{ "publisher": "RBlock Laboratories", "url": "https://rblocklabs.com/cryptography-audits.html", "verified": "November 2026", "licence": "Free to reuse with attribution to RBlock Laboratories and a link to the page.", "entries": [ { "uid": "ca-ncc-group-cryptography-services", "name": "NCC Group (Cryptography Services)", "website": "https://www.nccgroup.com", "hq": "Manchester, United Kingdom", "regions": [ "Europe", "North America", "APAC" ], "founded": 1999, "size_band": "1001-10000", "firm_type": "Security research firm with crypto practice", "summary": "Large listed security consultancy whose Cryptography Services team reviews cryptographic protocols and implementations, from ZK circuits and threshold ECDSA to BLS signature libraries and post-quantum readiness.", "best_for": "Protocol and enterprise teams that want an established consultancy for a fixed-scope review of a crypto library or protocol (signatures, ZK circuits, MPC) — especially when the same vendor must also cover pentest, hardware or assurance work.", "specialties": [ "Protocol design review", "Implementation audit", "Zero-knowledge proofs", "MPC / threshold signatures", "Post-quantum", "Side-channel & hardware", "Smart contracts" ], "languages": [ "Rust", "Go", "C/C++", "Java", "OCaml" ], "public_reports_url": "https://www.nccgroup.com/research/", "pricing_tier": "$$$$", "typical_engagement": "Short, fixed-scope reviews are common in its public reports: Anza BLS (2026) was 2 consultants / 6 person-days; Penumbra R1CS (2023) was 3 consultants / 20 person-days over two weeks. Larger multi-phase programmes are also offered.", "europe_presence": "UK headquarters (Manchester) with European operations including Fox-IT in the Netherlands. NCC sold its separate Dutch Fox Crypto B.V. unit to CR Group Nordic in March 2025 (EUR 78.5m); the Cryptography Services consulting practice was not part of that sale.", "strengths": [ "Dedicated Cryptography Services team with public reviews spanning ZK circuits (Penumbra R1CS, Zcash Orchard), threshold ECDSA (Qredo/Milagro) and signature libraries (Anza BLS12-381, 2026)", "Reports state scope, commit and effort (consultants, person-days), which helps buyers benchmark proposals", "Can bundle crypto review with pentest, hardware and assurance services from one vendor", "2025 research report cites Cryptography Services work on post-quantum migration, threshold signatures and secure messaging" ], "weaknesses": [ "Large-consultancy procurement and pricing relative to crypto boutiques", "Public output is modest in volume (NCC reports 8 public reports firm-wide for 2025), so fewer recent examples to compare than high-volume ZK boutiques", "Crypto team is one practice inside a ~2,000-person firm; ask which named cryptographers will be staffed" ], "key_works": [ { "title": "BLS12-381 and BLS signature implementation review", "client": "Anza Technology", "year": 2026, "kind": "Audit", "primitives": [ "Signatures", "Cryptographic libraries" ], "url": "https://github.com/anza-xyz/security-audits/blob/master/spl/NCCBLS12-381andBLSSignature-2026-05-12.pdf", "why": "Recent pairing-curve and BLS signature review for Solana; a current example of NCC's curve-arithmetic work.", "landmark": false }, { "title": "Auditable Key Directory (AKD) implementation review", "client": "Meta", "year": 2023, "kind": "Audit", "primitives": [ "Messaging & E2EE", "Hashing & commitments" ], "url": "https://www.nccgroup.com/media/phzpm0qv/_ncc_group_metaplatforms_e008327_report_2023-11-14_v10.pdf", "why": "Review of Meta's open-source key-transparency library behind WhatsApp's key directory; the WhatsApp integration was out of scope.", "landmark": false }, { "title": "Zcash FROST threshold signature security assessment", "client": "Zcash Foundation", "year": 2023, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Signatures" ], "url": "https://www.nccgroup.com/media/m1yjijzn/_ncc_group_zcashfoundation_e008263_report_2023-10-20_v11-1.pdf", "why": "Audit of the Rust FROST implementation tracking the IETF CFRG FROST draft; relevant to Schnorr threshold signing.", "landmark": false }, { "title": "Penumbra R1CS circuits and ZK proofs implementation review", "client": "Penumbra Labs", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://www.nccgroup.com/media/zo4h0apc/_ncc_group_penumbralabs_e008695_report_2023-08-18_v10.pdf", "why": "Circuit-level review of R1CS gadgets (decaf377, Poseidon377) in a shielded-transaction chain.", "landmark": false }, { "title": "Zcash NU5 (Orchard) cryptography review", "client": "Electric Coin Co.", "year": 2021, "kind": "Audit", "primitives": [ "Signatures", "Hashing & commitments", "Cryptographic libraries" ], "url": "https://www.nccgroup.com/media/hzlftzlu/_ncc_group_zcash_nu5_publicreportfinal.pdf", "why": "Spec and code review of Zcash's NU5 (Orchard) upgrade: Pasta curves, RedPallas, note encryption. The Orchard circuit was out of scope.", "landmark": true }, { "title": "WhatsApp end-to-end encrypted backups security assessment", "client": "WhatsApp", "year": 2021, "kind": "Audit", "primitives": [ "Key management & HSM", "Messaging & E2EE" ], "url": "https://www.nccgroup.com/media/fzwdxklh/_ncc_group_whatsapp_e001000m_report_2021-10-27_v12.pdf", "why": "Assessment of the HSM-based key vault behind WhatsApp's end-to-end encrypted backups; 23 issues found in initial testing.", "landmark": false }, { "title": "BLST BLS12-381 library cryptographic implementation review", "client": "Supranational / Protocol Labs / Ethereum Foundation", "year": 2021, "kind": "Audit", "primitives": [ "Signatures", "Cryptographic libraries", "Hashing & commitments" ], "url": "https://www.nccgroup.com/research/public-report-blst-cryptographic-implementation-review/", "why": "Review of blst's hash-to-curve and BLS signature code, commissioned jointly by Supranational, Protocol Labs and the Ethereum Foundation.", "landmark": true }, { "title": "Apache Milagro MPC threshold ECDSA cryptographic assessment", "client": "Qredo", "year": 2020, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Signatures" ], "url": "https://www.nccgroup.com/research/public-report-qredo-apache-milagro-mpc-cryptographic-assessment/", "why": "Early public review of an MPC library implementing Gennaro-Goldfeder threshold ECDSA (Apache Milagro MPC).", "landmark": false }, { "title": "Hardware-Backed Heist: extracting ECDSA keys from Qualcomm's TrustZone", "client": "", "year": 2019, "kind": "Research", "primitives": [ "Side-channel & hardware", "Key management & HSM", "Signatures" ], "url": "https://www.nccgroup.com/research/whitepaper-hardware-backed-heist-extracting-ecdsa-keys-from-qualcomm-s-trustzone/", "why": "Cache side-channel recovered a 256-bit key from Android's hardware keystore; presented at ACM CCS 2019.", "landmark": false } ], "sources": [ "https://www.nccgroup.com/us/assessment-advisory/cryptography", "https://www.nccgroup.com/research/public-report-penumbra-labs-r1cs-implementation-review", "https://www.nccgroup.com/newsroom/ncc-group-publishes-its-annual-cyber-security-research-report-2025-highlighting-breakthroughs-across-ai-security-cryptography-and-cyber-physical-risk", "https://github.com/anza-xyz/security-audits/blob/master/spl/NCCBLS12-381andBLSSignature-2026-05-12.pdf", "https://minaprotocol.com/blog/ncc-group-security-audit-results-of-coda-protocol", "https://en.wikipedia.org/wiki/NCC_Group", "https://nccgroupplc.com/media/gasp25jg/ncc_group_plc_fox_crypto_divestment_completion_28_march_2025.pdf" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-trail-of-bits", "name": "Trail of Bits", "website": "https://www.trailofbits.com", "hq": "New York, United States", "regions": [ "North America", "Global/remote" ], "founded": 2012, "size_band": "51-200", "firm_type": "Security research firm with crypto practice", "summary": "Security research and engineering firm with a dedicated cryptography team doing design assessments, code reviews and cryptographic engineering, backed by one of the largest public report archives.", "best_for": "Teams shipping novel or high-value cryptography — threshold ECDSA/MPC wallets, ZK proof systems, post-quantum signatures, standard-library crypto — that want design review plus code review, with custom tooling, before mainnet or a major release.", "specialties": [ "Protocol design review", "Implementation audit", "Zero-knowledge proofs", "MPC / threshold signatures", "Post-quantum", "Smart contracts", "Wallets & key management" ], "languages": [ "Rust", "Go", "C/C++", "Python", "TypeScript", "Solidity", "Circom" ], "public_reports_url": "https://github.com/trailofbits/publications", "open_source_tools": [ "Circomspect", "ZKDocs", "Slither", "Echidna", "Medusa" ], "pricing_tier": "$$$$", "typical_engagement": "Multi-week design and code assessments staffed by named engineers, usually followed by a fix review (e.g. QRL fixes were reviewed about a month after the main assessment). Ask for a quote; no first-party rate card is published.", "strengths": [ "Dedicated cryptography team; the firm states half the team holds PhDs in cryptography", "Large public archive on GitHub with a separate 'Cryptography Reviews' section, including 2025–2026 reports on threshold ECDSA (NEAR One), Google's Go crypto libraries and ML-DSA/XMSS (QRL)", "Builds widely used open-source tools, e.g. Circomspect for Circom circuits and Slither/Echidna for Solidity", "Published research on proof-system weaknesses: 'Weak Fiat-Shamir Attacks on Modern Proof Systems' (IEEE S&P 2023, ToB co-authors)" ], "weaknesses": [ "Premium-priced consultancy; budget accordingly and compare scoped quotes", "Broad firm (AppSec, blockchain, AI); confirm the cryptography team itself is staffed on your engagement", "In-demand staff can mean longer lead times; plan bookings early" ], "key_works": [ { "title": "Go cryptographic libraries security assessment", "client": "Google", "year": 2025, "kind": "Audit", "primitives": [ "Cryptographic libraries", "Signatures", "TLS & secure channels" ], "url": "https://github.com/trailofbits/publications/blob/master/reviews/2025-03-google-gocryptographiclibraries-securityreview.pdf", "why": "Review of the Go standard library crypto packages: constant-time and API-misuse findings, scalar-mult analysis and fix review.", "landmark": true }, { "title": "Open Quantum Safe liboqs security assessment", "client": "Open Quantum Safe", "year": 2025, "kind": "Audit", "primitives": [ "Post-quantum", "Cryptographic libraries" ], "url": "https://github.com/trailofbits/publications/blob/master/reviews/2025-04-quantum-open-safe-liboqs-securityreview.pdf", "why": "Review of liboqs wrapper code, CI and constant-time testing, with differential fuzzing of ML-KEM-512 implementations.", "landmark": false }, { "title": "OpenSSL security assessment (OSTIF)", "client": "OpenSSL", "year": 2024, "kind": "Audit", "primitives": [ "Cryptographic libraries" ], "url": "https://github.com/trailofbits/publications/blob/master/reviews/2023-09-openssl-securityreview.pdf", "why": "OSTIF-organised review of OpenSSL 3's provider architecture and new primitives (KDFs, SIV, Blake2); the TLS stack was not the focus.", "landmark": false }, { "title": "Discord DAVE end-to-end encryption protocol design review", "client": "Discord", "year": 2023, "kind": "Audit", "primitives": [ "Messaging & E2EE" ], "url": "https://github.com/trailofbits/publications/blob/master/reviews/2024-08-discord-dave-protocol-designreview.pdf", "why": "Design review of Discord's MLS-based E2EE for audio/video calls; a reference for group-messaging protocol reviews.", "landmark": false }, { "title": "Google Longfellow zero-knowledge library assessment", "client": "Google", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Signatures" ], "url": "https://github.com/trailofbits/publications/blob/master/reviews/2025-08-googlelongfellow-securityreview.pdf", "why": "Review of Google's ZK system for privacy-preserving proofs over identity credentials (e.g. age checks).", "landmark": false }, { "title": "NEAR One Robust ECDSA threshold signing assessment", "client": "NEAR One", "year": 2026, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Signatures" ], "url": "https://github.com/trailofbits/publications/blob/master/reviews/2026-02-near-one-robust-ecdsa-securityreview.pdf", "why": "Review of NEAR One's threshold-ECDSA implementation and its changes from the DJNPO20 scheme, with fix review.", "landmark": false }, { "title": "Turnkey key management system assessment", "client": "Turnkey", "year": 2026, "kind": "Audit", "primitives": [ "Key management & HSM", "Wallets" ], "url": "https://github.com/trailofbits/publications/blob/master/reviews/2026-06-turnkey-keymanagementsystem-securityreview.pdf", "why": "Assessment of an enclave-based wallet key management system, with fix review.", "landmark": false }, { "title": "Frozen Heart: weak Fiat-Shamir in Girault, Bulletproofs and PlonK", "client": "", "year": 2022, "kind": "Vulnerability disclosure", "primitives": [ "ZK proofs" ], "url": "https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/", "why": "Named a bug class (insecure Fiat-Shamir) found across gnark, SnarkJS, Dusk PlonK and others; now a standard ZK audit check.", "landmark": true }, { "title": "Circomspect static analyzer for Circom circuits", "client": "", "year": 2022, "kind": "Tool", "primitives": [ "ZK proofs" ], "url": "https://github.com/trailofbits/circomspect", "why": "Open-source linter that flags under-constrained signals and risky patterns in Circom ZK circuits.", "landmark": false }, { "title": "ZKDocs: implementation guide to ZK and related primitives", "client": "", "year": 2021, "kind": "Tool", "primitives": [ "ZK proofs", "MPC / threshold signatures" ], "url": "https://github.com/trailofbits/zkdocs", "why": "Open documentation of common pitfalls in non-standard protocols (Fiat-Shamir, Paillier, Shamir sharing) drawn from audits.", "landmark": false } ], "sources": [ "https://trailofbits.com/services/cryptography", "https://github.com/trailofbits/publications", "https://www.theqrl.org/press/qrl-announces-trail-of-bits-publication-of-security-assessment-of-its-cryptographic-heart-with-all-findings-resolved", "https://eprint.iacr.org/2023/691", "https://github.com/trailofbits/publications/blob/master/reviews/DFINITYThresholdECDSAandBtcCanisters.pdf" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-kudelski-security", "name": "Kudelski Security", "website": "https://kudelskisecurity.com", "hq": "Cheseaux-sur-Lausanne, Switzerland", "regions": [ "Europe", "North America", "APAC" ], "founded": 2012, "size_band": "201-1000", "firm_type": "Security research firm with crypto practice", "summary": "Cybersecurity division of the Swiss Kudelski Group with a long-standing cryptography team that publishes code reviews of threshold-signature (CGGMP, GG18/20, FROST) libraries, timelock encryption and blockchain systems.", "best_for": "Custody, wallet and validator teams that need a review of a threshold ECDSA/EdDSA (MPC) or DKG library, or of a novel scheme such as timelock encryption, from a European firm with in-house cryptographers.", "specialties": [ "Implementation audit", "Protocol design review", "MPC / threshold signatures", "Smart contracts", "Post-quantum" ], "languages": [ "Rust", "Go", "Solidity", "ink!" ], "public_reports_url": "https://kudelskisecurity.com/audits/", "pricing_tier": "$$$", "typical_engagement": "Fixed-scope cryptographic secure code reviews of a few weeks, sold alongside a much larger managed-security and consulting business.", "europe_presence": "International HQ in Cheseaux-sur-Lausanne (Switzerland) plus offices in Adliswil, Madrid, Paris, Munich and London.", "strengths": [ "Repeated public work on threshold-signature libraries: ING ecdsa-mpc (2021), AMIS CGGMP/FROST (2022); its archive also lists Lit Protocol FROST, Uniwire TSS and Ava Labs threshold-signature reviews", "Cryptographers teach crypto code auditing publicly (NIST CSRC talk 'A Hitchhiker's Guide to Cryptography Code Audit', Jan 2024; Eurocrypt 2024 affiliated workshop)", "Public blockchain report archive of about 120 reports with service and language filters", "Swiss headquarters with offices across Europe, the US and Asia" ], "weaknesses": [ "Public archive is weighted toward blockchain code reviews; few public ZK-circuit audits compared with ZK specialists", "Cryptography is a small part of a 400+-person managed-security business; confirm reviewer seniority", "Some archive entries did not open as individual pages when checked; ask for the PDF of any report you want to rely on" ], "key_works": [ { "title": "drand tlock timelock encryption audit", "client": "Protocol Labs (drand)", "year": 2023, "kind": "Audit", "primitives": [ "Signatures", "Randomness", "Cryptographic libraries" ], "url": "https://kudelskisecurity.com/research/audit-of-drand-timelock-encryption", "why": "Review of tlock/tlock-js identity-based timelock encryption built on the drand BLS randomness beacon.", "landmark": false }, { "title": "AMIS HTSS hierarchical threshold signatures audit (CGGMP, FROST)", "client": "AMIS Technologies", "year": 2022, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Signatures" ], "url": "https://kudelskisecurity.com/wp-content/uploads/report_amis_1.2_final_public.pdf", "why": "Audit of Go threshold ECDSA (CGGMP) and threshold EdDSA (FROST) implementations with hierarchical shares.", "landmark": false }, { "title": "ING ecdsa-mpc threshold signature library audit", "client": "ING", "year": 2021, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Randomness", "Side-channel & hardware" ], "url": "https://kudelskisecurity.com/wp-content/uploads/Audit-of-ECDSA-MPC.pdf", "why": "Rust threshold-ECDSA review covering hashing, randomness, secret erasure and constant-time behaviour.", "landmark": false }, { "title": "Binance tss-lib threshold ECDSA security audit", "client": "Binance", "year": 2019, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "ZK proofs", "Wallets" ], "url": "https://docs.bnbchain.org/assets/files/audit-binance-tss-lib-final-63068f1784fabc5be1ec7ffce35acf0b.pdf", "why": "Static audit of Binance's open-source tss-lib threshold ECDSA library: Paillier, range proofs, Schnorr proofs and VSS.", "landmark": true }, { "title": "Wire Proteus protocol and Cryptobox security review (with X41 D-Sec)", "client": "Wire Swiss", "year": 2017, "kind": "Audit", "primitives": [ "Messaging & E2EE", "Cryptographic libraries" ], "url": "https://www.x41-dsec.de/static/reports/Kudelski-X41-Wire-Report-phase1-20170208.pdf", "why": "Joint review with X41 D-Sec of Wire's Proteus messaging protocol and Cryptobox, in Rust and CoffeeScript.", "landmark": false }, { "title": "Polynonce: a novel ECDSA nonce-recurrence attack", "client": "", "year": 2023, "kind": "Research", "primitives": [ "Signatures", "Randomness", "Wallets" ], "url": "https://kudelskisecurity.com/research/polynonce-a-tale-of-a-novel-ecdsa-attack-and-bitcoin-tears", "why": "New attack on polynomially related ECDSA nonces; recovered 773 Bitcoin keys from public chain data (DEF CON 31).", "landmark": true }, { "title": "Lattice-free half-half nonce attack on Bitcoin and Ethereum", "client": "", "year": 2023, "kind": "Research", "primitives": [ "Signatures", "Randomness" ], "url": "https://kudelskisecurity.com/research/lattice-free-half-half-attack-on-bitcoin-and-ethereum", "why": "Adapts Polynonce to half-half nonce generation; recovered 110 Bitcoin private keys and none from Ethereum.", "landmark": false }, { "title": "Polynonce ECDSA attack implementation", "client": "", "year": 2023, "kind": "Tool", "primitives": [ "Signatures", "Randomness" ], "url": "https://github.com/kudelskisecurity/ecdsa-polynomial-nonce-recurrence-attack", "why": "Open-source code to test signature sets for related-nonce weaknesses.", "landmark": false }, { "title": "CDF: crypto differential fuzzing", "client": "", "year": 2017, "kind": "Tool", "primitives": [ "Cryptographic libraries", "Side-channel & hardware" ], "url": "https://github.com/kudelskisecurity/cdf", "why": "Differential testing tool for crypto implementations (correctness, compliance, timing leaks); Black Hat USA 2017.", "landmark": false } ], "sources": [ "https://kudelskisecurity.com/audits", "https://kudelskisecurity.com/company", "https://kudelskisecurity.com/wp-content/uploads/Audit-of-ECDSA-MPC.pdf", "https://csrc.nist.gov/presentations/2024/a-hitchhikers-guide-to-cryptography-code-audit", "https://docs.drand.love/blog/2023/05/26/tlock-security-assessment", "https://www.nagra.com/sites/default/files/migration/pressreleases/kudelski_security_launch_21_11_2012_f.pdf" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-least-authority", "name": "Least Authority", "website": "https://leastauthority.com", "hq": "Berlin, Germany", "regions": [ "Europe", "North America", "APAC", "Global/remote" ], "founded": 2011, "size_band": "1-50", "firm_type": "Applied cryptography specialist", "summary": "Berlin-based, privacy-focused security consultancy with a deep record auditing cryptographic libraries, signature schemes and ZK provers, mostly for open-source and Web3 clients.", "best_for": "Open-source and Web3 teams that need an audit of a cryptographic library or prover — BLS/Ed25519/secp256k1 signature code, gnark/GKR provers, DKG or privacy-protocol cryptography — with a published final report.", "specialties": [ "Implementation audit", "Protocol design review", "Zero-knowledge proofs", "MPC / threshold signatures", "Smart contracts", "Wallets & key management" ], "languages": [ "Rust", "Go", "Solidity", "TypeScript" ], "public_reports_url": "https://leastauthority.com/security-consulting/published-audits/", "open_source_tools": [ "MoonMath Manual (ZK-SNARK educational resource)" ], "pricing_tier": "$$$", "typical_engagement": "Fixed-scope audits ending in a published final report that records remediation status; repeat multi-phase work is common (e.g. several Linea prover phases).", "europe_presence": "Relocated to Berlin in 2016; operates as Least Authority TFA GmbH (Germany) with a largely remote team.", "strengths": [ "Sustained cryptographic-library and prover work: gnark GKR (2024), Linea Limitless Prover (2025), Anza BLS and Ed25519 (2026)", "Publishes final reports with remediation status on a public audits page (about 90 listed, 2020–2026)", "Published the MoonMath Manual to zk-SNARKs (2022)", "German entity (Least Authority TFA GmbH) plus US and Singapore subsidiaries" ], "weaknesses": [ "Small team; capacity for large or urgent programmes can be limited", "Little public tooling compared with larger research firms", "Client base is mostly Web3/FOSS; few public enterprise or hardware crypto reviews" ], "key_works": [ { "title": "solana-ed25519 library audit", "client": "Anza Technology", "year": 2026, "kind": "Audit", "primitives": [ "Signatures", "Cryptographic libraries" ], "url": "https://github.com/anza-xyz/security-audits/blob/master/solana/LeastAuthorityEd25519Audit-2026-06-23.pdf", "why": "Recent review of the Ed25519 signature library used across Solana tooling.", "landmark": false }, { "title": "Serai distributed key generation (PVSS) implementation audit", "client": "MAGIC Grants", "year": 2026, "kind": "Audit", "primitives": [ "MPC / threshold signatures" ], "url": "https://leastauthority.com/magic-grants-serai-dkg-implementation-final-audit-report/", "why": "Audit of a DKG built on publicly verifiable secret sharing for a cross-chain DEX's threshold keys.", "landmark": false }, { "title": "Token-2022 confidential transfer audit", "client": "Anza Technology", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Smart-contract cryptography" ], "url": "https://leastauthority.com/token-2022-confidential-transfer-final-audit-report/", "why": "Review of Solana's ElGamal-based confidential token transfers and their zero-knowledge proofs.", "landmark": false }, { "title": "Linea zkEVM Limitless Prover audit", "client": "Consensys", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://leastauthority.com/linea-zkevm-limitless-prover-final-audit-report/", "why": "Audit of the distributed prover and compiler components of a production zkEVM.", "landmark": false }, { "title": "Plonky3 STARK toolkit audit", "client": "Polygon", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://leastauthority.com/polygon-plonky3-final-audit-report/", "why": "Review of the fields, hashes and polynomial commitments in Plonky3, a toolkit many zkVMs build on.", "landmark": true }, { "title": "gnark and gnark-crypto audit for the Linea prover (phase 1)", "client": "Consensys", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://leastauthority.com/consensys-linea-prover-and-cryptography-phase-1-final-audit-report/", "why": "Covers GKR, sumcheck and polynomial code in gnark, a widely used Go ZK library.", "landmark": true }, { "title": "World SMPC iris-matching protocol audit (second review)", "client": "Tools for Humanity (World)", "year": 2024, "kind": "Audit", "primitives": [ "MPC / threshold signatures" ], "url": "https://leastauthority.com/worldcoin-smpc-protocol-2nd-review-final-audit-report/", "why": "Audit of a three-node secure multi-party computation protocol matching biometrics against secret-shared data.", "landmark": false }, { "title": "Safeheron MPC-ECDSA algorithm audit", "client": "Safeheron", "year": 2023, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Wallets" ], "url": "https://leastauthority.com/safeheron_mpc_algorithm_updated_final_audit_report_least_authority/", "why": "Threshold-ECDSA review for an MPC custody provider.", "landmark": false }, { "title": "Mina Pickles recursive zk-SNARK audit", "client": "Mina Foundation", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://leastauthority.com/mina_foundation_pickles_final_audit_report_least_authority/", "why": "Review of the inductive SNARK composition system behind Mina's succinct blockchain.", "landmark": false }, { "title": "MoonMath Manual to zk-SNARKs", "client": "", "year": 2022, "kind": "Tool", "primitives": [ "ZK proofs" ], "url": "https://github.com/LeastAuthority/moonmath-manual", "why": "Open educational text that builds zk-SNARKs step by step with pen-and-paper examples.", "landmark": false } ], "sources": [ "https://leastauthority.com/about-us", "https://leastauthority.com/security-consulting/published-audits", "https://leastauthority.com/blog/audit-of-anza-technology-bls-signatures-crate", "https://github.com/anza-xyz/security-audits/blob/master/solana/LeastAuthorityEd25519Audit-2026-06-23.pdf", "https://build.avax.network/integrations/leastauthority" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-zksecurity", "name": "zkSecurity", "website": "https://www.zksecurity.xyz", "hq": "Not publicly stated (remote team)", "regions": [ "Global/remote" ], "founded": 2023, "size_band": "1-50", "firm_type": "Applied cryptography specialist", "summary": "Cryptography-focused firm launched in May 2023 that audits and builds ZK proof systems, zkVMs, circuits, KZG libraries and other advanced cryptography, with a high volume of public reports.", "best_for": "ZK rollups, zkVMs, proof-system and circuit-heavy projects (Circom, Cairo, Halo2, gnark, STARK verifiers) that need proof-system soundness specialists before launch or a major upgrade; also confidential-transfer and encrypted-mempool designs.", "specialties": [ "Zero-knowledge proofs", "Implementation audit", "Protocol design review", "MPC / threshold signatures", "Formal verification", "Smart contracts" ], "languages": [ "Rust", "Circom", "Noir", "Cairo", "Go", "Solidity" ], "public_reports_url": "https://reports.zksecurity.xyz", "open_source_tools": [ "zkbugs (reproducible ZK circuit bugs)", "clean (Lean DSL for formally verified ZK circuits)" ], "pricing_tier": "$$$", "typical_engagement": "Fixed-scope audits of a few weeks (e.g. Stwo-Cairo verifier: 3 weeks; PeerDAS KZG: 4 weeks), with frequent repeat or multi-phase engagements (OpenVM 2.0 ran in four phases).", "strengths": [ "Very high public output: 67 reports listed on its reports site, 12 of them dated 2026", "Covers proof systems, zkVMs, KZG libraries and Circom/Cairo circuits, plus confidential-asset and encrypted-mempool designs (Aptos, 2026)", "In Aztec's three-firm comparative bigfield audit, its report included all three issues Aztec graded Critical (engagement lengths and scopes differed between firms, per Aztec's issue-comparison table)", "Also does development and formal-verification work (e.g. the Lean-based 'clean' circuit DSL), not only audits" ], "weaknesses": [ "Young firm (launched 2023) with a small team (about 15 engineers including interns, per a Sept 2024 founder post)", "Strong ZK/Web3 focus; few public enterprise, TLS or hardware crypto reviews", "Headquarters and legal entity are not stated on its site; confirm the contracting entity" ], "key_works": [ { "title": "PeerDAS KZG libraries audit (blst, c-kzg-4844, rust-eth-kzg, go-eth-kzg)", "client": "Ethereum Foundation", "year": 2025, "kind": "Audit", "primitives": [ "Hashing & commitments", "Cryptographic libraries", "Signatures" ], "url": "https://reports.zksecurity.xyz/reports/ef-blst-kzg", "why": "Review of the four KZG libraries Ethereum clients use for PeerDAS data availability; some blst assembly was out of scope.", "landmark": true }, { "title": "OpenVM 2.0 zkVM audit", "client": "Axiom", "year": 2026, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://reports.zksecurity.xyz/reports/openvm", "why": "Four-phase review of a STARK zkVM: recursive verifier, continuations, Halo2 static verifier and new SHA-2/Keccak AIRs.", "landmark": false }, { "title": "Zcash Orchard and Halo2 gadgets audit", "client": "Tachyon Foundation", "year": 2026, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://reports.zksecurity.xyz/reports/zcash-orchard", "why": "Fresh review of the Orchard Action circuit, Halo2 gadgets and PLONK verifier that secure Zcash's shielded pool.", "landmark": false }, { "title": "Stwo-Cairo verifier audit", "client": "StarkWare", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://reports.zksecurity.xyz/reports/starkware-stwo-cairo", "why": "Review of a Cairo implementation of the Stwo (Circle STARK) verifier, checked against a draft of the Stwo whitepaper.", "landmark": false }, { "title": "Rust p256 crate audit", "client": "NEAR", "year": 2025, "kind": "Audit", "primitives": [ "Signatures", "Cryptographic libraries" ], "url": "https://reports.zksecurity.xyz/reports/near-p256", "why": "Review of the RustCrypto p256 crate: curve and field arithmetic and ECDSA verification, with a focus on 32-bit targets.", "landmark": false }, { "title": "zkLogin circuits and trusted-setup ceremony audit", "client": "Mysten Labs", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs", "Wallets" ], "url": "https://reports.zksecurity.xyz/reports/mysten-labs-zklogin", "why": "Audit of Circom circuits proving OAuth (JWT) logins for Sui wallets, plus patches to the Groth16 ceremony tooling.", "landmark": true }, { "title": "Phantom Challenge soundness bug in Solana's ZK ElGamal proof program", "client": "", "year": 2025, "kind": "Vulnerability disclosure", "primitives": [ "ZK proofs", "Smart-contract cryptography" ], "url": "https://blog.zksecurity.xyz/posts/solana-phantom-challenge-bug/", "why": "Missing Fiat-Shamir input allowed forged proofs in confidential transfers; the feature was paused and patched.", "landmark": false }, { "title": "OpenVM pairing library soundness bug (CVE-2026-46669)", "client": "", "year": 2026, "kind": "Vulnerability disclosure", "primitives": [ "ZK proofs", "Signatures" ], "url": "https://blog.zksecurity.xyz/posts/openvm-bugs/", "why": "Critical pairing-check bypass found with an AI auditor and fixed in OpenVM 1.6.0.", "landmark": false }, { "title": "zkbugs: reproducible ZK circuit vulnerabilities", "client": "", "year": 2024, "kind": "Tool", "primitives": [ "ZK proofs" ], "url": "https://github.com/zksecurity/zkbugs", "why": "Open dataset reproducing real ZK circuit bugs, useful for training reviewers and benchmarking tools.", "landmark": false }, { "title": "clean: Lean DSL for formally verified ZK circuits", "client": "", "year": 2024, "kind": "Tool", "primitives": [ "ZK proofs", "Formal verification" ], "url": "https://github.com/Verified-zkEVM/clean", "why": "Embedded Lean framework for writing circuits (AIR, PLONK, R1CS) with machine-checked proofs.", "landmark": false } ], "sources": [ "https://reports.zksecurity.xyz", "https://blog.zksecurity.xyz/posts/a-year-of-zksecurity", "https://zeroknowledge.fm/290", "https://aztec.network/blog/security-of-the-aztec-network-audits-of-bigfield", "https://github.com/AztecProtocol/audit-reports/blob/main/Barretenberg/stdlib_primitives/Bigfield/Test%20Bigfield%20Audit/Issue%20Comparison.md", "https://cryptologie.net/posts/some-news-from-founding-a-startup-zksecurity" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-cure53", "name": "Cure53", "website": "https://cure53.de", "hq": "Berlin, Germany", "regions": [ "Europe", "Global/remote" ], "founded": 2007, "size_band": "1-50", "firm_type": "Security research firm with crypto practice", "summary": "Berlin security firm that publishes a large library of reports, including audits of cryptographic libraries (noble, ed25519, Monocypher), MPC/threshold code and end-to-end-encrypted apps alongside web and app pentests.", "best_for": "Wallets, privacy and E2EE apps, and JS/TS, Rust or C++ crypto libraries (MPC, Shamir secret sharing, curve libraries) that want crypto review plus the surrounding app, extension and infra attack surface in one time-boxed engagement.", "specialties": [ "Implementation audit", "Protocol design review", "MPC / threshold signatures", "Wallets & key management" ], "languages": [ "TypeScript", "JavaScript", "Rust", "C/C++", "Go", "Kotlin", "Swift" ], "public_reports_url": "https://cure53.de/", "pricing_tier": "$$", "typical_engagement": "Time-boxed, fixed-day audits with published (sometimes summary) reports; Ente's crypto design and code audit ran nine days, while Nym's multi-package review ran 56 working days with six testers.", "europe_presence": "Headquartered in Berlin, Germany.", "strengths": [ "Large public report library with many crypto-specific audits: MPC (Coinbase cb-mpc), ECDSA (Silence Labs), Shamir SSS (Privy), ed25519 and secp256k1 libraries, NIP-44", "Recent crypto-library work for Coinbase cb-mpc and the widely used noble libraries", "Can cover crypto together with app, browser-extension and infrastructure testing", "Clients routinely publish the reports, so buyers can read past findings" ], "weaknesses": [ "Primarily a web/app security firm; little public work on ZK circuits or proof systems", "Short time-boxed engagements may limit depth on novel protocol design", "Some engagements are published only as summary reports" ], "key_works": [ { "title": "cb-mpc MPC cryptography library audit", "client": "Coinbase", "year": 2025, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "ZK proofs", "Cryptographic libraries" ], "url": "https://cure53.de/audit-report_coinbase-kms.pdf", "why": "Crypto review of Coinbase's C++ MPC and ZK-proof library cb-mpc; tested Nov-Dec 2024, report dated March 2025.", "landmark": false }, { "title": "noble-ciphers and noble-curves libraries audit", "client": "Paul Miller", "year": 2024, "kind": "Audit", "primitives": [ "Cryptographic libraries", "Signatures" ], "url": "https://cure53.de/audit-report_noble-crypto-libs.pdf", "why": "Audit of the dependency-free JS crypto libraries (incl. bn254) that many wallets and web apps depend on.", "landmark": true }, { "title": "ExpressVPN Lightway protocol audit", "client": "ExpressVPN", "year": 2024, "kind": "Audit", "primitives": [ "TLS & secure channels" ], "url": "https://cure53.de/pentest-report_expressvpn-lightway_2024.pdf", "why": "Review of a Rust VPN protocol built on wolfSSL bindings; a template for secure-channel protocol audits.", "landmark": false }, { "title": "Nym apps, VPN and cryptography audit (Sphinx, zk-nym, offline eCash)", "client": "Nym Technologies", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Messaging & E2EE", "Signatures" ], "url": "https://cure53.de/audit-report_nym.pdf", "why": "Covers mixnet Sphinx packets and Coconut-based anonymous credentials alongside app pentests.", "landmark": false }, { "title": "NIP44 encryption spec and implementations audit", "client": "Paul Miller", "year": 2023, "kind": "Audit", "primitives": [ "Messaging & E2EE", "Cryptographic libraries" ], "url": "https://cure53.de/audit-report_nip44-implementations.pdf", "why": "Spec review plus JS, Go and Rust code audits of Nostr's NIP-44 message-encryption scheme.", "landmark": false }, { "title": "Ente cryptography design and code review", "client": "Ente Technologies", "year": 2023, "kind": "Audit", "primitives": [ "Messaging & E2EE", "Key management & HSM" ], "url": "https://cure53.de/audit-report_ente-crypto.pdf", "why": "White-box review of an end-to-end encrypted photo storage design and its clients.", "landmark": false }, { "title": "Privy Shamir secret sharing library audit", "client": "Horkos, Inc. (Privy)", "year": 2023, "kind": "Audit", "primitives": [ "Key management & HSM", "Cryptographic libraries" ], "url": "https://cure53.de/audit-report_privy-sss-library.pdf", "why": "Focused crypto review of Privy's TypeScript Shamir secret-sharing library for splitting keys among parties.", "landmark": false }, { "title": "RNP OpenPGP library and Thunderbird integration audit", "client": "Mozilla (MOSS)", "year": 2020, "kind": "Audit", "primitives": [ "Messaging & E2EE", "Cryptographic libraries" ], "url": "https://cure53.de/pentest-report_rnp.pdf", "why": "Audit of the OpenPGP library Thunderbird adopted for built-in email encryption.", "landmark": false }, { "title": "rustls TLS library security review", "client": "CNCF", "year": 2020, "kind": "Audit", "primitives": [ "TLS & secure channels", "Cryptographic libraries" ], "url": "https://cure53.de/pentest-report_rustls.pdf", "why": "Review of rustls and its ring and webpki dependencies, a memory-safe TLS stack used widely in Rust.", "landmark": true }, { "title": "Monocypher crypto library audit", "client": "Monocypher maintainer (funded by Open Technology Fund)", "year": 2020, "kind": "Audit", "primitives": [ "Cryptographic libraries", "Signatures" ], "url": "https://cure53.de/pentest-report_monocypher.pdf", "why": "White-box audit of Monocypher 3.1.1, a small portable C crypto library, incl. its optional Ed25519 module.", "landmark": false } ], "sources": [ "https://cure53.de", "https://cure53.de/audit-report_coinbase-kms.pdf", "https://nym.com/trust-center/Cure53-security-audit-2024", "https://cure53.de/audit-report_ente-crypto.pdf" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-quarkslab", "name": "Quarkslab", "website": "https://quarkslab.com", "hq": "Paris, France", "regions": [ "Europe" ], "founded": 2011, "size_band": "51-200", "firm_type": "Security research firm with crypto practice", "summary": "French security research firm (now part of Airbus Defence and Space) with a cryptography team that audits TLS/SSH and crypto libraries, evaluates privacy-coin cryptography and tests post-quantum implementations.", "best_for": "Maintainers of C/C++ or Python crypto and protocol libraries (TLS, SSH, disk encryption) and teams shipping post-quantum or embedded crypto that want a European, research-led implementation audit — often OSTIF-funded for open source.", "specialties": [ "Implementation audit", "Post-quantum", "Side-channel & hardware", "Protocol design review" ], "languages": [ "C/C++", "Python", "Rust", "Go" ], "public_reports_url": "https://github.com/quarkslab/public-reports", "open_source_tools": [ "crypto-condor (compliance testing of primitive implementations, incl. ML-KEM/ML-DSA)" ], "pricing_tier": "$$$", "typical_engagement": "Fixed-scope library or product audits of several weeks with a public report when the client agrees; open-source work is often funded through OSTIF (Mbed TLS 2026: two engineers).", "europe_presence": "Registered office in Paris (Quarkslab SAS, 10 boulevard Haussmann); most of its ~100 staff are in Paris and Rennes. Part of Airbus Defence and Space since October 2026.", "strengths": [ "Hands-on audits of core crypto libraries with public reports: Mbed TLS 4.0/TF-PSA-Crypto (2026), Paramiko (2025–26), VeraCrypt (2016), Monero Bulletproofs (2018)", "Publishes crypto-condor, an Apache-2.0 tool for testing primitive implementations against test vectors, including ML-KEM and ML-DSA", "Active post-quantum implementation research (HQC reference-implementation bugs, CVE-2024-54137; differential fuzzing of LibOQS and Bouncy Castle)", "French research culture with reverse-engineering and hardware depth" ], "weaknesses": [ "Little public ZK, MPC or smart-contract cryptography work", "Fewer public reports per year than high-volume crypto boutiques", "Acquired by Airbus Defence and Space (completed 1 Oct 2026); ask how this affects availability, pricing and independence for your engagement" ], "key_works": [ { "title": "Mbed TLS 4.0 and TF-PSA-Crypto security audit", "client": "Arm / OSTIF", "year": 2026, "kind": "Audit", "primitives": [ "TLS & secure channels", "Cryptographic libraries" ], "url": "https://github.com/quarkslab/public-reports/blob/main/Reports/26-05-2730-REP_v1.0-1.pdf", "why": "Audit of the embedded TLS and PSA crypto library used in IoT and firmware; useful for teams shipping constrained devices.", "landmark": true }, { "title": "Paramiko SSHv2 library and PyCA cryptography audit", "client": "OSTIF", "year": 2025, "kind": "Audit", "primitives": [ "TLS & secure channels", "Cryptographic libraries" ], "url": "https://github.com/quarkslab/public-reports/blob/main/Reports/25-11-2415-REP_paramiko-security-audit_v1.1.pdf", "why": "SSH protocol review plus differential fuzzing of PyCA cryptography primitives; v1.1 adds the 2026 fix check.", "landmark": false }, { "title": "dalek-cryptography libraries evaluation (curve25519-dalek, bulletproofs, subtle)", "client": "Tari Labs", "year": 2019, "kind": "Audit", "primitives": [ "Cryptographic libraries", "ZK proofs", "Side-channel & hardware" ], "url": "https://github.com/quarkslab/public-reports/blob/main/Reports/19-06-594-REP.pdf", "why": "Review of the Rust curve25519 and Bulletproofs crates that many wallets and protocols depend on.", "landmark": false }, { "title": "herumi mcl and bls pairing libraries assessment", "client": "Ethereum Foundation", "year": 2020, "kind": "Audit", "primitives": [ "Signatures", "Cryptographic libraries" ], "url": "https://github.com/quarkslab/public-reports/blob/main/Reports/20-07-732-REP.pdf", "why": "Assessment of the herumi BLS12-381 pairing and BLS signature libraries for use in Ethereum 2.0 clients.", "landmark": false }, { "title": "Monero Bulletproofs implementation evaluation", "client": "Monero Research Lab / OSTIF", "year": 2018, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://github.com/quarkslab/public-reports/blob/main/Reports/18-06-439-REP-monero-bulletproof-sec-assessment.pdf", "why": "Early public audit of a production range-proof implementation before Monero's Bulletproofs rollout.", "landmark": false }, { "title": "VeraCrypt 1.18 security assessment", "client": "OSTIF", "year": 2016, "kind": "Audit", "primitives": [ "Cryptographic libraries", "Key management & HSM" ], "url": "https://github.com/quarkslab/public-reports/blob/main/Reports/16-08-215-REP-VeraCrypt-sec-assessment.pdf", "why": "Public audit of the widely used disk-encryption tool; shows bootloader, KDF and crypto-implementation review.", "landmark": false }, { "title": "Bugs in HQC post-quantum KEM implementations (CVE-2024-54137)", "client": "", "year": 2025, "kind": "Vulnerability disclosure", "primitives": [ "Post-quantum" ], "url": "https://blog.quarkslab.com/finding-bugs-in-implementations-of-hqc-the-fifth-post-quantum-standard.html", "why": "Decapsulation flaw in the HQC reference code found while fuzzing liboqs; shows hands-on PQC implementation testing.", "landmark": false }, { "title": "State of post-quantum cryptography implementations", "client": "", "year": 2026, "kind": "Research", "primitives": [ "Post-quantum", "Cryptographic libraries" ], "url": "https://blog.quarkslab.com/state-of-post-quantum-cryptography-implementations.html", "why": "Survey of PQC support in 23 open-source libraries with differential fuzzing of ML-KEM, ML-DSA and XMSS code.", "landmark": false }, { "title": "MIFARE Classic static encrypted nonce and hardware backdoors", "client": "", "year": 2024, "kind": "Research", "primitives": [ "Side-channel & hardware", "Key management & HSM" ], "url": "https://blog.quarkslab.com/mifare-classic-static-encrypted-nonce-and-backdoors.html", "why": "Found hardware backdoors in Fudan FM11RF08S cards letting all keys be recovered in minutes (IACR ePrint 2024/1275).", "landmark": true }, { "title": "crypto-condor test suite for cryptographic primitives", "client": "", "year": 2024, "kind": "Tool", "primitives": [ "Cryptographic libraries", "Post-quantum" ], "url": "https://github.com/quarkslab/crypto-condor", "why": "Open-source compliance tester for primitive implementations (incl. ML-KEM/ML-DSA) using test vectors.", "landmark": false } ], "sources": [ "https://blog.quarkslab.com/mbedtls-security-audit.html", "https://blog.quarkslab.com/paramiko-security-audit.html", "https://github.com/quarkslab/crypto-condor", "https://ostif.org/mbed-tls-audit-complete", "https://quarkslab.com/about", "https://www.airbus.com/en/newsroom/press-releases/2026-10-airbus-completes-acquisition-of-quarkslab-strengthens-french-sovereignty-in-cybersecurity" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-x41-d-sec", "name": "X41 D-Sec", "website": "https://www.x41-dsec.de", "hq": "Aachen, Germany", "regions": [ "Europe" ], "size_band": "1-50", "firm_type": "Security research firm with crypto practice", "summary": "German source-code audit firm whose public reports include messenger cryptography (Wire/Proteus), a post-quantum ledger (QRL), software-update signing frameworks (TUF, in-toto) and QUIC libraries.", "best_for": "Projects whose cryptographic risk sits in protocol and signing code — secure messengers, software-update and supply-chain signing (TUF/in-toto), QUIC/TLS stacks, VPN clients — and that want a German code-audit firm with public reports.", "specialties": [ "Implementation audit", "Protocol design review", "Wallets & key management" ], "languages": [ "C/C++", "Rust", "Go", "Python", "Java" ], "public_reports_url": "https://www.x41-dsec.de/references/", "open_source_tools": [ "BeanStack (Java fingerprinting)" ], "pricing_tier": "$$", "typical_engagement": "Time-boxed source-code audits of roughly 2–5 weeks with public reports (TUF 2022: two weeks of testing; ngtcp2/nghttp3 2025: about five weeks); frequent OSTIF-funded open-source work.", "europe_presence": "Headquartered in Aachen, Germany, with an office in Frankfurt.", "strengths": [ "Many public source-code audit reports, including signing frameworks (TUF, go-tuf, in-toto, RSTUF) and QUIC libraries", "Messenger and ledger cryptography reviews: Wire Proteus (2017, with Kudelski Security) and QRL (2018)", "Steady VPN-client audit work (Mullvad 2024 and 2026, AzireVPN/Malwarebytes 2026), useful when crypto sits inside a larger client app", "German base with offices in Aachen and Frankfurt" ], "weaknesses": [ "Generalist code-audit firm; little public ZK, MPC or post-quantum-specific work", "Most messenger/ledger cryptography reviews are older (2017–2018); the 2024 Mullvad app report did not put tunnel cryptography in scope", "Small team; founding year and headcount are not published" ], "key_works": [ { "title": "nghttp3 and ngtcp2 (QUIC / HTTP/3) source code audit", "client": "OSTIF", "year": 2025, "kind": "Audit", "primitives": [ "TLS & secure channels" ], "url": "https://www.x41-dsec.de/static/reports/X41-OSTIF-NG-2025-Audit-Report-Public.pdf", "why": "QUIC/HTTP/3 stack review incl. QUIC-TLS adherence, key agreement and key-update handling; TLS backends not audited.", "landmark": true }, { "title": "go-tuf implementation code review", "client": "OSTIF", "year": 2023, "kind": "Audit", "primitives": [ "Signatures", "Key management & HSM" ], "url": "https://www.x41-dsec.de/static/reports/X41-go-tuf-Audit-2023-Final-Report-PUBLIC.pdf", "why": "Client-focused review of the Go implementation of TUF, the framework for signed software updates.", "landmark": false }, { "title": "in-toto framework and specification audit", "client": "OSTIF", "year": 2023, "kind": "Audit", "primitives": [ "Signatures" ], "url": "https://www.x41-dsec.de/static/reports/X41-in-toto-Audit-2023-Final-Report-PUBLIC.pdf", "why": "Spec and Python/Go code review of signed supply-chain attestations.", "landmark": false }, { "title": "The Update Framework (TUF) source code audit", "client": "OSTIF", "year": 2022, "kind": "Audit", "primitives": [ "Signatures", "Key management & HSM" ], "url": "https://www.x41-dsec.de/static/reports/X41-TUF-Audit-2022-Final-Report-PUBLIC.pdf", "why": "Audit of the python-tuf client workflow and Metadata API, the reference for signed software-update security.", "landmark": true }, { "title": "RandomX proof-of-work audit", "client": "Monero Labs (via OSTIF)", "year": 2019, "kind": "Audit", "primitives": [ "Hashing & commitments" ], "url": "https://www.x41-dsec.de/static/reports/X41-RandomX-Audit-2019-Final-Report-Public.pdf", "why": "Design and code review of Monero's CPU-oriented PoW, with Secfault Security, incl. ASIC/FPGA feasibility analysis.", "landmark": false }, { "title": "theQRL security review (XMSS-based ledger)", "client": "The Quantum Resistant Ledger", "year": 2018, "kind": "Audit", "primitives": [ "Post-quantum", "Signatures", "Wallets" ], "url": "https://github.com/theQRL/audits/blob/master/X41-theQRL-Review-2018-Final-Report.pdf", "why": "Early review of a production hash-based (XMSS) signature deployment, incl. key-index reuse risks.", "landmark": false }, { "title": "Wire security review phase 2: web app and calling key establishment (with Kudelski)", "client": "Wire Swiss", "year": 2018, "kind": "Audit", "primitives": [ "Messaging & E2EE" ], "url": "https://www.x41-dsec.de/static/reports/X41-Kudelski-Wire-Security-Review-Web-Calling.pdf", "why": "Joint review with Kudelski of how Wire calling establishes SRTP keys via Proteus, plus the Wire web app.", "landmark": false }, { "title": "Wire Proteus protocol and Cryptobox review (with Kudelski)", "client": "Wire Swiss", "year": 2017, "kind": "Audit", "primitives": [ "Messaging & E2EE", "Cryptographic libraries" ], "url": "https://www.x41-dsec.de/static/reports/Kudelski-X41-Wire-Report-phase1-20170208.pdf", "why": "Joint review with Kudelski Security of Wire's Proteus messaging protocol and Cryptobox, in Rust and CoffeeScript.", "landmark": false }, { "title": "Smartcard driver vulnerabilities (OpenSC, Yubico PIV, pam_pkcs11 and others)", "client": "", "year": 2018, "kind": "Vulnerability disclosure", "primitives": [ "Key management & HSM", "Side-channel & hardware" ], "url": "https://www.x41-dsec.de/lab/blog/smartcards/", "why": "Fuzzing found memory-corruption bugs triggered by malicious cards in common smartcard middleware (DEF CON 2018).", "landmark": false } ], "sources": [ "https://www.x41-dsec.de/references", "https://www.x41-dsec.de/company", "https://github.com/theQRL/audits", "https://www.x41-dsec.de/static/reports/Kudelski-X41-Wire-Report-phase1-20170208.pdf", "https://wireapp.medium.com/wire-application-level-security-audits-98324d1f211b" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-galois", "name": "Galois", "website": "https://www.galois.com", "hq": "Portland, Oregon, United States", "regions": [ "North America" ], "founded": 1999, "size_band": "201-1000", "firm_type": "Applied cryptography specialist", "summary": "R&D firm known for machine-checked verification of cryptographic code (Cryptol/SAW) and for advanced-cryptography research and engineering in ZK, MPC and FHE.", "best_for": "Organisations that want mathematical proof that production crypto code (AES-GCM, SHA-2, HMAC, DRBG, ECDSA) matches its specification, wired into CI, or long-horizon R&D on MPC, FHE and ZK — rather than a classic pre-launch audit.", "specialties": [ "Formal verification", "Implementation audit", "Zero-knowledge proofs", "MPC / threshold signatures", "FHE", "Post-quantum", "Side-channel & hardware" ], "languages": [ "C/C++", "Rust", "Haskell", "x86 assembly", "Cryptol" ], "open_source_tools": [ "Cryptol", "SAW (Software Analysis Workbench)", "Swanky (MPC libraries)", "Diet Mac'n'Cheese (ZK backend)" ], "pricing_tier": "$$$$", "typical_engagement": "Verification and R&D projects measured in months (the AWS-LC AES-GCM/SHA-384 proofs took about six calendar months); often government- or large-enterprise-funded.", "strengths": [ "Created Cryptol and SAW, used to prove AWS-LC and s2n code matches its specification", "Proofs can run in CI so they are re-checked on every code change (s2n, AWS-LC-Verification with AWS)", "Deep MPC/ZK/FHE research base: DARPA SIEVE (ZK), Swanky (MPC), BASALISC (FHE hardware accelerator)", "Strong fit for high-assurance government and infrastructure buyers" ], "weaknesses": [ "Not a classic audit shop; no public audit-report library to compare findings", "Engagements skew to long R&D/verification projects; less suited to a quick pre-launch review", "US offices only (Portland, Arlington, Minneapolis, Dayton); no European presence found" ], "key_works": [ { "title": "Verified Cryptographic Code for Everybody: SAW proofs of AES-256-GCM and SHA-384 in AWS-LC", "client": "AWS", "year": 2021, "kind": "Research", "primitives": [ "Formal verification", "Cryptographic libraries" ], "url": "https://cdn.amazon.science/4e/23/177acd514c799204ae22f98e193d/verified-cryptographic-code-for-everybody.pdf", "why": "With AWS (CAV 2021): memory-safety and functional-correctness proofs of AES-256-GCM and SHA-384 C/x86 code in AWS-LC.", "landmark": true }, { "title": "blst BLS12-381 library formal verification", "client": "Supranational / Ethereum Foundation / Protocol Labs", "year": 2020, "kind": "Audit", "primitives": [ "Formal verification", "Signatures", "Cryptographic libraries" ], "url": "https://github.com/GaloisInc/BLST-Verification", "why": "Public Cryptol/SAW specs and proofs for blst, incl. hand-written x86 field arithmetic; README tracks proof coverage.", "landmark": true }, { "title": "Continuous formal verification of Amazon s2n (HMAC and DRBG)", "client": "Amazon", "year": 2018, "kind": "Research", "primitives": [ "Formal verification", "TLS & secure channels", "Randomness" ], "url": "https://discovery.ucl.ac.uk/id/eprint/10075271/", "why": "With AWS (CAV 2018): proofs that s2n's HMAC and DRBG match Cryptol specs, re-run automatically as code changes.", "landmark": false }, { "title": "Cheesecloth: proving software vulnerabilities in zero knowledge", "client": "DARPA (SIEVE)", "year": 2024, "kind": "Research", "primitives": [ "ZK proofs" ], "url": "https://www.galois.com/articles/introducing-cheesecloth-a-tool-for-proving-software-vulnerabilities-in-zero-knowledge", "why": "Compiles C/C++/Rust into ZK circuits; demonstrated on Heartbleed and an FFmpeg bug.", "landmark": false }, { "title": "BASALISC: hardware acceleration for FHE (DARPA DPRIVE)", "client": "DARPA", "year": 2021, "kind": "Research", "primitives": [ "FHE", "Side-channel & hardware" ], "url": "https://galois.com/blog/2021/03/galois-basalisc-project-wins-15-3m-darpa-contract", "why": "DARPA DPRIVE project (awarded March 2021) with KU Leuven, U. Arkansas and Verilab to build an FHE hardware accelerator.", "landmark": false }, { "title": "Cryptol specification language for cryptography", "client": "", "year": 2014, "kind": "Tool", "primitives": [ "Formal verification", "Cryptographic libraries" ], "url": "https://github.com/GaloisInc/cryptol", "why": "Executable spec language used to write reference models of primitives that implementations are proved against.", "landmark": false }, { "title": "SAW (Software Analysis Workbench)", "client": "", "year": 2015, "kind": "Tool", "primitives": [ "Formal verification", "Cryptographic libraries" ], "url": "https://github.com/GaloisInc/saw-script", "why": "Proves C (LLVM), Java, Rust and x86 code equivalent to Cryptol specs; used for the AWS-LC, s2n and blst proofs.", "landmark": false }, { "title": "swanky: Rust libraries for secure computation", "client": "", "year": 2018, "kind": "Tool", "primitives": [ "MPC / threshold signatures", "ZK proofs" ], "url": "https://github.com/GaloisInc/swanky", "why": "Open-source MPC and ZK building blocks (garbling, Diet Mac'n'Cheese, VOLE-in-the-head) from Galois research.", "landmark": false } ], "sources": [ "https://www.galois.com/research/cryptography", "https://www.galois.com/articles/2024-year-in-review", "https://galois.com/project/amazon-s2n", "https://cdn.amazon.science/4e/23/177acd514c799204ae22f98e193d/verified-cryptographic-code-for-everybody.pdf", "https://www.sos-vo.org/node/107141", "https://en.wikipedia.org/wiki/John_Launchbury" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-veridise", "name": "Veridise", "website": "https://veridise.com", "hq": "Austin, Texas, United States", "regions": [ "North America", "Global/remote" ], "founded": 2021, "size_band": "1-50", "firm_type": "Blockchain & smart-contract auditor", "summary": "Blockchain auditor with a strong ZK practice that pairs manual review with in-house verification tooling such as the Picus under-constraint checker.", "best_for": "zkVM, ZK-circuit and ZK-coprocessor teams (RISC Zero, ZKsync Airbender, Halo2/Circom/gnark circuits) that want tool-assisted audits focused on under-constrained circuits, pre-launch or as recurring CI-integrated review.", "specialties": [ "Zero-knowledge proofs", "Smart contracts", "Formal verification", "Implementation audit" ], "languages": [ "Circom", "Halo2 (Rust)", "Rust", "Solidity", "Leo", "o1js (TypeScript)", "gnark (Go)" ], "public_reports_url": "https://veridise.com/audits-archive/", "open_source_tools": [ "Picus (ZK circuit under-constraint checker)", "LLZK (circuit IR)" ], "pricing_tier": "$$$", "typical_engagement": "Fixed-scope ZK and contract audits of a few weeks (ChainSafe BLS: under two weeks) up to multi-month zkVM programmes (RISC Zero: July–December 2024); repeat engagements are common.", "strengths": [ "Large public ZK audit archive covering zkVMs, precompiles and circuits (RISC Zero, ZKsync Airbender, Monero FCMP++, Succinct)", "Picus formally checks circuit determinism; in a 2025 preliminary engagement it proved determinism for 11 SP1 operations", "Published data from 100 audits: 55% of its ZK audits had a critical issue vs 27.5% of other audits (The Block, Jul 2024)", "Academic formal-methods roots; publishes papers and conference talks on ZK verification" ], "weaknesses": [ "Focus is blockchain/ZK; little public work on TLS, PQC or enterprise cryptography", "Small team (about 40 staff per Built In); capacity can be constrained", "Many archive reports are smart-contract scope; confirm ZK specialists are staffed" ], "key_works": [ { "title": "ZKsync Airbender zkVM tool-assisted assessment (Picus, fuzzing)", "client": "Matter Labs", "year": 2026, "kind": "Audit", "primitives": [ "ZK proofs", "Formal verification" ], "url": "https://veridise.com/wp-content/uploads/2026/05/VAR_zksync_260216_picus_fuzzing-_Veridise_Security_Audit_AuditHub.pdf", "why": "Shows Veridise's tool-led method on a RISC-V zkVM: Picus determinism checks plus fuzzing and targeted review.", "landmark": false }, { "title": "Monero FCMP++ full-chain membership proofs audit", "client": "MAGIC Grants", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://veridise.com/wp-content/uploads/2025/06/VAR_Monero_250407_fcmp___V3.pdf", "why": "Review of the curve-tree membership-proof gadgets for Monero's FCMP++ upgrade; no low-or-higher issues found.", "landmark": false }, { "title": "RISC Zero zkVM V2 circuits, recursion and prover audit", "client": "RISC Zero", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://veridise.com/wp-content/uploads/2025/04/VAR-Risc0-241028-Round2-V4.pdf", "why": "End-to-end zkVM review: RISC-V and recursion circuits, ELF decoding, STARK verifiers and prover.", "landmark": true }, { "title": "o1js ZK framework audit", "client": "o1Labs", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://veridise.com/wp-content/uploads/2024/10/VAR_o1js_240318_o1js_V3.pdf", "why": "Constraint-level review of Mina's TypeScript ZK framework and its field encodings.", "landmark": false }, { "title": "DendrETH Plonky2 beacon light client audit", "client": "Metacraft Labs", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Bridges & light clients" ], "url": "https://veridise.com/wp-content/uploads/2025/05/Metacraft_Labs_240531_DendrETH_V1.pdf", "why": "Review of a ZK light client proving beacon-chain state in Plonky2, plus contracts integrating it with Lido and Diva.", "landmark": false }, { "title": "BLS12-381 in halo2-ecc audit", "client": "ChainSafe", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Signatures", "Bridges & light clients" ], "url": "https://veridise.com/wp-content/uploads/2025/03/VAR_ChainSafe-2.pdf", "why": "In-circuit BLS12-381 arithmetic for verifying BLS signatures inside halo2, as used by ZK light clients.", "landmark": false }, { "title": "Daimo P256Verifier audit", "client": "Daimo", "year": 2023, "kind": "Audit", "primitives": [ "Signatures", "Smart-contract cryptography" ], "url": "https://veridise.com/wp-content/uploads/2023/10/VAR-DaimoP256Verifier-V101.pdf", "why": "Solidity ECDSA verifier for P-256 (secp256r1), designed as a drop-in for the proposed EIP-7212 precompile.", "landmark": false }, { "title": "Automated detection of under-constrained ZK circuits (QED², PLDI 2023)", "client": "", "year": 2023, "kind": "Research", "primitives": [ "ZK proofs", "Formal verification" ], "url": "https://pldi23.sigplan.org/details/pldi-2023-pldi/63/Automated-Detection-of-Under-Constrained-Circuits-in-Zero-Knowledge-Proofs", "why": "With UT Austin, UCSB, 0xPARC and others: QED2 resolved 70% of 163 Circom circuits and found 8 new bugs.", "landmark": true }, { "title": "Picus under-constrained circuit checker", "client": "", "year": 2022, "kind": "Tool", "primitives": [ "ZK proofs", "Formal verification" ], "url": "https://github.com/Veridise/Picus", "why": "Open-source checker for under-constrained signals in Circom, R1CS and gnark circuits.", "landmark": false }, { "title": "LLZK: MLIR intermediate representation for ZK circuits", "client": "", "year": 2024, "kind": "Tool", "primitives": [ "ZK proofs" ], "url": "https://github.com/project-llzk/llzk-lib", "why": "Open IR that lets analysis tools work across ZK circuit languages.", "landmark": false } ], "sources": [ "https://veridise.com/zk", "https://veridise.com/audits-archive", "https://www.theblock.co/post/306331/blockchain-security-veridise-zk-audits-critical-issues", "https://builtin.com/company/veridise", "https://veridise.com/blog/audit-insights/verifying-sp1-circuit-determinism-with-picus-a-collaboration-between-veridise-and-succinct", "https://github.com/Veridise/Picus" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-zellic", "name": "Zellic", "website": "https://www.zellic.io", "hq": "Not publicly stated", "regions": [ "North America", "Global/remote" ], "founded": 2021, "size_band": "51-200", "firm_type": "Blockchain & smart-contract auditor", "summary": "Vulnerability-research firm founded by CTF players, with substantial public ZK and applied-cryptography audit output across zkEVMs, proof aggregators, ZK light clients and Zcash.", "best_for": "ZK rollups, proof aggregators, ZK light clients and privacy-coin teams (Zcash Sapling/Orchard, librustzcash) that want a high-volume Web3 auditor with ZK and applied-crypto depth.", "specialties": [ "Zero-knowledge proofs", "Smart contracts", "Implementation audit", "Protocol design review" ], "languages": [ "Rust", "Go", "C++", "Solidity", "Move", "Circom", "Halo2" ], "public_reports_url": "https://github.com/Zellic/publications", "pricing_tier": "$$$", "typical_engagement": "Consultative audits of a few weeks with a public PDF report when the client agrees.", "strengths": [ "Public reports on major ZK systems: Scroll zkEVM circuits, SP1 design review, Barretenberg bigfield, Nebra UPA circuits, Blobstream X", "Recent Zcash cryptography work in 2026 (Sapling, librustzcash and further Zcash reports)", "One of three firms Aztec chose for a side-by-side bigfield audit (2024)", "Team background in top-ranked CTF competition; site lists applied cryptography and ZK circuits among core specialisms" ], "weaknesses": [ "Web3-centric; little public work on TLS, PQC or enterprise crypto", "Headquarters and headcount are not stated on its site; confirm contracting entity and staffing", "Code4rena, the contest platform Zellic acquired in 2024, announced in May 2026 that it is winding down; do not assume a contest add-on is available" ], "key_works": [ { "title": "Zcash Sapling cryptographic security assessment", "client": "Valar Group", "year": 2026, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments", "Cryptographic libraries" ], "url": "https://github.com/Zellic/publications/blob/master/Zcash%20Sapling%20-%20Zellic%20Audit%20Report.pdf", "why": "Recent review of Zcash's Sapling shielded protocol code; shows depth on production privacy cryptography.", "landmark": true }, { "title": "SP1 zkVM design review (register-memory aliasing)", "client": "Succinct Labs", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://github.com/Zellic/publications/blob/master/Succinct%20SP1%20-%20Zellic%20Design%20Review.pdf", "why": "Focused review of SP1's register-memory aliasing and RISC-V spec compliance; not a full audit of the SP1 implementation.", "landmark": false }, { "title": "Scroll zkEVM circuits, Part 1 (with KALOS)", "client": "Scroll", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://github.com/Zellic/publications/blob/master/Scroll%20zkEVM%20-%20Part%201%20-%20Audit%20Report.pdf", "why": "Halo2 zkEVM circuit assessment (with KALOS); a reference for under-constrained circuit findings in zkEVMs.", "landmark": true }, { "title": "Barretenberg bigfield proof circuit assessment", "client": "Aztec", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://github.com/Zellic/publications/blob/master/Barretenberg%20Bigfield%20-%20Zellic%20Audit%20Report.pdf", "why": "Review of non-native field arithmetic gadgets in Aztec's prover stack, a common source of soundness bugs.", "landmark": false }, { "title": "Blobstream X zero-knowledge assessment", "client": "Celestia", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Bridges & light clients" ], "url": "https://github.com/Zellic/publications/blob/master/Blobstream%20X%20-%20Zellic%20Audit%20Report.pdf", "why": "ZK light-client circuits relaying Celestia data roots to Ethereum; relevant to bridge and DA builders.", "landmark": false }, { "title": "Universal Proof Aggregator circuit assessment", "client": "Nebra", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://github.com/Zellic/publications/blob/master/Nebra%20Universal%20Proof%20Aggregator%20-%20Zellic%20Audit%20Report.pdf", "why": "Review of recursive proof-aggregation circuits; relevant to anyone verifying many Groth16 proofs at once.", "landmark": false }, { "title": "SolBLS BLS signature library assessment", "client": "Warlock Labs", "year": 2024, "kind": "Audit", "primitives": [ "Signatures", "Smart-contract cryptography" ], "url": "https://github.com/Zellic/publications/blob/master/SolBLS%20-%20Zellic%20Audit%20Report.pdf", "why": "On-chain BLS verification library review; a reference for teams verifying pairing-based signatures in Solidity.", "landmark": false }, { "title": "Zcash Ironwood upgrade cryptographic assessment", "client": "Valar Group", "year": 2026, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://github.com/Zellic/publications/blob/master/Zcash%20Ironwood%20Upgrade%20-%20Zellic%20Audit%20Report.pdf", "why": "Checks new Orchard/Ironwood bundle flags and v3 note-commitment trapdoor derivation against the spec.", "landmark": false }, { "title": "Relay Protocol legacy Bitcoin sighash bug", "client": "Relay Protocol", "year": 2026, "kind": "Vulnerability disclosure", "primitives": [ "Signatures", "MPC / threshold signatures", "Bridges & light clients" ], "url": "https://www.zellic.io/blog/signing-blind", "why": "Legacy P2PKH signing omitted input amounts, letting an MPC signer approve fee-draining sweeps of deposits.", "landmark": false } ], "sources": [ "https://github.com/Zellic/publications", "https://www.zellic.io/our-work", "https://aztec.network/blog/security-of-the-aztec-network-audits-of-bigfield", "https://www.theblock.co/news/deals/2024-08-22-zellic-code4rena-312583", "https://www.odaily.news/en/newsflash/481189", "https://www.theblock.co/post/401179", "https://partners.circle.com/partner/zellic" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-openzeppelin", "name": "OpenZeppelin", "website": "https://www.openzeppelin.com", "hq": "Not publicly stated (remote team; site entity Zeppelin Group Ltd)", "regions": [ "Global/remote" ], "founded": 2015, "size_band": "51-200", "firm_type": "Blockchain & smart-contract auditor", "summary": "Major smart-contract security firm and library maintainer with a dedicated ZKP practice (launched Dec 2023) reviewing PLONK provers, verifiers and circuits; S&P Global agreed to acquire it in Sept 2026.", "best_for": "Rollup and L1/L2 teams that need on-chain verifier and prover review (PLONK/KZG, Fiat-Shamir transcripts) alongside contract audits from one established Web3 firm.", "specialties": [ "Smart contracts", "Zero-knowledge proofs", "Protocol design review", "Implementation audit" ], "languages": [ "Solidity", "Cairo", "Circom", "Noir", "Rust", "Leo", "o1js (TypeScript)", "Go" ], "public_reports_url": "https://www.openzeppelin.com/research", "open_source_tools": [ "OpenZeppelin Contracts" ], "pricing_tier": "$$$", "typical_engagement": "Multi-week audits with fix review (Linea prover 2024: about four weeks). No first-party rate card; request a scoped quote.", "strengths": [ "Dedicated ZKP practice covering PLONK-style systems, KZG, FRI, Fiat-Shamir and recursive proofs", "Found a critical Fiat-Shamir transcript flaw (proof forgery) in Linea's PLONK verifier (2023 public report)", "Reviewed gnark's PLONK prover for zero-knowledge properties, finding missing blinding of quotient shards (High, resolved; 2024)", "Maintains OpenZeppelin Contracts, the most widely used Solidity library" ], "weaknesses": [ "Primarily a smart-contract firm; few public pure-cryptography library audits outside Web3", "S&P Global agreed to acquire OpenZeppelin (announced 17 Sept 2026, subject to closing); it is to run as a standalone unit — confirm contracting terms", "Public research listing shows recent reports only; older ZK reports must be found individually" ], "key_works": [ { "title": "Linea gnark PLONK prover backend and verifier audit", "client": "Linea (Consensys)", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://www.openzeppelin.com/news/linea-prover-audit", "why": "Review of gnark's BN254 PLONK prover and Solidity verifier template; found unblinded quotient shards (high).", "landmark": true }, { "title": "Linea PLONK verifier contracts audit", "client": "Linea (Consensys)", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs", "Smart-contract cryptography" ], "url": "https://www.openzeppelin.com/news/linea-verifier-audit-1", "why": "On-chain PLONK verifier review that surfaced one critical issue; useful for teams shipping generated verifiers.", "landmark": false }, { "title": "ZKsync crypto precompile audit (BN254 pairing)", "client": "Matter Labs", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://github.com/matter-labs/era-contracts/blob/main/audits/v28/ZKsync%20Crypto%20Precompile%20Audit.pdf", "why": "Review of Boojum circuit gadgets for BN254 field and curve arithmetic; five highs incl. a missing G2 subgroup check.", "landmark": false }, { "title": "ZKsync protocol precompiles implementation audit", "client": "Matter Labs", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://www.openzeppelin.com/news/zksync-protocol-precompiles-implementation-audit", "why": "Covers ECAdd, ECMul, ECPairing and ModExp precompile logic and circuit definitions in ZKsync; ModExp circuits in full.", "landmark": false }, { "title": "ZKsync SSO account recovery circuits audit", "client": "Matter Labs / Moonsong Labs", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Signatures", "Wallets" ], "url": "https://www.openzeppelin.com/news/sso-account-recovery-circuits-audit", "why": "Circom circuits proving a Google-signed JWT (RSA-SHA256) for smart-wallet account recovery; a zkLogin-style reference.", "landmark": false }, { "title": "OpenZeppelin Contracts cryptography utilities", "client": "", "year": 2024, "kind": "Tool", "primitives": [ "Signatures", "Smart-contract cryptography", "Cryptographic libraries" ], "url": "https://docs.openzeppelin.com/contracts/api/utils/cryptography", "why": "Widely used Solidity ECDSA, P256, RSA, WebAuthn and Merkle proof code; P256/RSA arrived in v5.1 (2024).", "landmark": true }, { "title": "openzeppelin-crypto Rust crate (Stylus)", "client": "", "year": 2024, "kind": "Tool", "primitives": [ "Cryptographic libraries", "Hashing & commitments", "Signatures" ], "url": "https://github.com/OpenZeppelin/rust-contracts-stylus/tree/main/lib/crypto", "why": "Open-source no_std field, curve, EdDSA, Pedersen and Poseidon2 code for Arbitrum Stylus contracts.", "landmark": false }, { "title": "ECDSA signature malleability advisory (CVE-2022-35961)", "client": "", "year": 2022, "kind": "Vulnerability disclosure", "primitives": [ "Signatures", "Smart-contract cryptography" ], "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4h98-2769-gh6h", "why": "Compact EIP-2098 signatures let used signatures be replayed; a lesson in signature-uniqueness assumptions.", "landmark": false } ], "sources": [ "https://www.openzeppelin.com/zkp", "https://www.openzeppelin.com/news/announcing-the-openzeppelin-zero-knowledge-proofs-zkp-practice", "https://www.openzeppelin.com/news/linea-verifier-audit-1", "https://www.openzeppelin.com/news/linea-prover-audit", "https://theblock.co/news/business/2026-09-17-sp-global-agrees-to-acquire-openzeppelin-in-onchain-security-push-415360" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-chainsecurity", "name": "ChainSecurity", "website": "https://www.chainsecurity.com", "hq": "Zurich, Switzerland", "regions": [ "Europe" ], "founded": 2017, "size_band": "1-50", "firm_type": "Blockchain & smart-contract auditor", "summary": "ETH Zurich spin-off focused on smart-contract and protocol audits, with a small but real body of ZK-circuit (Plonky2) and DKG-tool audit work.", "best_for": "EVM projects based in or selling to Europe whose scope mixes contracts with Plonky2 circuits or validator DKG tooling, and that want a Swiss auditor — not a first choice for pure cryptography reviews.", "specialties": [ "Smart contracts", "Zero-knowledge proofs", "MPC / threshold signatures" ], "languages": [ "Solidity", "Vyper", "Rust", "Go" ], "public_reports_url": "https://www.chainsecurity.com/smart-contract-audit-reports", "pricing_tier": "$$$", "typical_engagement": "Fixed-scope smart-contract audits of weeks; repeat audits for large DeFi and stablecoin clients.", "europe_presence": "Headquartered in Zurich, Switzerland (Thurgauerstrasse 40).", "strengths": [ "Large public archive: 430 reports since 2017, per its site", "Some ZK-circuit (Intmax Plonky2) and DKG-tool audit experience with public PDFs", "Swiss base and ETH Zurich academic roots" ], "weaknesses": [ "Cryptography is a minor share of public work; mostly smart-contract audits", "No public reviews of standalone crypto libraries, PQC or hardware found", "Site lists Decentralized Security AG (Zurich) as the entity; ChainSecurity was acquired by PwC Switzerland in 2020 — confirm the current contracting entity" ], "key_works": [ { "title": "Intmax 2 ZKP circuits code assessment", "client": "Intmax", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://reports.chainsecurity.com/Intmax/ChainSecurity_Intmax_Intmax2ZKPCircuits_Audit.pdf", "why": "Soundness review of recursive Plonky2 rollup circuits (balance, validity, withdrawal); 7 criticals found and fixed.", "landmark": true }, { "title": "Plonky2 BN254 scalar-multiplication and Keccak256 circuits", "client": "Intmax", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments", "Cryptographic libraries" ], "url": "https://reports.chainsecurity.com/Intmax/ChainSecurity_Intmax_Plonky2BN254Keccak256Circuits_Audit.pdf", "why": "Gadget-level review of non-native curve and Keccak circuits with cross-table lookups; 3 criticals fixed.", "landmark": false }, { "title": "SSV-DKG tool limited code review", "client": "SSV Labs", "year": 2024, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Key management & HSM", "TLS & secure channels" ], "url": "https://reports.chainsecurity.com/SSVNetwork/ChainSecurity_ssv.network_SSV-DKGTool.pdf", "why": "DKG tooling for distributed validators: missing result-signature check, TLS default, PKCS#1 v1.5 share encryption.", "landmark": false }, { "title": "Herodotus CairoLib (MPT, MMR, Keccak) assessment", "client": "Herodotus", "year": 2023, "kind": "Audit", "primitives": [ "Hashing & commitments", "Bridges & light clients", "Cryptographic libraries" ], "url": "https://reports.chainsecurity.com/Herodotus/ChainSecurity_Herodotus_CairoLib_Audit.pdf", "why": "Storage-proof primitives in Cairo; a critical MPT verify bug let forged keys pass. Useful for proof-of-state builders.", "landmark": true }, { "title": "Herodotus on Starknet storage-proof contracts", "client": "Herodotus", "year": 2023, "kind": "Audit", "primitives": [ "Hashing & commitments", "Bridges & light clients" ], "url": "https://reports.chainsecurity.com/Herodotus/ChainSecurity_Herodotus_HerodotusOnStarknet_Audit.pdf", "why": "L1-to-Starknet header and fact registry review; an MMR flaw let proofs verify against inner nodes.", "landmark": false }, { "title": "Chronicle Scribe Schnorr-aggregation oracle", "client": "Chronicle", "year": 2023, "kind": "Audit", "primitives": [ "Signatures", "Smart-contract cryptography" ], "url": "https://reports.chainsecurity.com/Chronicle/ChainSecurity_Chronicle_Scribe_Audit.pdf", "why": "On-chain secp256k1 Schnorr multi-signature verification for oracles (scheme design itself out of scope).", "landmark": false } ], "sources": [ "https://www.chainsecurity.com/smart-contract-audit-reports", "https://www.chainsecurity.com/security-audit/intmax-2-zkp-circuits", "https://www.greaterzuricharea.com/en/news/pwc-switzerland-taking-over-chainsecurity-ag", "https://www.theblock.co/news/ecosystems/2020-01-06-pwc-switzerland-hires-team-behind-smart-contract-auditing-startup-52159" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-sigma-prime", "name": "Sigma Prime", "website": "https://sigmaprime.io", "hq": "Sydney, Australia", "regions": [ "APAC", "Global/remote" ], "founded": 2016, "size_band": "1-50", "firm_type": "Blockchain & smart-contract auditor", "summary": "Ethereum infrastructure and security firm (builder of the Lighthouse consensus client) auditing protocols, KZG/BLS cryptography, zkVM programs and ZK circuits.", "best_for": "Ethereum consensus, staking and rollup teams needing review of BLS/KZG code or zkVM-based consensus proofs by reviewers who also build core protocol software; budget-ready ZK projects (published floor applies).", "specialties": [ "Protocol design review", "Implementation audit", "Zero-knowledge proofs", "Smart contracts", "Wallets & key management" ], "languages": [ "Rust", "Go", "C", "Solidity", "Circom", "Halo2", "Noir", "Cairo" ], "public_reports_url": "https://github.com/sigp/public-audits", "open_source_tools": [ "Lighthouse (Ethereum consensus client)", "Anchor (SSV client)" ], "pricing_tier": "$$$$", "typical_engagement": "First-party: 'ZK audits start at US$150,000 and scale with circuit complexity'; engagements begin with a week of spec-building.", "strengths": [ "Builds and maintains Lighthouse, giving first-hand Ethereum consensus and BLS expertise", "Public reviews of Ethereum's KZG ceremony and the c-kzg-4844/go-kzg-4844 libraries", "ZK audit service covering Circom, Halo2, Cairo, Plonky2 and Noir, plus zkVM work (RISC Zero, Polygon zkEVM)", "Publishes a ZK pricing floor, which helps budgeting" ], "weaknesses": [ "High published floor for ZK audits (from US$150k)", "Ethereum-centric; little public non-blockchain crypto work", "Sydney base; check time-zone overlap for European and US teams" ], "key_works": [ { "title": "c-kzg-4844 and go-kzg-4844 libraries review", "client": "Ethereum Foundation", "year": 2023, "kind": "Audit", "primitives": [ "Hashing & commitments", "Cryptographic libraries" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/ethereum-foundation/c-kzg/review.pdf", "why": "Pre-Dencun review of the C and Go KZG libraries Ethereum clients use for blobs; found a BLS12-381 point deserialisation bug.", "landmark": true }, { "title": "KZG Powers of Tau ceremony review", "client": "Ethereum Foundation", "year": 2022, "kind": "Audit", "primitives": [ "Hashing & commitments", "Randomness" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/ethereum-foundation/ef-kzg/review.pdf", "why": "Review of the EIP-4844 trusted-setup sequencer; relevant to anyone running a public setup ceremony.", "landmark": false }, { "title": "On-chain BLS library review", "client": "Lido", "year": 2026, "kind": "Audit", "primitives": [ "Signatures", "Smart-contract cryptography" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/lido/Sigma_Prime_Lido_BLS_Library_Security_Assessment_Report_v2_0.pdf", "why": "Review of Lido's Solidity BLS12-381 library for verifying validator deposit signatures; scope limited to BLS.sol.", "landmark": false }, { "title": "The Signal: Ethereum consensus circuits review", "client": "RISC Zero", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Bridges & light clients", "Signatures" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/risc-zero/Sigma_Prime_Risc_Zero_The_Signal_Ethereum_Security_Assessment_Report_v2_0.pdf", "why": "zkVM proofs of Casper FFG finality; pairs consensus-client expertise with ZK light-client review.", "landmark": false }, { "title": "Clementine BitVM2 bridge review", "client": "Chainway Labs", "year": 2025, "kind": "Audit", "primitives": [ "Bridges & light clients", "Signatures", "ZK proofs" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/chainway/Sigma_Prime_Chainway_Labs_Clementine_Security_Assessment_Report_v2_0.pdf", "why": "Bitcoin bridge using BitVM2, MuSig2 and Winternitz keys; covers unverified light-client proof risks.", "landmark": false }, { "title": "Charon distributed validator protocol review", "client": "Obol", "year": 2023, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Signatures" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/obol/Sigma_Prime_Obol_Network_Charon_Security_Assessment_Report_v2_1.pdf", "why": "Threshold BLS validator middleware; flagged missing commitment-length checks in the Kryptology DKG dependency.", "landmark": false }, { "title": "DC4BC batch BLSToExecutionChange signing review", "client": "Lido", "year": 2023, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Key management & HSM" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/lido/lido-dc4bc/review.pdf", "why": "Review of the threshold-BLS DKG tooling Lido used to sign its validators' BLSToExecutionChange messages.", "landmark": false }, { "title": "drand distributed randomness beacon review", "client": "Protocol Labs (Filecoin)", "year": 2020, "kind": "Audit", "primitives": [ "Randomness", "MPC / threshold signatures", "Signatures" ], "url": "https://github.com/sigp/public-audits/blob/master/reports/filecoin/filecoin-drand/review.pdf", "why": "Threshold-BLS beacon and DKG review; found a rogue-key attack and a replay attack enabling node eviction in the DKG.", "landmark": true }, { "title": "SP1 and zkVMs: a security auditor's guide", "client": "", "year": 2025, "kind": "Research", "primitives": [ "ZK proofs" ], "url": "https://sigmaprime.io/blog/sp1-zkvm-security-guide/", "why": "Checklist for reviewing SP1/RISC-V guest programs: input validation, 32-bit pitfalls, verification-key handling.", "landmark": false } ], "sources": [ "https://sigmaprime.io/services/zero-knowledge-audit", "https://sigmaprime.io/about", "https://github.com/sigp/public-audits", "https://governance.aave.com/t/sigma-prime-security-assessment-services-for-aave/8518", "https://builtinlondon.uk/company/sigma-prime" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-spearbit-cantina", "name": "Spearbit / Cantina", "website": "https://www.cantina.security", "hq": "Miami, Florida, United States", "regions": [ "Global/remote" ], "founded": 2021, "size_band": "51-200", "firm_type": "Audit contest platform", "summary": "Spearbit is a curated network of independent security researchers; Cantina, which grew out of it, now sells researcher-led and AI-assisted reviews, competitions and bug bounties.", "best_for": "Web3 teams that want a hand-picked researcher team for a ZK circuit library or protocol (Halo2, Barretenberg) as part of a broader contract review, and can vet the named researchers' crypto record themselves.", "specialties": [ "Smart contracts", "Zero-knowledge proofs", "Implementation audit" ], "languages": [ "Solidity", "Rust", "Halo2", "C++", "Go" ], "pricing_tier": "$$$$", "typical_engagement": "Team reviews scoped by codebase complexity and required expertise (no public rate card), plus fixed-window competitions with prize pools and ongoing bounties.", "strengths": [ "Network model lets clients match named researchers to a ZK, L1/L2 or DeFi stack", "One of three firms Aztec chose for its comparative bigfield audit; its report included two of the three issues Aztec graded Critical (engagements differed in length and scope)", "Managed reviews, competitions and bounties available under one platform", "Stated process ends with a final verification audit of fixes" ], "weaknesses": [ "Reviewer quality depends on who is staffed; ask for named researchers and their cryptography record", "Few public, cryptography-specific reports; little non-blockchain crypto work", "Brand and site moved from cantina.xyz to cantina.security with an AI-native review offering; confirm what is human-led in your scope" ], "key_works": [ { "title": "Polygon zkEVM: Protocol (ROM and prover), engagement 1", "client": "Polygon (Agglayer)", "year": 2022, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://cantina.xyz/portfolio/47149dac-9411-454f-97da-73014cd9f02d", "why": "Pre-mainnet review of zkEVM ROM and prover code with 7 criticals fixed; a reference for zkEVM attack surfaces.", "landmark": true }, { "title": "Polygon zkEVM: Cryptography (pil-stark, proverjs)", "client": "Polygon (Agglayer)", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://cantina.xyz/portfolio/0b05adac-0237-4fd7-84ca-25471a1c9840", "why": "Dedicated review of the PIL-STARK proving stack; shows how they split cryptography from protocol review.", "landmark": false }, { "title": "Axiom circuits security review (halo2-lib, axiom-eth)", "client": "Axiom", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Bridges & light clients", "Cryptographic libraries" ], "url": "https://docs.axiom.xyz/assets/files/spearbit.zk.audit-b72ef0a5d6a642214e88d478a8fedd19.pdf", "why": "halo2 gadget library and Ethereum storage-proof circuits; 4 criticals fixed. Useful for halo2-based ZK coprocessors.", "landmark": true }, { "title": "Barretenberg bigfield security review", "client": "Aztec", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://github.com/AztecProtocol/audit-reports/blob/main/Barretenberg/stdlib_primitives/Bigfield/Test%20Bigfield%20Audit/Cantina%20Audit%20Report%20-%20Barretenberg%20Bigfield.pdf", "why": "Found two criticals in bigfield non-native arithmetic (unconstrained bit in pow, limb invariant); Zellic also reviewed it.", "landmark": false }, { "title": "Aztec stdlib field security review", "client": "Aztec", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://github.com/AztecProtocol/audit-reports/blob/main/Barretenberg/stdlib_primitives/Field/Cantina-Field-Audit.pdf", "why": "Review of Barretenberg's in-circuit field_t primitive; low-severity and informational findings only.", "landmark": false }, { "title": "zkSync snark-wrapper review (Boojum, rescue-poseidon)", "client": "Matter Labs", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://cantina.xyz/portfolio/100de63d-47fe-453a-9504-a6f8d8e3c784", "why": "Review of the wrapper compressing Boojum STARK proofs into a SNARK for L1 verification.", "landmark": false }, { "title": "zksync-protocol BN254 circuits review", "client": "Matter Labs", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://cantina.xyz/portfolio/1ec576fa-02d2-43c2-971b-16aa2b0215c1", "why": "BN254 scalar-mul and pairing circuit review in zkevm_circuits by three researchers incl. Guido Vranken; 5 informational.", "landmark": false }, { "title": "Succinct SP1 zkVM audit competition", "client": "Succinct Labs", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://cantina.xyz/competitions/b92d2750-d5a3-4c53-9bca-2e70d5dfe0ac", "why": "Crowdsourced competition on SP1's AIRs, precompiles and verifier (65 submissions); no consolidated report is published.", "landmark": false } ], "sources": [ "https://docs.cantina.security/vision-and-approach.md", "https://docs.avax.network/integrations/spearbit", "https://aztec.network/blog/security-of-the-aztec-network-audits-of-bigfield", "https://refreshmiami.com/news/spearbit-raises-7m-to-make-web3-projects-more-secure", "https://docs.axiom.xyz/transparency-and-security/security" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-ottersec", "name": "OtterSec", "website": "https://osec.io", "hq": "Not publicly stated (operating entity Otter Audits LLC)", "regions": [ "North America", "Global/remote" ], "size_band": "51-200", "firm_type": "Blockchain & smart-contract auditor", "summary": "Blockchain auditor strong in Solana, Sui and Aptos, with public reports on Solana's ZK token SDK, Sui zkLogin circuits and WSTS threshold signatures.", "best_for": "Solana and Move ecosystem teams needing contract plus ZK-adjacent review (confidential tokens, zkLogin-style circuits, threshold signing for bridges) from an ecosystem-trusted auditor.", "specialties": [ "Smart contracts", "Zero-knowledge proofs", "Wallets & key management", "MPC / threshold signatures" ], "languages": [ "Rust", "Move", "Solidity", "TypeScript" ], "public_reports_url": "https://osec.io/audits/", "open_source_tools": [ "Anchor (Solana framework; OtterSec states it maintains it)", "bn-ebpf-solana (sBPF Binary Ninja plugin)" ], "pricing_tier": "$$$", "typical_engagement": "Fixed-scope audits of weeks; also reviews emergency patches for ecosystem incidents (e.g. Solana's May 2025 ZK ElGamal fix).", "strengths": [ "Deep Solana/Move expertise; states that it maintains the Anchor framework", "Public reports on ZK-adjacent systems (Solana zk-token-sdk, Sui zkLogin, Light Protocol) and WSTS threshold signing", "Named by Solana as one of three firms that reviewed the 2025 ZK ElGamal Proof program fix", "Strong CTF and exploit-research culture" ], "weaknesses": [ "Few cryptography-specific research publications compared with applied-crypto boutiques", "Solana's May 2025 post-mortem on a Fiat-Shamir bug in the ZK ElGamal Proof program links OtterSec's 2023 audit of that code — a reminder that audits do not guarantee security", "No stated HQ, founding year or headcount; confirm team staffing" ], "key_works": [ { "title": "Unfaithful claims: breaking 6 zkVMs", "client": "", "year": 2026, "kind": "Vulnerability disclosure", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://osec.io/blog/zkvms-unfaithful-claims/", "why": "Fiat-Shamir transcript gaps in Jolt, Nexus, Ceno, Expander, Binius64 and Cairo-M verifiers allowed false proofs.", "landmark": true }, { "title": "Unverified evaluations in Dusk's PLONK", "client": "Dusk Network", "year": 2026, "kind": "Vulnerability disclosure", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://osec.io/blog/unverified-evaluations-dusk-plonk/", "why": "Verifier trusted prover-supplied selector evaluations, enabling forged proofs and minting; shows verifier-level depth.", "landmark": false }, { "title": "zk-token-sdk (confidential transfers) audit", "client": "Solana Foundation", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs", "Cryptographic libraries" ], "url": "https://github.com/anza-xyz/security-audits/blob/master/spl/OtterSecZkTokenSdkAudit-2023-11-04.pdf", "why": "ElGamal and sigma-proof library behind Token-2022 confidential transfers; two critical fee-proof findings.", "landmark": false }, { "title": "ZK Compression v1 audit (incl. groth16-solana)", "client": "Light Protocol", "year": 2024, "kind": "Audit", "primitives": [ "ZK proofs", "Hashing & commitments" ], "url": "https://github.com/Lightprotocol/light-protocol/blob/main/audits/ottersec_2024-08_zkcompression-v1.pdf", "why": "Audit of Solana ZK Compression programs with the groth16-solana verifier crate in scope; 30 findings reported.", "landmark": false }, { "title": "Celestia BlobstreamX security assessment", "client": "Celestia", "year": 2024, "kind": "Audit", "primitives": [ "Bridges & light clients", "Smart-contract cryptography" ], "url": "https://docs.celestia.org/audits/Blobstream_X-OtterSec_Audit.pdf", "why": "Contract-level review of BlobstreamX (gateway, function registry); two informational findings. Circuits not named in scope.", "landmark": false }, { "title": "Stacks WSTS cryptography review", "client": "Stacks", "year": 2025, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Signatures" ], "url": "https://osec.io/reports/1d584d4e-4146-80b9-82ea-c5b37d99176c", "why": "Listed on OtterSec's public reports index (osec.io/reports) under this title and date.", "landmark": false }, { "title": "Mysten zkLogin review", "client": "Mysten Labs", "year": 2023, "kind": "Audit", "primitives": [ "ZK proofs" ], "url": "https://osec.io/reports/42a0ccb1-3da4-470a-ba15-69c890f1d4a6", "why": "Listed on OtterSec's public reports index (osec.io/reports) under this title and date.", "landmark": false } ], "sources": [ "https://osec.io", "https://osec.io/audits", "https://solana.com/news/post-mortem-may-2-2025", "https://github.com/anza-xyz/security-audits", "https://www.sui.io/blog/ottersec-robert-chen-blockchain-security" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-pqshield", "name": "PQShield (advisory)", "website": "https://pqshield.com", "hq": "Oxford, United Kingdom", "regions": [ "Europe", "North America", "APAC" ], "founded": 2018, "size_band": "51-200", "firm_type": "Applied cryptography specialist", "summary": "Oxford University spin-out selling post-quantum cryptography IP whose advisory arm is in the UK NCSC's assured-consultancy PQC pilot for discovery, migration planning and advice.", "best_for": "Enterprises, critical-infrastructure operators and chip makers planning a post-quantum migration (crypto inventory, ML-KEM/ML-DSA roadmap) who want advice from PQC specialists — not a code audit.", "specialties": [ "Post-quantum", "Protocol design review", "Side-channel & hardware", "Formal verification" ], "languages": [ "C/C++", "Assembly", "Jasmin", "Verilog" ], "pricing_tier": "$$$", "typical_engagement": "Advisory programmes (discovery of the cryptographic estate, migration roadmap, standards-aligned advice), with partners such as Capgemini, CGI, Roke and TCS for larger programmes.", "europe_presence": "UK company (Oxford spin-out); NCSC-assured PQC consultancy pilot for UK critical national infrastructure.", "strengths": [ "Selected for the UK NCSC Assured Cyber Security Consultancy PQC pilot in both categories (Discovery & Migration Planning; Advice), Sept 2025", "Team wrote CRYPTREC's ML-KEM evaluation report and co-authors formal-verification work on ML-KEM", "Hardware/firmware PQC IP experience relevant to side-channel-aware migration", "Named customers/partners include AMD, Microchip, Lattice Semiconductor, Collins Aerospace and NTT Data" ], "weaknesses": [ "Advisory and IP vendor, not an audit firm; no public audit-report library", "Advice may touch on its own PQC products; ask how independence is handled", "Narrow focus: no ZK, MPC or smart-contract work" ], "key_works": [ { "title": "CRYPTREC ML-KEM evaluation report (CRYPTREC-EX-3502-2025)", "client": "CRYPTREC", "year": 2025, "kind": "Research", "primitives": [ "Post-quantum", "Side-channel & hardware", "TLS & secure channels" ], "url": "https://pqshield.com/wp-content/uploads/2026/03/cryptrec-ex-3502-2025.pdf", "why": "Independent evaluation of FIPS 203 covering proofs, cryptanalysis, side channels and TLS 1.3 use; a migration primer.", "landmark": true }, { "title": "Falcon signature scheme (basis of NIST FN-DSA)", "client": "", "year": 2017, "kind": "Standard / spec", "primitives": [ "Post-quantum", "Signatures" ], "url": "https://falcon-sign.info/", "why": "Multi-author NIST lattice signature (10 designers incl. Thomas Prest, now PQShield) selected by NIST in 2022; basis of FN-DSA.", "landmark": true }, { "title": "Formally verifying AVX2 rejection sampling for ML-KEM (explainer of Almeida et al., IEEE S&P 2025)", "client": "", "year": 2025, "kind": "Research", "primitives": [ "Post-quantum", "Formal verification", "Cryptographic libraries" ], "url": "https://pqshield.com/post-quantum-cryptography-verification-for-ml-kem/", "why": "PQShield post on an EasyCrypt proof of Jasmin AVX2 rejection sampling for ML-KEM (Almeida et al., S&P 2025); not solely PQShield work.", "landmark": false }, { "title": "Formally verifying Kyber Episode V: IND-CCA security of ML-KEM in EasyCrypt", "client": "", "year": 2024, "kind": "Research", "primitives": [ "Post-quantum", "Formal verification" ], "url": "https://pqshield.com/publications/formally-verifying-kyber-episode-v-machine-checked-ind-cca-security-and-correctness-of-ml-kem-in-easycrypt/", "why": "Crypto 2024 machine-checked IND-CCA proof of ML-KEM linked to Jasmin code; 14 authors, one from PQShield (P.-Y. Strub).", "landmark": false }, { "title": "Threshold Raccoon: practical lattice threshold signatures", "client": "", "year": 2024, "kind": "Research", "primitives": [ "Post-quantum", "MPC / threshold signatures", "Signatures" ], "url": "https://pqshield.com/publications/threshold-raccoon-practical-threshold-signatures-from-standard-lattice-assumptions/", "why": "Eurocrypt 2024 threshold signatures from standard lattice assumptions; five PQShield authors plus one from XWiki/CryptPad.", "landmark": false }, { "title": "Raccoon: a masking-friendly signature proven in the probing model", "client": "", "year": 2024, "kind": "Research", "primitives": [ "Post-quantum", "Signatures", "Side-channel & hardware" ], "url": "https://pqshield.com/publications/raccoon-a-masking-friendly-signature-proven-in-the-probing-model/", "why": "CRYPTO 2024 masking-friendly lattice signature with t-probing proofs, submitted to NIST's extra-signature call; with ANSSI.", "landmark": false }, { "title": "RISC-V scalar crypto, entropy source and constant-time extensions", "client": "RISC-V International", "year": 2021, "kind": "Standard / spec", "primitives": [ "Side-channel & hardware", "Randomness", "Cryptographic libraries" ], "url": "https://pqshield.com/?p=1284", "why": "PQShield staff were main contributors, within the RISC-V Crypto Task Group, to the scalar crypto, entropy and constant-time extensions.", "landmark": false } ], "sources": [ "https://pqshield.com/ncsc-assured-cyber-security-consultancy", "https://quantumcomputingreport.com/pqshield-selected-as-ncsc-official-pqc-consultant-for-uk-critical-infrastructure", "https://pqshield.com/wp-content/uploads/2026/03/cryptrec-ex-3502-2025.pdf", "https://www.thestack.technology/pqshield-series-b-post-quantum-cryptography", "https://pqshield.com/?p=3998" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-keysight-riscure", "name": "Keysight (Riscure)", "website": "https://www.keysight.com", "hq": "Delft, Netherlands (Riscure lab; part of Keysight Technologies)", "regions": [ "Europe", "North America", "APAC" ], "founded": 2001, "size_band": "201-1000", "firm_type": "Hardware & side-channel lab", "summary": "Riscure, founded in Delft in 2001 and acquired by Keysight in 2024, is a device-security lab and tool vendor for side-channel, fault-injection and certification evaluations, including of post-quantum implementations.", "best_for": "Chip, secure-element, HSM and hardware-wallet makers needing side-channel/fault-injection testing of crypto implementations (including ML-DSA) or PSA Certified evaluations.", "specialties": [ "Side-channel & hardware", "Post-quantum", "FIPS 140-3 / CC certification", "Implementation audit" ], "languages": [ "C/C++", "Assembly", "Hardware/RTL" ], "pricing_tier": "$$$$", "typical_engagement": "Lab evaluations and certification projects of weeks to months; test tooling (Inspector) sold separately.", "europe_presence": "Riscure lab based in Delft, Netherlands.", "strengths": [ "Hands-on side-channel and fault-injection testing; Keysight's lab completed what it calls the first PSA Certified Level 4 evaluation (2025)", "Measured ML-DSA leakage at three protection levels with NXP; Inspector added PQC (Dilithium) testing in 2024", "Combines evaluation services with widely used commercial test tooling", "Long-standing Dutch lab (Delft, since 2001)" ], "weaknesses": [ "Hardware/device focus; not suited to protocol, ZK or smart-contract review", "Client reports are confidential; little public evidence to compare depth", "Now part of a large test-and-measurement corporation; procurement can be heavier" ], "key_works": [ { "title": "SiXG301 Series 3 Secure Vault, PSA Certified Level 4 evaluation", "client": "Silicon Labs", "year": 2025, "kind": "Certification", "primitives": [ "Side-channel & hardware", "Key management & HSM" ], "url": "https://www.businesswire.com/news/home/20250821281333/en/Keysight-Completes-Industry-First-PSA-Certified-Level-4-Evaluation-for-Silicon-Labs-SiXG301-SoC", "why": "Announced as the first PSA Certified Level 4 evaluation; included side-channel and fault-injection testing of Secure Vault.", "landmark": true }, { "title": "ML-DSA side-channel countermeasure evaluation", "client": "NXP Semiconductors", "year": 2025, "kind": "Research", "primitives": [ "Post-quantum", "Side-channel & hardware", "Signatures" ], "url": "https://www.keysight.com/us/en/about/newsroom/featured/2025/0722-keysight-supports-post-quantum-cryptography-evaluation.html", "why": "Press item: leakage tests of NXP's ML-DSA signing in three configurations (unprotected and two countermeasure levels).", "landmark": false }, { "title": "SN200 secure element with crypto library, CC EAL6+ evaluation", "client": "NXP Semiconductors", "year": 2023, "kind": "Certification", "primitives": [ "Side-channel & hardware", "Key management & HSM", "Cryptographic libraries" ], "url": "https://commoncriteriaportal.org/nfs/ccpfiles/files/epfiles/NSCIB-2200037-01-CR%20.pdf", "why": "NSCIB EAL6+ certification report (Mar 2023) naming Riscure as evaluation facility for an NXP secure element.", "landmark": false }, { "title": "SN220 secure element with crypto library, CC EAL6+ evaluation", "client": "NXP Semiconductors", "year": 2021, "kind": "Certification", "primitives": [ "Side-channel & hardware", "Key management & HSM", "Cryptographic libraries" ], "url": "https://www.commoncriteriaportal.org/files/epfiles/NSCIB-CC-0258298-CR.pdf", "why": "EAL6+ secure-element certification with Riscure as ITSEF; shows smart-card-grade attack testing.", "landmark": false }, { "title": "Jlsca side-channel analysis toolkit", "client": "", "year": 2016, "kind": "Tool", "primitives": [ "Side-channel & hardware", "Cryptographic libraries" ], "url": "https://github.com/Keysight/Jlsca", "why": "Open-source Julia toolkit for CPA, LRA and MIA attacks on AES, DES and SHA-1 (HMAC), incl. white-box models.", "landmark": false }, { "title": "FiSim fault-injection simulator", "client": "", "year": 2020, "kind": "Tool", "primitives": [ "Side-channel & hardware" ], "url": "https://github.com/Keysight/FiSim", "why": "Open-source Unicorn-based simulator for testing secure-boot code against instruction-skip and corruption faults.", "landmark": false }, { "title": "Bypassing secure boot using fault injection (Black Hat EU 2016)", "client": "", "year": 2016, "kind": "Research", "primitives": [ "Side-channel & hardware", "Signatures" ], "url": "https://www.blackhat.com/docs/eu-16/materials/eu-16-Timmers-Bypassing-Secure-Boot-Using-Fault-Injection.pdf", "why": "Riscure talk (Timmers, Spruyt) showing voltage glitching can skip signature checks in Cortex-A9 secure boot; covers countermeasures.", "landmark": true } ], "sources": [ "https://securitydelta.nl/news/overview/riscure-acquired-by-keysight-technologies", "https://globalplatform.org/?p=2315", "https://www.keysight.com/jp/ja/about/newsroom/featured/2025/0722-keysight-supports-post-quantum-cryptography-evaluation.html", "https://www.businesswire.com/news/home/20240430030207/en/Keysight-Introduces-New-Testing-Capabilities-to-Strengthen-Post-Quantum-Cryptography" ], "confidence": "medium", "last_verified": "2026-11" }, { "uid": "ca-atsec", "name": "atsec information security", "website": "https://atsec.de", "hq": "Austin, United States & Munich, Germany (no single HQ stated)", "regions": [ "North America", "Europe", "APAC" ], "founded": 2000, "size_band": "201-1000", "firm_type": "Certification lab", "summary": "Accredited evaluation lab for FIPS 140-3 (CMVP), cryptographic algorithm and entropy-source testing, and Common Criteria.", "best_for": "Vendors of cryptographic modules (HSMs, TEEs, OS crypto libraries, network appliances) that need FIPS 140-3 validation, algorithm testing, SP 800-90B entropy assessment or Common Criteria certification.", "specialties": [ "FIPS 140-3 / CC certification", "Implementation audit" ], "languages": [ "C/C++", "Assembly", "Java" ], "public_reports_url": "https://atsec.de/services/cryptographic-testing/fips-140-3-testing", "pricing_tier": "$$$", "typical_engagement": "FIPS 140-3 projects span months including the NIST CMVP queue; algorithm and entropy assessments are shorter.", "europe_presence": "European offices in Munich (Germany), Stockholm (Sweden) and Rome (Italy).", "strengths": [ "Large FIPS track record (its site links to 577 certificates)", "Named as testing lab on NIST CMVP certificates for major vendors (Qualcomm, F5)", "FIPS 140-3, algorithm testing, entropy-source assessment and Common Criteria under one roof", "Offices in Austin, Munich, Stockholm, Rome and Beijing" ], "weaknesses": [ "Conformance testing, not adversarial cryptanalysis or protocol design review", "Timelines depend on NIST CMVP queues outside the lab's control", "Not relevant for ZK, MPC or smart-contract projects" ], "key_works": [ { "title": "First ML-KEM and ML-DSA algorithm testing via NIST ACVTS", "client": "", "year": 2024, "kind": "Certification", "primitives": [ "Post-quantum", "Cryptographic libraries" ], "url": "https://atsec.de/first-post-quantum-cryptographic-algorithm-certificates-published/", "why": "atsec reports running the first ML-KEM/ML-DSA CAVP tests hours after NIST opened ACVTS in Aug 2024.", "landmark": true }, { "title": "Qualcomm TEE Software Cryptographic Library, FIPS 140-3 cert #4809", "client": "Qualcomm Technologies", "year": 2024, "kind": "Certification", "primitives": [ "Cryptographic libraries", "Key management & HSM" ], "url": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4809", "why": "FIPS 140-3 validation of a TEE crypto library (AES, ECDSA, RSA, DRBG) tested by atsec as the accredited lab.", "landmark": false }, { "title": "F5OS-A Cryptographic Module, FIPS 140-3 cert #4883", "client": "F5", "year": 2024, "kind": "Certification", "primitives": [ "Cryptographic libraries", "TLS & secure channels" ], "url": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4883", "why": "Level 2 FIPS 140-3 validation of a network appliance crypto module; atsec listed as testing lab.", "landmark": false }, { "title": "CMUF feedback coordination for ISO/IEC 19790:2025 and 24759:2025", "client": "CMUF / ISO/IEC JTC1/SC27 WG3", "year": 2025, "kind": "Standard / spec", "primitives": [ "Key management & HSM", "Cryptographic libraries" ], "url": "https://atsec.de/the-publication-of-iso-iec-197902025-and-iso-iec-247592025/", "why": "atsec hosted CMUF, co-led its FIPS 140-3 working group and coordinated feedback to SC27 on the 2025 standards.", "landmark": false }, { "title": "ACVP Proxy client for NIST algorithm testing", "client": "", "year": 2018, "kind": "Tool", "primitives": [ "Cryptographic libraries" ], "url": "https://github.com/smuellerDD/acvpproxy", "why": "Open-source C client for fetching ACVP test vectors and submitting results; developed by atsec, hosted on a staff GitHub account.", "landmark": false }, { "title": "Jitter RNG with SP 800-90B compliance", "client": "", "year": 2019, "kind": "Tool", "primitives": [ "Randomness", "Cryptographic libraries" ], "url": "https://github.com/smuellerDD/jitterentropy-library", "why": "CPU-jitter entropy source by atsec colleague Stephan Mueller; atsec announced its SP 800-90B-compliant release in 2019.", "landmark": false } ], "sources": [ "https://atsec.de/services/cryptographic-testing/fips-140-3-testing", "https://atsec.de/company", "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4809", "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4883" ], "confidence": "high", "last_verified": "2026-11" }, { "uid": "ca-nethermind-security", "name": "Nethermind Security", "website": "https://www.nethermind.io", "hq": "London, United Kingdom", "regions": [ "Europe", "Global/remote" ], "founded": 2017, "size_band": "51-200", "firm_type": "Blockchain & smart-contract auditor", "summary": "Security arm of Ethereum infrastructure company Nethermind, doing ZK and smart-contract audits plus formal verification of on-chain proof verifiers.", "best_for": "Rollups and zkVM-based apps (SP1, RISC Zero, Noir, Cairo) that want ZK circuit plus verifier audits, optionally with EasyCrypt/Lean formal verification, from a London-based Ethereum core-infrastructure team; also MPC/OPRF-style identity components.", "specialties": [ "Zero-knowledge proofs", "Formal verification", "Smart contracts", "Implementation audit", "MPC / threshold signatures" ], "languages": [ "Solidity", "Yul", "Cairo", "Noir", "Circom", "Rust", "o1js (TypeScript)" ], "public_reports_url": "https://github.com/NethermindEth/PublicAuditReports", "open_source_tools": [ "zksync-verification (EasyCrypt model)", "Clear (Lean framework for Yul)" ], "pricing_tier": "$$$", "typical_engagement": "Audits of weeks; formal-verification projects of months (ZKsync verifier: about 2.5 months).", "europe_presence": "Headquartered in London, United Kingdom.", "strengths": [ "Proved ZKsync's ~1,700-line Yul verifier conforms to a PLONK/plookup specification in EasyCrypt", "ZK audits across Noir, Circom, Cairo, SP1 and RISC Zero (e.g. Lido's SP1 zk-oracle, 2025)", "Cryptographic findings in identity infrastructure, e.g. World ID nullifier review flagged non-constant-time field arithmetic and Lagrange-coefficient checks (2026)", "Parent builds Ethereum client software; London HQ suits European buyers" ], "weaknesses": [ "Public report repository has terse file names and no index, making comparison harder", "Formal-verification scope can be partial (ZKsync: soundness, completeness and zero-knowledge not proven)", "Ethereum/Starknet-centric; little enterprise or PQC work" ], "key_works": [ { "title": "Formal verification of the ZKsync PLONK verifier in EasyCrypt", "client": "Matter Labs", "year": 2025, "kind": "Research", "primitives": [ "Formal verification", "ZK proofs", "Smart-contract cryptography" ], "url": "https://www.nethermind.io/blog/formal-verification-of-the-zksync-verifier", "why": "With Matter Labs: EasyCrypt proof that ZKsync's production Yul verifier matches a PLONK/plookup honest-verifier model.", "landmark": true }, { "title": "World ID OPRF nullifier (threshold/secret-sharing) review", "client": "World", "year": 2026, "kind": "Audit", "primitives": [ "MPC / threshold signatures", "Signatures", "Hashing & commitments" ], "url": "https://github.com/NethermindEth/PublicAuditReports/blob/main/NM_0693_D_NULLIFIER_WORLD_ID.pdf", "why": "Rust threshold-OPRF nullifier code: Lagrange party-ID checks, constant-time field ops, EdDSA timing, Poseidon2.", "landmark": true }, { "title": "World nullifier contracts security review", "client": "World", "year": 2026, "kind": "Audit", "primitives": [ "Smart-contract cryptography", "Signatures" ], "url": "https://github.com/NethermindEth/PublicAuditReports/blob/main/NM_0411_0693_WORLD_ID_C.pdf", "why": "On-chain side of the World ID nullifier system; flagged a missing BabyJubJub on-curve check.", "landmark": false }, { "title": "Lido accounting zk-oracle on SP1: circuit and verifier", "client": "Lido", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Bridges & light clients" ], "url": "https://github.com/NethermindEth/PublicAuditReports/blob/main/NM_0530_LIDO_ACCOUNTING_ZK_ORACLE_FINAL.pdf", "why": "zkVM program proving beacon-chain balances; high-severity validator-index manipulation found and fixed.", "landmark": false }, { "title": "World Chain Priority Blockspace for Humans contracts", "client": "World", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Smart-contract cryptography" ], "url": "https://github.com/NethermindEth/PublicAuditReports/blob/main/NM0417_FINAL-WORLDCHAIN-PBH.pdf", "why": "World ID proof-gated blockspace; found nullifier hashes could be consumed without a valid proof (medium).", "landmark": false }, { "title": "SAMM anonymous multisig Noir circuits audit", "client": "Oxorio (SAMM)", "year": 2025, "kind": "Audit", "primitives": [ "ZK proofs", "Wallets" ], "url": "https://www.nethermind.io/blog/anonymous-governance-meets-safe-multisig-netherminds-audit-of-samm-protocol", "why": "Noir circuits for email-based anonymous Safe voting; a reference for Noir and email-proof designs.", "landmark": false }, { "title": "risczero-fv: Lean formalisation of RISC Zero circuits", "client": "", "year": 2023, "kind": "Tool", "primitives": [ "Formal verification", "ZK proofs" ], "url": "https://github.com/NethermindEth/risczero-fv", "why": "Lean models of Zirgen circuits with constraint-to-spec proofs (decoder, IsZero, OneHot); shows circuit FV method.", "landmark": false }, { "title": "LatticeFold / LatticeFold+ proof-of-concept implementation", "client": "", "year": 2024, "kind": "Tool", "primitives": [ "ZK proofs", "Post-quantum" ], "url": "https://github.com/NethermindEth/latticefold", "why": "Proof-of-concept Rust implementation of Boneh-Chen lattice folding with Ajtai commitments; not reviewed for production use.", "landmark": false } ], "sources": [ "https://www.nethermind.io/zk-audits-and-zero-knowledge-security", "https://www.nethermind.io/blog/formal-verification-of-the-zksync-verifier", "https://www.nethermind.io/blog/zk-audit-of-lidos-accounting-zk-oracle-built-on-sp1", "https://builtinlondon.uk/company/nethermind", "https://github.com/NethermindEth/PublicAuditReports" ], "confidence": "high", "last_verified": "2026-11" } ] }