Audit of DeFi projects based on zero-knowledge proof technology (ZK) was twice as likely to identify critical errors than in general cases. This is reported by The Block with reference to the Veridise report.
The company's specialists analyzed 1,605 vulnerabilities identified during 100 inspections. They found an average of 16 problems per audit, while the indicator of ZK projects turned out to be slightly higher and amounted to 18 errors.
However, in terms of critical vulnerabilities, the last 55% (11 out of 20) contained similar problems compared with 27.5% (22 out of 80) of the remaining checks.
According to experts, the security of ZK solutions is "simply more complex" due to the complex cryptographic designs and the innovative nature of the protocols.
"The development of the ZK scheme requires an accurate justification of the semantics of operations in the witness generator. When these constructs are incorrectly encoded due to limitations, you get errors. It is logical that there are more of them in [these] schemes, since they are very different from the typical programming paradigm," explained John Stevens, co—founder and CEO of Veridise.
In general, the most common vulnerabilities discovered during audits were logical errors (385), ease of maintenance (355) and data validation (304). These categories accounted for 65% of all identified problems.
Veridise noted that the lack of usability, strictly speaking, does not relate to security vulnerabilities. But bad code writing practices "are one step away from creating critical vulnerabilities," the team stressed.
For ZK protocols, "insufficiently limited contours" became a specific problem, which with a 90% probability led to a serious error.
«[...] when the limitations of the arithmetic scheme do not sufficiently provide all the necessary conditions to verify that some calculations were performed correctly. They are not found in traditional smart contracts," the firm noted.
This means that an attacker can create evidence that will trick the verifier into mistaking a false statement for a true one, which will seriously undermine the integrity of the protocol.
Recall that ForkLog spoke about the development of ZK protocols in 2024 in an exclusive article.