HACKING PROJECT · crypto · Advanced
Zero-Knowledge Proof Verifier
Implement and rigorously validate a zero-knowledge proof verifier that accepts only valid proofs and rejects forged or malformed ones.
Zero-knowledge proofs let one party prove a statement is true without revealing underlying data, powering privacy coins, zk-rollups, and confidential identity — but building and correctly verifying ZK circuits is error-prone, and a flawed verifier or under-constrained circuit silently accepts false proofs. Most engineers treat ZK as a black box, creating a dangerous gap between using proofs and trusting them. Soundness and completeness bugs in verifiers have already caused critical vulnerabilities in production rollups.
**What you'll build**
Build a working ZK proof system that implements (or integrates) a proving scheme such as Groth16 or PLONK, writes an arithmetic circuit (e.g., in Circom or Halo2), generates proofs, and — the core deliverable — implements a rigorous on-chain/off-chain verifier that validates proofs for soundness, completeness, and correct public-input binding. Include negative tests that attempt to forge or replay proofs, and document the trusted-setup assumptions and their risks.
**Objective** — Implement and rigorously validate a zero-knowledge proof verifier that accepts only valid proofs and rejects forged or malformed ones.
**Expected outcome** — A functioning ZK circuit + prover + verifier (with a Solidity on-chain verifier and a test suite of forgery/soundness attacks) demonstrating correct, secure verification.
**Difficulty** — Expert — requires strong applied cryptography, elliptic-curve/pairing math, circuit constraint design, and an understanding of trusted-setup soundness.
**Primary category** — Applied Cryptography; Secondary = Blockchain Security, Privacy Engineering, AppSec
**Security domains** — Primary = Security Research; Secondary = DevSecOps, AppSec, Cloud Security
**Technical focus** — zk-SNARKs/zk-STARKs, Groth16/PLONK, arithmetic circuit design, constraint systems (R1CS), elliptic-curve pairings, trusted setup/MPC ceremonies, on-chain verification, soundness/completeness testing
**Core technologies** — Languages: Circom, Rust, Solidity, JavaScript/TypeScript; Frameworks/Libraries: snarkjs, circomlib, Halo2, arkworks, gnark; Security Tools: circom sanity checkers, formal constraint analyzers (e.g., Picus/Ecne concepts); Cloud/Infra: Node.js, Docker, EVM testnet; AI/Data: N/A (optional constraint-fuzzing); Databases: N/A
**Where it's valued** — zk-rollup L2s, privacy protocols, confidential DeFi, digital identity, regulated finance, blockchain scaling infrastructure
**Careers it builds toward** — Cryptography Engineer, ZK/Applied Crypto Researcher, Protocol Security Engineer, Blockchain Core Developer, Privacy Engineer
**Framework alignment**
• MITRE ATT&CK: N/A (cryptographic protocol assurance, not adversary TTPs). Threat model centers on soundness bypass and proof forgery rather than ATT&CK techniques.
• NIST CSF 2.0: Protect (data confidentiality, cryptographic assurance), Identify (crypto risk)
• OWASP: OWASP Smart Contract Top 10 (logic/verification flaws), Cryptographic Failures (A02) analog
• CIS Controls v8: 3 Data Protection, 16 Application Software Security
**Innovation** — Research-Level Project — correctly implementing and adversarially validating a ZK verifier sits at the frontier of applied cryptography and privacy infrastructure. Scores: Innovation 9/10, Startup 8/10, Enterprise-Readiness 6/10, Patent = Possible.