ZIP: Unassigned
Title: Future Dev and Legal Defense Fund Lockbox, and Removal of ZCG Funds to the Network Sustainability Mechanism
Owners: Sean Bowe (Tachyon Group) <[email protected]>
        Zooko Wilcox (Shielded Labs) <[email protected]>
        Jason McGee (Shielded Labs) <[email protected]>
Status: Draft
Category: Consensus / Process
Created: 2026-10-29
License: MIT
Discussions-To: <https://forum.zcashcommunity.com/t/future-dev-and-legal-defense-fund-zip/58611>
Pull-Request: <https://github.com/zcash/zips/pull/1428>
Updates: 207, 209, 214, 237, 1015, 1016

Terminology

The key words “MUST”, “MUST NOT”, “SHALL”, “SHOULD”, “SHOULD NOT”, and “MAY” in this document are to be interpreted as described in BCP 14 ¹ when, and only when, they appear in all capitals.

The terms “Mainnet”, “Testnet”, “block subsidy”, “funding stream”, “coinbase transaction”, “chain value pool balance”, and “Issued Supply” have the meanings given in the Zcash Protocol Specification ²; the character § refers to its sections.

“Zcash Community Grants” (“ZCG”), the “ZCG Committee”, the “Financial Privacy Foundation” (“FPF”), and the “Deferred Dev Fund Lockbox” have the meanings given in ZIP 1015 ³.

The “Network Sustainability Mechanism” (“NSM”) and the “NSM Value Balance” have the meanings given in ZIP 237 ⁴: ZEC removed from circulation is added to the NSM Value Balance, and returns to circulation through future block subsidies.

A “v7 transaction” has the meaning given in ZIP 248 ⁵, and its explicit removal amount, \(\mathsf{zip233\_amount}\kern-0.05em\textsf{,}\) has the meaning given in ZIP 233 ⁶: a v7 transaction can carry an amount that is removed from circulation when the transaction is mined.

Abstract

This ZIP makes two changes.

1. ZCG’s 8% funding stream ends when this ZIP activates. For the rest of that stream’s term, the same 8% of the block subsidy goes into a new lockbox, the Future Dev and Legal Defense Fund Lockbox, which holds it for future Zcash development and legal defense.

2. The ZCG Committee removes 50,000 ZEC from circulation, crediting it to the NSM, using ZIP 233’s removal mechanism if it is available when this ZIP activates. An unspendable address is specified only as a last resort: it is used, and given consensus and wallet treatment under this ZIP, only if ZIP 233 is not available.

Motivation

The rapid rise in the price of ZEC has enlarged the monetary value of ZCG’s treasury to a much greater amount than ever before. This ZIP reduces the risks and pressure that come with large amounts of money, removes ZCG funds from circulation, crediting the Network Sustainability Mechanism (providing increased long-term issuance), and accrues funds in a lockbox for future use by the Zcash community.

ZCG’s dashboard reports holdings of 91,452.98 ZEC and $8,796,224, against $2,417,165 of outstanding grant liabilities ⁷. FPF reported $4,718,359 of ZCG expenses in the first half of 2026, about $9.4 million a year ⁸. The 8% stream adds another 144 ZEC a day, 52,560 ZEC a year; at $1,300 per ZEC, that is about $68 million a year, more than seven times ZCG’s spending ⁹.

ZCG’s treasury before and after the removal, at $1,300 per ZEC (details ¹⁰):

Privacy Implications

The Future Dev and Legal Defense Fund Lockbox adds no addresses, keys, or notes. A ZIP 233 transaction carries its removal amount explicitly and visibly ⁶. If selected for deployment, the address fallback uses transparent payments to a published address. This ZIP leaves the privacy of every transaction unchanged.

Specification

Activation

Let \(A\) be this ZIP’s activation height on a network. Let \(E\) be the end height of FS_FPF_ZCG_H3 under Revision 3 of ZIP 214 ¹¹: the third halving under ZIP 218’s 25-second blocks ¹², \(E = N + 3 \cdot (H_3 - N)\kern-0.05em\textsf{,}\) where \(N\) is the network’s NU7 activation height and \(H_3\) is the pre-NU7 third-halving height (4406400 on Mainnet, 4476000 on Testnet). With Mainnet’s \(N = 3543405\) ¹³, \(E = 6132390\kern-0.05em\textsf{.}\) End heights are exclusive, as in ZIP 207 ¹⁴.

The lockbox rules below apply on a network where \(A < E\kern-0.05em\textsf{;}\) where \(A \geq E\kern-0.05em\textsf{,}\) the ZCG stream has already ended, and they change nothing. The rules for removing funds from circulation depend on the mechanism selected by the deployment ZIP, as the section “Removing funds from circulation” specifies.

The Future Dev and Legal Defense Fund Lockbox

The Future Dev and Legal Defense Fund Lockbox is a second lockbox, separate from the Deferred Dev Fund Lockbox, with its own chain value pool balance. It holds funds for future Zcash development and legal defense. No disbursement mechanism is currently defined for this lockbox; the Zcash community will need to decide upon and specify a suitable decentralized mechanism for permitting withdrawals from this lockbox in a future ZIP in order to make these funds available for funding Zcash development and legal defense.

Funding streams. A new revision of ZIP 214 makes these changes at \(A\kern-0.05em\textsf{:}\)

• The end height of FS_FPF_ZCG_H3 becomes \(A\kern-0.05em\textsf{.}\) Its recipient list keeps the addresses for the address periods before \(A\kern-0.05em\textsf{,}\) as ZIP 207 computes them, including ZIP 2008’s change ¹⁵.
• A new funding stream, FS_FDLDF_H3, pays 8/100 of the block subsidy from height \(A\) to height \(E\kern-0.05em\textsf{,}\) to the recipient \(\mathsf{FDLDF\_POOL}\) in every address period.

FS_CCF_H3 and the Deferred Dev Fund Lockbox are unchanged.

The recipient. A new revision of ZIP 207 adds the recipient identifier \(\mathsf{FDLDF\_POOL}\kern-0.05em\textsf{,}\) which works as \(\mathsf{DEFERRED\_POOL}\) does ¹⁶: a stream paid to it produces no coinbase output, and its value goes into the Future Dev and Legal Defense Fund Lockbox’s own balance, defined below — not into the Deferred Dev Fund Lockbox’s. In § 7.8 and § 7.1.2, define \(\mathsf{totalFDLDFOutput}(h)\) as the sum of \(\mathsf{fs.Value}(h)\) over the streams paid to \(\mathsf{FDLDF\_POOL}\) at height \(h\kern-0.05em\textsf{,}\) and add it to the coinbase transaction’s \(\mathsf{totalOutputValue}\kern-0.05em\textsf{,}\) beside \(\mathsf{totalDeferredOutput}(h)\kern-0.05em\textsf{.}\)

The balance. In § 4.17, add the Future Dev and Legal Defense Fund Lockbox’s chain value pool balance,

\[\mathsf{FDLDFBalance}(h) := \sum_{i=0}^{h} \mathsf{totalFDLDFOutput}(i),\]

and include it in \(\mathsf{IssuedSupply}(h)\kern-0.05em\textsf{.}\) Add it to the pools of ZIP 209 ¹⁷, whose balances MUST be nonnegative and whose sum MUST NOT exceed \(\mathsf{MAX\_MONEY}\kern-0.05em\textsf{.}\) No consensus rule moves value out of it.

Removing funds from circulation

The section “The removal of ZCG funds” requires the ZCG Committee to remove 50,000 ZEC from circulation, crediting it to the NSM. The intended means is ZIP 233 ⁶, which lets a sender voluntarily remove a specified amount of ZEC from circulation; ZIP 237 credits removed value to the NSM Value Balance ⁴.

The deployment ZIP that sets \(A\) MUST identify the removal mechanism to be used on each network. If ZIP 233 will be active at \(A\kern-0.05em\textsf{,}\) it MUST select ZIP 233 and MUST NOT deploy the address fallback below. Only if ZIP 233 will not be active at \(A\) MAY the deployment ZIP explicitly select that fallback as a last resort.

Unless the fallback is explicitly selected, the address MUST NOT be used to fulfill this ZIP’s removal obligation, and implementations MUST NOT give the address or its script any special consensus accounting or wallet recognition under this ZIP. In particular, payments to it MUST NOT be credited to the NSM Value Balance. The absence of ZIP 233 alone does not select the fallback.

Removal with ZIP 233 transactions

Where ZIP 233 is selected, its own consensus rules perform the removal: a v7 transaction ⁵ carries an explicit removal amount, \(\mathsf{zip233\_amount}\kern-0.05em\textsf{,}\) which is removed from circulation when the transaction is mined, and which ZIP 237 adds to the NSM Value Balance. On such a network, this ZIP adds no consensus rules.

Last-resort NSM removal address

All rules in this subsection, including the ZIP 237 changes and wallet handling, apply only on a network where the deployment ZIP selects the address fallback. Its consensus rules take effect at height \(A\) and remain in effect at every later height: the address becomes a permanent feature of the protocol.

The NSM removal address is the Mainnet P2SH address

t3QZUHYkaEQEuWosAc9HgMPKiQRdvuBPCQZ

Its script hash, 41c98a140039816273e50db317422c11c2bfcc88, is HASH160 of the one-byte redeem script 0x6a: the single opcode OP_RETURN, a script that fails whatever a spender supplies. To check this, decode the address with Base58Check, confirm its version prefix (1cbd) and checksum, and compare its script hash with HASH160 of the byte 0x6a.

Let \(\mathsf{RemovalOutput}(h)\) be the total value of the transparent outputs in block \(h\kern-0.05em\textsf{,}\) in any transaction including the coinbase transaction, whose script is exactly the P2SH script a91441c98a140039816273e50db317422c11c2bfcc8887.

Changes to ZIP 237. Register the following mechanism for removal from circulation in the list defined in ZIP 237 ⁴:

\[\mathsf{NSMAddressRemovals}(h) := \begin{cases} 0 & \text{if } h < A \\ \displaystyle\sum_{i=0}^{A} \mathsf{RemovalOutput}(i) & \text{if } h = A \\ \mathsf{RemovalOutput}(h) & \text{if } h > A \end{cases}\]

At height \(A\kern-0.05em\textsf{,}\) everything sent to the address up to and including block \(A\) is removed from circulation at once; at each later height \(h\kern-0.05em\textsf{,}\) block \(h\)’s payments are. In § 4.17, the transparent chain value pool balance decreases by \(\mathsf{NSMAddressRemovals}(h)\kern-0.05em\textsf{,}\) which ZIP 237 adds to the NSM Value Balance.

Nothing sent to this address can be returned.

Wallet handling. The NSM removal address looks like any other Mainnet P2SH address; nothing about it warns a user that funds sent to it cannot be recovered. Software that accepts payment destinations — typed or pasted by a user, read from a payment request URI, or kept in an address book — SHOULD recognize the NSM removal address, by its script hash or its exact string, at every such entry point; SHOULD present a payment to it as an irreversible removal of funds from circulation, not an ordinary payment; and SHOULD NOT offer it as an ordinary payment destination.

The removal of ZCG funds

The ZCG Committee SHALL cause 50,000 ZEC of the funds it administers to be removed from circulation, crediting it to the NSM, in one or more Mainnet transactions using the mechanism selected by the deployment ZIP. The specified removal amounts MUST total that amount, excluding transaction fees. If the address fallback is selected, these are the amounts paid to that address. The ZCG Committee SHALL do so as soon as possible, and no later than 30 days after Mainnet reaches height \(A\kern-0.05em\textsf{.}\)

Payments to the NSM removal address before height \(A\) count toward the removal and are added to the NSM Value Balance at height \(A\) — but only where the fallback is selected. The ZCG Committee MUST NOT pay the address before the deployment ZIP that sets \(A\) selects the fallback.

Since the funds ZCG administers are held by FPF, the ZCG Committee fulfills this obligation by directing FPF to create the transactions, as it directs FPF to make grant payments under ZIP 1015.

The ZCG Committee SHALL publish the transaction identifier of each such transaction to the Zcash community promptly after it is mined.

Changes to ZIPs 1015 and 1016

In ZIP 1015’s section on ZCG ¹⁸, add: “ZCG funds MAY also be used for the removal from circulation that [this ZIP] specifies, which credits the Network Sustainability Mechanism. That removal is not a grant.”

In ZIP 1016’s section on ZCG ¹⁹, end ZCG’s funding stream at this ZIP’s activation height, and state that from then until the third halving the same 8% goes into the Future Dev and Legal Defense Fund Lockbox, as this ZIP specifies. In its section on the Coinholder-Controlled Fund, give the 12% stream’s duration by FS_CCF_H3’s own start and end heights in ZIP 214, which this ZIP leaves unchanged.

Rationale

A lockbox of its own. The 8% is set aside, issued but locked, for future development and legal defense, and a future ZIP decides how it is spent. A separate balance keeps the fund apart from the Deferred Dev Fund Lockbox’s purpose and disbursement rules, and lets a future disbursement mechanism authorize withdrawals from each lockbox separately — under ZIP 270’s tracked signing keys ²⁰, for example, each can have authorizing keys of its own. Like that lockbox, it needs no custodians or keys today, and its disbursement mechanism can take the same technical approach as the one being designed for the Deferred Dev Fund Lockbox.

An address only as a last resort. ZIP 233 is the protocol’s purpose-built way to remove funds from circulation: an explicit amount in a v7 transaction, with no address. NU7 deploys neither ZIP 233 nor ZIP 248’s v7 format ^{6 13}, and this ZIP cannot anticipate whether they will be available when it activates, so it reserves the address solely for the case where they are not. If needed, the fallback requires no new transaction fields or address formats, recognizes only one script, and is permanent, so value sent to the address at any height is added to the NSM Value Balance; if ZIP 233 activates later, both mechanisms add to the same balance.

No spending prohibition. Spending from the NSM removal address would require a redeem script other than OP_RETURN with the same script hash — a preimage attack on RIPEMD-160. This ZIP adds no rule against such a spend: an attack of that kind would threaten the much larger value held in ordinary transparent outputs, and a rule for this one address would not change that.

The removal’s size. 50,000 ZEC is about 55% of ZCG’s ZEC. Anyone can check the removal on the chain, and ZCG keeps the rest of its treasury and its grants program.

Accounting. The lockbox’s balance stays in the Issued Supply. A ZIP 233 removal subtracts its amount from the Issued Supply when its transaction is mined; where the fallback is selected, a payment to the NSM removal address leaves the transparent pool at the height ZIP 237 credits it. In each case, the value moves to the NSM Value Balance in the same block, keeping ZIP 237’s invariant: in each block from NU7 on, the Issued Supply plus the NSM Value Balance grows by exactly the scheduled block subsidy.

Other proposals. ZIP draft #1414 sends the 8% stream to the NSM ²¹, and draft #1423 winds ZCG down ²². Where they overlap with this ZIP, they are alternatives to it.

Deployment

The lockbox rules — and, if the fallback is selected, the NSM removal address rules — are consensus changes, proposed for a network upgrade after NU7 that activates before height \(E\kern-0.05em\textsf{;}\) that upgrade’s deployment ZIP sets \(A\) for each network ²³. The expected deployment activates ZIPs 248 and 233 in the same upgrade, so the fallback is not selected; it is selected only as a last resort, if ZIP 233 will not be active at \(A\kern-0.05em\textsf{.}\) The removal of ZCG funds follows the schedule in the section “The removal of ZCG funds”.

Reference implementation

None yet.

References