ZCG Grants Prototype
Back to applications

Grant application

Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

Evaluation snapshot

Request at a glance

Applicant
Crackdevs
Requested
$18,000
Status
Declined
Review context
Forum discussion linked2 committee records linked

FPF source evidence

Milestone and disbursement ledger

Read-only milestone and disbursement fields normalized from the FPF grants ledger.

These ledger rows are FPF source evidence. They do not by themselves prove that a progress update was accepted, a payment request was approved, or an on-chain settlement was completed. Named rows can also describe reimbursements, returned funds, or other ledger adjustments.

No normalized FPF milestone or disbursement rows are linked to this application yet. The application and its other source evidence remain available below.
AI-grounded decision supportCommittee briefingReview an evidence-grounded briefing or ask a custom question about this application. AI output supports committee review; it does not recommend or make a funding decision.Not generated

No committee briefing yet

Generate a standard briefing from this application, linked evidence, team history, relationships, and comparable grants. The completed shared report will be available to other authorized users.

Your account can read shared briefings but cannot generate them.

Application-scoped research

Ask about this application

Ask a focused question. Answers use the grant knowledge index and retain numbered links to the evidence supplied to the model.

Your account can read shared analyses but cannot generate a custom answer.

Workflow signals
📋 Grant Application👀 Ready For ZCG Review❌ Grant Declined
Latest committee record
Remains Open2/16/2026

This project strengthens the security and operational reliability of Zebra ↔ lightwalletd deployments by adding native RPC cookie-file authentication support to zcash/lightwalletd, eliminating the current need for operators to disable cook…

Data quality and provenanceSource matching, linked-record coverage, and reconciliation diagnostics

Source coverage

Operational context for tracing how this canonical record was assembled.
Source stateGitHub + Sheet
GitHub-Sheet match100%
Primary forum1
Supporting forum1
GitHub labels3
Decision notes2

GitHub workflow labels

3 labels captured as structured grant attributes
📋 Grant Application
Category
Intake
Status
Grant Application
Milestone
-
Observed
3/2/2026
Open GitHub issue
👀 Ready For ZCG Review
Category
Review
Status
Ready For Zcg Review
Milestone
-
Observed
3/2/2026
Open GitHub issue
❌ Grant Declined
Category
Decision
Status
Declined
Milestone
-
Observed
3/2/2026
Open GitHub issue

Decision history

2 meeting notes linked
Remains Open2/16/2026

Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

Too early to vote

This project strengthens the security and operational reliability of Zebra ↔ lightwalletd deployments by adding native RPC cookie-file authentication support to zcash/lightwalletd, eliminating the current need for operators to disable cookie authentication or rely on long-lived static RPC credentials. The work introduces a new configuration option to read Zebra’s RPC cookie file and use it for HTTP Basic authentication, along with deterministic cookie refresh behavior on authentication failures and clear error handling for misconfiguration. To ensure durability and ease of adoption, the project includes a regression-proof CI integration test that validates a fully authenticated Zebra + lightwalletd setup, as well as updated documentation and reference deployments (Docker Compose and Kubernetes) that make secure configurations the default. Designed as a tightly scoped, upstreamable improvement with no protocol or infrastructure changes, the implementation closes a documented security gap, reduces credential risk, and enables operators to run authenticated local RPC setups using the safer, standard cookie-based mechanism already used across Zcash node infrastructure. Applicant is requesting $18,000.

Confidence
100%
Match method
Direct Source Url
Minutes
Zcash Community Grants Meeting Minutes 2/16/26
Declined1/3/2026

Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

Declined

This project strengthens the security and operational reliability of Zebra ↔ lightwalletd deployments by adding native RPC cookie-file authentication support to zcash/lightwalletd, eliminating the current need for operators to disable cookie authentication or rely on long-lived static RPC credentials. The work introduces a new configuration option to read Zebra’s RPC cookie file and use it for HTTP Basic authentication, along with deterministic cookie refresh behavior on authentication failures and clear error handling for misconfiguration. To ensure durability and ease of adoption, the project includes a regression-proof CI integration test that validates a fully authenticated Zebra + lightwalletd setup, as well as updated documentation and reference deployments (Docker Compose and Kubernetes) that make secure configurations the default. Designed as a tightly scoped, upstreamable improvement with no protocol or infrastructure changes, the implementation closes a documented security gap, reduces credential risk, and enables operators to run authenticated local RPC setups using the safer, standard cookie-based mechanism already used across Zcash node infrastructure. Applicant is requesting $18,000. Gguy: I’ve reviewed the implementation details, I think that this might be something that lightwalletd and Zebra team might need to do themselves. I’m not sure it’s the right time to do this without clear cooperation with that team. Artkor: My current position is that it’s difficult for me to envision realistic scenarios in which Zebra and lightwalletd will be deployed separately in a way that requires a dedicated authentication scheme between them. In any case, I will prefer that change of this nature be implemented by the core backend developers of Zcash rather than external teams without a proven track record. So I reject. Hanh: I will reject as well because I think this work, if it’s done by someone else, would need significant review by the authors of Zebra and Zallet and at the end of the day they will essentially do the work themselves. There is not much to outsource here. Zerodartz: Agree with others. Reject. Decentralistdan: agreed. reject due to reliance on core teams. Declined (unanimous) Laminar - The Tactical Spike: Batch Payment Infrastructure Laminar, by Darklight Labs, is a local-first, air-gapped desktop tool that converts payroll spreadsheets into scannable QR codes for secure, batch shielded Zcash payments, ensuring private keys never touch an internet-connected device. It addresses the operational bottleneck of manual address entry by reducing large payroll disbursements from hours to minutes while maintaining full offline operation, standards-compliant payment requests, and zero hosted dependencies. Positioned as a “calculator, not conduit,” the project strengthens security, regulatory clarity, and institutional usability of shielded Zcash, with a roadmap toward audited, institutional-grade treasury infrastructure and an open SDK for broader ecosystem integration. Applicant is requesting $50,000. GGuy: I personally don’t see this as a priority right now. This kind of fits in between solutions that already exist and I don’t currently see the benefits right now. Artkor: I generally like this proposal. However, after the committee discussions, I have concluded there does not appear to be significant demand for it at this time. Recently, the community has been placing strong emphasis on demonstrated product demand. There are already custodial payroll and payout services available for Zcash. I have not seen clear evidence that this functionality is currently in high demand. So the proposal feels expensive relative to its immediate necessity. I hope the community will need to revisit this idea in the future. But at this time, I vote to reject it. Zerodartz: It’s also my understanding that there is not much demand for it yet and maybe if it is needed in future it should be built into the wallets instead of having a special tool for it. Reject for now. Hanh: For me, what they request in Milestone 1 is not infrastructure for batch payment but a converter between a list of payees as a CSV and converting that into payment URI. As it is this doesn’t represent the batch payment infrastructure, which would be valuable. But that’s not what it is here. I reject. Decentralistdan: reject. Milestones not aligned with described infra work, and lack of clear demand for a standalone tool/product like this. Declined (unanimous) Incremental Contributions to the Zcash Ecosystem Eryx, a worker-owned cooperative with nearly 15 years of experience in mathematics, software development, and cryptography, is seeking a grant to make their first contributions to the Zcash ecosystem by resolving three well-scoped issues in the librustzcash repository: adding a WalletRead::find_account_for_address method ( #1944 ), fixing a bug where wallet summaries omit coins due to identical change outputs ( #1964 ), and updating zip321::Payment::new to return a Result instead of an Option ( #1794 ). These issues were selected in consultation with maintainers and span key crates including zcash_client_backend, zcash_client_sqlite, and zip321. The work will be delivered as GitHub PRs with automated tests, and is intended as a foundation for deeper, ongoing contributions to the ecosystem. Applicant is requesting $18,000. Gguy: I’m waiting to hear more feedback on the ability for this individual to contribute and we hope to have more information soon about the feasibility of this. Artkor: It would help if core backend developers flagged tasks for outsourcing so the committee could better understand priorities. Hanh: This doesn’t represent a classic way to contribute to our project, an open source project. First, you learn about the project, you communicate with the moderators, with the developers, and you find bugs that you can contribute, low-hanging fruits that you can fix and get a reputation with the project. This seems to be more like trying to pick an easy task and get a grant for that. There’s no sign of added value for these particular bugs and it feels awkward. I will reject, but it doesn’t mean that the guy who submitted this proposal can’t later submit something better after he gains some reputation. Zerodartz: They might actually be good developers but the proposal itself is a bit much for the proposed fixes. Decentralistdan: team seems qualified to contribute but would like to see them contribute and get involved in the open source development of Zcash independently as opposed to relying on a grant as a first step. Remains open Incrypted Media Support in the CIS Region Incrypted is proposing a localized educational media campaign to raise Zcash awareness among CIS and Eastern European Web3 audiences. The project addresses the lack of accessible, native-language (Ukrainian and Russian) content about Zcash by producing original videos, articles, and Telegram digests across Incrypted’s existing platforms. The goal is to simplify Zcash’s privacy technology for general crypto users in the region and drive broader adoption. Applicant is requesting $45,000. Decentralistdan: This definitely feels like a send to ZecHub request. In my mind this is a rejection at this price but we can discuss further. Gguy: I agree. We’ll get in contact with the team on next steps. Zerodartz: Would want to have more community feedback on it also. Remains open Project Sentinel: Automated Dust Quarantine for Zodl Project Sentinel proposes a “privacy firewall” for Zcash that automatically detects and quarantines malicious transparent dust to prevent deanonymization attacks. The solution consists of a real-time Risk Scoring API built on the CipherScan API and a Rust-based middleware module that wallets such as Zodl can integrate to identify, flag, and lock suspicious low-value t-address transactions before they can be inadvertently spent alongside shielded funds. Applicant is requesting $9,990. Artkor: I vote to reject because I don’t consider the issue described in this proposal to be relevant. Gguy: I agree. This grant doesn’t resonate with me as a current need for Zcash. Zerodartz: Same, reject. Hanh: This is for transparent dust, it’s not very meaningful. Anyway, if it’s really dust, the price of spending it exceeds the fee as dictated by the zip 317. Wallets typically skip over dust inputs under that amount. I think it’s a non-issue actually. Decentralistdan: reject. Out of scope for current funding. Declined Veridex: Passkey Shielded Wallets and AI Agent Payments Veridex is proposing to integrate Zcash into two of its existing open-source SDKs: a passkey wallet SDK that enables seedless, biometric-authenticated shielded Zcash wallets using WebAuthn/device secure enclaves, and an agentic payments SDK that allows AI agents to autonomously execute shielded ZEC transactions within strict human-defined spending limits. Deliverables include updated npm packages with WASM bindings, a third-party cryptographic audit of the WebAuthn-to-Zcash key derivation, developer documentation, and an open-source demo app featuring an MCP-based AI agent paying for resources with ZEC. Applicant is requesting $45,000. Hanh: I would be interested in splitting the grant in 2. First one for Passkey shielded wallet and the other for the AI agent payments. Gguy: I vote we reject this now and we recommend the applicant split this up into two separate grants, one for the passkeys and one for the AI agents. We wouldn’t be interested in providing startup funding. If the applicant is able to resubmit as two grants we would prefer to review these applications separately. Zerodartz: Passkeys are needed. Could this team deliver a working feature, not sure. Decentralistdan: reject in current form. Declined (unanimous - see GGuy’s comments above) Zallet ↔ zcashd Wallet RPC Equivalence Harness (Normalized Diff Reports) This project builds a repeatable JSON-RPC parity harness that runs standardized wallet RPC calls against both zcashd and Zallet using the same keys and produces normalized diff reports (MATCH, DIFF, MISSING, ERROR) to identify migration-critical compatibility gaps. As zcashd is deprecated, subtle differences in response structure and error behavior pose operational risks for downstream infrastructure; the tool provides a shared, reproducible way to measure readiness, prioritize fixes or documentation, and prevent regressions during the transition without requiring strict one-to-one parity. Applicant is requesting $20,000. Artkor: I appreciate the effort and the initiative to apply to our grants program, but I urge the applicant to stop here. Zcash is not an experimental playground. It is payment infrastructure that I consider part of the future of finance. I am not willing to rely on vibe-coding in this context and I would honestly feel embarrassed approving this grant. Gguy: My concern is that the way that the application is described has more wording about how they’re going to achieve the goal when it feels like they probably could have described the implementation in the same amount of effort and it would have more clearly demonstrated a clear understanding of the work that’s required. I vote to reject. Hanh: I reject because this submission is obviously AI generated and doesn’t show that the submitter has proper understanding of what the proposal is and how they can complete it. Zerodartz: I understand it would be useful to have. The team doesn’t have proof of being trustworthy enough sadly. Decentralistdan: out of scope due to AI generation proposal and lack of clarity on ability of team to execute Declined (unanimous) Strategic Lobbying and Community Building for the Proliferation and Understanding of Zcash in Japan Fracton Ventures, a Japanese crypto incu [Decision rationale truncated.]

Confidence
100%
Match method
Direct Source Url
Minutes
Zcash Community Grants Meeting Minutes 1/3/26
Committee notes

Gguy: I’ve reviewed the implementation details, I think that this might be something that lightwalletd and Zebra team might need to do themselves. I’m not sure it’s the right time to do this without clear cooperation with that team.

Artkor: My current position is that it’s difficult for me to envision realistic scenarios in which Zebra and lightwalletd will be deployed separately in a way that requires a dedicated authentication scheme between them. In any case, I will prefer that change of this nature be implemented by the core backend developers of Zcash rather than external teams without a proven track record. So I reject.

Hanh: I will reject as well because I think this work, if it’s done by someone else, would need significant review by the authors of Zebra and Zallet and at the end of the day they will essentially do the work themselves. There is not much to outsource here.

Zerodartz: Agree with others. Reject.

Decentralistdan: agreed. reject due to reliance on core teams.

Laminar - The Tactical Spike: Batch Payment Infrastructure

GGuy: I personally don’t see this as a priority right now. This kind of fits in between solutions that already exist and I don’t currently see the benefits right now.

Artkor: I generally like this proposal. However, after the committee discussions, I have concluded there does not appear to be significant demand for it at this time. Recently, the community has been placing strong emphasis on demonstrated product demand. There are already custodial payroll and payout services available for Zcash. I have not seen clear evidence that this functionality is currently in high demand. So the proposal feels expensive relative to its immediate necessity. I hope the community will need to revisit this idea in the future. But at this time, I vote to reject it.

Zerodartz: It’s also my understanding that there is not much demand for it yet and maybe if it is needed in future it should be built into the wallets instead of having a special tool for it. Reject for now.

Hanh: For me, what they request in Milestone 1 is not infrastructure for batch payment but a converter between a list of payees as a CSV and converting that into payment URI. As it is this doesn’t represent the batch payment infrastructure, which would be valuable. But that’s not what it is here. I reject.

Decentralistdan: reject. Milestones not aligned with described infra work, and lack of clear demand for a standalone tool/product like this.

Gguy: I’m waiting to hear more feedback on the ability for this individual to contribute and we hope to have more information soon about the feasibility of this.

Artkor: It would help if core backend developers flagged tasks for outsourcing so the committee could better understand priorities.

Hanh: This doesn’t represent a classic way to contribute to our project, an open source project. First, you learn about the project, you communicate with the moderators, with the developers, and you find bugs that you can contribute, low-hanging fruits that you can fix and get a reputation with the project. This seems to be more like trying to pick an easy task and get a grant for that. There’s no sign of added value for these particular bugs and it feels awkward. I will reject, but it doesn’t mean that the guy who submitted this proposal can’t later submit something better after he gains some reputation.

Zerodartz: They might actually be good developers but the proposal itself is a bit much for the proposed fixes.

Decentralistdan: team seems qualified to contribute but would like to see them contribute and get involved in the open source development of Zcash independently as opposed to relying on a grant as a first step.

Decentralistdan: This definitely feels like a send to ZecHub request. In my mind this is a rejection at this price but we can discuss further.

Gguy: I agree. We’ll get in contact with the team on next steps.

Zerodartz: Would want to have more community feedback on it also.

Project Sentinel: Automated Dust Quarantine for Zodl

Artkor: I vote to reject because I don’t consider the issue described in this proposal to be relevant.

Gguy: I agree. This grant doesn’t resonate with me as a current need for Zcash.

Zerodartz: Same, reject.

Hanh: This is for transparent dust, it’s not very meaningful. Anyway, if it’s really dust, the price of spending it exceeds the fee as dictated by the zip 317. Wallets typically skip over dust inputs under that amount. I think it’s a non-issue actually.

Decentralistdan: reject. Out of scope for current funding.

Veridex: Passkey Shielded Wallets and AI Agent Payments

Hanh: I would be interested in splitting the grant in 2. First one for Passkey shielded wallet and the other for the AI agent payments.

Gguy: I vote we reject this now and we recommend the applicant split this up into two separate grants, one for the passkeys and one for the AI agents. We wouldn’t be interested in providing startup funding. If the applicant is able to resubmit as two grants we would prefer to review these applications separately.

Zerodartz: Passkeys are needed. Could this team deliver a working feature, not sure.

Decentralistdan: reject in current form.

Artkor: I appreciate the effort and the initiative to apply to our grants program, but I urge the applicant to stop here. Zcash is not an experimental playground. It is payment infrastructure that I consider part of the future of finance. I am not willing to rely on vibe-coding in this context and I would honestly feel embarrassed approving this grant.

Gguy: My concern is that the way that the application is described has more wording about how they’re going to achieve the goal when it feels like they probably could have described the implementation in the same amount of effort and it would have more clearly demonstrated a clear understanding of the work that’s required. I vote to reject.

Hanh: I reject because this submission is obviously AI generated and doesn’t show that the submitter has proper understanding of what the proposal is and how they can complete it.

Zerodartz: I understand it would be useful to have. The team doesn’t have proof of being trustworthy enough sadly.

Decentralistdan: out of scope due to AI generation proposal and lack of clarity on ability of team to execute

Artkor: I can reach out to the applicant to verify some details.

Gguy: Great, thanks Artkor.

Decentralistdan: I’m definitely open to exploring a Japan-based community building that they touch on as the second part there. And it might end up being again like a Zechub-style collab. Question for Alex: is there a restriction on lobbying as described in this application?

Alex: Lobbying isn’t allowed but the applicant is actually talking about education so no issues here.

Zerodartz: Japan community sounds like it could be good for Zcash. Would love to have community feedback and see Zcashers from Japan comment on it (if there are any out there).

Zerodartz: We are happy with their new connections made at ETH Denver. Would love to see community feedback on this new proposal also. We are also looking into some possible future plans with them at Berlin Blockchain Week.

Forum links

1 primary, 1 supporting
Primary forum thread

Grant Application - Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

Project Summary This project adds RPC cookie-file authentication support to zcash/lightwalletd so it can authenticate to Zebra’s JSON-RPC backend without requiring operators to disable cookie authentication or rely on long-lived static RPC credentials. It also ships a CI integration test and up...

Confidence
100%
Forum URL
https://forum.zcashcommunity.com/t/grant-application-secure-by-default-zebra-lightwalletd-add-rpc-cookie-file-authentication-support/54722
Open forum thread

source: forum_mirror | topicId: 54722 | fetchedAt: 2026-10-22T07:05:35.273Z | categoryId: 36 | mirrorKind: forum_topic | coverageCapped: false | discoveredFrom: ["github_issue_comment:ZcashCommunityGrants/zcashcommunitygrants#218:comment:3908326165","google_sheet_row:1FQ28rDCyRW0TiNxrm3rgD8ai2KGUsXAjPieQmI1kKKg:1164534734:grant-platform:9c8cf878f965ea26fa1d5a8dd462637b34bba72508f4ac656c790a1a96deae4a"] | postStreamCount: 3

Supporting forum reference

Grant Application - Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

Project Summary This project adds RPC cookie-file authentication support to zcash/lightwalletd so it can authenticate to Zebra’s JSON-RPC backend without requiring operators to disable cookie authentication or rely on long-lived static RPC credentials. It also ships a CI integration test and up...

Confidence
100%
Forum URL
https://forum.zcashcommunity.com/t/grant-application-secure-by-default-zebra-lightwalletd-add-rpc-cookie-file-authentication-support/54722/3
Open forum thread

source: forum_mirror | topicId: 54722 | fetchedAt: 2026-10-22T07:05:42.901Z | categoryId: 36 | mirrorKind: forum_topic | coverageCapped: false | discoveredFrom: ["github_issue_comment:ZcashCommunityGrants/zcashcommunitygrants#218:comment:3984554388"] | postStreamCount: 3

Application source evidence

Primary GitHub, Sheet, and other non-forum source records.
Github Issue

Grant Application - Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

### Terms and Conditions - [x] I agree to the [Grant Agreement](https://9ba4718c-5c73-47c3-a024-4fc4e5278803.usrfiles.com/ugd/9ba471_f81ef4e4b5f040038350270590eb2e42.pdf) terms if funded - [x] I agree to [Provide KYC information](https:/...

Confidence
100%
Source ID
ZcashCommunityGrants/zcashcommunitygrants#218
Open source record

repo: zcashcommunitygrants | owner: ZcashCommunityGrants | state: closed | author: Crackdevs | labels: ["📋 Grant Application","👀 Ready For ZCG Review","❌ Grant Declined"] | number: 218 | closedAt: 2026-03-02T13:54:41Z | commentCount: 2

Github Issue Comment

Comment on #218: Grant Application - Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

[Forum post for reference. ](https://forum.zcashcommunity.com/t/grant-application-secure-by-default-zebra-lightwalletd-add-rpc-cookie-file-authentication-support/54722)

Confidence
100%
Source ID
ZcashCommunityGrants/zcashcommunitygrants#218:comment:3908326165
Open source record

repo: zcashcommunitygrants | owner: ZcashCommunityGrants | author: alexgbo | number: 218 | issueUrl: https://github.com/ZcashCommunityGrants/zcashcommunitygrants/issues/218 | commentId: 3908326165 | createdAt: 2026-02-16T12:48:19Z | issueNumber: 218

Github Issue Comment

Comment on #218: Grant Application - Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

[Grant declined ](https://forum.zcashcommunity.com/t/grant-application-secure-by-default-zebra-lightwalletd-add-rpc-cookie-file-authentication-support/54722/3)

Confidence
100%
Source ID
ZcashCommunityGrants/zcashcommunitygrants#218:comment:3984554388
Open source record

repo: zcashcommunitygrants | owner: ZcashCommunityGrants | author: alexgbo | number: 218 | issueUrl: https://github.com/ZcashCommunityGrants/zcashcommunitygrants/issues/218 | commentId: 3984554388 | createdAt: 2026-03-02T13:54:41Z | issueNumber: 218

Google Sheet Row

Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support

Date Submitted: 2/16/2026 | Proposal Title: Secure-by-Default Zebra ↔ lightwalletd: Add RPC Cookie-File Authentication Support | Applicant(s): Crackdevs | Grant Platform Link: https://github.com/ZcashCommunityGrants/zcashcommunitygrants/issues/218 | Forum Link: https://forum.zcashcommunity.com/t/gra

Confidence
100%
Source ID
1FQ28rDCyRW0TiNxrm3rgD8ai2KGUsXAjPieQmI1kKKg:1164534734:grant-platform:9c8cf878f965ea26fa1d5a8dd462637b34bba72508f4ac656c790a1a96deae4a
Open source record

gid: 1164534734 | sheetId: 1FQ28rDCyRW0TiNxrm3rgD8ai2KGUsXAjPieQmI1kKKg | tabName: all_grants_tracking | rowNumber: 497 | legacySourceId: 1FQ28rDCyRW0TiNxrm3rgD8ai2KGUsXAjPieQmI1kKKg:1164534734:row:497 | identityStrategy: grant_platform_link | businessIdentifier: https://github.com/ZcashCommunityGrants/zcashcommunitygrants/issues/218 | rowLocationSourceId: 1FQ28rDCyRW0TiNxrm3rgD8ai2KGUsXAjPieQmI1kKKg:1164534734:row:497