EXHIBIT 01 · re-check
Already-audited production circuits, re-checked in July 2026: 97 circuits, 0 false-positive FAILs.
89 analysed, 8 inconclusive. Run of 2026-07-10, Circomspect engine only; not yet re-measured with the current engines. evidence
Prove it can break.
97 already-audited production circuits re-checked: 0 false-positive FAILs (July 2026 re-check, Circomspect engine only; not yet re-measured).
Audit replay · view-only
Watch an audit.
A zk-audit pass over a real zkBugs case: it reads the circuit, maps every signal and constraint, analyzes it, and traces the path from the entry template to the fault. Then the same pass on the fixed version.
The replay starts when it scrolls into view.
side –
stage –
- nodes
- 0
- flags
- 0
- fault paths
- 0
0 / 0
Illustrative cases, not a detection rate. The analysis is shown as one stage at a fixed pace; bundled cases are DEV-split zkBugs cases. Open the full view for the stage log.
What is measured, and what is not
Numbers come with a date and a source.
EXHIBIT 02 · benchmark corpus
140 zkBugs entries catalogued for the benchmark. None are Noir.
source: zkBugs, commit 212cc50. run log
EXHIBIT 03 · test suite
620 automated tests passing in the zk-audit repo.
passing as of 2026-10-26 (3 skipped). status
In progress: a detection benchmark against the public zkBugs known-bug corpus. The method and the run log are on the benchmark page, and results post there. Until a run evaluates real cases, zk-audit claims no detection rate.
Two engagements
One for circuits. One for cryptography you already ship.
Pre-audit
An automated and expert-triaged pass over Noir and Circom circuits before your paid audit: under-constrained signals, missing range checks, unbound public inputs.
Quantum-Safe Review
A cryptographic inventory (CycloneDX CBOM), circuit-level findings, and conformance testing of ML-KEM, ML-DSA and SLH-DSA implementations against NIST ACVP vectors.
Where this sits
Free tools exist. Here is what is different.
zkSecurity released circom-auditor (MIT, August 2026), an open-source pre-audit skill for Circom, and zkhydra, which runs several open analysers together. If you only need a free first look at a Circom circuit, use them.
zk-audit is positioned on four things they do not offer:
- Noir support. Lint rules for Noir today (nine rules); machine-checked Noir uniqueness analysis is on the roadmap, not shipped.
- Machine-checked findings. Reject-vectors replayed through the real prover; the counterexample is the evidence (see sample output).
- CI with signed receipts (in development). Re-scan on every commit, with a signed record of what was checked. The signing pieces are in the repo; the public receipt is not live.
- Post-quantum readiness. Inventory, findings and implementation conformance in the same engagement.
In development
An audit badge and CI receipts.
A badge you can embed that links to a signed, replayable receipt of what was checked, at which commit, with which rule-pack hash. Concept, not live
The building blocks exist in the repo (rule-pack hash, commit pinning, SHA-256 manifest, optional cosign signing). The public receipt page and badge do not, and the receipt format and hosting are still open.