Shipping ZK Circuits? Prove They're Sound.
One under-constrained signal can let anyone forge proofs your verifier accepts. Find the right ZK auditor, the tooling that catches circuit bugs, and learn from real proving-system failures.
Original guides
Read these before you pick a tool or an auditor
The useful part of this site is the writing. ZK Security publishes five circuit-security guides. Savy Advisors LLC operates the site. The guides cover the bug class that makes zero-knowledge systems different from ordinary smart-contract reviews, a circom audit workflow, how to choose a proving system, what a trusted setup can still go wrong on, and a checklist a team can adopt section by section.
Read them in the order below. The tool and auditor directories further down are maps of the names those guides already use. A profile page repeats a short public summary so you can jump to the project or the firm. The judgment lives in the guides and on the directory hubs, where the same facts sit next to each other.
-
Guide 1
ZK Bug Classes: Under-Constrained Circuits
Why under-constrained circuits are the dominant bug class in zero-knowledge systems, how attackers exploit them with forged proofs, and how to detect them before they ship.
Start here if you need the failure mode in plain language: a verifier accepts a witness the circuit author never meant to allow.
Read the guide → -
Guide 2
Auditing Circom Circuits: A Practical Walkthrough
A step-by-step workflow for auditing circom circuits: scoping, constraint review, tooling passes, witness fuzzing, and how to report findings that engineers can act on.
Use this when a review is about to start and you want the order of operations: statement, signals, circomlib assumptions, then the analyzers.
Read the guide → -
Guide 3
Choosing a Proving System: Security Trade-offs
Groth16, PLONK, STARKs, and zkVMs compared through a security lens: trusted setup risk, cryptographic assumptions, tooling maturity, and who can actually audit your stack.
Use this before locking a stack. Proof size, setup, and whether anyone can actually audit the circuit are one decision.
Read the guide → -
Guide 4
Trusted Setup Ceremonies: Risks and Mitigations
What toxic waste actually is, how powers-of-tau and phase-2 ceremonies work, what history teaches about setup risk, and what integrating teams must verify before trusting someone else's parameters.
Use this when a design still depends on powers of tau or a phase-2 ceremony, or when someone suggests a transparent proof system to avoid one.
Read the guide → -
Guide 5
The ZK Security Checklist for Teams
An actionable, end-to-end security checklist for teams shipping zero-knowledge systems: circuit development, tooling, setup handling, verifier integration, operations, audit readiness, and incident response.
Use this as the working list: specification, CI, setup hygiene, verifier integration, and what to hand an auditor.
Read the guide →
Tools and auditors the guides already name
These are the stacks and firms a circom, halo2, or zkVM review runs into first. The short lines are summaries, not rankings you should hire from. Read the editorial policy before treating a score as a decision, and use the tool directory and auditor directory when you want the full set side by side.
Top ZK Tools*
- Circom
A domain-specific language and compiler for writing arithmetic circuits used in zk-SNARK proof systems.
- Halo2
Zcash's Rust proving system implementing PLONKish arithmetization with no trusted setup, widely forked across the ZK ecosystem.
- Noir
Aztec's Rust-like language for writing zero-knowledge circuits with a backend-agnostic intermediate representation (ACIR).
- SP1
Succinct's open-source zkVM that proves execution of ordinary Rust programs using a Plonky3-based STARK stack.
- Circomspect
Trail of Bits' static analyzer and linter for circom, detecting under-constrained signals and other circuit anti-patterns.
- Picus
Veridise's automated verifier that detects under-constrained circuits by checking uniqueness of witness outputs.
ZK-Capable Auditors*
- Trail of Bits
Rating: 4.9/5 · Est. 2012
- Veridise
Rating: 4.8/5 · Est. 2021
- zkSecurity
Rating: 4.8/5 · Est. 2023
- Zellic
Rating: 4.8/5 · Est. 2020
- OpenZeppelin
Rating: 4.8/5 · Est. 2015
Notable ZK Incidents
- ZKsync Era (Boojum) $0 (bug bounty)Ethereum L2 · Under-constrained circuit in the Boojum proof system discovered by ChainLight and responsibly disclosed via bug bounty before any exploitation
- Nova (reference implementation) $0 (disclosed)Proof system (generic) · Soundness vulnerability in the Nova recursive folding implementation allowing forged proofs of long computations; reported by researchers and patched
- circom-pairing / Succinct Telepathy $0 (disclosed pre-deployment)Ethereum (light client) · Missing constraint in the circom-pairing BLS signature verification circuits found by Veridise, which would have allowed forged validity proofs
- BNB Chain (BSC Token Hub bridge) ~$570M minted (partially frozen)BNB Chain · Forged IAVL Merkle proof accepted by the cross-chain bridge's proof verification, letting the attacker mint 2M BNB
Public disclosures, including cases caught before funds moved. How under-constrained circuits fail
* How we rank: Tools are scored on community adoption (GitHub stars, downloads), active maintenance, detection accuracy, and practitioner recommendations. Auditors are evaluated on public ZK audit track record, depth of circuit and cryptography findings, transparency (public reports), and reputation among security researchers. Savy Advisors LLC may earn referral fees from auditors, fees for premium auditor listings, affiliate commissions, content-sponsorship revenue, and display-advertising revenue. Guides and the 1–5 ratings are editorial judgments based on public reports and repositories. A paid listing, affiliate link, or sponsorship is labeled, is not the editorial Featured mark, and does not set the rating. See our full methodology.
The Path to a Sound Proof System
Three steps between your circuits and a safe deployment
Why Trust Us
Who operates the site, how it may be paid, and what the quality gate checks
Practitioners Since 2017
Built by an infosec practitioner with blockchain security experience since 2017 — including first-audit work on major protocol launches.
Disclosed revenue
Savy Advisors LLC may earn referral fees from auditors, fees for premium auditor listings, affiliate commissions, content-sponsorship revenue, and display-advertising revenue. Guides and the 1–5 ratings are editorial judgments based on public reports and repositories. A paid listing, affiliate link, or sponsorship is labeled, is not the editorial Featured mark, and does not set the rating.
Edited and re-checked
The guides are original. Directory listings are checked against public reports and repositories. A research note is published only after it clears the editorial quality gate.
Community
Connect with security researchers and practitioners
0xPARC
A non-profit research and development organization supporting applied cryptography and ZK application development, known for programs like ZK learning groups and the ZK Bug Tracker.
Privacy & Scaling Explorations (PSE)
An Ethereum Foundation-supported research lab building open-source zero-knowledge and privacy infrastructure, including Semaphore, MACI, TLSNotary, and zkEVM research.
Zero Knowledge Podcast
The long-running podcast hosted by Anna Rose covering zero-knowledge research, proof systems, and the teams building ZK infrastructure, with an active community around it.