Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper systematically evaluates the landscape of zero-knowledge proof (ZKP) security tools, revealing that while these tools can detect 45.7% of bugs in isolated targets, their effectiveness drops significantly to 19.6% when applied to full codebases. The study also identifies critical gaps in formal verification efforts and highlights the reliance on human-led development, despite the widespread use of LLMs among practitioners. By surveying 48 practitioners, the authors provide actionable insights aimed at improving the integration of security tooling in ZKP development and auditing processes.
Despite the promise of zero-knowledge proofs, current security tools only catch a fraction of vulnerabilities in real-world applications, exposing critical gaps in their effectiveness.
Zero-knowledge proofs (ZKPs) have become a core technology for privacy and verifiable computing. They are used to secure blockchains that handle billions of dollars and identity applications dealing with sensitive personal data. However, ZKP systems are complex, and subtle implementation errors can completely break their guarantees, letting attackers forge money or false proofs of identity. Researchers and practitioners have therefore developed a growing set of bug detection and formal verification methods to secure these systems. Yet their real-world effectiveness and adoption remain unclear. In this paper, we aim to shed light on the state of ZKP security tooling. We first systematize the landscape of these tools and observe that most target Circom, leaving newer DSLs and zkVMs with limited support. We then evaluate six tools across 70 real-world vulnerabilities and find that while the tools detect 45.7% of bugs on isolated targets, their effectiveness drops to 19.6% on full codebases, with important vulnerability classes left unaddressed. We also present the first systematic analysis of formal verification efforts, revealing that current work focuses primarily on constraint correctness and identifying key gaps and risks. Finally, we survey 48 practitioners, showing that development and security remain human-led, LLMs are widely used, and practitioners prioritize tools with clearer guarantees and lower integration effort. Overall, our results highlight the need for better integration of security tooling with the development and auditing process, and we provide actionable insights for researchers and practitioners.
Max Planck