ZK security tooling, and how to choose it
Published by ZK Security. Operated by Savy Advisors LLC, an Arizona limited liability company, Buckeye, Arizona.
Pick the statement you need to prove and the chain that has to verify it before you pick a prover. A new proving system with no static analysis and no auditor who has shipped a review of it is a security decision, not a performance one. This page is the map. Each profile below is a short public summary — what the project is, and why a reviewer should care — so you can compare stacks without opening twenty GitHub READMEs.
The long-form versions of this advice are the guides: under-constrained circuits, auditing circom, choosing a proving system, trusted setup risk, and the ZK security checklist.
Circuit languages. Circom has a long public audit record and analyzers that match it (Circomspect, Picus, Ecne). Noir and Leo hide raw constraints behind a higher-level language, which moves risk into the compiler. gnark writes circuits in Go and has published library advisories. Cairo is the Starknet path, with field and VM bugs that EVM habits miss. ZoKrates is an older Ethereum toolbox, and newer production reviews on this site more often name the stacks that are still shipping audits.
Proving systems. snarkjs is the usual Groth16 and PLONK end of a circom pipeline, including the ceremony tooling and the Solidity verifier export. Halo2 (and the PSE KZG fork that Scroll grew from) is the PLONKish system reviewers actually see in zkEVM code. Plonky2, Plonky3, and Winterfell are STARK-family provers. Barretenberg is the backend Noir most often targets. arkworks and lambdaworks are libraries you build a prover on, not applications. SP1 and RISC Zero are zkVMs: the bug surface moves from hand-written constraints to the VM, its precompiles, and the recursion wrapper.
Analyzers. Circomspect, Picus, halo2-analyzer, and Ecne do not replace an audit. They catch the classes that show up in almost every circom review — unconstrained signals, ignored template outputs, some under-constrained paths — and they belong in CI with written triage, not a blanket ignore. Cairo-fuzzer is the execution-level counterpart for Cairo programs.
Libraries and live systems. circomlib's documented input assumptions are part of the threat model of every circuit that imports it. ZKsync Era and Scroll are listed because their circuits are public production zkEVM code, including the Boojum under-constrained bug ChainLight disclosed, not because you drop them into an app as a dependency.
Circom
A domain-specific language and compiler for writing arithmetic circuits used in zk-SNARK proof systems.
snarkjs
JavaScript/WASM implementation of zk-SNARK proving and verification, including Groth16 and PLONK, with trusted setup ceremony tooling.
circomlib
The standard library of audited circom circuit templates: hashes, signatures, comparators, Merkle trees, and more.
Halo2
Zcash's Rust proving system implementing PLONKish arithmetization with no trusted setup, widely forked across the ZK ecosystem.
Noir
Aztec's Rust-like language for writing zero-knowledge circuits with a backend-agnostic intermediate representation (ACIR).
Barretenberg
Aztec's C++ cryptography backend implementing PLONK-family proving systems, used as the default prover for Noir.
gnark
Consensys' fast zk-SNARK library in Go with a high-level circuit API, implementing Groth16 and PLONK.
arkworks
A modular Rust ecosystem of libraries for zk-SNARK development: finite fields, elliptic curves, R1CS, and proof systems.
lambdaworks
LambdaClass's Rust library of SNARK and STARK primitives focused on performance and usability for prover development.
Plonky2
Polygon Zero's recursive SNARK framework combining PLONK with FRI for fast recursion over the Goldilocks field.
Plonky3
A modular toolkit of STARK proving components (fields, hashes, PCS, AIR) that serves as the proving backbone for zkVMs like SP1.
Winterfell
A Rust STARK prover and verifier originally developed at Facebook/Meta, designed for AIR-based computations.
Cairo
StarkWare's provable programming language for writing STARK-verifiable programs, the native language of Starknet.
Cairo-Fuzzer
FuzzingLabs' coverage-guided fuzzer for Cairo and Starknet smart contracts.
Leo
A statically-typed programming language for private applications on Aleo, compiling to Aleo instructions proven with zk-SNARKs.
SP1
Succinct's open-source zkVM that proves execution of ordinary Rust programs using a Plonky3-based STARK stack.
RISC Zero
A general-purpose zkVM proving RISC-V execution, with the Bonsai proving service and an on-chain verifier ecosystem.
ZoKrates
A toolbox for zk-SNARKs on Ethereum: a high-level language, compiler, and proof pipeline with Solidity verifier export.
Circomspect
Trail of Bits' static analyzer and linter for circom, detecting under-constrained signals and other circuit anti-patterns.
Picus
Veridise's automated verifier that detects under-constrained circuits by checking uniqueness of witness outputs.
halo2-analyzer (Korrekt)
Quantstamp's analysis tool for detecting under-constrained halo2 circuits.
Ecne
An R1CS constraint verification tool that checks circom circuits for under-constrained outputs, originating from the 0xPARC community.
ZK Bug Tracker
0xPARC's community-maintained catalog of real ZK vulnerabilities found in the wild and in audits, organized by bug class.
ZKsync Era
Matter Labs' EVM-compatible ZK rollup, with its zkEVM circuits, prover (Boojum), and node software fully open source.
Scroll
An EVM-equivalent ZK rollup whose zkEVM circuits are built on the halo2 proving stack, with open-source node and circuit code.