{
  "type": "option",
  "name": "Verifier and integration review",
  "slug": "verifier-review",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/verifier-review/",
  "markdown": "https://zkpick.com/md/audit/verifier-review.md",
  "category": "Human review",
  "summary": "Verifier and integration review: Human review. Layer: Verifier / on-chain. Characteristic finds: Public-input aliasing and encoding mismatch, replay, verifying-key drift, missing point checks. Blind to: Circuit-internal soundness. Coverage claim: None — but the code is small. Cost profile: Low; conventional review skills. Choose it when: Every deployment. Assign one party explicit ownership of the circuit-to-verifier boundary, and require them to check the deployed verifying key against a reproducible build of the audited circuit.",
  "description": "Review of everything between a valid proof and a state change: the verifier contract or host routine, public input encoding and ordering, field-range validation, verifying-key provenance and immutability, nullifier storage and replay logic, upgrade authority, and the binding between the deployed key and the audited circuit. This is where circuit-correct systems still fail.",
  "notes": [],
  "sections": [],
  "strengths": [
    "Covers a bug class that circuit tooling structurally cannot see",
    "Relatively cheap and fast — the code is small and conventional",
    "Reuses well-developed smart-contract audit practice and tooling",
    "Directly addresses the highest-frequency deployment failures"
  ],
  "tradeoffs": [
    "Often split across two engagements with the seam owned by nobody — and the seam is where encoding mismatches live",
    "Generated verifier code is assumed correct because a tool produced it — yet generated verifiers have shipped without a field-modulus check on public signals, the input-aliasing bug",
    "Cannot be done meaningfully without the circuit's public-input specification"
  ],
  "bestFit": "Every deployment. Assign one party explicit ownership of the circuit-to-verifier boundary, and require them to check the deployed verifying key against a reproducible build of the audited circuit.",
  "maintainers": null,
  "maturity": "Production standard",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://github.com/iden3/snarkjs/issues/358",
  "facts": [
    {
      "table": "What each assurance technique can and cannot find",
      "url": "https://zkpick.com/audit/#audit-matrix-verifier-and-integration-review",
      "tech": "Verifier and integration review",
      "layer": "Verifier / on-chain",
      "catches": "Public-input aliasing and encoding mismatch, replay, verifying-key drift, missing point checks",
      "blind": "Circuit-internal soundness",
      "coverage": "None — but the code is small",
      "cost": "Low; conventional review skills"
    }
  ],
  "relatedFailureModes": [
    {
      "name": "Public input encoding mismatch",
      "url": "https://zkpick.com/audit/failure-modes/public-input-encoding-mismatch/"
    },
    {
      "name": "Unchecked curve point and subgroup membership",
      "url": "https://zkpick.com/audit/failure-modes/unchecked-curve-point-and-subgroup-membership/"
    },
    {
      "name": "Circuit and verifier version drift",
      "url": "https://zkpick.com/audit/failure-modes/circuit-and-verifier-version-drift/"
    }
  ],
  "sources": [
    {
      "title": "snarkjs #358 — public signals not checked against the field modulus (input aliasing)",
      "url": "https://github.com/iden3/snarkjs/issues/358",
      "kind": "issue"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/verifier-review/",
  "authors": [
    "MarketComp"
  ]
}