ZK protocols are becoming popular due to increased privacy and scalability of transactions on the blockchain. They allow one party to prove to the other that the statement is true, without disclosing information.
During the last 100 checks, Veridise analyzed 1,605 discovered vulnerabilities. On average, the researchers managed to find about 16 problems per check, while the average audit rates of protocols using ZK are slightly higher — about 18 problems. 55% (11 out of 20) of the audits of the ZK protocols contained a critical problem, whereas during the checks of smart contracts, wallet integration, implementation of blockchain and repeaters, this figure was 27.5% (22 out of 80). Analysts attributed this to the complex cryptographic designs of the ZK protocols and their innovative nature.
According to Veridise, the most common vulnerabilities in the DeFi sector were logical errors (385), the probability of system recovery (355) and data validation (304), which in total accounts for 65% of all problems detected during audits. These three problems also dominated among the 360 vulnerabilities found related to the ZK audit.
Of the 223 critical vulnerabilities found, logical errors (91) and data validation problems (35), insufficient restrictions (19), denial of service (16) and access control problems (13) prevailed. About 78% of high-severity problems (174) in all checks are attributed to these five types of errors. In general, critical errors account for 10% to 30% of vulnerabilities, analysts said.
John Stephens, CEO and co-founder of Veridise, explained that the development of ZK protocols requires precise semantics of operations. When it is incorrectly encoded in the constraints, errors occur. A large number of identified errors arise due to the fact that ZK is very different from the usual programming paradigm. He fears that attackers may create evidence that will trick the verifier into mistaking a false statement for a true one, and this will seriously undermine the integrity of the protocol.
Recall that last year, the decentralized OKX exchange was subjected to a hacker attack, as a result of which the site lost more than $ 2.7 million due to a security breach in a smart contract. In March, the Curio crypto project lost $16 million. The reason was a critical vulnerability related to voting rights.