ZKP Security Review
Audit the end-to-end proof-system claim. Keep completeness, soundness, knowledge, zero knowledge, setup, composition, and efficiency as independent dimensions.
Scope
In scope: relation/transcript/setup, security definitions, reductions/extractors/simulators, Fiat-Shamir ROM/QROM, polynomial commitments, arithmetization, aggregation/recursion/folding/IVC, parameters/errors, and proof-system costs.
Out of scope: accepting protocol security from one local lemma, implementation side-channel certification, or inventing missing security proofs.
Required Inputs
- protocol/specification and exact proof version;
- relation/language, instance/witness, transcript and public parameters;
- claimed properties, adversary, setup/model, assumptions, and parameter set;
- dependent primitives/proofs and intended composition/deployment.
Success Criteria
- Each property has its own definition, adversary/model, error, proof status, and limitation.
- Setup/trapdoor/updatability/transparency assumptions are explicit.
- Fiat-Shamir transcript binding, oracle model, query loss, and classical/quantum status are checked.
- Composition, aggregation, recursion/folding/IVC implication steps are explicit.
- Parameter, soundness/knowledge/correctness errors and reduction losses are accumulated.
- Costs separate constraints, prover/verifier, proof size, setup, online, amortized, communication, memory, and operation model.
- End-to-end verdict stops at the first unsupported implication.
Failure Modes
- Missing relation/security definition: block the corresponding verdict.
- Proof sketch or inaccessible dependency: mark property unverified.
- ROM-to-QROM, HVZK-to-ZK, soundness-to-knowledge, or component-to-system upgrade: reject without checked transformation.
- Incomplete parameters/error terms: give symbolic review only.
- Unavailable implementation/artifact: do not verify measured costs or operational setup.
Never fabricate a property proof, extractor/simulator, oracle argument, parameter, benchmark, or trusted-setup fact.
Workflow
- Apply protocol.md to freeze the formal object and property matrix.
- Build dependency and implication graphs from primitives to system claims.
- Audit Fiat-Shamir/model, composition/advanced construction, parameters/errors, and costs.
- Return per-property and end-to-end findings with evidence status.
- Use evaluation-scenarios.md for future independent evaluation.
Output Contract
Return: object/version; relation/setup/transcript; property matrix; assumption/dependency graph; Fiat-Shamir/model findings; aggregation/recursion/folding findings; parameter/error ledger; cost ledger; blocking/major/minor findings; per-property verdicts; bounded end-to-end conclusion.
1---2name: zkp-security-review3description: Use when auditing an interactive or non-interactive zero-knowledge proof/argument, proof of knowledge, Fiat-Shamir transform, SNARK/STARK, polynomial commitment, aggregation, recursion, folding, or IVC system.4---56# ZKP Security Review78Audit the end-to-end proof-system claim. Keep completeness, soundness, knowledge, zero knowledge, setup, composition, and efficiency as independent dimensions.910## Scope1112In scope: relation/transcript/setup, security definitions, reductions/extractors/simulators, Fiat-Shamir ROM/QROM, polynomial commitments, arithmetization, aggregation/recursion/folding/IVC, parameters/errors, and proof-system costs.1314Out of scope: accepting protocol security from one local lemma, implementation side-channel certification, or inventing missing security proofs.1516## Required Inputs1718- protocol/specification and exact proof version;19- relation/language, instance/witness, transcript and public parameters;20- claimed properties, adversary, setup/model, assumptions, and parameter set;21- dependent primitives/proofs and intended composition/deployment.2223## Success Criteria2425- Each property has its own definition, adversary/model, error, proof status, and limitation.26- Setup/trapdoor/updatability/transparency assumptions are explicit.27- Fiat-Shamir transcript binding, oracle model, query loss, and classical/quantum status are checked.28- Composition, aggregation, recursion/folding/IVC implication steps are explicit.29- Parameter, soundness/knowledge/correctness errors and reduction losses are accumulated.30- Costs separate constraints, prover/verifier, proof size, setup, online, amortized, communication, memory, and operation model.31- End-to-end verdict stops at the first unsupported implication.3233## Failure Modes3435- Missing relation/security definition: block the corresponding verdict.36- Proof sketch or inaccessible dependency: mark property unverified.37- ROM-to-QROM, HVZK-to-ZK, soundness-to-knowledge, or component-to-system upgrade: reject without checked transformation.38- Incomplete parameters/error terms: give symbolic review only.39- Unavailable implementation/artifact: do not verify measured costs or operational setup.4041Never fabricate a property proof, extractor/simulator, oracle argument, parameter, benchmark, or trusted-setup fact.4243## Workflow44451. Apply [protocol.md](references/protocol.md) to freeze the formal object and property matrix.462. Build dependency and implication graphs from primitives to system claims.473. Audit Fiat-Shamir/model, composition/advanced construction, parameters/errors, and costs.484. Return per-property and end-to-end findings with evidence status.495. Use [evaluation-scenarios.md](references/evaluation-scenarios.md) for future independent evaluation.5051## Output Contract5253Return: object/version; relation/setup/transcript; property matrix; assumption/dependency graph; Fiat-Shamir/model findings; aggregation/recursion/folding findings; parameter/error ledger; cost ledger; blocking/major/minor findings; per-property verdicts; bounded end-to-end conclusion.54
RiaoMike