Static analyzer for ZK
Catch critical zero-knowledge circuit bugs before deployment with static analysis.
ZK Vanguard is Veridise’s powerful static analyzer that identifies common and subtle vulnerabilities in zero-knowledge circuits. Purpose-built for ZK, it combines deep formal methods with practical insights from real-world audits to catch critical bugs before your system hits production.
Whether you’re building with Circom, Halo2, or custom DSLs, ZK Vanguard helps you detect bugs such as under-constrained bugs, private input leaks, and non-deterministic witness code — all without relying on runtime execution.
Why use a static analyzer like ZK Vanguard?
Zero-knowledge circuits are notoriously difficult to get right. A single missing constraint can render your entire ZK circuit insecure. Moreover, our analysis shows that ZK audits are twice as likely to uncover critical-severity bugs compared to smart contract audits.
ZK Vanguard was developed by Veridise researchers who have published foundational research on ZK circuit security and have extensive experience auditing production-grade ZK systems.
We built ZK Vanguard to help ZK developers to detect a wide variety of ZK vulnerabilities.
Core features
CI/CD-friendlystatic analysis
Integrates seamlessly into development pipelines, enabling continuous monitoring and preventing regressions during refactors. Get vulnerability reports delivered straight into GitHub Actions.
Advancedvulnerability triage
Through AuditHub, ZK Vanguard allows developers to easily triage reported findings. Related findings are grouped together, and root causes can be marked to eliminate false alarms in bulk.
Customdetectors
If you have vulnerability patterns specific to your codebase, you can write your own detectors using ZK Vanguard’s custom query language. Utilize ZK Vanguard’s advanced static analysis engine to perform value flow analysis, constraint dependency analysis, and more.
Use cases for a static analyzer in ZK development
Early-stagesafety check
Catch critical zero-knowledge security vulnerabilities during development to avoid redesigning your entire protocol later on.
Integrationwith formal audits
Run ZK Vanguard before a lengthy manual audit to uncover bugs ahead of time and get a more positive audit report.
Regressionprotection
Automatically check that patches haven’t introduced new vulnerabilities.
Zero-knowledge vulnerabilities detected
ZK Vanguard’s static analyzer leverages a growing set of detectors tailored for zero-knowledge circuits:
Non-deterministic witness
Private input leakage
Unconstrained signals
Underconstrained outputs
Unused subcomponents
Witness-constraints difference
Divide-by-zero error detection
Learn more about each detector in the ZK Vanguard docs
Combine ZK Vanguard with Picus
ZK Vanguard and Picus work together to give you comprehensive coverage of your ZK circuit’s security. ZK Vanguard uses static analysis to detect a wide range of vulnerabilities directly from your source code. Picus complements it by formally verifying and providing guarantees that your circuit is free from under-constrained bugs.
Together, they form a powerful and complementary toolkit for ensuring soundness and constraint correctness.
Why choose ZK Vanguard?
Designed to deliver concise, accurate reports that focus on the vulnerabilities that matter.
Unlike competing tools, ZK Vanguard performs deep ZK-specific static analysis using a growing set of custom detectors.
Fits seamlessly into CI/CD and audit workflows.
Backed by Veridise’s world-class static analysis, formal verification, and security research.
Trusted by industry leaders
ZK Vanguard has been used to secure industry-leading zero-knowledge systems, including L2 rollups, zkVMs, and applications built on top of them. Our ZK clients include companies such as RISC Zero, Succinct, and Linea.
Try ZK Vanguard
When you choose Veridise as your security auditor, you’ll get access to ZK Vanguard static analyzer via our AuditHub platform — no extra fees, no setup required.
Want standalone access to AuditHub and ZK Vanguard?
Stay tuned, this will be available later this year!