Stefanos Chaliasos

security & research @zksecurityXYZ, Lecturer @ucl - Exploring ZKPs, PhD @imperialcollege

[Stefanos Chaliasos @schaliasosvons]

Excited to share our latest work on ZKPs security: "SoK: What don’t we know? Understanding Security Vulnerabilities in SNARKs" (w/ @0xSerious, @infosecual, @cryptodavidw, @MMJahanara, @convoluted_code).
URL: https://t.co/r01e68rwy3

[Fede’s intern 🥊 @fede_intern]

I'm still reading about it. Great work by @zksecurityXYZ as always and @cryptodavidw.

[alin.apt @alinush]

It's disheartening to see so many root against Zcash.

We owe so much to the courage of the Zcash team: ten years ago, Zcash was a moonshot.

They were the 1st to deploy a *fully* anonymous payment system and the 1st to deploy a zkSNARK-based cryptosystem.

Rooting against the team being able to recover from this bug is rooting against all other serious privacy efforts for cryptocurrencies: they are all based on the same nullifier techniques via circuit-based zkSNARKs.

This is not a zero-sum game.

Zcash has been showing us the way for over a decade and will continue to do so.

e.g., Zcash will soon be the 1st team to deploy a *formally-verified* zkSNARK circuit implementation for anonymous payments.

[zkao @zkaotool]

looking for a continuous bugfinding AI solution for your cryptography codebase? contact us!

[Nico @nico_mnbl]

1/ Very happy to share a new paper with Benedikt Wagner on data availability sampling (DAS). In this one we extend FRIDA with our recent findings on FRI

FRIDA was a 2024 paper in which they showed that we can construct DAS from proofs of proximity that satisfy 3 conditions

[Project Tachyon @TachyonZcash]

Our team is very grateful for @zksecurityXYZ’s research and tooling for building secure cryptographic software, including formal verification, fuzzing, and extensive auditing expertise.

[zkSecurity @zksecurityXYZ]

Groth16 is still the GOAT of zero-knowledge proof. Why can't anyone understand how it works then? Don't worry, we got you :) https://t.co/gH6ei714pX

[zkSecurity @zksecurityXYZ]

Read more on how we broke and reported bugs in post-quantum lattice-based zero-knowledge proof systems, link in comment

[Stefanos Chaliasos @schaliasosvons]

zkbugs updated website: https://t.co/jX6GS0av38

giveth link: https://t.co/0edC8McquN

[Stefanos Chaliasos @schaliasosvons]

We recently added more Circom bugs to zkbugs, bringing the total to 70 Circom and 139 ZK bugs. We aim to reach 300 bugs, focusing more on zkVMs. We also began evaluating security tools and are currently building open-source AI tools that the community can use while developing ZK code and before audits. Any contribution to the QF round will help us focus more on it and give opportunities to junior researchers through internships.

[Common Prefix @CommonPrefix]

Set a reminder and join us.

https://t.co/pefu785DNV

[thedao.fund @thedaofund]

With no further ado, meet the final 100 ETHSecurity Badge holders:

@404ouch
@mzargham
@neburo
@arik_g
@ret2jazzy
@0xQuit
@simon_jentzsch
@zigtur
@Hudsonjameson
@pashov
@PabloSabbatella
@GalloDaSballo
@tanuki42_
@aviggiano
@claudijd
@parithosh_j
@saxenism
@RMacwha
@socrates1024
@TrustSecAudits
@bbarwik
@schaliasosvons
@lethalspoons
@eladernst
@HalbornSteve

[zkSecurity @zksecurityXYZ]

We collaborated with Aptos Labs to audit their Confidential Assets protocol, a system enabling confidential balances and transfers on the Aptos blockchain. 👇🏼

[Stefanos Chaliasos @schaliasosvons]

Excellent blog on how to give LLMs access to tools and improve the quality of the output https://t.co/qfNZS9cKJJ

[alin.apt @alinush]

Confidential Assets v1.1 is now open-source: the first Move smart contract that lets you confidentially transfer your assets from your encrypted balance.

Here's what it does 🧵👇

https://t.co/XCxC4FvVNH

[JP Aumasson @veorq]

overdue, feels like "we forgot you all these years sry" https://t.co/3qKaLDTnJJ

[Stefanos Chaliasos @schaliasosvons]

@cryptodavidw Do you want to buy a car??

[Stefanos Chaliasos @schaliasosvons]

Read our Blog on the two ZK exploits that happened this week. If I'm not wrong, those were the first exploits of zk protocols. https://t.co/lZMx1USGbT

[zkSecurity @zksecurityXYZ]

The first two known exploits against live ZK circuits just happened, and they weren't subtle underconstrained bugs.

They were Groth16 verifiers deployed without completing the trusted setup ceremony. One was white-hat rescued for ~$1.5M, the other drained for 5 ETH.

🧵

[zkSecurity @zksecurityXYZ]

The first two known exploits against live ZK circuits just happened, and they weren't subtle underconstrained bugs.

They were Groth16 verifiers deployed without completing the trusted setup ceremony. One was white-hat rescued for ~$1.5M, the other drained for 5 ETH.

🧵

[Stefanos Chaliasos @schaliasosvons]

@Elliot0x @FOOMCASH @_SEAL_Org https://t.co/tow4KpkXFg

[FOOM CASH @FOOMCASH]

Security flex
✅ $500K bug bounty
✅ Audited contracts
✅ 32,000+ ETH in treasury
✅ Withdrawals work even if paused

https://t.co/fHlHHtmaXx isn’t a game. It’s war-grade DeFi.

[Stefanos Chaliasos @schaliasosvons]

@moo9000 Publishing a blog post tomorrow, but this wasn't a deep cryptography bug. This was not following a quick start guide thoroughly (with a bit of a conducted API, to be frank)