ZKsync developers fixed three critical Airbender flaws affecting proof soundness during a 21-person-week assessment, but five of 26 formal targets were still unresolved at its conclusion.
Reviewers worked on the system from Feb. 16 through April 15, 2026. They assessed selected circuits and proof-generation components through tool-assisted analysis and targeted manual checks. The engagement did not cover every part of the codebase by hand.
The review logged six findings: three critical flaws, one low-severity issue and two warnings. The latter three remained open, the assessment said, because the related paths were not in use or fell outside Airbender’s trusted-bytecode assumptions.
For a zero-knowledge Ethereum Virtual Machine (zkEVM), soundness lets users rely on a proof as evidence that a block’s execution followed Ethereum’s rules.
For the end of 2026, Ethereum’s stated security benchmarks call for 128-bit provable security, a final proof capped at 300 KiB and a formal soundness argument for its recursion architecture.
