Zebra 4.4.0 — Critical Security Release Patches Five Vulnerabilities
The Zcash Foundation released Zebra v4.4.0 on May 2 with fixes for multiple security vulnerabilities, including consensus-critical issues. All node operators should upgrade immediately.
Five CVEs were patched: denial-of-service via gossip queue saturation and syncer poisoning (GHSA-28xj-328h-72vm), a V5 sighash callback consensus bypass (GHSA-gq4h-3grw-2rhv), allocation amplification in inbound deserializers (GHSA-438q-jx8f-cccv), a transparent input/output alignment bug, and RPC hardening including a cookie file permission fix (GHSA-jg86-rwhm-fhg4). The V5 sighash bypass was the most severe — a consensus-critical issue that could potentially cause chain splits if left unpatched.
Sources: ZF Forum · GitHub Release · ZF Tweet
ZCG Earmarks $1M for Security Bug Bounties
Zcash Community Grants announced a $1 million USD earmark to fund payouts for responsibly disclosed vulnerabilities affecting core Zcash repositories. The program covers Zebra, librustzcash, and related consensus-critical code. Payouts flow through a formalized pipeline: remediation team → ZCG → FPF → researcher.
This is the largest coordinated security funding initiative in Zcash history and follows an April disclosure cycle that saw three independent researchers find vulnerabilities, one of whom (Alex Sol) had rewards retroactively doubled from 300 to 600 ZEC. ZCG, ZODL, ZF, and Shielded Labs are in active discussions on triage, severity classification, and coordination to ensure the program runs smoothly.
Sources: ZCG Tweet · Forum Discussion
Three Independent Hardware Wallet Projects Now Active
The Zcash hardware wallet ecosystem went from near-zero to three simultaneous projects this week:
1. Hito ($50k ZCG grant under review, #280) — Dedicated Orchard cold signing module. Architecture published, 5,000+ units in production planning. Forum thread has the highest engagement score of any current grant application.
2. wh00hw's Open-Source SDK (FPF retroactive grant #28) — libzcash-orchard-c and zcash-hw-wallet-sdk targeting embedded platforms: FlipZcash (ARM Cortex-M4) and ESP32 (Xtensa LX7). Code-complete, MIT-licensed, 49 KAT vectors and 17 integration tests. Posted via the FPF Coinholder Grants track.
3. Zafu/Zigner (FPF retroactive grant #29) — Chrome MV3 extension with sub-12-second client-side Halo2 Orchard proving, end-to-end FROST t-of-n multisig, and air-gap device pairing via PCZT (ZIP-324). The most technically ambitious browser wallet in the Zcash ecosystem.
Meanwhile, Ledger's Orchard device-app integration remains on track for mid-May signing completion, with full launch targeted for July. Four different teams, four different approaches — all converging on Orchard signing.
Sources: Hito Forum · wh00hw Forum · Zafu Forum