Skip to content

Awesome zero knowledge proofs security

Awesome A curated list of awesome things related to learning zero knowledge proofs security

Table of Content

1. Introduction

Zero Knowledge Proof (ZKP) technology is considered a promising infrastructure for blockchain and many broader privacy-preserving systems.

Conceptually, proving systems are advanced cryptographic protocols. In practical ZK applications, however, security review usually separates the system into a front-end and a back-end.

In general, ZKP is a technique for proving correct program execution while preserving completeness, soundness, and zero knowledge. The front-end is the provable program, usually circuits or circuit-like constraints that encode computation logic. The back-end is the proving system that generates and verifies proofs for that logic.

As in other engineering domains, many practical ZK failures come from implementation bugs and incorrect integration assumptions.

This repository uses a zk application perspective. The following figure from Aumasson's slides provides a useful layered model.

Circuit implementations have their own vulnerability classes, which are distinct from low-level cryptographic bugs in proving systems.

2. Vulnerability Classification

The mental model of circuits is different from traditional programming. A value appearing in witness generation code is not necessarily constrained by the proof.

The programming model of zkVM applications is closer to traditional programming, but the underlying VM is still implemented as constraints. Only circuit-friendly operations, such as Pedersen, Poseidon, and MiMC, are cheap to prove. The underlying execution model of zkVMs is still circuit-based.

The emergence of zkVMs, including zkEVMs, has expanded ZK applications to smart contracts, rollups, and general programs, such as Starknet, Polygon zkEVM, Scroll, zkSync, RISC Zero, and SP1.

It also overlaps with traditional security fields such as reverse engineering, as shown by this CTF puzzle by weikeng chen.

Therefore, programs above zkVMs have a broader security scope, including smart contracts and traditional application logic. This repository focuses mainly on ZK-specific security issues.

Architectural Design Flaws

FrontEnd: Circuits

Soundness Error (Under-constrained)

Missing constraints are the most common class of circuit bug. They occur when a circuit fails to enforce necessary conditions on inputs, witness values, intermediate computations, or protocol state. As a result, a prover may satisfy the constraints while proving a statement that is false under the intended specification.

This repository groups soundness errors into the following subcategories:

Completeness Error (Over-constrained)

Zero Knowledge Error

Misc: Witness Generation & Arithmetization

Worth further exploring.

BackEnd: Proving system

The backend is the proving system and is closer to the cryptographic layer. One must note: even secure primitives may introduce vulnerabilities if used incorrectly in the larger protocol or configured in an insecure manner.

To sum up, many proving-system vulnerabilities come from unstandardized cryptographic implementation.

3. Security Consideration

circom

For practical review, use check_list.md together with the Circuit Bugs taxonomy. Circom-specific review should focus on constraint completeness, public input binding, witness assignment, compiler behavior, and cryptographic primitive integration.

cairo

  1. No payable functions
  2. Name hashed storage slots
  3. Upgradeability built-in
  4. Separated internal/external functions
  5. Cheap execution means readable algorithms
  6. Immutable variables by default
  7. Safe type conversions
  8. Option and Result traits

Reference - starknet book - cairo-the-starknet-way-to-writing-safe-code by Nethermind Security

4. Learning Resources

Books & Docs

Papers

Blogs

Highlights

Resources

Videos & Podcast

Audit Reports

You can directly visit the solodit website to get some off-the-shelf audit reports.

If you are intereted in security about zkVM programs, here are some audit material about smart contract.

Solidity: - Solidity Security Blog - not-so-smart-contract - List of Security Vunerabilities

Cairo: - Opus-2024_01-c4 - lindy-labs-aura-2023_11-tob - Argent-Account-2023_6-consensys

Tools

Tool Technique UC OC CE
Circomspect SA ✓ ✗ ✗
ZKAP SA ✓ ✗ ✗
halo2-analyzer SA ✓ ✓ ✗
Coda FV ✓ ✓ ✓
Ecne FV ✓ ✗ ✗
Picus FV ✓ ✗ ✗
Aleo FV ✓ ✓ ✓
SnarkProbe DA ✓ ✓ ✗
CIVER FV ✓ ✗ ✗
GNARK/Lean FV ✓ ✓ ✓

zkHACK/CTF/Puzzles

writeups

Lectures

Algebraic Error Correcting Codes

Miscellaneous

Acknowledgements

Special thanks go to the following individuals and organizations for their ongoing support and encouragement: Nullity.