{
  "slug": "zkcraft",
  "name": "zkCraft (with zkFuzz)",
  "tagline": "Prompt-guided LLM mutation oracle on top of the zkFuzz circuit fuzzer",
  "maintainer": "Academic (Takahashi et al.)",
  "url": "https://arxiv.org/abs/2602.00667",
  "repo": "https://github.com/Koukyosyumei/zkFuzz",
  "category": "crypto-zk",
  "targets": [
    "Circom",
    "Noir (preliminary)"
  ],
  "approach": "LLM proposes mutation patterns; zkFuzz's trace-constraint consistency test supplies ground truth",
  "license": "Open source",
  "status": "Research (zkFuzz at IEEE S&P 2026; zkCraft 2026 preprint)",
  "summary": "zkFuzz is a mutation fuzzer that finds disagreements between witness generation and constraints in Circom circuits (85 bugs across 452 circuits, 59 zero-days, 39 confirmed) without any LLM. zkCraft adds a prompt-guided LLM as the oracle that proposes mutation patterns, making it the clearest example of LLM plus fuzzing for ZK.",
  "details": [
    "The combination matters because the fuzzer, not the model, decides what counts as a bug: an LLM hypothesis is only reported when a concrete trace violates the constraints. That eliminates hallucinated findings at the cost of missing bugs the mutation space cannot reach."
  ],
  "strengths": [
    "Ground truth from execution, so no hallucinated findings.",
    "Strong published bug counts.",
    "Open source."
  ],
  "limits": [
    "Circom focus; Noir preliminary.",
    "Cannot prove absence of bugs.",
    "Research maintenance cadence."
  ],
  "fit": [
    "Pair with zk-skills or zkao: fuzzing for concrete underconstraint traces, agents for logic bugs."
  ],
  "references": [
    [
      "zkCraft (arXiv 2602.00667)",
      "https://arxiv.org/abs/2602.00667"
    ],
    [
      "zkFuzz paper (arXiv 2504.11961)",
      "https://arxiv.org/abs/2504.11961"
    ],
    [
      "zkFuzz repository",
      "https://github.com/Koukyosyumei/zkFuzz"
    ]
  ],
  "category_name": "Cryptography and ZK specialists",
  "page": "https://agentsast.com/tools/zkcraft/",
  "updated": "2026-09-13"
}