Zcash Completes Over $8 Million in Retroactive Grants
Zcash founder Zooko Wilcox announced that the protocol has just completed a round of retroactive grants exceeding $8 million, with millions allocated to contributors who voluntarily participated in user protection during this year's AI vulnerability crisis. He characterized this as a successful demonstration of self-financing and self-governance, stating that the mechanism will be repeated multiple times each year after improvements.
This round corresponds to the Q3 voting of the Coinholder-Directed Retroactive Grants Program, which closed on September 29 at 20:00 UTC. Coin holders voted anonymously on-chain, weighted by their holdings, to decide whether completed work would be compensated, without prepaying milestones. A total of 37 proposals were submitted, requesting approximately $9.01 million, with the approved list covering wallet integrations, cross-chain exchanges, block explorers, node infrastructure, and several security and formal verification expenditures related to Zebra, zcashd, and Ironwood.
The security side saw concentrated funding. The Orchard vulnerability discovered and disclosed by Taylor Hornby received $1.5 million in retroactive recognition, with $750,000 as a bounty and $750,000 as community contributions; this vulnerability had put approximately $2.3 billion worth of ZEC at risk. Other items included a bounty for a critical Zebra vulnerability, net amounts of $425,000 for five consensus fork vulnerabilities, $400,000 for detectable temporary infinite minting and selling exploits, $599,000 for external audits of Ironwood, and over $1.2 million for formal verification bonuses and ValarGroup emergency development. Zooko also noted that this round involved collaboration with Valar, ZODL, Vizor, and voting organized by the Financial Privacy Foundation, mobilizing approximately $3 billion worth of ZEC for participation weighting narratives.
The funds come from the development fund's locked box, not from temporary fundraising. The C&C model after NU6.1 directs 12% of block rewards to coinholder retroactive grants and 8% continues to the Zcash Community Grants, lasting until the third halving in 2028; the minimum voting threshold is 420,000 ZEC. Approximately 2.18 million ZEC were actually voted in Q3. Zooko emphasized that Shielded Labs and he himself do not decide who receives the funds, which are disbursed from a multi-signature wallet at market price for completed results.
The Q4 timeline has been announced: proposals will be collected from October 30 to November 13, with reviews from November 16 to December 16. The community is also discussing AI-era vulnerability bounties: ZCG once opened a $1 million disclosure program but scaled back due to AI-generated reports overwhelming core engineers, forcing high-value discoveries to go through the coinholder retroactive channel.
In market mechanics, sellers are newly issued ZEC in the locked box, while buyers are individuals or teams who have completed audits, formal verifications, node operations, and emergency patches. The flow is block rewards → locked box → anonymous coinholder voting → post-event redemption, representing a governance event rather than a spot transaction drive. Beneficiaries are security researchers and protocol engineering teams that can deliver verifiable patches during crisis windows; those under pressure are external entities that view the development fund as a captureable treasury, as well as ordinary applicants who do not meet the voting threshold. Price-wise, the ZEC from the locked box is a one-time release, while for privacy coins, it shifts the decision of "who can pay to fix vulnerabilities" from foundation discretion to coinholder discretion.
Supplementary data: Voting snapshot height 3485940; acceptance rate for Ironwood formal verification bonus approximately 99.6%, and for ValarGroup emergency development approximately 99.8%. Zooko previously estimated the available scale of the locked box at about $63 million worth of ZEC. On the same day, the U.S. ZEC spot ETF saw a net outflow of about $30.25 million, which is not from the same channel as this round of grants.
Source: Public Information
ABAB AI Insight
Zooko has long framed the survival issues of Zcash through the lens of cryptography and governance, from Least Authority and Electric Coin Company to Shielded Labs. After the split between ECC and the Zcash Foundation, the development fund has repeatedly been accused of being captured by the foundation; ZIP 1016 directly allocates 12% of issuance rights to coinholder retroactive voting, which is a reverse design of that path. The Orchard vulnerability was discovered with AI-assisted auditing after the bounty window closed, and the $1.5 million was supplemented through retroactive voting, acknowledging that permanent bounties cannot keep pace with model capabilities.
Capital mobilization is not about VC investment; it involves pre-locking future block rewards in multi-signature wallets and then redeeming them based on delivered results. Josh Swihart proposed the C&C model, Jason McGee wrote it into the NU6.1 process, the Financial Privacy Foundation conducted the voting, and Valar covered engineering in the Ironwood emergency. The motivation is that once the privacy pool is breached by minting or consensus forks, the coin price and shielded set collapse in sync, making post-event payments cheaper than maintaining a committee that can be lobbied in advance.
This is analogous to Gitcoin's quadratic funding, the Ethereum Foundation's retroactive public goods funding, and Bitcoin Core's reliance on sponsorship rather than protocol taxes. Zcash is transitioning from foundation grants to coinholder treasury control, rather than expanding into new categories. Monero relies on community donations to fix vulnerabilities, while Zcash incorporates fixing vulnerabilities into the 12% issuance.
The structural judgment indicates a concentration of capital combined with technological substitution. AI lowers the cost of finding vulnerabilities but also overwhelms manual triage, forcing the protocol to shift its security budget from fixed bounty tables to post-event pricing by coinholders. The mechanism is: whoever can anonymously gather enough ZEC decides which patches are worth millions; the development fund is no longer a cash flow that can be intercepted by a single non-profit organization but is instead a quarterly voted insurance pool.
ABAB News · Cognitive Laws
Deliver first, then the treasury acknowledges
The bounty window closes, but risks do not
Issuance tax does not provide promises, only completed patches