The new decision is about a retroactive award

Zcash Coinholder Grants proposal 106 asks voters to award an individual security researcher $37,500 for a vulnerability disclosure completed in September. The application was edited on 11 November and is marked “ready for vote.” It is a request, not an approved grant or proof that funds have been distributed.

The applicant, identified as Rowan and GitHub user piatoss3612, says the work received no payment from Ledger or an earlier Zcash security programme. The proposed amount uses a former Zcash Community Grants security-payout table as a reference and classifies the work at a high-severity supporting-infrastructure rate. Ledger’s own advisory labels the underlying vulnerability critical. Those are separate classifications: the first supports the applicant’s requested award, while the second describes Ledger’s assessment of the software flaw.

The application also discloses that the researcher works for Vizor, a Zcash wallet supporting Ledger signing, while applying as an individual. Voters therefore have to assess completed technical work, the requested valuation and the disclosed relationship separately.

Ledger patched the memo-processing fault on 21 September

Ledger’s GHSA-376f-cc2v-g94c security advisory says Zcash app versions up to and including 3.9.3 contained an uninitialised BLAKE2b hashing context in the code that handled memos outside printable ASCII. A Korean character, emoji, accented letter, tab or line break could route a shielded memo into the faulty code and crash the application before the transaction-review screen appeared.

The advisory records reproducible crashes in Ledger’s Speculos emulator. It also records an observation on a Ledger Stax in which the device returned to factory onboarding and had to be restored from its recovery phrase. The researcher explicitly says the application fault is explained, while the mechanism that produced the hardware reset was not investigated. That distinction matters: the advisory documents what happened on the tested device without establishing that every supported Ledger model would reset in the same way.

Ledger lists version 3.9.4 as the patched release and versions through 3.9.3 as affected. The fix initialised the hashing context before processing the memo and added regression coverage. The public timeline places the private report, merge, release and advisory on 21 September, before Ledger’s later launch of native shielded-ZEC support.

Ledger’s current support guidance instructs users to run Zcash app version 3.9.4 or later. That makes the practical distinction straightforward: the historical flaw is relevant to older software, while the public evidence reviewed by NetNapz says the supported fixed line begins at 3.9.4. Users should verify their installed app version through Ledger’s official software and retain a tested recovery-phrase backup rather than attempting to reproduce the bug.

NetNapz assessment: do not confuse funding with an active exploit

NetNapz assessment: the 11 November development is a governance and compensation decision, not the discovery of a new unpatched Zcash network vulnerability. The affected component was Ledger’s device application, not Zcash consensus, and the cited flaw was patched in September. The pending question is whether coinholders should fund the completed disclosure at the requested amount.

The case still has wider security relevance. Payment-request memos can be selected by another party, so wallet and hardware-signing integrations need to treat ordinary international text and control characters as adversarial input. The fix and tests address the disclosed application path; they do not prove every wallet, device operating system or future memo parser is free of related defects.

Verification scope: NetNapz checked Ledger’s advisory, the public grant application and Ledger’s published version guidance. We did not test a hardware wallet, reproduce the crash, inspect private communications, vote in the grant process or verify any payout. No claim is made about ZEC price, token ownership rights or the outcome of the pending proposal.