Retroactive Grant Application - Ledger Zcash App Vulnerability Disclosure: Memo Crash and Device Wipe (GHSA-376f-cc2v-g94c) があなたのスワップに何を意味するか

GitHub application: [PASTE THE GITHUB ISSUE LINK HERE] Hi all, I’m Rowan (piatoss3612 on GitHub). I’m asking coinholders for $37,500 for a completed vulnerability disclosure in Ledger’s official Zcash app. (ZcashとMonero 2026比較)

Zcash Forum 完全報道： GitHub application: [PASTE THE GITHUB ISSUE LINK HERE] Hi all, I’m Rowan (piatoss3612 on GitHub). I’m asking coinholders for $37,500 for a completed vulnerability disclosure in Ledger’s official Zcash app. Summary In September I found that the Zcash app on Ledger devices (version 3.9.3) crashed whenever a shielded transaction carried a memo with any character outside plain ASCII: an emoji, Korean text, an accented letter, even a line break. The crash happened before the review screen, so there was nothing for the user to reject. On my own Ledger Stax it did more than crash. The device rebooted into factory setup and had to be restored from the recovery phrase. I traced the root cause, verified a fix and reported it privately to Ledger on Sep 21. About 13 hours later Ledger shipped the fix in 3.9.4 for all five device models and published the advisory, GHSA-376f-cc2v-g94c , at Critical severity, crediting me as the reporter. That was two days before Ledger announced native shielded Zcash support, so users arriving with the launch installed the fixed app. Why it mattered Ordinary input triggered it. Anyone writing a memo in a non-Latin script, adding an emoji or pressing Enter would (ZcashとMonero 2026比較)

実際に触れる部分。 ボラティリティが急騰する局面で、確定したレートは後で比較する対象であり、ドリフトする対象ではありません。固定レートの窓はまさにこのようなgoogle日のために存在します——見積もりを取り、窓内で送金し、既に自分が支配する数字でチェーンに決済させましょう。

本日やること。 本当に気になるペアの見積もりを開き、固定レートにロックし、支払い・返金アドレスを設定し、残りはチェーンに任せる。アカウントもメールも KYC も不要です。

出典：Zcash Forum、原文：https://forum.zcashcommunity.com/t/retroactive-grant-application-ledger-zcash-app-vulnerability-disclosure-memo-crash-and-device-wipe-ghsa-376f-cc2v-g94c/59194 (ZcashとMonero 2026比較)