ZK/SEC Research notes from zkSecurity
All posts
educative · zk

zkHack x zkSecurity (Whiteboard Session) - What is Zero-Knowledge (like, actually)?

What is Zero-Knowledge (like, actually)?

zkSecurity is helping zkHack kick off a new season of zkHack whiteboard sessions!

In this module, Nicolas Mohnblatt and David Wong from zkSecurity dig into the term “Zero Knowledge” and discuss what this property actually is, when it is being used (or not) and what characteristics some systems need in order to be considered truly ZK. They then highlight the different types of ZK (perfect, statistical, and computational), discuss the distinction between dishonest and honest verifiers, and the preference for adaptive models over non-adaptive ones. Additionally, they explore methods for generating hiding commitments from techniques such as KZG, Pedersen, and hashes, and conclude with an overview of the zero-knowledge analysis of PLONK.

watch it on youtube or on the zkhack.dev page

What's in it? Check the timestamps:

00:00 – Introduction 01:03 – ZK, SNARKs, Proving… High-level overview 04:53 – Defining ZK and the concept of Simulator 08:41 – A concrete example of a Simulator with the Schnorr Identity Protocol 14:06 – Honest vs. dishonest Verifier 19:28 – Non-interactive to interactive protocol with Fiat-Shamir 24:50 – The 3 flavors of ZK 29:52 – Application to the PLONK protocol 46:37 – Managing KZG and its trusted setup 50:00 – The ZK flavor of PLONK 57:02 – Summary

Keep reading
Latest

Optimizing Cryptography with AI

Many of us are using AI to generate code. Vibe coding cryptography is especially sensitive - you have to uphold strict mathematical correctness. This can lead to wrong security guarantees and soundness bugs. We will discuss what are some patterns to do it well.

Kobi Gurkan · August 11, 2026

Introducing zkvmBlast: Differential Fuzzing for Ethereum's zkVMs

zkVMs are moving to the center of Ethereum's roadmap, which means a bug in a zkVM is turning into a bug in Ethereum itself. We built zkvmBlast, a zkVM-agnostic differential fuzzer that runs the same program across SP1, RISC0, OpenVM, Pico, Zisk, and Airbender against a reference simulator and flags any disagreement. It hunts for both soundness and completeness bugs, with a deliberate focus on completeness, an under-explored class that can turn a single valid block into a liveness failure. We share the first batch of findings.

Stefanos Chaliasos, Martín Ochoa, Varun Thakore · August 10, 2026

Circom-Auditor: Open-Source Skills for Finding Vulnerabilities in Circom Code

We are releasing zk-skills, a set of open-source security skills for AI coding agents, starting with circom-auditor: a first line of defense against vulnerabilities in Circom circuits, compatible with both Claude Code and Codex. On the zkbugs benchmark it detects up to 66 of 70 known bugs when pointed at the vulnerable circuits, and up to 40 of 56 when let loose on the full original codebases, far ahead of existing Circom security tools.

Stefanos Chaliasos, Hao Pham, False Witness Team · August 05, 2026
Recommended

zkBank: you think you have what it takes to work at zkSecurity?

Join us as we dive into the world of ZK through an exciting challenge called zkBank! Whether you're a bug-hunting enthusiast or just curious about zero-knowledge projects, this is your chance to test your skills and learn across various areas. Think you can crack it? Check out the details and see if you have what it takes.

ZK/SEC · February 27, 2024

zkBitcoin: Use Zero-Knowledge Applications (zkapps) on Bitcoin

We're excited to introduce zkBitcoin, a new tool that lets you create zero-knowledge applications on Bitcoin using a minimal layer 2 protocol. This innovation opens up a world of complex, privacy-focused apps by enhancing Bitcoin's scripting capabilities. We're currently on testnet, so you can jump in and explore the possibilities. Check out our whitepaper or watch some videos for a deeper dive. It's an exciting time for Bitcoin development, and we can't wait to see what you'll build!

David Wong · January 31, 2024

Introducing bugs.zksecurity.xyz a knowledge base for ZK bugs

We're thrilled to introduce our new site, [bugs.zksecurity.xyz](https://bugs.zksecurity.xyz/), a hub for exploring past vulnerabilities in ZK circuits. Dive into our growing catalog of documented bugs and learn how we've reproduced some with comprehensive scripts. Discover evaluations of prominent security tools like Circomspect and Picus, and see where they shine or stumble. We're calling on the community to join us in expanding this invaluable resource, whether by adding bugs, reproducing them, or improving our platform. Let's collaborate to elevate ZK security together!

Stefanos Chaliasos · February 17, 2025