ZK Hints
Daily Digest每日摘要View All查看全部
Khambhati et al. propose garbling Groth16 verification with native elliptic-curve group operations. Their projective partial garbling scheme conditionally discloses invalid proofs, uses a rekeying gadget for pairing, and achieves a 2.4 MiB BN254 garbled program vs 48 GB Boolean garbling, with privacy under DDH in the ROM.Khambhati等人提出用原生群运算混淆Groth16验证，构建射影部分混淆方案以条件披露无效证明；BN254实现仅2.4 MiB，较48 GB布尔混淆缩小超四个数量级，隐私归约至DDH。
Key Points:要点：
- •Groth16 verification can be garbled with native EC group operations instead of Boolean circuits.Groth16验证方程可用原生椭圆曲线群运算进行混淆，避免布尔电路实现
- •The scheme is a projective partial garbling for conditional disclosure of invalid Groth16 proofs.方案为射影部分混淆，用于对无效Groth16证明进行条件披露
- •Invalid proofs reveal a garbler-held secret; valid proofs hide it while the proof remains public.当证明无效时求值会揭示混淆方持有的秘密；证明有效时秘密保持隐藏，证明本身仍公开
- •A rekeying gadget handles pairing when both arguments come from the evaluator, using one private scalar multiplication.针对求值方提供配对两个参数的挑战，引入rekeying gadget，仅需一次私有标量乘法
- •A composition theorem transforms group encodings into bitwise projective encodings and extends projectivization to quadratic extension fields.组合定理将群编码转换为逐位射影编码，并把Duty-Free Bits的射影化扩展到二次扩域
- •The BN254 implementation yields a 2.4 MiB garbled program versus 48 GB Boolean garbling; privacy holds under DDH in the ROM.BN254实现生成2.4 MiB混淆程序，远优于48 GB布尔混淆，隐私在随机预言模型下归约至DDH
Alan Woodward discussed Oxford physicist Tim Palmer's RaQM theory, which argues quantum computers face a fundamental ceiling of ~1,000 qubits and cannot break RSA, yet urges post-quantum migration regardless.Alan Woodward在博客中讨论了牛津物理学家Tim Palmer提出的Rational Quantum Mechanics理论，该理论认为量子计算机存在约1000量子比特的物理上限，无法破解RSA，但作者强调后量子密码迁移仍具必要性。
Key Points:要点：
- •Tim Palmer proposes RaQM, arguing quantum states carry fundamentally finite informationTim Palmer提出Rational Quantum Mechanics (RaQM)，认为量子态承载的信息量存在根本性的有限上限
- •The theory predicts a hard ceiling of roughly 1,000 effective entangled qubits该理论预测量子计算机有效纠缠量子比特的上限约为1000个
- •This falls below the ~2,049 logical qubits needed for Shor's algorithm to break 2048-bit RSA该上限低于Shor算法破解2048位RSA所需的约2049个逻辑量子比特
- •No experimental evidence currently supports or refutes the discretized Hilbert space theory目前既无实验证据支持也无实验证据反驳这一离散化希尔伯特空间理论
- •The author argues migration costs remain far lower than the catastrophic cost of betting wrong作者认为即使RaQM正确，后量子迁移成本也远低于赌注失败可能带来的灾难性损失
- •Large-scale cryptographic migration takes nearly a decade, too long to wait for physical validation大规模密码迁移周期长达近十年，无法等到该物理理论被证实或证伪后再行动
Trail of Bits shared how AI agents audited the Miden zkVM by building an LSP, decompiler, static analysis engine, and Lean models, uncovering a critical Falcon signature forgery bug and validation flaws.Trail of Bits分享了借助AI审计Miden zkVM的经验，构建LSP、反编译器、静态分析与Lean模型，发现可伪造Falcon签名的高危漏洞与多处验证缺陷。
Key Points:要点：
- •Built an LSP server, decompiler, and static analysis engine for MASM from scratch为MASM语言从零构建了LSP服务器、反编译器与静态分析引擎
- •Critical bug: unvalidated prover-supplied advice values enabled Falcon signature forgery and fund theft发现高危漏洞：未验证advice值使恶意证明者可伪造Falcon签名盗币
- •Static analysis identified 400+ type validation improvements reachable from the public API静态分析识别出400余处可从公共API触发的类型验证改进点
- •Produced 95 machine-checked Lean correctness proofs covering core library binary arithmetic使用Lean完成95个机器检验正确性证明，覆盖核心库二进制算术组件
- •AI-assisted discovery of two subtle bugs in rotr and wrapping_mul missed by unit testsAI辅助发现两个单元测试遗漏的细微bug：rotr大输入边缘情况与wrapping_mul栈错误
- •Demonstrates the economic viability of AI agents for high-assurance security audit tooling项目展示了AI代理在构建高保证安全审计工具方面的经济性与可行性
Dittmer et al. proposed ZK-JPEG, a ZK tool for JPEG compression proving correct compression from secret inputs and verifying image transformations with minimal overhead.Dittmer等人在论文中提出ZK-JPEG，一种针对JPEG有损压缩的零知识工具，可证明图像从秘密输入正确压缩，并低成本验证模糊、编辑等变换历史。
Key Points:要点：
- •ZK-JPEG supports zero-knowledge proving for lossy JPEG compression.ZK-JPEG支持JPEG有损压缩的零知识证明
- •It integrates and verifies image transformations like blurring and editing within compression.可将模糊、编辑等图像变换集成进压缩流程并验证
- •Python image processing code is converted into ZK circuits using PicoZK.使用PicoZK将Python图像处理代码转换为ZK电路
- •The system is built on the LPZK proof system for efficient proving.基于LPZK证明系统实现高效证明
- •It aims to verify image provenance and combat deep fakes.旨在帮助验证图像真实来源，对抗深度伪造
- •The system is fast, flexible, and instantiable from off-the-shelf ZK tools.系统灵活快速，可由现成ZK工具实例化
O'Grady et al. proposed Bonsai, an account-based private payment scheme where validators store one commitment per account without keeping nullifiers. Users maintain and prune received nullifiers privately. Combined with ZKP and batch verification, it achieves over one million verifications per second on commodity hardware.O'Grady等人提出基于账户的隐私支付方案Bonsai，验证者仅存储单个承诺而非nullifier，用户自行维护并可剪枝旧nullifier，结合ZK与批量验证，在消费级硬件上实现每秒百万级操作验证。
Key Points:要点：
- •Bonsai uses an account-based design; validators do not store any nullifier set.Bonsai采用基于账户的设计，验证者无需存储任何nullifier集合
- •Users privately maintain received nullifiers and can prune older ones to cold storage.用户私下维护接收到的nullifier，并可将旧nullifier剪枝归档至冷存储
- •External observers only learn that an account performed an action, not the amount or counterparty.外部观察者仅知账户发生动作，无法获知金额与交易对手
- •Zero-knowledge is integrated into Pari with no increase in proof size and negligible prover overhead.将零知识集成至Pari证明系统，未增加证明大小且证明者开销可忽略
- •A batch verification strategy supports high-throughput verification requirements.采用批量验证策略，支撑高吞吐量验证需求
- •The prototype verifies over one million operations per second on an M5 MacBook Pro.原型在M5 MacBook Pro上验证速度超过每秒100万笔操作
Apple SEAR and Camera & Photos introduced Apple Reference Image, a verifiable photography mode on iPhone 18 Pro using secure hardware and PCC for timestamps, post-quantum signatures, and privacy.Apple SEAR与相机团队发布Apple Reference Image，在iPhone 18 Pro上通过安全硬件与PCC实现可验证摄影，支持时间戳、后量子签名和隐私保护。
Key Points:要点：
- •Apple Reference Image is an opt-in mode on iPhone 18 Pro main camera that creates securely timestamped reference images.Apple Reference Image在iPhone 18 Pro主摄上提供可选模式，生成经安全时间戳的参考图像。
- •It splits the flow into a secure digital negative and PCC development, protected by sensor hardware and transparency logs.系统分为安全数字负片与PCC显影两阶段，分别用传感器硬件和可验证透明日志保护。
- •The sensor signs pixels and metadata at capture, while Apple's timestamp service provides lower and upper time bounds.拍摄时传感器立即签名像素与元数据，并用Apple时间戳服务给出拍摄时间上下界。
- •The final image is signed with a composite RSA-3072 and ML-DSA-87 post-quantum signature and can be revoked per photo or sensor.最终图像使用RSA-3072与ML-DSA-87复合后量子签名，并支持按照片或传感器撤销。
- •Privacy design avoids photographer identity and device linkage; timestamp requests use Oblivious HTTP.隐私设计避免暴露摄影师身份与设备关联，时间戳请求经Oblivious HTTP传输。
Jeong et al. revealed kleptographic backdoor risks in ZK-friendly hash function matrices, demonstrating severe consequences including forged proofs, digest collisions, and counterfeit currency in Plonky3, Neptune Cash, and Plonky2.Jeong等人在论文中揭示了ZK友好哈希函数矩阵可能被恶意利用植入kleptographic后门，并在Plonky3、Neptune Cash与Plonky2中展示了伪造证明、摘要碰撞与假币铸造等严重安全后果。
Key Points:要点：
- •The paper reveals that inconsistent standards for linear-layer matrix selection in ZK-friendly hash functions create room for malicious backdoors.论文揭示ZK友好哈希函数线性层矩阵选择缺乏统一标准，存在恶意后门植入空间。
- •A malicious designer can choose matrices satisfying MDS conditions and security checks while enabling controlled input-to-output mapping.恶意设计者可选定满足MDS条件及安全检测的矩阵，实现特定输入到输出的可控映射。
- •In Plonky3, an attacker could control Fiat-Shamir challenges to make verifiers accept invalid claims.Plonky3案例中，攻击者可控制Fiat-Shamir挑战，使验证者接受无效声明。
- •In Neptune Cash, program digest collisions could bypass transaction validation and enable counterfeit currency.Neptune Cash案例中，可通过构造程序摘要碰撞绕过交易验证，实现伪造货币。
- •In Plonky2, forged Merkle-tree membership proofs could compromise system integrity.Plonky2案例中，可伪造Merkle树成员证明，破坏系统完整性。
- •The study emphasizes that algebraic properties like MDS are insufficient; matrix generation must be transparent and verifiable.研究强调仅满足MDS等代数条件不足以保证矩阵可信，生成过程须透明可验证。
Kei and Chow systematize 58 cryptographic private Transformer inference frameworks, revealing cross-level design constraints and security boundaries across systems, models, and cryptography, and distill 12 open problems.Kei与Chow在论文中系统分析了58个密码学私有Transformer推理框架，从系统、模型与密码学三维度揭示跨层设计约束与安全边界，归纳出12个开放问题。
Key Points:要点：
- •The work systematizes 58 cryptographic private transformer frameworks from 2022 to 2026.系统化了2022至2026年间的58个密码学私有Transformer推理框架
- •It analyzes three interacting levels: systems, models, and cryptography.从系统执行、模型适配和密码学实现三个交互层面进行分析
- •Optimizations cannot transfer unchanged across phases due to unavailable values.揭示优化无法直接跨执行阶段迁移的适用性约束
- •Data-dependent pruning, caching, and routing require private execution structure handling.发现数据依赖的剪枝、缓存与路由需隐藏或约束执行结构
- •Four security concern classes affecting five frameworks are identified in maliciously secure designs.识别出影响5个框架的四类安全问题与恶意安全组合边界
- •Twelve open problems and sixteen outlooks span efficiency, security, and scalability.提出12个开放问题与16个展望，涵盖效率、安全与可扩展性
Bouvier et al. systematically surveyed ZK-friendly hash functions over prime fields, covering design paradigms, algebraic cryptanalysis, and comparing constraint counts and performance under R1CS, AIR, and PLONK.Bouvier等人对素数域上的ZK友好哈希函数进行了系统综述，涵盖设计范式、代数密码分析，并在R1CS、AIR、PLONK下对比了约束数与性能。
Key Points:要点：
- •Systematically organizes design paradigms and modes of existing ZK-friendly hash functions.系统梳理了现有ZK友好哈希函数的设计范式和运行模式。
- •Reviews algebraic cryptanalysis techniques and third-party analyses for these designs.综述了针对这些设计的代数密码分析技术及第三方分析结果。
- •Estimates minimum round counts to resist known attacks for broken parameter sets.对被攻破的参数集估算了抵抗已知攻击所需的最小轮数。
- •Compares constraint counts and performance across R1CS, AIR, and PLONK arithmetizations.在R1CS、AIR、PLONK三种算术化方式下对比了约束数和性能。
- •Provides an open-source suite with reference framework, Rust implementations, and in-circuit implementations.提供了开源实现套件，包括参考框架、Rust实现和电路实现。
- •Guides practitioners in hash selection for ZK protocols with benchmarks.为实践者在ZK协议中选择哈希函数提供了指导和基准。
a16z crypto introduced Lattice Jolt, a lattice-based zkVM replacing Dory with Akita. It achieves post-quantum security, 2-3x speedups, and sub-100KB proofs.a16z crypto团队在博客中发布Lattice Jolt，开源zkVM新版本，以格基承诺Akita替代椭圆曲线Dory，实现后量子安全，证明速度提升2至3倍，证明尺寸低于100KB。
Key Points:要点：
- •Replaces elliptic-curve Dory with Module-SIS-based Akita for transparent post-quantum security以基于Module-SIS的Akita承诺替代椭圆曲线Dory，实现透明后量子安全
- •Prover reaches 2M+ cycles/sec on CPU, 10M+ on MacBook GPU via Metal证明者速度提升至200万+周期/秒，MacBook GPU加速超1000万周期/秒
- •Proof size under 100KB, smallest among current post-quantum zkVMs证明尺寸低于100KB，为现有后量子zkVM中最小
- •Proving overhead dropped from millions to ~10,000x, memory to 200 bytes/cycle证明开销从数百万倍降至约1万倍，内存占用降至200 bytes/cycle
- •Highlights security risks of algebraic hashes and unproven proximity-gap bounds in hash-based SNARKs指出哈希基SNARKs中代数哈希（如Poseidon）及未证proximity-gap界限的安全隐患
- •Maintains nearly 128-bit security over 128-bit fields, unlike hash-based soundness loss n/|F|128位域上保持近128位安全性，优于哈希方案因n/|F|导致的安全损耗
Sonnino et al. proposed Guppy, a protocol that enables efficient light clients via recursive ZKPs, allowing validators to commit only to state updates while an off-chain service maintains a verifiable Merkle tree.Sonnino等人在论文中提出了一个名为Guppy的协议，通过递归ZKP实现高效轻客户端，让验证者只承诺状态更新，由链下服务维护可验证Merkle树。
Key Points:要点：
- •Guppy removes the need for validators to maintain full state Merkle trees.Guppy避免了验证者维护完整状态Merkle树的开销
- •An off-chain service maintains the verifiable Merkle tree using recursive ZKPs.链下服务通过递归ZKP维护可验证Merkle树
- •A hash-chain commitment moves signature verification out of the ZK circuit.哈希链承诺将签名验证移出ZK电路以降低证明成本
- •A parallel recursive proving pipeline keeps latency logarithmic in throughput.并行递归证明管线确保延迟随吞吐量对数增长
- •Plonky2 implementation supports a 2^30 tree and thousands of updates per second.基于Plonky2实现，支持2^30大小的树和每秒数千更新
- •Validator overhead is negligible and block construction complexity is not increased.验证者开销可忽略，不增加区块构建复杂度
Ott et al. proposed ZK-Trace, combining public identity marks, recipient-specific Tardos fingerprints, and ZK credential verification to enable offline collusion tracing in federated GNSS monitoring without leaker cooperation, establishing verifiable statistical and cryptographic bounds.Ott等人在论文中提出ZK-Trace框架，结合公开身份标记、接收者特定Tardos指纹与ZK凭证验证，实现联邦GNSS监测中无需配合的离线泄露溯源，并建立可验证的统计与密码学界限。
Key Points:要点：
- •ZK-Trace targets proprietary classifier leaks in federated GNSS monitoring.ZK-Trace针对联邦GNSS监测中专有分类器泄露问题
- •It combines public identity marks, Tardos fingerprints, and ZK credential verification.结合公开身份标记、Tardos指纹与ZK凭证验证实现溯源
- •Offline tracing is supported without requiring the leaker's cooperation.支持无需泄露者配合的离线追踪机制
- •Conditional false-accusation, completeness, and tracing-score bounds are established.建立条件误指控界限、完备性界限与追踪分数界限
- •An interval-arithmetic checker makes bounds executable and allocates a common budget.采用区间算术检查器执行条件界限并分配共同预算
- •Experiments isolated 160 single-owner copies and traced 712 of 720 two-owner mixtures.实验验证可隔离160个单所有者副本并追踪712/720个双所有者混合
The authors propose ZK-eSIM, a privacy-preserving eSIM provisioning scheme using zero-knowledge proofs to hide device identifiers and one-time pseudonymous credentials for unlinkable sessions, while retaining accountable traceability by exception.作者在论文中提出ZK-eSIM，通过零知识证明隐藏设备标识符，并利用一次性假名凭证实现eSIM配置会话的不可关联性，同时保留可追责的例外追踪。
Key Points:要点：
- •Uses ZK proofs for device validity instead of long-term identifiers like EID.用ZK证明设备有效性，避免直接暴露EID等长期标识符
- •Adopts one-time pseudonymous credentials and session IDs to prevent tracking.采用一次性假名凭证和会话ID，防止跨会话追踪
- •Achieves accountable traceability via jointly authorised escrow.通过联合托管机制实现可追责的例外追踪
- •Formalises honest-but-curious model with anonymity and unlinkability proofs.形式化诚实但好奇威胁模型并证明匿名性与不可关联性
- •Implemented and evaluated on test eUICC; overhead is practical.在测试eUICC上实现并评估，增加实用水平的开销
- •Preserves GSMA roles and interfaces for deployability.保持现有GSMA角色与接口，便于部署
Ethereum core developers are prioritizing quantum security over mandatory zkEVM execution proofs, aiming for full post-quantum readiness by December 2029. This delays base-layer execution scaling, cementing Layer-2 networks as the primary scaling venue.以太坊核心开发团队将量子安全置于zkEVM执行证明之上，计划在2029年12月前全面实现后量子就绪，这导致zkEVM强制执行被推迟到2028年后，使Layer-2网络成为扩展主战场。
Key Points:要点：
- •Ethereum targets full post-quantum readiness by December 2029, aligning with corporate migration timelines.以太坊设定2029年12月为全面后量子就绪截止日期，与谷歌、微软等企业迁移目标对齐。
- •In the Hegotá upgrade, FOCIL and Frame Transactions get high priority, while Quick Slots and Hash-Chain RANDAO are demoted to B-tier.Hegotá升级中，FOCIL和Frame Transactions获得高优先级，而Quick Slots和Hash-Chain RANDAO被降为B级。
- •To maintain fork cadence, devs may move post-quantum attestations earlier to K* and delay mandatory zkEVM proofs to L*.为保持分叉节奏，核心开发者考虑将后量子认证提前到K*，将强制zkEVM执行证明推迟到L*。
- •The J* upgrade may include a Minimum Viable Post-Quantum milestone as fallback, but lacks full economic finality.作为后备方案，J*升级可能包含最小可行后量子（MV-PQ）里程碑，但缺乏完整经济最终性。
- •The article draws a parallel to Y2K efforts, emphasizing base security over feature velocity.文章将当前行动与Y2K工程类比，强调基础安全优先于性能迭代。
- •Delaying mandatory execution proofs cements Layer-2 dependency until at least 2028.强制zkEVM执行证明的延迟将巩固Layer-2网络的依赖地位，直至2028年甚至更久。
Cascudo and Liu proposed subring VOLE (srVOLE) over Galois rings, constructed maliciously secure protocols, and built publicly verifiable ZK proofs over rings with reduced communication.Cascudo和Liu提出子环VOLE（srVOLE）概念，构造了恶意安全协议，并在环上实现了公开可验证的ZK证明，显著降低通信量。
Key Points:要点：
- •Proposed subring VOLE (srVOLE), generalizing subfield VOLE to Galois rings提出子环VOLE（srVOLE），将子域VOLE推广到伽罗瓦环
- •Constructed two maliciously secure srVOLE protocols: one PCG-like with low amortized communication, one SoftSpoken-like compatible with VOLEitH构造两个恶意安全srVOLE协议：一个基于PCG，通信量极低；一个基于SoftSpokenOT，兼容VOLEitH
- •Can be used to build publicly verifiable VOLE-based ZK可用于构造公开可验证的VOLE-based ZK
- •Shown that Moz$\mathbb{Z}_{2^k}$arella's VOLE correlation is a special case of srVOLE证明Moz$\mathbb{Z}_{2^k}$arella的VOLE关联是srVOLE的特例
- •Adapted QuickSilver protocol to any Galois ring将QuickSilver协议适配到任意伽罗瓦环
- •Circuit satisfiability: communication reduced to one subring element per multiplication gate电路可满足性：每个乘法门通信量降至1个子环元素
Singh proposes a Jacobian-based algebraic diagnostic to detect under-constrained ZK circuits, separating local rigidity, algebraic dependence, and field uniqueness.Singh在论文中提出基于精确Jacobian线性代数的诊断方法，用于检测ZK电路中欠约束问题，区分局部刚性、代数依赖和域上唯一性。
Key Points:要点：
- •Jacobian kernel method detects under-constraints and separates three notions提出基于Jacobian核的欠约束检测方法，分离三种不同概念
- •At satisfying assignment, augmented Jacobian kernel is the Zariski tangent space of the fibre scheme在满足赋值处，扩展约束Jacobian的核即对应纤维scheme的Zariski切空间
- •Under separability, recovers component-wise algebraic dependence and multiplicity bounds在可分离性假设下，可恢复分量级代数依赖，并提供重数界限
- •Sparse exact implementation handles 6k-60k constraint gnark R1CS instances精确稀疏实现可处理6k-60k约束的gnark R1CS实例
- •Limitation: witness locality may miss under-constraints on degenerate branches局限性：诚实见证处看似刚性，但在退化分支可能欠约束
- •Positioned as a scalable detector to combine with adversarial witness generation and solver confirmation建议作为可扩展候选检测工具，与对抗见证生成和求解器确认结合
Rometsch et al. proposed the first delegatable anonymous credential scheme built on legacy credentials using recursive zk-SNARKs, requiring no issuer changes and offering constant-size credentials with full unlinkability.Rometsch等人在论文中提出了首个基于现有凭证的可委托匿名凭证方案，利用递归zk-SNARKs实现无需修改签发基础设施，支持恒定大小凭证、完全不可链接性和选择性属性披露。
Key Points:要点：
- •First DAC scheme built directly on legacy credentials, with no issuer-side modifications首个直接在传统凭证上构建的DAC方案，无需修改现有签发基础设施
- •Credentials remain constant-size regardless of delegation depth, with full unlinkability凭证大小恒定，不随委托深度增长，且具备完全不可链接性
- •Supports selective attribute disclosure at every level of the delegation chain支持选择性属性披露，委托链上每层均可控制披露范围
- •Instantiated for JWT+ECDSA using Plonky2 as recursive proving backend针对JWT+ECDSA实例化，使用Plonky2实现递归证明
- •Contributes a secure in-circuit JWT parser and a Plonky2 extension for cyclic recursion贡献了安全的链上JWT解析器和支持循环递归的Plonky2扩展
- •Delegation takes 1.2s and verification 3.3ms with 64 attributes64个属性下委托耗时1.2秒，验证仅3.3毫秒
World Foundation announced ProveKit, a production-ready ZK proving toolkit that generates proofs on user devices, offering post-quantum security, no trusted setup, Noir support, and integration with World ID.World Foundation宣布推出ProveKit，一个生产级ZK证明工具包，可在用户设备上生成证明，具备后量子安全、无需可信设置、支持Noir语言，并已集成至World ID。
Key Points:要点：
- •ProveKit generates ZK proofs on phones and browsers, keeping private data local.ProveKit可在手机和浏览器上生成ZK证明，私密数据不离开设备。
- •Based on WHIR hash-based commitments, no trusted setup and 128-bit post-quantum security.基于WHIR哈希承诺方案，无可信设置且达到128位后量子安全。
- •Developers can write provable claims in the Noir language.开发者可使用Noir语言编写可证明声明，易于上手。
- •Outperforms Circom and Barretenberg in proving time and memory usage.与Circom和Barretenberg相比，证明时间显著更快且内存占用更低。
- •Proof size under 1MB, but verification is non-succinct, suitable for server-side verification.证明体积小于1MB，但验证非简洁，适合服务器验证场景。
- •Version 2 will migrate to Goldilocks field and add Groth16 backend for efficient on-chain verification.V2将迁移至Goldilocks域并引入Groth16后端以提升链上验证效率。
Horizen announced Season 2 of its Builder Ecosystem Fund, focusing on private on-chain finance, with over 100K ZEN in funding and up to $150,000 per major RFP project.Horizen宣布第二季Builder Ecosystem Fund，聚焦私密链上金融，提供超过100K ZEN资金，单个重大RFP项目最高可达150,000美元，支持构建隐私交易、借贷等应用。
Key Points:要点：
- •Fund focuses on private on-chain finance: trading, lending, cross-chain基金重点支持私密链上金融应用，包括交易、借贷、跨链等
- •Over 100K ZEN; up to $150K per major RFP提供超过100K ZEN，重大RFP项目最高资助150,000美元
- •Supports TEE (Vela) and ZK (zkVerify)支持TEE（Vela）和ZK（zkVerify）两条隐私技术路线
- •Encourages migration of EVM projects adding privacy鼓励现有EVM项目迁移并增加隐私功能
- •Offers technical integration, audit, launch support提供技术集成、审计和上线支持，不只提供资金
- •Two RFPs: private agentic trading vaults and private borrow-lend两个主要RFP：私人代理交易金库和私人借贷
The authors propose Liezz, which found 13 bugs (7 soundness-critical) in Circom, Corset, Gnark, and Noir toolchains via adversarial witness injection.作者提出Liezz框架，通过对抗性见证注入在Circom、Corset、Gnark和Noir工具链中发现13个漏洞，其中7个影响健壮性。
Key Points:要点：
- •Liezz splices witnesses from different executions to create invalid witnesses and checks rejection.Liezz通过拼接不同执行的见证构造无效见证，测试工具链是否能拒绝。
- •Supports Circom, Corset, Gnark, and Noir toolchains.支持Circom、Corset、Gnark和Noir四种ZK DSL工具链。
- •Finds 13 bugs, 7 with soundness impact.发现13个漏洞，其中7个影响健壮性。
- •Several bugs only reachable via generated library calls.部分漏洞仅通过生成的库调用才能触发。
- •Valid-execution testing under the same budget finds no soundness failures.在相同测试预算下，有效执行测试未发现任何健壮性缺陷。
- •Effectively exposes missing or incorrect constraints.方法能有效暴露约束缺失或错误等健壮性问题。
The authors propose a privacy protocol for CBDC interbank settlement that uses a relaxed sender anonymity model on a permissioned EVM, combining Groth16 ZK proofs and Poseidon commitments to keep transaction content confidential while keeping the sender auditable.研究者提出一种面向CBDC银行间结算的隐私协议，采用放松的发送方匿名模型，在许可EVM上结合Groth16零知识证明和Poseidon承诺实现交易内容保密，同时保持发送方可审计性。
Key Points:要点：
- •Proposes a relaxed sender anonymity model: sender identity public for compliance, receiver and amount hidden.提出放松的发送方匿名模型，发送方身份公开以满足AML/CFT合规，接收方和金额保密。
- •Implemented on permissioned Hyperledger Besu with QBFT consensus and Groth16 (BN254) proofs.在Hyperledger Besu许可链上实现，使用QBFT共识和Groth16（BN254）证明。
- •Uses Poseidon hash in an incremental Merkle tree and ECIES multi-recipient encryption for note storage.采用Poseidon哈希的增量Merkle树和ECIES多接收方加密存储笔记。
- •On-chain NoteRegistry contract acts as append-only ledger, removing need for trusted off-chain custody.链上NoteRegistry合约作为仅追加账本，无需可信离线托管服务器。
- •Five-node experiment: end-to-end settlement 8-16 s, on-chain verification ~220k gas.五节点实验显示端到端结算8-16秒，链上验证约220k gas。
- •Prototype's NoteRegistry uses owner-indexed events, leaking privacy; production can use uniform broadcasting.原型中NoteRegistry使用所有者索引事件，存在隐私泄露，生产可改为统一事件广播。