ZKPs 生态系统的安全审计

CertiK 将深厚的应用密码学专业知识应用于人工审查和定制形式验证，对零知识系统进行严格审核，确保 zk 电路的合理性和正确性。

确保 ZKPs 生态系统的安全

零知识证明是一种加密协议，它允许一方在不透露证明者不想透露的任何私人信息的情况下证明语句的有效性。零知识证明可在 Web3 中实现可验证的计算和隐私，为隐私保护协议、跨链桥接器、zkRollups 和 zkVM 等应用提供支持。

ZKP 的高级形式验证：两个错误的故事

CertiK identified two soundness bugs in zkWasm. The first one, found during Stage 1 manual review, was a missing constraint on a Load instruction from memory. The second one that was uncovered via formal verification in Stage 2, involved the Return instruction, which could enable unintended control flow by adding fake returns due to missing constraints. Both soundness vulnerabilities could allow malicious provers to generate invalid proofs to bypass verifier’s validity checks.

为何选择 CertiKZKPs 安全性

CertiK is a trusted audit partner for zero-knowledge protocol projects, backed by deep expertise in formal verification and applied cryptography. Our audit process combines rigorous manual code reviews by domain experts with custom formal verification to ensure both the correctness of the prover’s zero-knowledge proof generation and the integrity of the verifier's validation logic, as demonstrated in our work zkWasm. This hybrid approach allows us to uncover subtle soundness vulnerabilities and logic flaws that manual review alone often misses, providing a higher level of assurance for your zero-knowledge cryptographic systems.

ZKPs 项目审计如何进行？

审计过程首先要对项目的整个代码库进行详细分析。