ZK and cryptography audit
Circuits fail quietly. A soundness bug mints money in silence.
What it is
Cryptographic code fails differently from ordinary code. An under-constrained circuit does not throw an error; it accepts a proof it should have rejected, and the first sign of trouble is the balance sheet.
We review the construction and the implementation together: the scheme, the circuit constraints, the trusted setup, the randomness, and the glue code where most real breaks actually happen.
What we examine
- Circuit review for under-constrained signals, the dominant class of ZK bug.
- Soundness and completeness of the proving system as you have used it.
- Trusted setup handling, ceremony assumptions and what a compromised setup permits.
- Custom primitives reviewed against the standard construction they resemble.
- Randomness: sources, bias, predictability and reuse of nonces.
- Signature schemes, including malleability and cross-protocol replay.
- Verifier contract review, where an otherwise sound proof system is commonly undone.
What you get
Findings across the circuit, the scheme and the verifier, with severity.
Concrete exploit descriptions for soundness issues, not abstract warnings.
A statement of the cryptographic assumptions your design depends on.
A re-audit of your fixes, included.
How the engagement runs
- 01
Scope
Scheme, circuits, proving stack and verifier. Fixed quote.
- 02
Read the maths
The construction is reviewed before the code, because a sound implementation of a broken scheme is still broken.
- 03
Constrain
Circuits checked signal by signal for missing constraints.
- 04
Report
Findings with exploit descriptions, then verification of your fixes.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
Which proving systems do you cover?
The common Groth16, PLONK and STARK families, and the circuit languages built on them. Tell us your stack in scoping and we will say plainly whether it is within our competence.
Is an under-constrained circuit really that serious?
It is usually the worst finding available. It means invalid proofs are accepted, which in a bridge or a mixer means unlimited minting, silently, with no error anywhere.
Do you audit the trusted setup ceremony?
We review the assumptions and the handling, and advise on ceremony design. Observing a live ceremony is a separate engagement.
Often bought with
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Formal verification
Mathematical proof that a critical property holds for every reachable state, not just the tested ones.
L1 and L2 infrastructure audit
Consensus, client code, validator economics, sequencers and proof systems.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote