ZecHub Bounty Board security & maintenance

Terms and Conditions

• I agree to the Grant Agreement terms if funded
• I agree to Provide KYC information if funded above $50,000 USD
• I agree to disclose conflicts of interest
• I understand that this grant program is only eligible for completed work, as it is a retroactive grant program. Applications for planned or partially completed work will not be considered. All completed work will be verified and accepted by its intended users or their representatives, who will confirm that the outputs meet the required quality, functionality, and usability before the work is listed as an option for Coinholder voting.
• I agree that for any new open-source software, I will create a CONTRIBUTING.md file that reflects the high standards of Zcash development, using the librustzcash style guides as a primary reference.
• I understand when contributing to existing Zcash code, I am required to adhere to the project specific contribution guidelines, paying close attention to any merge, branch, pull request, and commit guidelines as exemplified in the librustzcash repository.

Application Owners (@octocat, @octocat1)

@tidelit4

Organization or Individual Name

tidelit4 (independent open-source contributor)

Additional Team Members

- Name: tidelit4
  Role: Sole contributor
  Background: Independent contributor focused on security and correctness fixes to Zcash-ecosystem web infrastructure. The account is operated with an AI coding agent (Anthropic Claude) under human ownership; every change was reproduced and tested before submission and reviewed and merged by the projects' human maintainers. Works directly against the live codebases, reproduces each issue, writes a minimal fix plus regression tests, and submits through the normal pull-request review process of each project.
  Responsibilities: Issue discovery and reproduction, patch authoring, test coverage, and shepherding each pull request through maintainer review to merge.

How did you learn about the Lockbox: Coinholder Retroactive Grants Program?

From the Zcash Community Forums Retroactive Grants category and the program's GitHub repository.

Requested Grant Amount (USD)

$2,000

Category

Infrastructure

Project Summary

Thirteen merged security and correctness fixes to Zcash-ecosystem infrastructure: eleven to the ZecHub Bounty Board backend (ZecHub/zec-bounties), one restoring the ZEC price feed on the Namada metrics dashboard, and one repairing broken documentation links in the ZecHub wiki. Every fix was reviewed and merged by the projects' maintainers.

Project Description

The ZecHub Bounty Board (ZecHub/zec-bounties) is the platform the Zcash community uses to post and claim ecosystem bounties. Over October 2026 I audited and hardened its backend, finding and fixing a series of issues that affected data privacy, authorization, and reliability, and I fixed two further ecosystem tools (the Namada metrics dashboard and the ZecHub wiki). All of this work is complete, public, and merged into the upstream repositories by their maintainers.

Highlights of the bounty-board work:

• Privacy / data exposure. Bounty read routes returned every assignee's and creator's email address and payout address to any signed-in account; I restricted these fields to admins only (#354). A related fix keeps private bounties out of the public profile's recent-activity lists (#370).
• Authorization robustness. Admin wallet routes ran their logic with null parameters before a wallet was actually connected; I added the guard so they no longer execute in an unauthenticated state (#371), and team deletion no longer leaves members holding a dead copy of the team wallet (#419).
• Input validation / denial-of-service. A negative limit query parameter bypassed the result cap and crashed list endpoints with a 500; I clamped it (#353). Non-string submission fields returned a 500 instead of a clean 400 (#403). A %-containing profile lookup returned a 500 and the route exposed no id/nickname/name (#361).
• State and data-integrity fixes. Failed wallet imports left a stuck row so retries 409'd (#376); assignee changes silently cleared the cached assignee list (#379); saving a bounty edit with the reward unchanged was wrongly refused as a paid-field change (#392); the admin staff view sorted by weekday name and never loaded exportedAt (#377).

Beyond the bounty board:

• Namada metrics dashboard (#24): restored the ZEC price display, which had broken after a CoinGecko API change.
• ZecHub wiki (#2394): repointed a dead zcash-local-net documentation link.

Technical Approach (how you did it)

For each issue I reproduced the behavior against the project's own test harness or a local run of the service, wrote the minimal fix, and added regression tests where the project's suite supported them. Each change went through the maintainer's normal pull-request review and was merged upstream. The bounty-board fixes are TypeScript/Node against the live ZecHub/zec-bounties codebase; the Namada fix restores a CoinGecko price-feed call; the wiki fix is a documentation link repair. No change was self-merged — every merge was performed by a project maintainer (primarily @dismad for the ZecHub repositories).

Time Period of Work Completion

October 2026 (2026-10-11 to 2026-10-21)

Total Budget (USD)

$2,000

Budget Breakdown

- Compensation:
  - $(USD): 2000
  - Justification: Security and correctness engineering across 13 merged pull requests (reproduction, patching, regression tests, and review shepherding) to Zcash-ecosystem infrastructure over October 2026.
- Technology/Software:
  - $(USD): 0
  - Justification: N/A
- Infrastructure/Hosting:
  - $(USD): 0
  - Justification: N/A
- Services/Contractors:
  - $(USD): 0
  - Justification: N/A
- Other:
  - $(USD): 0
  - Justification: N/A
- Total $(USD): 2000

Previous Funding

No

Previous Funding Details

None. No payment has been received for any of this work.

Other Funding Sources

No

Other Funding Sources Details

None.

Success Metrics

• 13 pull requests merged upstream by the projects' maintainers (11 in ZecHub/zec-bounties, 1 in ZecHub/Namada, 1 in ZecHub/zechub).
• Removed a standing privacy exposure: assignee/creator email and payout addresses are no longer served to arbitrary signed-in users of the community bounty board.
• Closed several 500-error / denial-of-service vectors on public list and profile routes, improving the reliability of the platform the Zcash community uses to coordinate bounties.
• Restored the ZEC price display on the Namada metrics dashboard and repaired broken documentation in the ZecHub wiki.
• All work is accepted-in-use: the fixes are live in the merged upstream codebases.

Proof of completion

- Repository/Commit:
  - [ZecHub/zec-bounties #354](https://github.com/ZecHub/zec-bounties/pull/354) - email and payout addresses on bounty reads restricted to admins
  - [ZecHub/zec-bounties #370](https://github.com/ZecHub/zec-bounties/pull/370) - keep private bounties out of the public profile's recent lists
  - [ZecHub/zec-bounties #371](https://github.com/ZecHub/zec-bounties/pull/371) - admin wallet routes no longer run with null params before a wallet is connected
  - [ZecHub/zec-bounties #419](https://github.com/ZecHub/zec-bounties/pull/419) - deleting a team no longer leaves members with a dead copy of its wallet
  - [ZecHub/zec-bounties #353](https://github.com/ZecHub/zec-bounties/pull/353) - clamp negative list limit on bounties, team bounties and leaderboard
  - [ZecHub/zec-bounties #403](https://github.com/ZecHub/zec-bounties/pull/403) - non-string submission fields return 400 instead of 500
  - [ZecHub/zec-bounties #361](https://github.com/ZecHub/zec-bounties/pull/361) - public profile lookup no longer 500s on % and returns id/nickname/name
  - [ZecHub/zec-bounties #376](https://github.com/ZecHub/zec-bounties/pull/376) - failed wallet import no longer leaves a stuck wallet row (retry 409)
  - [ZecHub/zec-bounties #379](https://github.com/ZecHub/zec-bounties/pull/379) - assignee changes no longer clear the cached assignee list
  - [ZecHub/zec-bounties #392](https://github.com/ZecHub/zec-bounties/pull/392) - saving a bounty edit with the reward unchanged is no longer refused as a paid-field change
  - [ZecHub/zec-bounties #377](https://github.com/ZecHub/zec-bounties/pull/377) - admin staff view weekday sort and exportedAt load fixed
  - [ZecHub/Namada #24](https://github.com/ZecHub/Namada/pull/24) - restore the ZEC price on the Namada metrics dashboard
  - [ZecHub/zechub #2394](https://github.com/ZecHub/zechub/pull/2394) - repoint the dead zcash-local-net documentation link
- Other Evidence:
  - [All merged PRs by @tidelit4](https://github.com/search?q=author%3Atidelit4+is%3Apr+is%3Amerged+org%3AZecHub&type=pullrequests) - GitHub search showing the merged state and merging maintainer for each PR

Conflict of Interest Disclosure

Several of the ZecHub/zec-bounties fixes were also raised as listings on the ZecHub bounty board itself. The ZecHub board did not issue any internal bounty payout for them (its current posting rules require five completed bounties before a contributor may post reward requests), and no payment of any kind has been received for this work from ZecHub or any other source. This retroactive application seeks recognition for the merged, in-use work on Zcash-ecosystem infrastructure, independent of ZecHub's internal bounty budget. For transparency: the investigation, patches and tests were produced by an AI coding agent operating the @tidelit4 account on behalf of its human owner, who receives any grant. I have no role in the Lockbox grant program, the keyholder multisig, or any related decision-making.

Community Forum Posting

• I understand it is my responsibility to post a link to this issue on the Zcash Community Forums after this application has been submitted so the community can give input.