zkSecurity

zkSecurity is a cryptography-focused security firm that launched on 30 May 2023. It audits zero-knowledge proof systems, circuits and zkVMs, plus MPC, TEE and other advanced-cryptography code. It fits teams whose main risk is in the cryptography itself: proof systems, verifiers, confidential-transfer schemes, threshold signatures. It is a weaker fit for general DeFi contract review. The strongest evidence-backed signal is its public report index of 65 reports (2023–2026, re-counted 2026-10-14), with clients such as StarkWare, Aptos Labs, Anza (Solana), the Ethereum Foundation, RISC Zero and Aztec, alongside disclosed soundness bugs, including CVE-2026-46669 in OpenVM.

At a glance

Founded	Launched 30 May 2023 (A Year of zkSecurity)
Headquarters / jurisdiction	Not published on pages fetched
Engagement model	Private firm audit; also development work, research and the zkao AI auditing platform (homepage)
Core specialties	ZK proof systems and circuits, zkVMs, MPC and threshold signatures, TEEs, FHE and post-quantum cryptography (per the homepage)
Ecosystems / languages	Circom, Halo2, gnark, Plonky2, Cairo/STARK, o1js/Mina, Aleo/Leo, Move (Aptos), Solana, Solidity, Rust, per report tags in the report index
Public report index	zksecurity.xyz/audits, backed by reports.zksecurity.xyz
Open-source tooling	zkbugs, zkvmBlast, circom-auditor skills, noname and others in the GitHub org
Published pricing	Not published

What they do

The homepage lists four lines of work:

• security audits of ZK circuits and cryptographic protocols
• development of production cryptographic implementations
• research in ZK, MPC and FHE
• automation through zkao, an AI-agent platform for continuous analysis of cryptography code

The homepage claimed "100+" audit reports in September 2026; on 2026-10-14 it no longer showed a report count (homepage). The site offers several educational resources: a ZK bug tracker, an MPC security hub and courses on PLONK, sumcheck and Halo2.

The contact page describes three steps: a response within 24 hours with an assigned project lead, async or embedded collaboration, and ready-made NDA and review templates. It publishes no pricing or turnaround figures.

Specialties and ecosystem coverage

Evidence comes from the firm's report index JSON. On 2026-10-14 it listed 65 reports: 7 from 2023, 17 from 2024, 30 from 2025 and 11 from 2026 (63 on 2026-09-24); the newest were SecondFi (2026-09-25) and Zcash Ironwood (2026-09-04). The audits page notes that not all reports are listed. The most common technology tags were Merkle Trees, Poseidon, Circuits, Aleo, ECDSA, Schnorr and Groth16.

• Proof systems and zkVMs:
  • StarkWare Stwo-Cairo verifier (August 2025)
  • Axiom OpenVM 2.0 (June 2026)
  • RISC Zero Helios (April 2025)
  • Generalized Bulletproofs (June 2026)
• Confidential transfers and applied cryptography:
  • Anza Solana Token-2022 confidential transfers (September 2025)
  • Aptos Confidential Assets and Aptos Encrypted Mempool (March 2026)
  • Tongo on Starknet (October 2025)
  • Ethereum Foundation PeerDAS KZG libraries (September 2025)
• TEEs: Phala dstack (May 2025).
• Aleo and Mina: 14 reports are tagged Aleo. Mina work includes the Mina treasury and Zeko reviews.

Compared with the directory:

• ZK proofs, cryptography, MPC and TEE-adjacent work are confirmed. FHE and post-quantum appear as stated focus areas on the homepage, but no report in the public index was tagged for them in this pass.
• Ethereum and Starknet are confirmed. No Polygon or Scroll report appears in the index.
• Of the listed notable audits, StarkWare, Aztec, the Ethereum Foundation and RISC Zero are confirmed. "Solana Foundation" appears as a homepage client logo, and the public Solana report is for Anza.

Recent public work

These were pulled from the report index, sorted by date.

1. SecondFi proof-tool circuits and gnark prover patches: 9 September 2026 (report).
2. Zcash Orchard (Halo2), for the Tachyon Foundation: 14 July 2026 (report).
3. Axiom OpenVM 2.0: 9 June 2026 (report).
4. Zeko circuits, sequencer and DA layer: 3 June 2026 (report).
5. Generalized Bulletproofs, for MAGIC Grants: 1 June 2026 (report).
6. Mina decentralised treasury: 28 April 2026 (report).
7. Aptos Confidential Assets: 26 March 2026 (report).
8. Aptos Encrypted Mempool: 13 March 2026 (report).
9. INTMAX zERC20: 8 December 2025 (report).
10. Lighter spot-market circuits (Plonky2): 24 November 2025 (report).

Research, tooling and methodology

• Disclosed vulnerabilities:
  • The OpenVM pairing soundness bug (July 2026, CVE-2026-46669, critical) was found by the zkao AI auditor, validated by staff, and fixed in OpenVM 1.6.0.
  • The Solana ZK ElGamal "phantom challenge" bug (June 2025) was reported to Anza, which patched it at runtime level. Solana's post-mortem, as quoted in the post, reports no exploitation in the wild.
  • The blog index also lists write-ups on CIRCL library bugs and bron-crypto bugs.
• Tools:
  • zkbugs, a collection that reproduces ZK vulnerabilities
  • zkvmBlast (August 2026), a differential fuzzer for zkVMs that the firm reports found seven bugs across SP1, Pico and OpenVM
  • circom-auditor (August 2026), MIT-licensed AI-agent skills for reviewing Circom code
  • noname, a zkApp language
  • zkao, the AI auditing platform, which reached version 2.0 in July 2026 per the blog
• Research blog: The ZK/SEC Quarterly blog publishes ongoing cryptography research. Recent examples are Fiat-Shamir bugs (September 2026), a multi-part series on KZG variants, and a from-scratch CGGMP threshold ECDSA write-up.
• Team: The first-year retrospective names founders including David Wong and describes about 10 engineers by May 2024, working roughly half on audits and half on grant-funded development. No current headcount is published.

Track record and incidents

This pass found no reputable post-audit incident that names zkSecurity as auditor of the exploited code.

Who should consider them — and who might look elsewhere

• Consider them if you need review of a proof system, zkVM, verifier, custom circuits (Circom, Halo2, gnark, Plonky2, Cairo AIR, o1js, Leo), or cryptographic protocols such as confidential transfers, threshold signatures, KZG/DA libraries or TEE attestation. That is where nearly all of their public reports and disclosed bugs sit.
• Also a fit for: the Aleo and Mina ecosystems, which have many public reports.
• Look elsewhere, or pair with a DeFi-focused auditor, if your main risk is EVM DeFi business logic, economic design or large Solidity codebases. The index includes some Solidity work, but it is a small share. Also ask for samples if you specifically need FHE or post-quantum review, which the firm lists as focus areas but which do not show up as tags in the public index.

How to engage

Use the contact page. It lists an email route (send your protocol, timeline and goals) and a Telegram group, promises a response within 24 hours, and offers ready-made NDA templates. Prepare the specification or paper for your proof system, the circuit or verifier repository at a fixed commit, the threat model (soundness, completeness, zero-knowledge) and any prior audits.

Gaps and unverified claims

• Headquarters and a current headcount are not published. The directory's "~10 engineers (May 2024)" is the figure in the firm's May 2024 retrospective.
• The directory's founding year is 2023, matching the firm's blog, which gives a public launch date of 30 May 2023.
• The homepage claimed "100+" reports in September 2026 and showed no count on 2026-10-14; the public index lists 65. The audits page says not all reports are listed.
• No Polygon or Scroll reports were found. FHE and post-quantum are stated focus areas without a tagged public report.
• Pricing is not published.

Sources

1. zkSecurity homepage — https://www.zksecurity.xyz — accessed 2026-09-24
2. Audits page — https://www.zksecurity.xyz/audits — accessed 2026-10-14 (the former audits.html URL redirects here)
3. Contact page — https://www.zksecurity.xyz/contact.html — accessed 2026-09-24
4. Report index JSON — https://reports.zksecurity.xyz/index.json — accessed 2026-09-24
5. SecondFi report — https://reports.zksecurity.xyz/reports/secondfi-proof-tool/ — accessed 2026-09-24
6. Zcash Orchard report — https://reports.zksecurity.xyz/reports/zcash-orchard/ — accessed 2026-09-24
7. OpenVM 2.0 report — https://reports.zksecurity.xyz/reports/openvm/ — accessed 2026-09-24
8. Zeko report — https://reports.zksecurity.xyz/reports/zeko-2/ — accessed 2026-09-24
9. Generalized Bulletproofs report — https://reports.zksecurity.xyz/reports/generalized-bulletproofs/ — accessed 2026-09-24
10. Mina treasury report — https://reports.zksecurity.xyz/reports/mina-treasury-1/ — accessed 2026-09-24
11. Aptos Confidential Assets report — https://reports.zksecurity.xyz/reports/aptos-confidential-assets/ — accessed 2026-09-24
12. Aptos Encrypted Mempool report — https://reports.zksecurity.xyz/reports/aptos-encrypted-mempool/ — accessed 2026-09-24
13. INTMAX zERC20 report — https://reports.zksecurity.xyz/reports/intmax-zerc20-1/ — accessed 2026-09-24
14. Lighter spot market report — https://reports.zksecurity.xyz/reports/zklighter-spot-market/ — accessed 2026-09-24
15. StarkWare Stwo-Cairo verifier report — https://reports.zksecurity.xyz/reports/starkware-stwo-cairo/ — accessed 2026-09-24
16. Tongo (Starknet) report — https://reports.zksecurity.xyz/reports/tongo/ — accessed 2026-09-24
17. Anza Solana confidential transfers report — https://reports.zksecurity.xyz/reports/anza-solana-token2022/ — accessed 2026-09-24
18. EF PeerDAS KZG libraries report — https://reports.zksecurity.xyz/reports/ef-blst-kzg/ — accessed 2026-09-24
19. Phala dstack report — https://reports.zksecurity.xyz/reports/phala-dstack/ — accessed 2026-09-24
20. RISC Zero Helios report — https://reports.zksecurity.xyz/reports/risc0-helios/ — accessed 2026-09-24
21. Blog index (ZK/SEC Quarterly) — https://blog.zksecurity.xyz — accessed 2026-09-24
22. Blog: A Year of zkSecurity — https://blog.zksecurity.xyz/posts/a-year-of-zksecurity/ — accessed 2026-09-24
23. Blog: OpenVM bugs (CVE-2026-46669) — https://blog.zksecurity.xyz/posts/openvm-bugs/index.html — accessed 2026-09-24
24. Blog: Solana phantom challenge bug — https://blog.zksecurity.xyz/posts/solana-phantom-challenge-bug/ — accessed 2026-09-24
25. Blog: CIRCL bugs — https://blog.zksecurity.xyz/posts/circl-bugs/index.html — accessed 2026-09-24
26. Blog: bron-crypto bugs — https://blog.zksecurity.xyz/posts/bron-bugs/index.html — accessed 2026-09-24
27. Blog: zkvmBlast — https://blog.zksecurity.xyz/posts/zkvmblast/index.html — accessed 2026-09-24
28. Blog: circom-auditor — https://blog.zksecurity.xyz/posts/circom-auditor/index.html — accessed 2026-09-24
29. Blog: Fiat-Shamir bugs — https://blog.zksecurity.xyz/posts/fiat-shamir/index.html — accessed 2026-09-24
30. Blog: Building CGGMP from scratch — https://blog.zksecurity.xyz/posts/building-cggmp-from-scratch/index.html — accessed 2026-09-24
31. GitHub org — https://github.com/zksecurity — accessed 2026-09-24
32. zkbugs repo — https://github.com/zksecurity/zkbugs — accessed 2026-09-24
33. noname repo — https://github.com/zksecurity/noname — accessed 2026-09-24
34. zkao — https://zkao.io — accessed 2026-09-24
35. Circomspect repo (Trail of Bits) — https://github.com/trailofbits/circomspect — accessed 2026-09-24