Ledger Zcash App Vulnerability Disclosure: Memo Crash and Device Wipe (GHSA-376f-cc2v-g94c)

Terms and Conditions

• I agree to the Grant Agreement terms if funded
• I agree to Provide KYC information if funded above $50,000 USD
• I agree to disclose conflicts of interest
• I understand that this grant program is only eligible for completed work, as it is a retroactive grant program. Applications for planned or partially completed work will not be considered. All completed work will be verified and accepted by its intended users or their representatives, who will confirm that the outputs meet the required quality, functionality, and usability before the work is listed as an option for Coinholder voting.
• I agree that for any new open-source software, I will create a CONTRIBUTING.md file that reflects the high standards of Zcash development, using the librustzcash style guides as a primary reference.
• I understand when contributing to existing Zcash code, I am required to adhere to the project specific contribution guidelines, paying close attention to any merge, branch, pull request, and commit guidelines as exemplified in the librustzcash repository.
• I understand all grants are valued in USD but will be disbursed in Shielded ZEC. I acknowledge and accept that disbursement amounts may fluctuate based on the ZEC/USD exchange rate at the time of payment.

Application Owners (@octocat, @octocat1)

@piatoss3612

Organization or Individual Name

Rowan (GitHub: piatoss3612), applying as an individual

Additional Team Members

None

How did you learn about the Lockbox: Coinholder Retroactive Grants Program?

Zcash Community Forum (Q3 results post and the Q3 security-disclosure grants).

Requested Grant Amount (USD)

$37,500

Category

Research & Development

Project Summary

Bounty request for GHSA-376f-cc2v-g94c (published by Ledger as Critical): in Ledger's official Zcash app, a shielded memo with an emoji, a non-Latin character or a line break crashed the app and, on the hardware tested, reset the device to factory state. Reported privately and fixed by Ledger within 13 hours, before its shielded Zcash launch. No bounty was paid: the Zcash app is outside Ledger's bounty program.

Project Description

What was wrong. memo_display() in src/parser/pczt.rs hashed any memo that cannot be shown as plain text, using a Blake2b_256::default() context that was never initialized. In the Ledger Rust SDK that context is zeroed, so cx_hash_update() dereferences a null pointer and the app crashes. The code was introduced in commit 797461a and shipped in 3.9.3.

Why it matters. Any shielded (PCZT) transaction whose memo was not plain printable ASCII triggered it. Memo content, not length, was the trigger, so for anyone writing in a non-Latin script or using emoji or line breaks it was routine.

• A third party can trigger it. In ZIP-321 payment requests (zcash: URIs / QR codes), the payee chooses the memo.
• No chance to refuse. The crash happens during parsing, before any review screen.
• The device was wiped. On both hardware attempts documented in the advisory (Ledger Stax), the device rebooted into factory onboarding with no PIN entry. A user without a tested recovery-phrase backup would lose access to their funds. How an app fault leads to a factory reset lies in the device OS, so the wipe is reported as an observation. Ledger's regression test for that memo carries the comment "These five bytes are what wiped the reporter's device."

Timeline.

• Sep 18. While testing Ledger signing in the Speculos emulator, the app crashed on a memo containing a line break.
• Sep 19–20 (weekend). Looking deeper, the applicant found that Korean text, emoji and any other byte outside printable ASCII triggered it too. On a Ledger Stax they personally own, the device was wiped. It was set up again, and the second wipe was recorded on video.
• Sep 21, 03:48 UTC. With the root cause traced and a fix verified, the applicant reported it privately through the repository's GitHub security-advisory channel.
• Sep 21, 15:47–16:37 UTC. Ledger merged the fix, released 3.9.4 for all five device models and published the advisory.

Technical Approach (how you did it)

1. Reproduction. Built app-zcash 3.9.3 (22dc3853) with Ledger's official builder image and ran it in the Speculos emulator. Sent a PCZT with one transparent input and one Ironwood (Orchard) output whose memo the device decrypts and displays.

2. Memo matrix. One fresh emulator per case, identical PCZT, only the memo bytes changed:

   Memo	3.9.3	With fix
   Printable-ASCII baseline memo	signed	signed
   x × 512 (max-length ASCII)	signed	signed
   first\nsecond	SIGSEGV	signed
   안녕하세요	SIGSEGV	signed
   first\tsecond	SIGSEGV	signed
   gg 🎉	SIGSEGV	signed
   \xff abc (non-text tag)	SIGSEGV	signed

3. Bisect. Removing only the BLAKE2b calls makes the transaction sign, and so does adding init_with_perso(...). That isolates the cause to the uninitialized context.

4. Code audit. Every other BLAKE2b context in the app is initialized before use. pczt.rs:194 is the only exception.

5. Hardware. Two attempts on a Ledger Stax (OS 1.10.1, app 3.9.3 installed from Ledger Wallet, over Bluetooth, memo test\n). Both ended in factory onboarding, one of them on video. A Nano S Plus was wiped the same way in a separate attempt that was not recorded and is not in the advisory.

6. Fix. Proposed initializing the context with HashInit::new() and verified that the whole matrix then signs. Ledger's fix (c07c46e3) takes the same approach and also returns initialization errors instead of discarding them.

Time Period of Work Completion

September 18–21, 2026

Total Budget (USD)

$0 (no costs claimed; outcome-based award)

Budget Breakdown

No costs are claimed, so the budget total above is $0. The requested $37,500 is an outcome-based award for a completed, fixed and publicly credited vulnerability disclosure.

The reference is the payout table of the former ZCG Security & Vulnerability Disclosure Initiative, which earlier security applications here have also used (#54 was funded at its Critical rate of $150,000). A Ledger device app is outside that table's categories. The closest one is Supporting Infrastructure, which is capped at High with a base payout of $37,500, and the table lists "Non-distributed denial of service against an individual node or wallet" among its High examples. Ledger published the advisory at Critical. This request stays at High and does not ask for the table's optional bonus.

Previous Funding

No

Previous Funding Details

N/A

Other Funding Sources

No

Other Funding Sources Details

The Zcash app is not among the in-scope device apps of Ledger's public bug bounty program (donjon.ledger.com/bounty), and on Sep 24, 2026 Ledger told the applicant that no separate reward process applies. ZCG's bounty program did not cover Ledger apps and had already closed. No other party has paid for this finding.

Success Metrics

• Fixed and shipped. 3.9.4 reached all five device models about 13 hours after the report, two days before Ledger's public launch of native shielded Zcash support. The current release, 3.10.0, carries the fix forward.
• Regression tests added. Ledger added a snapshot test for all five models and eight on-device unit tests for memo_display(), most of them using the memos from the report.
• Publicly credited as reporter in GHSA-376f-cc2v-g94c.
• User impact prevented. A payee-triggerable path to wiping a user's device is closed, one that would have hit non-English speakers hardest.

Proof of completion

• Repository/Commit:
  • Fix commit c07c46e3 - "fix(pczt): initialize the memo hasher before use", merged as 1a0f6495 and released as v3.9.4
  • Ledger's regression test for the reported memo - its comment reads "These five bytes are what wiped the reporter's device."
• Publication:
  • GHSA-376f-cc2v-g94c - Published Sep 21, 2026. Critical. Affected ≤ 3.9.3, patched 3.9.4. Reporter: @piatoss3612. Contains the emulator matrix, the bisect, the fixed-build app hash and the hardware-incident video (Ledger Stax).
• Deployment/Release:
  • 3.9.4 tags for all five device models, all at 1a0f6495 (for example stax_1.10.1_3.9.4_sdk_v26.6.3)
• Other Evidence:
  • Available to reviewers on request: still frames of the Stax incident and the Ledger Wallet catalog record for 3.9.4

Conflict of Interest Disclosure

The applicant is a frontend engineer at Vizor, a Zcash wallet that supports Ledger signing. This application is made as an individual, with Vizor's knowledge and support, and the award would go to the applicant personally. Any application Vizor submits to this program for its wallet work is separate and does not cover this finding. The applicant has no affiliation with Ledger, FPF, ZF, ZCG or any keyholder organization.

Community Forum Posting

• I understand it is my responsibility to post a link to this issue on the Zcash Community Forums after this application has been submitted so the community can give input. I understand this is required in order for the community to discuss and vote on this grant application. Note: If you are unable to post on the forum (for example, due to new user restrictions), please leave a comment below, and we will adjust your posting permissions.