Zcash closed its formal bug bounty program because of low-quality AI-assisted reports three days before an AI-assisted audit uncovered a flaw that could have created unlimited, undetectable ZEC, The Coinformer noticed.
Security researcher Taylor Hornby is now asking Zcash coinholders for $750,000 as a retroactive reward for finding and responsibly reporting the bug.
- The problem is that the Zcash Community Grants Committee closed its bounty program on May 26 after it attracted growing numbers of duplicate, speculative and low-quality reports.
- The committee said AI had made such submissions easier to produce and forced developers to spend scarce time reviewing them.
- Hornby found the Orchard counterfeiting vulnerability on May 29.
Hornby used Anthropic's Opus 4.8 model inside an auditing system he had built to examine specific security claims against the relevant code. After the system flagged the problem, he used Claude to build a working test that created millions of fake ZEC on a local test network.
"Having the ability to create infinite ZEC right in front of me was honestly the craziest emotional experience of my life," Hornby wrote in his grant application.
- He reported the flaw to Zcash Open Development Lab.
- Developers then temporarily disabled Orchard transactions and completed the fix by June 2.
Billions at stake
The bug had been present since Orchard launched in May 2022. It could have allowed an attacker to create counterfeit ZEC inside the private pool without detection, according to Shielded Labs.
But Orchard's privacy prevents them from proving through blockchain data alone that no counterfeit ZEC was created before the fix.
Hornby said Orchard held about 4.2 million ZEC (then worth roughly $2.3 billion) when he found the flaw.
- His $750,000 request equals about 0.033% of that amount.
The proposed payment hasn't been approved and will require community discussion and a coinholder vote. If approved, it would be paid in shielded ZEC.
Hornby was already paid his normal consulting rate by Shielded Labs, which hired him in April to search for Zcash vulnerabilities. He said the additional reward isn't meant to reimburse his costs but to establish an incentive for researchers who discover similarly dangerous bugs while no formal bounty program exists.