PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unfaithful claims: breaking 6 zkVMs

osec.io | blog | #web3 | #vulnerability-research | #cryptography | #vulnerability | #zero-knowledge | #zkvm | #fiat-shamir | #soundness
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec breaks soundness in six zkVMs — Jolt, Nexus, Cairo-M, Ceno, Expander, Binius64 — where unbound prover values let attackers prove false statements after seeing Fiat-Shamir challenges.
Published
Collected

Related coverage

blog · certik.com
CertiK Formally Verifies zkWasm, Proving Mathematical Soundness of a Leading zkVM
CertiK’s formal verification of zkWasm provides mathematical proof that a leading zero-knowledge virtual machine executes programs correctly — a rigor level beyond traditional audits, now validated for ACM CCS 2026.
blog · osec.io
Unverified evaluations in Dusk’s PLONK
OtterSec finds a critical soundness flaw in dusk-plonk: the verifier never validated four prover-supplied polynomial commitments, enabling forged proofs and minting DUSK from nothing.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
We beat Google’s zero-knowledge proof of quantum cryptanalysis
Trail of Bits forged a zero-knowledge proof beating Google's quantum cryptanalysis results by exploiting memory safety and logic bugs in its Rust zkVM prover code, demonstrating zkVM security risks.
blog · blog.trailofbits.com
Serving up zero-knowledge proofs
The Fiat-Shamir transformation makes zero-knowledge proofs non-interactive, but botching it breaks security. This post explains ZK proofs via a tennis analogy and common implementation pitfalls.
blog · certik.com
What Is a Zero-Knowledge Virtual Machine (zkVM)?
A zkVM combines zero-knowledge proofs with virtual machines to prove a program ran correctly without re-execution or exposing internal data, enabling scalable, privacy-preserving computation.
Back