From May 28, 2025 to Jun. 9, 2025, RISC Zero engaged Veridise to conduct a security assessment of their Kailua Protocol, which aims to create an infrastructure for optimistic rollups that resolve disputes with a zero-knowledge virtual machine (zkVM) application. In this audit, Veridise only reviewed the off-chain zkVM application and no on-chain components. This is the third review Veridise has conducted on the Kailua Protocol. Compared to the other versions of the code audited, the new version contains a number of refactors and changes as well as introduces the notion of “stitching”, which enables proof decomposition by allowing proofs to rely on other proofs from the same zkVM application. Veridise conducted the assessment over 4 person-weeks, with 2 security analysts reviewing the project over 2 weeks. The review strategy involved a thorough code review of the program source code performed by Veridise security analysts.