Efficient Branch-and-Bound Testing and Verification of zkVMs
ZEBRA verifies zkVM constraint systems via branch-and-bound cardinality counting, finding 11 zero-day bugs across five real-world zkVMs and running 51.5x faster than SMT verification.
ZEBRA reduces zkVM correctness to a solution-set cardinality problem requiring that each constraint system admit exactly one valid execution trace, eliminating redundancies like null-row padding and non-deterministic permutations before counting. It lifts analysis from finite-field witnesses to an integer interval lattice, exploiting that constraints across 5 real-world zkVMs use only 14.0% of theoretical connectivity capacity on average, enabling tight interval propagation. A parallel branch-and-bound search produces concrete counterexamples or certifies absence of violations within a bounded region. ZEBRA discovers 11 zero-day bugs (6 independently confirmed, 3 fixed), is 51.5x faster than SMT-based verification, and verifies 16.5 percentage points more instances.
- Reduces zkVM verification to solution-set cardinality over a canonical trace space
- Found 11 zero-day bugs in 5 real-world zkVMs; 6 confirmed, 3 already fixed
- 51.5x faster than SMT verification and verifies 16.5pp more instances
- Exploits 14% average constraint connectivity sparsity via integer interval lattice
Full article258 words · extracted from arxiv.org · click to collapse
Zero-knowledge virtual machines (zkVMs) enable verifiable execution of general-purpose programs by translating virtual machine semantics into algebraic constraints over execution traces. The correctness of these constraints is critical: a single incorrect constraint can admit forged proofs (under-constrained) or reject valid executions (over-constrained). Existing approaches do not provide meaningful guarantees at production scale: fuzzers and unit tests often miss bugs, SMT solvers struggle with the size and nonlinearity of constraints, and theorem provers require substantial manual effort. We present ZEBRA, a fully automated verification and bug-detection framework: for a given program and input, the constraint must admit exactly one valid execution trace - no more and no fewer. This reduces zkVM verification to a solution-set cardinality problem over a canonical trace space, where redundancies such as null-row padding and non-deterministic permutations are eliminated prior to counting. To compute cardinality tractably, ZEBRA lifts analysis from finite-field witnesses to an integer interval lattice, exploiting a structural sparsity property of zkVM constraints: across 5 real-world zkVMs, constraints utilize only 14.0% of their theoretical connectivity capacity on average. This sparsity enables tight interval propagation with limited approximation error. ZEBRA performs a parallel branch-and-bound search that either produces a concrete counter-example or certifies the absence of violations within a bounded region. We evaluate ZEBRA on five real-world zkVMs. ZEBRA discovers 11 zero-day bugs; 6 have already been independently confirmed and 3 have been fixed by developers. Compared to SMT-based verification, ZEBRA is 51.5x faster, verifies 16.5 percentage point more instances, and its range verification provides up to 63x efficiency gain over repeated single-input verification.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.15020