Zcash approves a $1.5 million vulnerability bounty, Zooko announces an $8 million funding plan

Zcash community approves more than US$8 million in grants, and Zooko emphasizes the network's ability to fund contributors through community governance

Zcash token holders have approved grants totaling more than US$8 million. Zcash co-founder Zooko Wilcox pointed out in an article published on the X platform that this result demonstrates Zcash's ability to provide financial support to contributors through community decision-making.

Security researcher Taylor Hornby received a $1.5 million reward approval for his work on discovering and disclosing loopholes in the Orchard protocol. The funding is designed to incentivize responsible safety research behavior, especially when researchers discover loopholes that could have serious consequences.

In addition, the Zcash Open Development Lab (ZODL) has received US$1.95 million approval to cover protocol repairs, wallet development, and related specification development to address quantum recovery and consensus deployment requirements.

Detailed funding status

According to the voting results announced by the Financial Privacy Foundation on September 29, the successfully approved applications cover multiple areas such as security, infrastructure and development. Although the project manager's announcement distinguished between "fund approval" and "actual payment" and outlined recipient verification and subsequent release arrangements, the overall approval amount has been determined.

Taylor Hornby received two separate award approvals: the $750,000 bounty he originally requested and a bonus of the same amount. Jason McGee independently submitted additional nominations, arguing that Hornby's original application underestimated the value of his findings. McGee specifically pointed out that Hornby neither requested the nomination nor assisted in preparing relevant materials, but would receive the full bonus. Both applications were approved, bringing the researcher's total allocation through the token holder process to $1.5 million.

Hornby viewed the award as an incentive for responsible disclosure in his application and thanked Shielded Labs for funding its audit work and the other Zcash teams for their cooperation in coordinating the security response.

Orchard vulnerability discovery is linked to broader protocol security funding

Shielded Labs hired Hornby in April 2026 to investigate protocol vulnerabilities to prevent malicious actors from causing damage before identifying and exploiting these vulnerabilities. During a targeted Orchard circuit review using Anthropic's AI model, he discovered the counterfeiting vulnerability on May 29.

Hornby then disclosed the discovery to Zcash Open Development Lab engineers, triggering an emergency response from the entire development ecosystem. Shielded Labs reported that the team completed the fix on June 2, distinguishing the emergency fix from subsequent network changes.

Although the vulnerability could have led to an unlimited number of counterfeit ZECs within Orchard, verifying whether there was an earlier exploit is complicated because of its privacy protection mechanisms. Shielded Labs warned that cryptographic evidence cannot conclusively prove whether an attacker had previously exploited the flaw.

Zooko Wilcox said in an October 1 post that the retrospective grant round totaled more than $8 million, including huge retrospective grants from many people who worked selflessly to protect all users during this year's AI error crisis. He emphasized that this is not only about money, but also a strong proof that the Zcash governance mechanism can reward completed contributions.

Zcash just gave away more than $8m in retroactive grants, including millions of dollars of retroactive grants to a lot of people who selflessly worked to protect all users during the AI bug crisis this year.
But that's not even the best thing about what just happened…

The US$1.95 million application received by ZODL covers core agreement contributions completed between January and June 2026. The submissions include Orchard fixes, Zallet wallet alternatives, and specification work to address post-quantum recovery and consensus deployment requirements.

综合来看，这些批准既认可了漏洞的发现与修复，而管理员则单独负责接收方验证和付款日程安排。Wilcox 将此结果呈现为证据，表明 Zcash 的治理可以通过其自身的资金机制来奖励已完成的贡献。