{
  "type": "option",
  "name": "Cryptographic review of the protocol and proof system",
  "slug": "cryptographic-review",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/cryptographic-review/",
  "markdown": "https://zkpick.com/md/audit/cryptographic-review.md",
  "category": "Cryptography review",
  "summary": "Cryptographic review of the protocol and proof system: Cryptography review. Layer: Proof system. Characteristic finds: Weak Fiat–Shamir, unsound composition and recursion boundaries, wrong concrete security parameters. Blind to: Implementation defects in the circuit above it; deployment and integration issues. Coverage claim: None — argument-based. Cost profile: High; cryptographers, not circuit engineers. Choose it when: Mandatory if you implement, modify or newly compose a proof system, add recursion or aggregation, change the transcript, or pick non-standard parameters. Reducible — not eliminable — if you use a mainstream library unmodified at a pinned, audited version.",
  "description": "Review of the argument system itself and everything below the arithmetisation: the soundness argument and its assumptions, what the Fiat–Shamir transcript absorbs, commitment instantiation, hash and sponge parameterisation, curve and subgroup structure, recursion composition, and the concrete bit-security the chosen parameters actually imply. This layer produces the highest-impact failures because they are construction-wide rather than deployment-specific.",
  "notes": [],
  "sections": [],
  "strengths": [
    "The only layer that can catch construction-level soundness breaks",
    "Findings are reusable across the ecosystem and often warrant CVEs and coordinated disclosure",
    "Supported by shared artefacts: the ZKProof Community Reference, ZKDocs, soundness calculators"
  ],
  "tradeoffs": [
    "Requires cryptographers rather than circuit engineers — a different and scarcer skill set",
    "Hardest layer to scope and schedule; results are not predictable per reviewer-week",
    "Frequently skipped because the upstream library is assumed 'already audited' — which is how weak Fiat–Shamir spread across many implementations",
    "Concrete-security arguments for newer hash-based systems still rest on unproven assumptions"
  ],
  "bestFit": "Mandatory if you implement, modify or newly compose a proof system, add recursion or aggregation, change the transcript, or pick non-standard parameters. Reducible — not eliminable — if you use a mainstream library unmodified at a pinned, audited version.",
  "maintainers": null,
  "maturity": "Established discipline",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2023/691",
  "facts": [
    {
      "table": "What each assurance technique can and cannot find",
      "url": "https://zkpick.com/audit/#audit-matrix-cryptographic-protocol-review",
      "tech": "Cryptographic protocol review",
      "layer": "Proof system",
      "catches": "Weak Fiat–Shamir, unsound composition and recursion boundaries, wrong concrete security parameters",
      "blind": "Implementation defects in the circuit above it; deployment and integration issues",
      "coverage": "None — argument-based",
      "cost": "High; cryptographers, not circuit engineers"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "zkSecurity — ZK security audits and cryptographic engineering",
      "url": "https://zksecurity.xyz/",
      "kind": "provider"
    },
    {
      "title": "Veridise — security proofs for cryptographic protocols",
      "url": "https://veridise.com/security/security-proofs/",
      "kind": "provider"
    },
    {
      "title": "Weak Fiat–Shamir Attacks on Modern Proof Systems (Dao, Miller, Wright, Grubbs)",
      "url": "https://eprint.iacr.org/2023/691",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/cryptographic-review/",
  "authors": [
    "MarketComp"
  ]
}