 blind signatures and DLEQ proofs. Serves as middleware for private airdrops, access controls, community votes, and similar apps.

A completed standalone Rust CLI that compares results from operator-supplied zcashd and Zallet JSON-RPC endpoints and generates normalized JSON/Markdown reports. Includes a 24-entry comparison manifest, six result classifications, automated tests, mock-node E2E validation, CI, and an operator runbook.

A discovery platform (zecmap.com, Android, iOS) that lists Zcash-accepting businesses on an interactive map to drive real-world adoption of privacy-focused crypto payments.

Editing and re-architecting Zcash ecosystem video footage into short, single-argument films for audiences unlikely to watch long-form content — five films published 28 July–12 August 2026, reaching 45,811 impressions and 9,931 views.

A Zcash application-layer attestation protocol built March–May 2026 using BLAKE2b Merkle commitments anchored to mainnet via Orchard shielded memos, with a Rust reference implementation, verification crate, JS/NPM package, and live public API.

A Mac-native, local-first bookkeeping layer for shielded Zcash: import a viewing key, classify income/change/expense, and export a scoped, expiring proof pack for an accountant. Cannot spend ZEC; not a merchant checkout product.

A non-custodial Zcash commerce platform built February–May 2026, shipping six MIT-licensed repositories covering payment processing, subscriptions, e-commerce plugins (Shopify, WooCommerce), event ticketing, AI agent payments (x402, MCP), and a point-of-sale interface — live with real merchants.

A privacy-centric Chrome MV3 browser wallet built around Zcash (with Penumbra as a second chain), delivering sub-12-second client-side Halo2 proving via parallelized WASM, FROST t-of-n Orchard multisig, an air-gapped signer (Zigner), and a per-site identity SDK (ZID) — published as an open-source beta on the Chrome Web Store.

A serverless, end-to-end encrypted P2P messenger fusing chat with shielded Zcash payments, enabling in-thread transactions and scan-and-pay. Live on Google Play, supporting fiat offramps across seven emerging-market rails without a phone number or central server.

The first portable, vendor-neutral, plain-C Orchard hardware wallet stack (~20,300 LOC across four MIT-licensed repos): a C11 crypto library, a Rust signing SDK, a Flipper Zero app, and an ESP32-S2 port — culminating in the first Orchard-shielded spend signed offline by a Flipper Zero, broadcast on mainnet 2026-03-30.

A self-hosted, shielded-first Zcash wallet running on the user's own Zebrad/Zakura + lightwalletd, with local witnesses rather than a hosted light wallet — CLI, Desktop, and companion API on the same core.

Integration of native ZEC cross-chain swaps into THORSwap and Metro wallet (launched October 2025), reporting $50M+ in ZEC volume, a $520K largest single swap, 24+ supported chains, and dual routing via Maya Protocol and NEAR Intents — no KYC, no custody, hardware wallet support.

Q1–Q3 2026 work covering expanded swap aggregation, Zcash wallet reliability improvements (server selection, transaction resend, address rotation, SDK migration), and full NU6.3/Ironwood migration support.

An on-chain Zcash naming system (ZNS) mapping human-readable names like alice.zcash to shielded addresses, delivered as a live beta web app, public explorer, docs portal, and developer SDK — framed as the trust-minimized successor to ZcashMe.

A completed security-research and remediation pack covering concrete security failures found in Zcash infrastructure and wallet code, responsibly disclosed and verified through to shipped remediation.

Bug bounty request for CVE-2026-34202, a Critical (CVSS 9.2) vulnerability allowing any unauthenticated peer to crash any Zebra node with a single P2P message, found via coverage-guided fuzzing, reported privately, and fixed in Zebra 4.3.0. No bounty was previously paid; ZCG's bounty program launched after this report and does not apply retroactively.

A bonus grant nomination (not a standard application) arguing Tachyon Foundation's $738,942 application for leading Ironwood zk-SNARK formal verification underprices real absorbed costs and emergency-rate work; this adds $261,058 to bring total recognition to $1,000,000.

A production Zcash block explorer and privacy-intelligence platform (cipherscan.app) covering completed, previously unfunded work: a custom Rust chain indexer, privacy-linkage analysis, wallet-fingerprint research, mining intelligence, an automated public data bot, and analytics tools.

Retroactive bounty request for multiple responsibly disclosed vulnerabilities across zcashd and Zebra, including a Sprout proof-verification bypass, a ZIP 209 turnstile-disabling duplicate-header bug, and consensus-divergence/node-crash findings composing into a temporary undetectable mint-and-sell exploit of counterfeit ZEC.

Net retroactive security award request for five responsibly disclosed Zebra vulnerabilities (each published by ZF as Critical) found via LLM-assisted differential review, validated, reported privately, and remediated; a separate $100,000 third-party payment is disclosed and deducted from the request.

Infrastructure powering 16 months of uptime for every major Zcash wallet: global edge monitoring, on-call support, testing new software at scale, and deploying critical updates including the Orchard security response before it was published.

Retroactive reimbursement for $599,000 of external security review costs incurred during the Ironwood incident response, engaging cryptography/blockchain auditors and AI tools to confirm no second soundness bug existed. Excludes any margin to Valargroup or costs to Valargroup team members.

After the Orchard counterfeiting vulnerability disclosure, Project Tachyon paused its roadmap to lead formal verification of Ironwood (NU6.3), implementing the new circuit, funding two independent verification firms, and producing machine-checked Lean proofs demonstrating no undetectable-counterfeiting vulnerabilities in the Ironwood zk-SNARK.

Bug bounty request for responsibly disclosing the Orchard counterfeiting vulnerability, which likely prevented the loss of $2.3B USD worth of ZEC. Intended to incentivize future responsible disclosure of devastating counterfeiting vulnerabilities.

A bonus grant nomination (not a standard application) arguing Taylor Hornby's $750,000 bounty ask for the Orchard counterfeiting vulnerability (application #51) is far below industry norms for a finding of this severity; adds $750,000 to bring the total to $1,000,000.

Retroactive compensation for Valargroup's emergency development, integration, testing, infrastructure, and activation work for Ironwood (NU6.3): consensus rules, production full node, wallet/migration tooling, transaction hashing, hardware signing, miner compatibility, public test infrastructure, and mainnet operations on an under-two-month emergency schedule.

Amended retroactive grant covering January–June 2026, narrowed to three workstreams: remediation of 10 major vulnerabilities (including 4 critical), Zallet v0.1.0-alpha.4 delivery with integration test suite, and ZIP 2005 (Quantum Recoverability) reaching Proposed / ZIP 256 reaching Final.