Hi everyone, I wrote a practical guide to finding soundness bugs in ZK circuits. It starts out with basic Circom examples, then discusses real-world exploits. Check it out if you are interested in auditing real-world ZK deployments.

Hey r/netsec,

As a security researcher, I've been exploring ways to leverage AI for more effective code audits. In my latest Medium article, I dive into a complete end-to-end walkthrough using Hound, an open-source AI agent designed for code security analysis. Originally built for smart contracts, it generalizes well to other languages.

What's in the tutorial:

• Introduction to Hound and its knowledge graph approach
• Setup: Selecting and preparing a Rust codebase
• Building aspect graphs (e.g., system architecture, data flows)
• Running the audit: Generating hypotheses on vulnerabilities
• QA: Eliminating false positives
• Reviewing findings: A real issue uncovered
• Exporting reports and key takeaways

At the end of the article, we create a quick proof-of-concept for one of the tool's findings.

The full post Is here:

https://medium.com/@muellerberndt/hunting-for-security-bugs-in-code-with-ai-agents-a-full-walkthrough-a0dc24e1adf0

Use it responsibly for ethical auditing only.