Zero-Knowledge VMs: Security and Usability in Practice

Abstract

Zero-knowledge Virtual Machines (zkVMs) are emerging critical infrastructure for blockchain Layer 2 scaling solutions, enabling execution of arbitrary programs while generating succinct proofs of correct computation. Despite hundreds of millions of investment, the rapidly evolving zkVM ecosystem lacks comprehensive empirical analysis of its security and usability challenges. We present the first systematic study of zkVM vulnerability and usability issues, analyzing production zkVMs through three perspectives covering 314 security vulnerabilities (professional audits), 11,854 commits (developer practices), and 1,150 user issues (user experiences). We identify prevalent, severe, and non-traditional vulnerability categories and their root causes, reveal high-value attack surfaces that consistently emerge across zkVMs, and identify major usability issues that users struggle with. Comparing our findings against existing research reveals four gaps representing research and tool development opportunities for the testing and analysis of zkVMs.