PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Circomspect has more passes!

blog.trailofbits.com | blog | #cryptography | #static-analysis | #blockchain | #zero-knowledge | #trail-of-bits | #circomspect | #circom
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Circomspect 0.8.0 adds five analysis passes for Circom ZK circuits — unconstrained signals, division-by-zero, Circomlib LessThan misuse — and would have caught the million-dollar ZK bug.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · blog.trailofbits.com
Circomspect has been integrated into the Sindri CLI
Trail of Bits' Circomspect static analyzer for Circom zero-knowledge circuits is now integrated into the Sindri CLI, adding linting and security analysis to a unified circuit dev workflow.
blog · blog.trailofbits.com
Tag, you’re it: Signal tagging in Circom
Trail of Bits explains Circom signal tags, a compile-time feature enforcing preconditions on ZK circuit templates, and shares four rules to prevent soundness bugs and ease auditing.
blog · certik.com
What Is a Zero-Knowledge Virtual Machine (zkVM)?
A zkVM combines zero-knowledge proofs with virtual machines to prove a program ran correctly without re-execution or exposing internal data, enabling scalable, privacy-preserving computation.
Back