Verified Cairo AIR (Stone and S-two)
Direct answerStarkWare, with Jeremy Avigad and Yoav Seginer, has proved in Lean 4 that satisfying the Cairo VM's AIR (for both the Stone and S-two provers) implies a correct Cairo execution, and in July 2026 used the same methodology to verify the STRK20 privacy pool with more than 230 theorems.
- Maintainer
- StarkWare with Jeremy Avigad and Yoav Seginer
- Website
- https://arxiv.org/abs/2606.04311
- Category
- ZK circuit verification
- Targets
- Cairo VM AIRStoneS-two
- Approach
- Lean 4 proofs that AIR satisfiability implies a correct Cairo execution; Sierra-to-CASM building blocks
- Access
- Open source
- Status (2026-09-13)
- Active (paper June 2026); in-house at StarkWare, not a service
What Verified Cairo AIR (Stone and S-two) does
This is the longest-running production zkVM verification effort and the model for 'AIR soundness' work elsewhere. Nethermind's Horus, which verified Cairo 0 contracts with SMT, was archived on 2026-09-09; the Lean route is now the only maintained one for Cairo.
Where it is strong
- Whole-VM soundness statement for a deployed prover.
- Long track record and academic rigour.
- Extended to an application (STRK20).
Limits and caveats
- Cairo specific and in-house.
- Not packaged as a reusable framework.
- Completeness is not the headline property.
When to choose it
If you build on Starknet, read the papers to understand what is and is not covered by StarkWare's proofs.
Who works with Verified Cairo AIR (Stone and S-two)
No firm on this index lists Verified Cairo AIR (Stone and S-two) as a core tool yet; the firms below cover the same problem class.
Top-listed for circuit verification work: zkSecurity
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Related frameworks in ZK circuit verification
Clean, sp1-lean, zkLean, Halva, Picus, LLZK, Garden, Lampe, proven-zk and gnark-lean-extractor, CIVER, Circomspect, zkFuzz, Coda, Ecne, NAVe.