Protect Your Project Today CertiK Icon
Strengthen your project with industry's largest security service provider
Project or Company Name *
Full Name *
Email *
Job Title *
Contact Platform *
Handle / Username *
Service Interest *
Additional Information
Apply to CertiK Ventures
Security Audit For the ZKPs Ecosystem
CertiK applies deep expertise in applied cryptography to manual review and custom formal verification to rigorously audit zero-knowledge systems, ensuring the soundness and correctness of zk-circuits.
Explore ZKPs Projects
Securing the ZKPs Ecosystem
Zero-knowledge proofs are cryptographic protocols that allow one party to prove the validity of a statement without revealing any private information that the prover does not want to disclose. Zero-knowledge proofs enable verifiable computation and privacy in Web3, powering applications such as privacy-preserving protocols, cross-chain bridges, zkRollups, and zkVMs.
sui service img
Advanced Formal Verification of ZKP: A Tale of Two Bugs

CertiK identified two soundness bugs in zkWasm. The first one, found during Stage 1 manual review, was a missing constraint on a Load instruction from memory. The second one that was uncovered via formal verification in Stage 2, involved the Return instruction, which could enable unintended control flow by adding fake returns due to missing constraints. Both soundness vulnerabilities could allow malicious provers to generate invalid proofs to bypass verifier’s validity checks.

Why Choose CertiK for ZKPs Security

CertiK is a trusted audit partner for zero-knowledge protocol projects, backed by deep expertise in formal verification and applied cryptography. Our audit process combines rigorous manual code reviews by domain experts with custom formal verification to ensure both the correctness of the prover’s zero-knowledge proof generation and the integrity of the verifier's validation logic, as demonstrated in our work zkWasm. This hybrid approach allows us to uncover subtle soundness vulnerabilities and logic flaws that manual review alone often misses, providing a higher level of assurance for your zero-knowledge cryptographic systems.

How Do ZKPs Project Audits Work?
The audit process kicks off with a detailed analysis of a project's entire codebase.
What Else We Offer
We have published multiple research articles covering the ZKPs ecosystem's evolution and security considerations.
Team Verification-icon
Team Verification
Through a rigorous process that uses both AI and human verification, we verify the identities of your team to reassure users that their investment is in safe hands.
Skynet-icon
Skynet
Skynet generates real-time insights of on-chain activity, allowing project teams to be alerted of any suspicious events and saving precious time in anticipating and responding to attack.
SkyInsights-icon
SkyInsights
SkyInsights is a powerful crypto compliance and wallet screening platform. The comprehensive risk management system analyzes and flags wallet address and transaction risks.
Penetration Testing-icon
Penetration Testing
Safe and In-depth attack simulation to expose the most complex vulnerabilities on your crypto exchanges, wallets and Dapps.