Automated Security Validation for Zero-Knowledge Systems

Objetivo

Zero-knowledge (ZK) systems are foundational to modern
privacy-preserving technologies, yet ensuring the correctness of
their increasingly complex implementations remains a major
bottleneck. The high stakes involved---for instance, the 745
million USD in digital assets managed by the Linea blockchain
that relies on such infrastructure---highlight the critical need
for a scalable and reliable solution. Currently, correctness
relies heavily on costly and labor-intensive manual audits, which
do not scale effectively.

CIRCUZZ addresses this gap by commercializing a breakthrough
automated-testing technology derived from the ERC-funded MirandaTesting
project. Originally developed for ZK circuit-processing pipelines, our
approach has since been generalized to ZK virtual machines
(zkVMs). Using metamorphic testing, CIRCUZZ systematically
uncovers critical correctness and security bugs across ZK systems
without manual intervention. The effectiveness of our approach is
already proven: our research prototype discovered more than 30
significant logic bugs in major, previously audited ZK
systems. These findings led to multiple real-world bug bounties,
with all reported issues acknowledged and nearly all fixed by
developers. With the support of key industry partners, including
a leading audit firm, this Proof-of-Concept project will
transform our prototype into a robust, commercial-grade solution
for continuous validation of ZK systems, validate a
testing-as-a-service business model, and prepare the groundwork
for launching a spinout company. CIRCUZZ will thus provide an
essential safety net for the rapidly expanding ZK ecosystem,
accelerating the creation of trustworthy digital infrastructure.