Zcash Ecosystem Security Lead:
This ecosystem role began as a ZCG grant application by earthrise to work as a security engineer serving the wider Zcash ecosystem outside of ECC and ZF, with a focus on ZCG grantees.
You can learn more about Earthrise's work as the Zcash Ecosystem Security Lead here .
After this grant was completed, ZCG put out an RFP to find a replacement. & at the end of March 2024 ZCG selected Least Authority to step into the role through another grant. You can learn more about Least Authority's work as the Zcash Ecosystem Security Lead here .
Responsible Disclosure:
The Electric Coin Company & Zcash Foundation both conform to this Responsible Disclosure standard with the following Deviation:
"Zcash is a technology that provides strong privacy. Notes are encrypted to their destination, and then the monetary base is kept via zero-knowledge proofs intended to only be creatable by the real holder of Zcash. If this fails, and a counterfeiting bug results, that counterfeiting bug might be exploited without any way for blockchain analyzers to identify the perpetrator or which data in the blockchain has been used to exploit the bug. Rollbacks before that point, such as have been executed in some other projects in such cases, are therefore impossible.
The standard describes reporters of vulnerabilities including full details of an issue, in order to reproduce it. This is necessary for instance in the case of an external researcher both demonstrating and proving that there really is a security issue, and that security issue really has the impact that they say it has - allowing the development team to accurately prioritize and resolve the issue.
In the case of a counterfeiting bug, however, just like in CVE-2019-7167, we might decide not to include those details with our reports to partners ahead of coordinated release, so long as we are sure that they are vulnerable."