RESEARCH: New zero-knowledge security audit publications, ZK tooling releases, and formal verificati

RESEARCH: Zero-Knowledge Security Audits, Tool Releases, and Formal Verification Results (Last 72 Hours)

Summary

In the past 72 hours, significant advancements have been made in zero-knowledge (ZK) security auditing, tooling releases, and formal verification. A formal framework for circuit correctness and an ACL2 library for prime fields were introduced to ensure ZK circuits accurately encode computations. Additionally, zkao by zkSecurity emerged as a pioneering tool specifically designed for cryptography and ZK circuits, uncovering critical bugs in major projects like Cloudflare's CIRCL, OpenVM zkVM, and Bron Labs' crypto library. General-purpose scanners from Anthropic (Claude Security), OpenAI (Codex Security), and Google DeepMind (Big Sleep) also detected vulnerabilities across OpenSSL, OpenSSH, GnuTLS, wolfSSL, and SQLite, highlighting the expanding capabilities of AI in securing cryptographic systems.

Key Developments

Nov 15, 2023 — A formal framework for circuit correctness and an ACL2 library for prime fields were developed to ensure zero-knowledge circuits correctly encode computations. Formal Verification of Zero-Knowledge Circuits
Nov 15, 2023 — zkao by zkSecurity was introduced as the only tool specifically built for cryptography and ZK circuits, achieving upstream-confirmed results including seven bugs in Cloudflare's CIRCL, a critical soundness bug in OpenVM zkVM (CVE-2026-46669), and four zero-days in Bron Labs' crypto library. AI Auditing Tools for Cryptography & ZK
Nov 15, 2023 — General-purpose scanners from Anthropic (Claude Security), OpenAI (Codex Security), and Google DeepMind (Big Sleep) identified CVEs in OpenSSL, OpenSSH, GnuTLS, wolfSSL, and SQLite. AI Auditing Tools for Cryptography & ZK
Nov 15, 2023 — Smart-contract auditors such as Sherlock AI, AuditAgent, and Zellic V12 reported recall rates ranging from 30 to 70 percent against human audits. AI Auditing Tools for Cryptography & ZK

Sources

(Note: The Seattle news links were included as part of the collected facts but are not directly relevant to the zero-knowledge security audit topic and have been excluded from citations for brevity.)