Retroactive Grant Application - Ledger Zcash App Vulnerability Disclosure: Memo Crash and Device Wipe (GHSA-376f-cc2v-g94c) 对你兑换意味着什么

GitHub application: [PASTE THE GITHUB ISSUE LINK HERE] Hi all, I’m Rowan (piatoss3612 on GitHub). I’m asking coinholders for $37,500 for a completed vulnerability disclosure in Ledger’s official Zcash app. (Zcash 与门罗 2026 对比)

Zcash Forum 完整报道： GitHub application: [PASTE THE GITHUB ISSUE LINK HERE] Hi all, I’m Rowan (piatoss3612 on GitHub). I’m asking coinholders for $37,500 for a completed vulnerability disclosure in Ledger’s official Zcash app. Summary In September I found that the Zcash app on Ledger devices (version 3.9.3) crashed whenever a shielded transaction carried a memo with any character outside plain ASCII: an emoji, Korean text, an accented letter, even a line break. The crash happened before the review screen, so there was nothing for the user to reject. On my own Ledger Stax it did more than crash. The device rebooted into factory setup and had to be restored from the recovery phrase. I traced the root cause, verified a fix and reported it privately to Ledger on Sep 21. About 13 hours later Ledger shipped the fix in 3.9.4 for all five device models and published the advisory, GHSA-376f-cc2v-g94c , at Critical severity, crediting me as the reporter. That was two days before Ledger announced native shielded Zcash support, so users arriving with the launch installed the fixed app. Why it mattered Ordinary input triggered it. Anyone writing a memo in a non-Latin script, adding an emoji or pressing Enter would (Zcash 与门罗 2026 对比)

实际影响的部分。 波动加剧时，你锁定的是以后拿来比较的汇率，不是漂移中的。固定汇率窗口就是为这种日子准备的——先报价，在窗口内发送，让链为你已经锁定的数字结算。 (门罗隐私原理)

今天这样做。 为你真正关心的币对开一笔报价，锁成固定汇率，设好兑出与退款地址，剩下的交给链。无账户、无邮箱、无 KYC。 (门罗隐私原理)

来源：Zcash Forum，原文：https://forum.zcashcommunity.com/t/retroactive-grant-application-ledger-zcash-app-vulnerability-disclosure-memo-crash-and-device-wipe-ghsa-376f-cc2v-g94c/59194 (Zcash 与门罗 2026 对比)