{
  "slug": "zksecurity",
  "name": "zkSecurity",
  "url": "https://www.zksecurity.xyz",
  "hq": "Remote-first (United States and Europe)",
  "founded": "2023",
  "focus": "Formal verification and audits of zero-knowledge circuits, proof systems and cryptographic protocols; creator of Clean and zk.golf",
  "summary": "zkSecurity is a cryptography security firm that audits and formally verifies zero-knowledge systems, MPC, FHE and post-quantum implementations. It created and maintains [Clean](/frameworks/clean/), the Lean 4 circuit framework with sound-and-complete gadgets that Succinct's sp1-lean is built on, runs the [zk.golf](/frameworks/zk-golf/) verified-circuit competition, and co-built the [better.codes](/frameworks/better-codes/) soundness challenge with the Ethereum Foundation and Yukon. Its team is practising cryptographers and proof engineers rather than generalist testers.",
  "why_first": "Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.",
  "services": [
    "Formal verification of ZK circuits and zkVM instruction sets in Lean 4 with Clean: specification writing, soundness and completeness proofs, CI-rechecked proof artifacts",
    "Security audits of ZK circuits (Circom, Halo2, Plonky3, Noir, Cairo, gnark), proof-system implementations and verifier integrations",
    "Cryptographic protocol and implementation review: MPC, FHE, post-quantum (ML-KEM, ML-DSA), TEEs",
    "Specification and threat-model authoring for teams preparing a verification effort",
    "Research and development engagements, including proof-system implementation and verified-circuit optimisation via zk.golf-style workflows"
  ],
  "tools": [
    "clean",
    "zk-golf",
    "better-codes",
    "sp1-lean",
    "lean4"
  ],
  "evidence": [
    [
      "Clean repository and documentation",
      "https://github.com/Verified-zkEVM/clean"
    ],
    [
      "Clean: from verified circuits to verified zkVMs (2026-06-05)",
      "https://blog.zksecurity.xyz/posts/clean-verified-zkvms/"
    ],
    [
      "Verifying Poseidon in Clean (2026-05-04)",
      "https://blog.zksecurity.xyz/posts/poseidon-clean/"
    ],
    [
      "Comparison of formal verification frameworks for arithmetic circuits (2025-11-19)",
      "https://blog.zksecurity.xyz/posts/formal-verification-arithmetic-circuits/"
    ],
    [
      "zk.golf announcement (2026-07-02)",
      "https://blog.zksecurity.xyz/posts/zkgolf/"
    ],
    [
      "better.codes launch with the Ethereum Foundation (2026-08-20)",
      "https://blog.ethereum.org/en/2026/08/20/better-codes-challenge"
    ],
    [
      "Public audit reports",
      "https://reports.zksecurity.xyz/"
    ]
  ],
  "fit": [
    "Choose zkSecurity when you want a circuit, gadget or zkVM verified in Lean with completeness as well as soundness, when you need the specification written by cryptographers who also audit, or when the surrounding protocol and verifier need a review in the same engagement. Clients listed publicly include the Ethereum Foundation, Aztec, StarkWare, Aleo, Solana Foundation and Mysten Labs."
  ],
  "rank": 1,
  "page": "https://sorryfree.com/firms/zksecurity/",
  "updated": "2026-09-13"
}