Lie to Me: Finding Bugs in ZK DSL Toolchains with Adversarial Witness Injection

Zero-knowledge domain-specific language (ZK DSL) toolchains compile programs into constraint systems and generate witnesses for cryptographic proofs. A central correctness requirement is **soundness**: the enforced constraints must be at least as strong as the source-program semantics. If a toolchain bug weakens the constraints, a prover can produce a proof for an invalid execution. Such soundness bugs are notoriously hard to detect because they are invisible to valid-execution testing: every valid execution still behaves correctly, so differential and regression tests on valid inputs pass.

The paper introduces **Liezz**, a testing framework that generates ZK DSL programs and exposes soundness bugs through *adversarial witness injection*. The key insight is that a correct toolchain must reject any witness that does not correspond to a valid execution. Liezz constructs such invalid witnesses by construction and checks whether the toolchain accepts them. Acceptance is a soundness bug.

Formally, for a deterministic program $P$ and two public input assignments $x_1,x_2$ with different outputs $y_1\ne y_2$, Liezz splices the witness of one execution with the output of the other. Th

Liezz was applied to four ZK DSL toolchains: **Circom, Corset, Gnark, and Noir**. The evaluation reports **13 bugs**, of which **seven have soundness impact**. Several of these bugs are reachable only through generated standard-library calls, demonstrating the value of parameterized library-call generation.

The central comparative result is that, under the same testing budget, a valid-execution baseline does **not** expose any of the soundness failures revealed by accepted injected witnesses. In other words, adversarial witness injection reaches failures that valid-execution testing misses entirely. This is consistent with the theoretical motivation: soundness bugs leave all valid executions correct, so they are invisible to tests that only run valid executions.

The reported numbers can be summarized as:

| Metric | Value |
|---|---|
| Toolchains supported | 4 (Circom, Corset, Gnark, Noir) |
| Bugs found | 13 |
| Bugs with soundness impact | 7 |
| Soundness failures found by valid-execution baseline | 0 |

The result that several bugs require generated standard-library calls is significant for practitioners: library gadgets are a high-value attack surface, and they are often unde