Lie to Me: Finding Bugs in ZK DSL Toolchains with Adversarial Witness Injection
2026-08-31 • Cryptography and Security
Cryptography and SecuritySoftware Engineering
AI summaryⓘ
The authors present Liezz, a tool that tests special programming languages used in zero-knowledge cryptography by creating tricky examples that should be rejected if the system works correctly. It mixes parts of two correct program runs into one invalid proof to see if the toolchain still accepts it, which would mean there is a bug. Liezz found 13 bugs in popular toolchains, some only detectable through its advanced test methods, showing that traditional testing misses important errors. This approach helps improve the trustworthiness of cryptographic software.
zero-knowledge proofsdomain-specific languageconstraint systemscryptographic witnesssoundness bugsadversarial testingCircomCorsetGnarkNoir
Authors
Sebastian Watzinger, Christoph Hochrainer, Valentin Wüstholz, Maria Christakis
Abstract
Zero-knowledge domain-specific language (ZK DSL) toolchains compile programs into constraint systems and generate witnesses for cryptographic proofs. Bugs in these toolchains can leave the enforced constraints weaker than the source-program semantics, admitting proofs for invalid executions. Such soundness bugs may remain invisible to valid-execution testing because all valid executions still behave correctly. We present Liezz, a testing framework that generates ZK DSL programs and exposes these bugs through adversarial witness injection. For each generated deterministic program, Liezz executes two public input assignments with different outputs and splices their witnesses, combining the input of one execution with the output of the other. The resulting witness is invalid by construction. A correct toolchain must reject it; acceptance exposes a soundness bug. Controlled divergence and multiple witness-splicing strategies preserve enough consistency to expose missing constraints. Liezz also generates parameterized standard-library calls to reach complex functionality. Liezz supports Circom, Corset, Gnark, and Noir. It finds 13 bugs, including seven with soundness impact. Several are reachable only through generated standard-library calls. Under the same testing budget, a valid-execution baseline does not expose any of the soundness failures revealed by accepted injected witnesses, showing that adversarial witness injection reaches failures missed by valid-execution testing.