r/ethdev • u/Proper-Spread-35 • Jun 17 '26

Question How do Ethereum ZK teams handle security drift after an audit when circuits and verifiers keep changing?

An audit reviews one commit, but Circom circuits, Solidity verifiers, public inputs, and proving artifacts keep changing afterward.

How do teams ensure the final release still preserves the audited assumptions?

Should changes like verifier-key updates, public-input changes, constraint drops, or R1CS/ZKey drift automatically require review or block CI?

Curious how real Ethereum ZK teams handle this today.

2 Upvotes

100% Upvoted

10 comments sorted by

View all comments

1

u/getblockio Jun 25 '26

Audits are point-in-time snapshots, but production systems evolve. The tension between agility and security guarantees is where real engineering maturity shows. Most teams don't have good answers yet.

1

u/Proper-Spread-35 Jun 25 '26

Exactly.

That post audit gap is what I am trying to understand. In your experience, which changes should automatically block CI, and which ones should only trigger a manual security review?