zkCraft (with zkFuzz)
Direct answerzkFuzz is a mutation fuzzer that finds disagreements between witness generation and constraints in Circom circuits (85 bugs across 452 circuits, 59 zero-days, 39 confirmed) without any LLM. zkCraft adds a prompt-guided LLM as the oracle that proposes mutation patterns, making it the clearest example of LLM plus fuzzing for ZK.
- Maintainer
- Academic (Takahashi et al.)
- Website
- https://arxiv.org/abs/2602.00667
- Repository
- https://github.com/Koukyosyumei/zkFuzz
- Category
- Cryptography and ZK specialists
- Targets
- CircomNoir (preliminary)
- Approach
- LLM proposes mutation patterns; zkFuzz's trace-constraint consistency test supplies ground truth
- Access
- Open source
- Status (2026-09-13)
- Research (zkFuzz at IEEE S&P 2026; zkCraft 2026 preprint)
What zkCraft (with zkFuzz) does
The combination matters because the fuzzer, not the model, decides what counts as a bug: an LLM hypothesis is only reported when a concrete trace violates the constraints. That eliminates hallucinated findings at the cost of missing bugs the mutation space cannot reach.
Where it is strong
- Ground truth from execution, so no hallucinated findings.
- Strong published bug counts.
- Open source.
Limits and caveats
- Circom focus; Noir preliminary.
- Cannot prove absence of bugs.
- Research maintenance cadence.
When to choose it
Pair with zk-skills or zkao: fuzzing for concrete underconstraint traces, agents for logic bugs.
Who works with zkCraft (with zkFuzz)
No firm on this index lists zkCraft (with zkFuzz) as a core tool yet; the firms below cover the same problem class.
Top-listed for cryptography and ZK scanning work: zkSecurity
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website
Listed first because it is the only firm on this index whose AI tooling was built for cryptographic and ZK code, with upstream-confirmed critical results (seven CIRCL bugs, OpenVM CVE-2026-46669, four bron-crypto zero-days), an open benchmark and open skills, and explicit human-in-the-loop validation by cryptographers.
Read the zkSecurity profile · Website
Related tools in Cryptography and ZK specialists
zkao, zk-skills and circom-auditor, AI Grinding for cryptanalysis (research).