mpcsec.org · Part 1 of 2

Announcing mpcsec.org: What Goes Wrong When You Implement MPC

ZK/SEC May 25, 2026 1 min educative · security · MPC

On May 15, 2026, THORChain was hit by a targeted exploit that drained roughly $10.7M from one of its vaults, the result of a flawed implementation of GG20, an MPC-based threshold signature scheme. Even when a scheme is theoretically sound, things can easily go wrong while implementing it. So, if you are implementing or auditing MPC, head over to mpcsec.org.

What is mpcsec.org?

At the RWMPC 2025 workshop, a group of practitioners agreed that the field needed a shared, living reference for the implementation mistakes that keep recurring. That conversation grew into a collaborative project, and today we are happy to announce its first public release: mpcsec.org, a guide to common multi-party computation pitfalls maintained with contributors from zkSecurity, Trail of Bits, Partisia, and Zama.

The guide currently covers six categories: input validation, context binding, concurrency and state, insecure subprotocols, failure recovery, and adaptive inputs. It also catalogs improper use of the cryptographic primitives that MPC protocols rely on, since even a well-designed scheme can fail when its building blocks are misused. Each entry walks through a pitfall, how it can go wrong, and how to avoid it, with examples drawn from real deployed libraries like tss-lib, WSTS, MP-SPDZ and Drand.

Auditing with AI assistance

mpcsec.org also ships with a SKILL.md file to help guide LLM-assisted code reviews.

Your Feedback is Invaluable

We hope that this website becomes a reference. Tell us what you think. Share your suggestions, or any new MPC-related bugs, via a PR.

Get in touch

If you would like an extra set of eyes on your MPC stack, reach out at hello@zksecurity.xyz.

Tip

Curious about how MPC techniques connect to zero-knowledge proofs? See our gentle introduction to the MPC-in-the-Head transformation.

Keep reading

Latest

Checking the Checkers and Auditing the Ironwood FV

Cryptographic software is error-prone and failures are catastrophic, therefore formal verification is a powerful and increasingly practical tool for greatly improving the assurances of our cryptographic software. But who verifies the formal verification? Formal verification itself is software too, what is proved, under which assumptions and its relation to the real-world implementation lie beyond the scope of the machine-checked proof. In this post, we want to give some insights into our three-week audit of the Ironwood formalization and some of the common pitfalls that formal verification more broadly can encounter.

Mathias Hall-Andersen · October 05, 2026

Archetype x zkSecurity - Proof is in the Pudding: zkML

In Session 11 of "Proof is in the Pudding," we look at what it takes to prove model inference. We cover transformer computation, sumcheck, GKR, lookup arguments, quantization, and KV caching, then discuss scaling and possible uses for verifiable ML.

ZK/SEC · September 30, 2026

Intro to Clean for Devs.

We think that Clean is the future of circuit development, so we created a programmer-first introduction to show circuit developers who have never used formal verification how they can build circuits faster, safer and better.

Mathias Hall-Andersen · September 29, 2026

Recommended

A Gentle Introduction to the MPC-in-the-Head Transformation

In this blog post, we dive into the fascinating world of zero-knowledge proofs using the MPC-in-the-Head transformation, a clever method that constructs proof systems from any secure multiparty computation protocol. Originally proposed in 2007, this transformation uses a creative approach involving "imaginary parties" to prove knowledge without revealing it. We explain how this technique can be applied to develop post-quantum signature schemes, providing insights into its practical implications and efficiency. By exploring these concepts, readers will uncover a unique intersection of cryptography and computer science.

Giorgio Dell'Immagine · February 20, 2025

Watch what we have to say about ZK security in the Node Guardians season 2 episode 1

Catch our cofounder David Wong on the latest episode of Node Guardians, where he chats about ZK security with Sam. Dive into the intriguing world of blockchain auditing, uncover the role math plays, and explore how auditors tackle challenges and rate vulnerabilities. Plus, get insights into the usefulness of formal verification. It's a must-watch for anyone curious about the future of ZK and the nitty-gritty of blockchain security!

ZK/SEC · August 31, 2023

Renegade Audit: When ZK meets MPC

We recently had the pleasure of auditing Renegade's circuits and smart contracts, and it was a great experience. Over three weeks, our team explored their top-notch code and documentation, with the Renegade team providing awesome support throughout. Curious how it all went? Dive into our full report for the inside scoop!

ZK/SEC · July 22, 2024

More to explore

New Challenge Alert: Complete Both to Join zkSecurity

Think you have what it takes to join zkSecurity? We're raising the bar with a second challenge! Now candidates must complete both zkBank and our new Curve Machine challenge to prove their skills across the full spectrum of ZK security. Are you ready to take on both challenges?

ZK/SEC · December 01, 2025

A Technical Dive into Jolt: The RISC-V zkVM

In our latest post, we take you inside the workings of Jolt, a zero-knowledge virtual machine for the RISC-V architecture. This post breaks down the three main components that prove execution correctness: instruction lookup, offline memory checking, and the Rank-1 Constraint System (R1CS). By exploring these elements, you'll get a grasp on how Jolt ensures VM execution is accurate and reliable, using innovative methods like Lasso lookup arguments and the Spartan protocol. Join us as we unravel this cutting-edge zkVM, which not only promises simplicity but also the potential for exciting advancements.

Imam Al-Fath · December 09, 2024

Nine Years to Halve a Hash Function: RFC 9861 Is Out

After nearly a decade in the making, RFC 9861: KangarooTwelve and TurboSHAKE was officially published in October 2025, with zkSecurity among its editors. This post explains why these hash functions deserve to be far more widely used than they are today. Built on the same Keccak permutation as SHA-3 and SHAKE but with the round count halved, they do the same job at the same security level roughly twice as fast. We cover why halving the rounds is safe, what the RFC actually defines, the caveats around FIPS compliance and workload-dependent speedups, and why a standard like this took nine years to land.

David Wong · July 21, 2026