Cowrie Research

zksecurity-primary-sources-2026-05-07

3 min read

zkSecurity primary-source snapshot

Fetched: 2026-05-07 UTC

1) GitHub organization profile / profile README

Source: https://raw.githubusercontent.com/zksecurity/.github/main/profile/README.md

Selected excerpts from the official source:

We are a security R&D team specializing in advanced cryptography.

We conduct expert security audits for zero-knowledge protocols, cryptographic algorithms, smart contracts, and more.

Our expertise spans zero-knowledge proofs (ZKP), multi-party computation (MPC), fully homomorphic encryption (FHE), and post-quantum cryptography.

Additional signals from the source:

  • The org profile frames zkSecurity as a cryptographic research-and-assurance team rather than a generic smart-contract audit shop
  • The same source also points to open-source projects and tools, suggesting the team’s work spills into reusable engineering infrastructure

2) Public reports portal

Source: https://reports.zksecurity.xyz/

Selected excerpts from the official site:

Audit of Aptos Confidential Assets

Audit of PeerDAS KZG libraries

Audit of RiscZero Helios

Audit of Self EU ID cards Circuits, OFAC Checks, and Smart Contracts

Audit of Darkfi contracts

Audit of Penumbra’s Circuits

Additional signals from the source:

  • The reports archive spans circuits, cryptographic primitives, consensus, smart contracts, and data-availability components, which is broader than most smart-contract-focused audit portfolios
  • The named clients and topics suggest zkSecurity is embedded in the technical edge of ZK and cryptographic protocol development, not only typical DeFi review work

3) zkbugs dataset README

Source: https://raw.githubusercontent.com/zksecurity/zkbugs/main/README.md

Selected excerpts from the official source:

Reproduce ZKP vulnerabilities.

This repo includes 139 vulnerabilities in the following DSLs:

Circom (70)

Halo2 (35)

Cairo (8)

Risc0 (3)

Additional signals from the source:

  • zkbugs is one of the clearest reasons to catalog zkSecurity as infrastructure: it packages public, reproducible vulnerability knowledge for other engineers and researchers
  • The repo’s structure, configs, helper scripts, and provenance fields show this is a maintained dataset/workbench rather than a lightweight marketing sample

4) Reclaim technical writeup

Source: https://blog.zksecurity.xyz/posts/reclaim/

Selected excerpts from the official site:

Through two audit iterations, it became evident that the word-based circuit approach still posed challenges, as several bit-level operations could not be efficiently constrained.

Our new circuit, validated as both secure and efficient, emerged as a 10% smaller and faster alternative to the word-based approach.

Additional signals from the source:

  • The writeup shows zkSecurity publishing deep technical reasoning about design tradeoffs and bug classes, not just sanitized audit summaries
  • It also demonstrates that the team’s role can extend from issue finding into concrete cryptographic redesign and performance/security improvement

Notes

  • zkSecurity appears best cataloged as cryptographic-security R&D / zero-knowledge audit-report infrastructure / reproducible ZKP-vulnerability dataset.
  • The most revealing primary sources were the GitHub organization profile, the public reports portal, the zkbugs repository, and the Reclaim technical writeup.
  • No canonical standalone zkSecurity whitepaper or litepaper surfaced in this pass.

Graph View