• Dapps:16.23K
  • Blockchains:78
  • Active users:66.47M
  • 30d volume:$303.26B
  • 30d transactions:$879.24M
DeFi audit: ZK projects lead in the number of critical vulnerabilities

DeFi audit: ZK projects lead in the number of critical vulnerabilities

user avatar

by Elena Ryabokon

a year ago


DeFi audits of projects based on zero-disclosure proof-of-concept (ZK) technology were twice as likely to reveal critical bugs compared to other projects, according to The Block citing a Veridise report.

The company's experts analyzed 1,605 vulnerabilities identified in 100 audits. On average, they found 16 issues per audit, with ZK projects having a higher rate of 18 bugs.

In terms of critical vulnerabilities, 55% (11 out of 20) of ZK projects contained such issues, compared to 27.5% (22 out of 80) for other projects.

Experts noted that the security of ZK solutions is “just more complicated” because of the complex cryptographic designs and the innovative nature of the protocols. Veridise co-founder and CEO John Stevens explained that designing a ZK scheme requires precise reasoning about the semantics of the operations in the witness generator. When these constructs are incorrectly encoded due to constraints, errors occur.According to Stevens : “It makes sense that there are more errors in these schemas because they are very different from the typical programming paradigm”.

Overall, the most common vulnerabilities found in the audits were logic errors (385), maintainability (355) and data validation (304). These categories accounted for 65% of all issues identified.

Veridise emphasized that insufficient maintainability is not a security vulnerability in the strict sense, but poor code writing practices are “one step away from creating critical vulnerabilities.”

For the ZK protocols, a specific problem was “insufficiently bounded loops”, which had a 90% probability of causing a serious error. This occurs when arithmetic scheme constraints do not provide sufficient conditions to verify the correctness of the computation. Veridise noted that such conditions do not exist in traditional smart contracts.

This means that an attacker could create a proof that tricks the checker into accepting a false statement as true, seriously undermining the integrity of the protocol.

Recall, ForkLog talked about the development of ZK protocols in 2024 in an exclusive piece.

0

Rewards

chest
chest
chest
chest

More rewards

Discover enhanced rewards on our social media.

Other news

HTX Announces Start of Team Competition with Million-Dollar Prize Pool

chest

HTX starts team competitions with a total prize pool of one million dollars. Each participant receives cashback and a chance to win an SUV.

user avatarGiorgi Kostiuk

The Smarter Web Company Acquires 275 BTC, Total Holdings Reach 1,275 BTC

chest

The Smarter Web Company has acquired 275 BTC, raising its total holdings to 1,275 BTC amid Bitcoin's new record high of $118,000.

user avatarGiorgi Kostiuk

FRAX Recovery and GMX Incident Analysis: Implications for DeFi

chest

A hacker returned 5.49 million FRAX following the $42 million exploit on GMX. Changes in DeFi security are anticipated.

user avatarGiorgi Kostiuk

Bitcoin Reaches $117,000: Over $1 Billion in Short Liquidations

chest

Bitcoin hits a new high at $117,000, triggering over $1 billion in short liquidations. Increased volatility impacts financial markets.

user avatarGiorgi Kostiuk

Ripple and BNY Mellon: A New Era for Stablecoins

chest

Ripple partners with BNY Mellon for stablecoin custody, emphasizing institutional credibility for the project.

user avatarGiorgi Kostiuk

OKX Launches PUMP Token: How It Will Affect Meme Coins

chest

OKX starts pre-market trading of PUMP token from Pump.fun, with significant implications anticipated for meme coins.

user avatarGiorgi Kostiuk
dapp expert logo
© 2020-2025. DappExpert. All rights reserved.
© 2020-2025. DappExpert. All rights reserved.

Important disclaimer: The information presented on the Dapp.Expert portal is intended solely for informational purposes and does not constitute an investment recommendation or a guide to action in the field of cryptocurrencies. The Dapp.Expert team is not responsible for any potential losses or missed profits associated with the use of materials published on the site. Before making investment decisions in cryptocurrencies, we recommend consulting a qualified financial advisor.