Veridise

Veridise is a blockchain security firm, founded in 2021, that grew out of the UToPiA program-analysis research group at UT Austin. It pairs manual audits with in-house tools: Picus for detecting under-constrained ZK circuits, the Vanguard static analyzer and the OrCa fuzzer. It fits teams building ZK circuits, zkVMs and proof infrastructure, and increasingly Stellar/Soroban and Aleo projects. The strongest evidence-backed signal is its public audit archive: 163 report pages from 2022 to 2026, heavy on zkVM and ZK work (13 RISC Zero reports alone). Its tools are backed by peer-reviewed papers at venues such as PLDI, CAV and IEEE S&P.

At a glance

Founded	2021 (company page)
Headquarters / jurisdiction	Not stated on pages fetched; origin is UT Austin's UToPiA group (company page)
Engagement model	Private firm audit, with the AuditHub platform offered to clients (request audit)
Core specialties	ZK circuit and zkVM audits, smart contract audits, L1/L2 audits, formal methods and security proofs (homepage)
Ecosystems / languages	EVM (Solidity), Circom/R1CS/gnark, RISC Zero and other zkVMs, Stellar Soroban, Aleo (Leo), Mina, Solana, Sui, per reports in the archive
Public report index	veridise.com/audits-archive
Open-source tooling	Picus, Medjai and others in the GitHub org
Published pricing	Not published

What they do

The homepage lists ZK audits, zkVM application audits, smart contract and DeFi audits, L1/L2 blockchain audits, wallet and integration reviews, NFT security, security proofs, security research and architecture review. It names these tools:

• Vanguard, a static analyzer
• OrCa, a fuzzer
• ZK Vanguard
• Picus
• AuditHub, an audit management platform

The homepage also says the team is 35+ people, including PhDs in program analysis, cryptography and software security, and that about half the team builds tooling rather than auditing.

The request-audit page offers a mutual NDA through DocuSign before you submit. It asks for one form per audit and mentions AuditHub access and post-audit validation. It publishes no timeline or pricing. Report write-ups such as the Lombard strategy vault summary show findings in Critical/High/Medium/Low/Warning/Informational buckets.

Specialties and ecosystem coverage

These counts come from the audit archive. On 2026-09-24, the page's HTML linked 163 distinct report pages: 8 from 2022, 44 from 2023, 53 from 2024, 50 from 2025 and 7 from 2026, counted by the date in each report URL.

• ZK circuits and zkVMs: This is the strongest area. Examples:
  • 13 RISC Zero reports, including the zkVM review, February 2025
  • Succinct's SP1 call-contract, July 2025
  • ZKM Ziren zkVM
  • Matter Labs' zkSync Airbender (RISC-V)
  • Aztec governance
  • circom-bigint
• EVM / Solidity: Examples include the Lombard strategy vault and Thetanuts Accreta Markets.
• Stellar / Soroban: Centiiv and a Stellar Soroban core review.
• Aleo and Mina: Examples include Nori's Mina multisig and several Aleo projects (Demox Labs, Venture23).
• Solana and Sui: Lombard LBTC Solana program and Ankr Sui liquid staking.

Compared with the directory:

• ZK proofs, formal verification, smart contracts and circuit auditing are all confirmed.
• Ethereum is confirmed. Polygon and Arbitrum were not isolated as report targets in this pass.
• No Scroll or Starknet report appears in the archive. The Cairo work found is the Medjai symbolic-execution tool, not a public Starknet audit.
• Linea has a company page in the archive, but no public report is linked from it.
• Stellar/Soroban and Aleo are well evidenced but not listed in the directory.

Recent public work

These were pulled from the audit archive. Dates are taken from report URLs. The archive table's month column sometimes differs from them.

1. Boundless marketplace: EVM smart contracts, June 2026.
2. Nori Mina multisig: ZK proof infrastructure, June 2026.
3. Lombard Finance strategy smart contracts: vault, May 2026. The write-up reports 1 high, 3 medium and 10 low findings.
4. Matter Labs zkSync Airbender: zkVM, RISC-V, 2026.
5. Centiiv 2.0 liquidity infrastructure: Soroban, April 2026.
6. Thetanuts Accreta Markets: Solidity, 2026.
7. Boundless Kailua: zkVM, February 2026.
8. ZKM Ziren zkVM: ZK circuits, late 2025.
9. EigenDA Hokulea: zkVM application, October 2025.
10. Aztec governance: October 2025.

Research, tooling and methodology

• Picus: Picus checks the uniqueness property (under-constrained signals) of ZK circuits. It supports Circom, R1CS and gnark, is MIT-licensed, and is based on the PLDI 2023 paper "Automated Detection of Under-constrained Circuits in Zero-Knowledge Proofs."
• Other open-source repos: The GitHub org includes Medjai (symbolic execution for Cairo), Eurus (DeFi attack synthesis), Coda (Coq-based circuit verification), and audithub-mcp and audithub-skills for connecting AI agents to its tools. No audit-report repository is hosted on GitHub; reports live on the website.
• Academic publications: The publications page lists papers at PLDI 2023, CAV 2024 and CAV 2025 (including "Zequal"), USENIX Security, IEEE S&P, POPL and OOPSLA.
• Blog: The blog publishes exploit case studies used as auditor training, for example the Arcadia $3.5M low-level call hijacking analysis (5 August 2026). That post does not claim Veridise audited Arcadia.
• Team: Leadership is listed on the company page: Isil Dillig (President and co-founder, UT Austin professor) and Jon Stephens (CEO and co-founder). See also the team page.
• Self-reported figures: The homepage claims 150+ audits and a 35+ person team. These were not independently verified. The archive count above is our own.

Track record and incidents

This pass found no reputable post-audit incident that names Veridise as auditor of the exploited code.

Who should consider them — and who might look elsewhere

• Consider them if you are shipping ZK circuits (Circom, gnark), a zkVM or zkVM-based application, a proof verifier, or a ZK rollup component. You should also consider them if you want tool-assisted review backed by published formal-methods research. Their archive also shows repeated Soroban and Aleo work.
• Also a fit for: EVM DeFi vaults and bridges, where the archive shows a steady run of Solidity reports.
• Look elsewhere, or ask for samples, if your main target is Starknet/Cairo or Scroll production code, or Move on Aptos. This pass found little public audit evidence for those, despite the Cairo tooling.

How to engage

Use the request-audit page. It offers a mutual NDA through DocuSign first, then a short form (name, project, email, notes). It advises reaching out early to secure an audit slot. Prepare the circuit or contract repository at a fixed commit, the constraint system or zkVM guest code, the specs and intended invariants, and any prior audit reports.

Gaps and unverified claims

• Headquarters location is not stated on the pages fetched.
• The directory lists Scroll and Starknet. No public Veridise report for either was found in the archive. The Linea company page in the archive shows no reports.
• The directory's publicReports URL (veridise.com/audits/) is a services page that points to the separate audit archive. It works, but it is not the index itself.
• Team size (35+) and audit count (150+) are the firm's own figures. The archive count of 163 report pages is ours.
• The archive table's month column and the date in the report URL sometimes differ (for example, Matter Labs Airbender).
• Pricing and turnaround are not published.

Sources

1. Veridise homepage — https://veridise.com — accessed 2026-09-24
2. Company page — https://veridise.com/security/blockchain/company/ — accessed 2026-09-24
3. Team page — https://veridise.com/team/ — accessed 2026-09-24
4. Audit archive — https://veridise.com/audits-archive/ — accessed 2026-09-24
5. Audits services page — https://veridise.com/audits/ — accessed 2026-09-24
6. Request audit — https://veridise.com/request-audit/ — accessed 2026-09-24
7. Publications — https://veridise.com/publications/ — accessed 2026-09-24
8. GitHub org — https://github.com/Veridise — accessed 2026-09-24
9. Picus repo — https://github.com/Veridise/Picus — accessed 2026-09-24
10. Medjai repo — https://github.com/Veridise/Medjai — accessed 2026-09-24
11. Blog: Arcadia exploit analysis — https://veridise.com/blog/audit-insights/low_level_call_hijacking_arcadia_exploit/ — accessed 2026-09-24
12. Blog: Lombard strategy vault audit write-up — https://veridise.com/blog/audits-archive/lombard_smart_contract_audit_strategy_vault/ — accessed 2026-09-24
13. Boundless marketplace report — https://veridise.com/audits-archive/company/boundless/marketplace-2026-06-24/ — accessed 2026-09-24
14. Nori Mina multisig report — https://veridise.com/audits-archive/company/nori/mina-multisig-2026-06-22/ — accessed 2026-09-24
15. Lombard strategy smart contracts report — https://veridise.com/audits-archive/company/lombard-finance/strategy-smart-contracts-2026-05-26/ — accessed 2026-09-24
16. Matter Labs zkSync Airbender report — https://veridise.com/audits-archive/company/matter-labs/zksync-airbender-2026-04-22/ — accessed 2026-09-24
17. Centiiv report — https://veridise.com/audits-archive/company/centiiv/centiiv-2-0-liquidity-infrastructure-2026-04-15/ — accessed 2026-09-24
18. Thetanuts Accreta Markets report — https://veridise.com/audits-archive/company/thetanuts/accreta-markets-2026-03-24/ — accessed 2026-09-24
19. Boundless Kailua report — https://veridise.com/audits-archive/company/boundless/boundless-kailua-2026-02-18/ — accessed 2026-09-24
20. ZKM Ziren zkVM report — https://veridise.com/audits-archive/company/zkm/ziren-zkvm-2025-11-12/ — accessed 2026-09-24
21. EigenDA Hokulea report — https://veridise.com/audits-archive/company/eigenda/hokulea-2025-10-02/ — accessed 2026-09-24
22. Aztec governance report — https://veridise.com/audits-archive/company/aztec/governance-2025-10-13/ — accessed 2026-09-24
23. RISC Zero zkVM report — https://veridise.com/audits-archive/company/risc-zero/zkvm-2025-02-24/ — accessed 2026-09-24
24. Succinct SP1 call-contract report — https://veridise.com/audits-archive/company/succinct/sp1-call-contract-2025-07-02/ — accessed 2026-09-24
25. circom-bigint report — https://veridise.com/audits-archive/company/circom-lib/circom-bigint-2022-11-15/ — accessed 2026-09-24
26. Lombard LBTC Solana program report — https://veridise.com/audits-archive/company/lombard-finance/lbtc-solana-program-2025-03-31/ — accessed 2026-09-24
27. Ankr Sui liquid staking report — https://veridise.com/audits-archive/company/ankr/sui-liquid-staking-2024-05-23/ — accessed 2026-09-24
28. Linea company page in archive — https://veridise.com/audits-archive/company/linea/ — accessed 2026-09-24