Search papers, labs, and topics across Lattice.
This paper introduces VeriSynth, a novel framework that automates the formal verification of zero-knowledge Ethereum Virtual Machines (zkEVMs) by synthesizing executable verification models from Rust code. By leveraging a hybrid approach where a language model translates code into symbolic constraints and a SMT solver verifies correctness, VeriSynth addresses the limitations of current manual specification practices and LLM hallucinations. The framework demonstrates a remarkable bug detection rate exceeding 90% on a new zkEVM verification benchmark, significantly outperforming existing methods.
Achieving over 90% bug detection in zkEVMs, VeriSynth transforms how we ensure the correctness of cryptographic implementations.
Zero-Knowledge Ethereum Virtual Machines (zkEVMs) secure Ethereum rollups by generating zero-knowledge proofs that guarantee off-chain execution correctness. However, subtle implementation bugs (e.g., incorrect gas accounting) can lead to valid proofs certifying semantically faulty states, thereby silently defeating cryptographic guarantees. Formal verification via SMT solvers can prevent this, but is bottlenecked by specification: current zkEVM development practice lacks automated methods to translate Rust opcode handlers into verification models. Current practices rely on unsustainable manual specifications, while LLM-based approaches suffer from hallucination and lack formal guarantees. To address this, we propose VeriSynth, a framework that synthesizes executable Python/Z3 verification models from Rust zkEVM code. VeriSynth enforces a hybrid paradigm: an LLM acts strictly as a formalization frontend to translate code into symbolic constraints, while an SMT solver serves as the correctness arbiter. To handle complex multi-component state transitions, VeriSynth integrates semantic decomposition, retrieval-grounded prompting, and verification-guided auto-repair into a closed-loop pipeline. We evaluate VeriSynth on the first source-level zkEVM verification benchmark, encompassing both correct and faulty opcode implementations. VeriSynth achieves a bug detection rate of over 90%, substantially outperforming direct and conversational LLM baselines, as well as a production-grade handwritten mutation-testing suite. Ablation studies confirm that each pipeline component is critical to the framework's overall effectiveness.
