What Retroactive Grant Application - Ledger Zcash App Vulnerability Disclosure: Memo Crash and Device Wipe (GHSA-376f-cc2v-g94c) means for your swap
Brief take: the headline, the parts that actually touch a no-KYC swap, and the order checklist for today. Source: Zcash Forum.
GitHub application: [PASTE THE GITHUB ISSUE LINK HERE] Hi all, I’m Rowan (piatoss3612 on GitHub). I’m asking coinholders for $37,500 for a completed vulnerability disclosure in Ledger’s official Zcash app. (Zcash vs Monero 2026)
The full Zcash Forum coverage: GitHub application: [PASTE THE GITHUB ISSUE LINK HERE] Hi all, I’m Rowan (piatoss3612 on GitHub). I’m asking coinholders for $37,500 for a completed vulnerability disclosure in Ledger’s official Zcash app. Summary In September I found that the Zcash app on Ledger devices (version 3.9.3) crashed whenever a shielded transaction carried a memo with any character outside plain ASCII: an emoji, Korean text, an accented letter, even a line break. The crash happened before the review screen, so there was nothing for the user to reject. On my own Ledger Stax it did more than crash. The device rebooted into factory setup and had to be restored from the recovery phrase. I traced the root cause, verified a fix and reported it privately to Ledger on Sep 21. About 13 hours later Ledger shipped the fix in 3.9.4 for all five device models and published the advisory, GHSA-376f-cc2v-g94c , at Critical severity, crediting me as the reporter. That was two days before Ledger announced native shielded Zcash support, so users arriving with the launch installed the fixed app. Why it mattered Ordinary input triggered it. Anyone writing a memo in a non-Latin script, adding an emoji or pressing Enter would (Zcash vs Monero 2026)
What this actually touches. When volatility spikes, the rate you locked is the one you compare later, not the one that drifted. Fixed-rate windows exist exactly for days like this — quote, send during the window, and let the chain settle around a number you already control.
Do this today. Open a quote for the pair you actually care about, lock it fixed, set your payout and refund addresses, and let the chain do the rest. No accounts, no emails, no KYC. (recovering misdirected funds)
Source: Zcash Forum: https://forum.zcashcommunity.com/t/retroactive-grant-application-ledger-zcash-app-vulnerability-disclosure-memo-crash-and-device-wipe-ghsa-376f-cc2v-g94c/59194 (Zcash vs Monero 2026)