Skynet leaderboard
Zero-knowledge proofs are cryptographic protocols that allow one party to prove the validity of a statement without revealing any private information that the prover does not want to disclose. Zero-knowledge proofs enable verifiable computation and privacy in Web3, powering applications such as privacy-preserving protocols, cross-chain bridges, zkRollups, and zkVMs.
Research
Our research on ZKPs
CertiK identified two soundness bugs in zkWasm. The first, found during the stage 1 manual review, was a missing constraint on a Load instruction from memory. The second, uncovered by formal verification in stage 2, involved the Return instruction, where missing constraints could allow fake returns and unintended control flow. Both soundness vulnerabilities could allow malicious provers to generate invalid proofs that bypass the verifier's validity checks.
Why CertiK
Why choose CertiK for ZKPs security
CertiK is a trusted audit partner for zero-knowledge protocol projects, backed by deep expertise in formal verification and applied cryptography. Our audit process combines rigorous manual code reviews by domain experts with custom formal verification to ensure both the correctness of the prover's zero-knowledge proof generation and the integrity of the verifier's validation logic, as demonstrated in our work on zkWasm. This hybrid approach allows us to uncover subtle soundness vulnerabilities and logic flaws that manual review alone often misses, providing a higher level of assurance for your zero-knowledge cryptographic systems.
Method
How do ZKPs project audits work?
The audit process kicks off with a detailed analysis of a project's entire codebase.
On occasion and when deemed necessary, CertiK reserves the right to conduct a Team Verification (KYC) check on a project it suspects to be high risk.
Source code submission
Scoping & quote
Security analysis
Remediation guidance
Final report delivery
Offerings
What else we offer
KYC verification
Through a rigorous process that uses both AI and human verification, we verify the identities of your team to reassure users that their investment is in safe hands.Skynet
Skynet generates real-time insights of on-chain activity, allowing project teams to be alerted of any suspicious events and saving precious time in anticipating and responding to attack.SkyInsights
SkyInsights is a powerful crypto compliance and wallet screening platform. The comprehensive risk management system analyzes and flags wallet address and transaction risks.Penetration Testing
Safe and in-depth attack simulation to expose the most complex vulnerabilities on your crypto exchanges, wallets and Dapps.
Resources
Learn more from our resources
We have published multiple research articles covering the ZKPs ecosystem's evolution and security considerations.
Company updatesCertiK Formally Verifies zkWasm, Proving Mathematical Soundness of a Leading zkVMCertiK’s formal verification of zkWasm provides mathematical proof that a leading zero-knowledge virtual machine executes programs correctly — a rigor level beyond traditional audits, now validated for ACM CCS 2026.
Ecosystem analysisAptos Confidential APT: Verifiable Encrypted Transfers on MainnetAptos Confidential APT brings encrypted balances and transfers to Aptos mainnet while using zero-knowledge proofs, governance controls, and optional auditor access to keep state transitions verifiable.
Technical insightsWhat Is a Zero-Knowledge Virtual Machine (zkVM)?A zkVM is a computational system designed to verify that a program executed correctly, without revealing the program's internal data. By combining zero-knowledge proofs (ZKPs) with virtual machine (VM) technology, zkVMs enable verifiable computation across blockchain and Web3 ecosystems, boosting transparency, privacy, and scalability all at once.
Technical insightsHiding in Plain Sight: zERC20 and zk-Proof-of-BurnFor years, the industry has struggled with this exact question. In this article, we are going to dive deep into an emerging privacy solution: zERC20. zERC20 is a pragmatic, immediate implementation of a concept known as plausible deniability (originally proposed in EIP-7503), which means the cryptographic evidence of an action equally supports a completely innocent explanation. For zERC20, depositing funds into the privacy protocol is mathematically indistinguishable from a user accidentally sending tokens to a dead address. 
Technical insightsZero-Knowledge Virtual Machines (ZKVMs) in Practice: A Technical SurveyZero-knowledge virtual machines (ZKVMs) are proof-generating replicas of familiar software stacks. Because they turn heavyweight replays into quick proof checks with optional privacy, ZKVMs already anchor privacy-preserving DeFi flows, compliance attestations, oracle feeds, and rollups.
Technical insightsIntroducing Aleo: A Premier Platform for Private Blockchain ApplicationsAleo Systems has created a Layer 1 blockchain named Aleo with a focus on privacy achieved through the use of zero-knowledge proofs (ZKPs) and other cryptographic methods. Unlike most popular blockchains where data used and created by transactions can be viewed by an external observer, Aleo provides the ability to hide such information.