Zcash Shielded News is a community article format based on the weekly Zcash Ecosystem Digest Newsletter.
Providing insight on current events and informing the community about important news in the Zcash ecosystem.
Check out the best Highlights below!
📅 Subscribe to the Zcash Event Calendar!
Fact of the Week 💡
zechub.wiki is one of the easiest places to learn about Zcash in a structured way. It works as a source of information for users who want to understand the ecosystem, from wallets and shielded transactions to grants, community projects, privacy tools, and technical resources.
For newcomers, it helps reduce confusion; for regular users, it serves as a quick reference point to stay informed and explore Zcash more confidently.
📩 In today’s edition: 🦓 Zcash Foundation Welcomes a New Platform Engineer• The Zcash Foundation welcomed a new Platform Engineer, strengthening its engineering capacity and ongoing work across Zcash infrastructure. 🛠️ Zebra 4.4.0 Fixes Critical Security Bugs• Zebra 4.4.0 was released with important security and reliability fixes, including consensus-critical issues, stronger network limits, RPC improvements, and safer node operation. 🛡️ ZCG Sets Aside $1M for Zcash Security Bounties• ZCG announced a $1M pool for responsibly disclosed Zcash vulnerabilities, aiming to support external security research as AI-assisted vulnerability discovery continues to accelerate. 👨💻 Shielded Labs Welcomes Giovanni Carlino as Engineer• Shielded Labs welcomed Giovanni Carlino as an engineer, expanding its capacity across core Zcash projects, protocol development, and Partner Services. 📩 ZODL Support• ZODL added a support section for wallet users, directing questions, error reports, and feedback to official channels while reminding users to stay alert for recovery phrase scams. 🗳️ Zcash Community Grants Meeting Minutes — April 27, 2026• ZCG reviewed the latest grant proposals, approving three initiatives, declining several others, and keeping multiple proposals under review, with all votes this week unanimous.
Zcash Foundation Welcomes a New Platform Engineer
On April 27, the Zcash Foundation announced that Andrés Rodríguez has joined ZF as a Platform Engineer, focusing on DevOps and SRE.
Andrés joins at an important moment for ZF’s infrastructure and platform operations. As the organization continues to scale its engineering efforts, having reliable, automated, and resilient systems becomes increasingly important.
With more than 8 years of experience across cloud infrastructure, ERP systems, and platform automation, Andrés brings a practical approach to modernizing technology environments and solving operational challenges.
His background includes building platforms for high-traffic APIs, adopting DevOps practices, and contributing to large-scale digital transformation initiatives.
At ZF, he will help strengthen infrastructure operations, reduce complexity, and support engineering teams with more scalable and reliable platforms.
With Andrés on the team, the Zcash Foundation continues to invest in a stronger engineering foundation for the future.
Welcome, Andrés!
Zebra 4.4.0 + 4.4.1 Fixes Critical Security Bugs
ZF is releasing Zebra 4.4.1 today. This version includes a fix for a consensus-critical security vulnerability, and we strongly recommend that all node operators upgrade immediately. Anyone who has not updated over the last few releases can update directly to 4.4.1.
It is worth noting that Zebra 4.4.0 was released just a few days ago. Anyone who has already upgraded to that version will unfortunately need to upgrade again.
The main focus of Zebra 4.4.1 is fixing an issue in V5 transparent transactions involving SIGHASH_SINGLE. Zebra was not correctly enforcing a ZIP-244 consensus rule: when an input is signed with SIGHASH_SINGLE and there is no corresponding transparent output at the same index, validation must fail. Instead, Zebra accepted a case that zcashd rejected, which could cause a consensus divergence between Zebra and zcashd nodes.
This fix is related to a previous vulnerability in the same area of the code, but covers a specific case that had not yet been addressed.
In addition, the previous 4.4.0 release had already introduced an important set of security and reliability improvements for node operators, including fixes to transparent transaction validation, sigops counting, and SIGHASH handling. These are the kinds of bugs that can cause Zebra and zcashd to disagree, so this upgrade remains especially important.
Zebra 4.4.0 also fixed a block discovery issue that could be exploited to stop a node from finding new blocks, and added tighter limits when handling inbound network messages, reducing memory and parsing costs caused by malicious or oversized inputs.
It also included practical RPC and infrastructure improvements:
getrawtransactionnow returns more reliable results, including correct confirmation counts.RPC request bodies are limited earlier, before unnecessary parsing and allocation.
RPC auth cookies now use safer file permissions on Unix systems.
Indexer gRPC streams now handle slow subscribers better.
getblocknow includes thenTxfield, improving compatibility with downstream tools.A new Criterion benchmark suite was added to help detect performance regressions over time.
The release also updates the librustzcash dependency stack and includes cleanup in zebra-consensus.
Because some of these fixes are consensus-critical and there are no known workarounds, all Zebra node operators should upgrade to Zebra 4.4.1 as soon as possible to ensure their nodes remain on the correct chain.
ZCG sets aside $1M for Zcash security bounties
ZCG announced a $1,000,000 pool for payouts tied to responsibly disclosed vulnerabilities in core Zcash repositories.
The announcement follows the recent Sprout pool verification vulnerability and additional issues disclosed across zcashd and Zebra. ZCG said the coordinated response from researchers, core teams, mining pools, and infrastructure operators helped protect user funds.
The program is meant to support more external security research as AI-assisted analysis increases the volume of vulnerability reports across open source software.
The bounty scope covers:
Core Node:
zcashd,Zebra, andlibrustzcashSupporting Infrastructure:
Zallet,Zaino, &lightwalletdDeveloper Tooling:
zcash-devtoolandz3
Severity will be evaluated around Zcash’s core tenets: issuance and supply, privacy, store of value, and finalization. Core Node is the only category eligible for Critical payouts, while Supporting Infrastructure and Developer Tooling are capped at High.
ZCG also matched Alex “Scalar” Sol’s previous awards, bringing his total compensation for recent disclosures to 600 ZEC.
Researchers should not send reports or payout requests directly to ZCG. Disclosures should go through the affected project’s SECURITY.md, and remediation teams will coordinate payout requests after review and remediation.
FPF will administer the initiative, payouts will be made in shielded ZEC, and KYC is required for payouts above $50,000.
Shielded Labs Welcomes Giovanni Carlino as Engineer
Few days ago, Shielded Labs announced that Giovanni Carlino has joined the team as an engineer. Based in Italy, Giovanni will work across core projects and support the organization’s Partner Services initiative.
Giovanni brings experience in systems engineering, security, software quality, and performance. Before joining Shielded Labs, he worked on Icarus, an advanced C/C++ IDE built in C99 using the Win32 API.
Building a full development environment gave him a practical understanding of reliable developer tooling and high-performance software, experience that now carries into Zcash infrastructure work.
At Shielded Labs, the focus will be on strengthening privacy-preserving infrastructure and supporting protocol development across the ecosystem. Giovanni described Zcash as a leader in financial privacy and said joining the team is an opportunity to help ensure the infrastructure behind it is as robust and efficient as the cryptography it supports.
The addition expands Shielded Labs’ capacity for both protocol development and ecosystem support. The team now has 11 members, including 9 full-time contributors and 2 part-time contributors focused on operations and security.
ZODL Support
ZODL recently added a support knoweldgebase for users who need help while using the wallet.
Users can contact the team directly at support@zodl.com for questions, error reports, or general feedback.
Support is also available through the ZODL Discord server (Zcash), where users can get help from both the team and the community. For technical issues, users can also open a bug report on GitHub with clear steps to reproduce the problem.
ZODL also reminds everyone to stay alert for scams. The team will never ask for your recovery phrase, and it should never be shared with anyone. If someone requests your seed phrase or points you to a support channel other than the official email, treat it as a scam.
ZODL will also never DM users first on Discord, Telegram, X, or any other platform.
If there is ever any doubt about whether a message is really from the ZODL team, users should contact support@zodl.com immediately.
Zcash Community Grants Meeting Minutes April 27, 2026 - @ZCG
Approved 🟢
Zcash CIS Media & Community Growth Program 2026 | $9,000
- One-month pilot for Russian-language educational Zcash content across media and community channels.
Zcash Network School | $13,600
- Educational program near Singapore with Zcash workshops, wallet onboarding, and merchant adoption.
Zcash Marketing at Istanbul Blockchain Week | $15,900
- Booth, interviews, wallet onboarding, and Turkish/English outreach at Istanbul Blockchain Week.
Declined 🔴
Zecret Ballots_2 | $132,391
- Private ZEC holder voting system; declined due to overlap with voting tools already being built.
BTCPayServer Per-Store Zcash Configuration | $24,500
- Multi-store BTCPay configuration work; declined over technical direction and overlap concerns.
ChainSafe WebZjs Maintenance Renewal | $168,000
- Maintenance renewal for WebZjs and MetaMask Snap; declined in favor of more targeted funding.
Castle Labs Research | $17,040
- Long-form Zcash research content; declined because similar research is already appearing organically.
ZPrivDEX | $203,000
- Fully shielded Zcash DEX proposal; declined due to timing, complexity, and technical readiness concerns.
Zcash CIS Educational Initiative | $36,050
- Russian-language education campaign; declined as too close to paid promotion.
ZEC Builders Hub | UNIABUJA | $32,500
- University developer training hub in Nigeria; declined pending a stronger track record or smaller pilot.
Formal Verification of CompactSize Encoding | $80,000
- Lean 4 verification of CompactSize encoding in Zebra; declined as too narrow for the budget.
Zonp | $90,000 requested
- Wallet-native commerce using shielded memos; declined because ZCG did not see enough on-chain value.
Voterax | $35,000 requested
- ZK-based governance and contributor coordination system; declined as out of scope.
Under Review 🟡
Formal Verification of Halo 2 in Lean 4 | $201,600
- 18-month formal verification project for Orchard and Halo 2 circuits; awaiting more feedback.
Feature Branch Testnet and Developer Tooling | $412,410
- Dedicated testnet for NU7-deferred features like ZSA and NSM; pending additional information.
BTCPayServer Multi-Account and 0conf Support | $42,000
- Adds 0conf mempool notifications and multi-account support to the Zcash BTCPay plugin.
Zush - Quiet Money for Zcash | $100,000
- Zcash-linked debit card product with no-KYC and light-KYC tiers; still being evaluated.
Grassroots Marketing Team at DWeb Camp | $10,200
- Grassroots team for Zodl demos, CipherPay education, and developer outreach at DWeb Camp.
Revocable Private Delegation in Voting | $140,900
- Private voting delegation prototype for Zcash token holders.
Teenagers in Blockchain Africa | $12,600
- Nigeria-based Zcash education program with meetups, workshops, and social content.
Zcash University Outreach - Mexico | $47,500 requested
- University outreach across five Mexican institutions focused on Zcash privacy and developer tooling.