Audits
We have audited all of the code used in any zk-email mainnet deployments (zkp2p, email recovery). Contact us on t.me/zkemail if you are using any code that is not covered in these audits.
Last updated
We have audited all of the code used in any zk-email mainnet deployments (zkp2p, email recovery). Contact us on t.me/zkemail if you are using any code that is not covered in these audits.
Last updated
We are currently completing an audit of our zk-regex rewrite and our Solidity zksync deployments. Expected end date is mid October.
We completed an audit with Zellic of our Ether Email Auth library in September 2024.
Fixes are merged on commit 38d9a4 on ether-email-auth.
We completed an audit of our smart contracts for Account Recovery in July 2024.
Fixes committed at 482d295 on email-recovery.
We completed a second audit in May 2024 of all of our ZK circuits, including our latest ZK regex rewrite. The audit deemed that EmailVerifier was safe, but people using sub-components in custom circuits may require extra changes and validations. We have fixed all of the high/medium issues, and you can see the full report here and use the fixed circuits via using version 6.1.1 from npm.
Fixes committed at 95cd90 for zk-email-verify
Fixes committed at 5396ec for zk-regex
We completed our first audit on the circom dependencies and helper templates in zk-email-verify. Below, you'll find a detailed PDF report of the findings. We've addressed each issue raised in the audit and have listed the corresponding PRs with each fix.
Missing constraint for illegal characters: PR#103
Incorrect use of division operation: PR#104
Missing range checks for output signals: PR#104
Missing constraints for a signal input: PR#104
Missing constraints for output signals: PR#104
Issue with value retrieval in the LongToShortNoEndCarry: PR#104