{
  "slug": "zkfuzz",
  "name": "zkFuzz",
  "tagline": "Fuzzer for trace-constraint inconsistencies in Circom",
  "maintainer": "Hideaki Takahashi (Koukyosyumei)",
  "url": "https://github.com/Koukyosyumei/zkFuzz",
  "repo": "https://github.com/Koukyosyumei/zkFuzz",
  "category": "zk-circuits",
  "targets": [
    "Circom"
  ],
  "approach": "Fuzzing for trace-constraint consistency (TCCT) violations between witness generation and constraints",
  "license": "Open source",
  "status": "Active research (IEEE S&P 2026)",
  "summary": "zkFuzz fuzzes Circom programs for disagreements between what witness generation computes and what the constraints enforce, the root of most underconstraint bugs. Its paper reports 66 bugs across 354 circuits.",
  "details": [
    "Fuzzing complements SMT and proofs: it needs no specification, scales to circuits that time out solvers, and produces concrete counterexamples. It cannot prove absence of bugs."
  ],
  "strengths": [
    "Concrete exploits, not warnings.",
    "Scales where solvers do not.",
    "Strong published results."
  ],
  "limits": [
    "No guarantee on a clean run.",
    "Circom only.",
    "Single-maintainer research project."
  ],
  "fit": [
    "Add zkFuzz when Picus times out or a circuit has heavy non-linear logic."
  ],
  "references": [
    [
      "zkFuzz repository",
      "https://github.com/Koukyosyumei/zkFuzz"
    ]
  ],
  "category_name": "ZK circuit verification",
  "page": "https://sorryfree.com/frameworks/zkfuzz/",
  "updated": "2026-09-13"
}