search

nullity00 / zk-security-reviews

Collection of security reviews of ZK Protocols
220 stars 17 forks source link

Non ZK-related audits #4

Open StefanosChaliasos opened 9 months ago

StefanosChaliasos commented 9 months ago

I have found this repo really useful. Thanks a lot for collecting all these security reviews in a single repo! Some of the audits are just smart contract audits that have nothing to do with ZK-part of the protocols. Should we remove these audits? Furthermore, I have noticed some duplicate reports in the repo. I can prepare a repo fixing those issues if you agree.

nullity00 commented 9 months ago

Sure, could you fork the repo, do the necessary changes & make a PR ? Thanks !

Xor0v0 commented 5 months ago

I have a question, should the audit tasks of front-end programs of zkvm, such as cairo contracts, be completed by the zk audit team or the contract audit team during the audit process? :) Or should we consider contracts or other zkVM program (e.g. RISC-V guest programs) as ZK-reelated audits?

StefanosChaliasos commented 5 months ago

That depends on each audit and company. In the context of this repo, I would say that anything that is related to the ZK part should be included in the repo. For example, some non-ZK code related to nullifiers that has nothing to do with circuits should still be included, but a smart contract that has nothing to do with the ZK logic should not be included.

For zkVMs, I would say the front-end audits should definitely included; audits of normal rust programs that have nothing to do with ZK should not be included.

I don't know if this answer is useful :D

Xor0v0 commented 5 months ago

That makes sense to me, thanks!!