DeFi audits of projects based on zero-disclosure proof-of-concept (ZK) technology were twice as likely to reveal critical bugs compared to other projects, according to The Block citing a Veridise report.
The company's experts analyzed 1,605 vulnerabilities identified in 100 audits. On average, they found 16 issues per audit, with ZK projects having a higher rate of 18 bugs.
In terms of critical vulnerabilities, 55% (11 out of 20) of ZK projects contained such issues, compared to 27.5% (22 out of 80) for other projects.
Experts noted that the security of ZK solutions is “just more complicated” because of the complex cryptographic designs and the innovative nature of the protocols. Veridise co-founder and CEO John Stevens explained that designing a ZK scheme requires precise reasoning about the semantics of the operations in the witness generator. When these constructs are incorrectly encoded due to constraints, errors occur.According to Stevens : “It makes sense that there are more errors in these schemas because they are very different from the typical programming paradigm”.
Overall, the most common vulnerabilities found in the audits were logic errors (385), maintainability (355) and data validation (304). These categories accounted for 65% of all issues identified.
Veridise emphasized that insufficient maintainability is not a security vulnerability in the strict sense, but poor code writing practices are “one step away from creating critical vulnerabilities.”
For the ZK protocols, a specific problem was “insufficiently bounded loops”, which had a 90% probability of causing a serious error. This occurs when arithmetic scheme constraints do not provide sufficient conditions to verify the correctness of the computation. Veridise noted that such conditions do not exist in traditional smart contracts.
This means that an attacker could create a proof that tricks the checker into accepting a false statement as true, seriously undermining the integrity of the protocol.
Recall, ForkLog talked about the development of ZK protocols in 2024 in an exclusive piece.
