CySec Researchers contribute to the 35th USENIX Security Symposium

CySec researchers Zeta Avarikioti (TU Wien and Common Prefix), Matteo Maffei (TU Wien), Andrea Pelosi (University of Pisa, University of Camerino, and TU Wien), and Christos Stefo (TU Wien) contributed to the international research collaboration behind “Bridging Bitcoin to Second Layers via BitVM2” The work was carried out together with Robin Linus Woll (Stanford University and ZeroSync Association), Lukas Aumayr (University of Edinburgh and Common Prefix), Orfeas Stefanos Thyfronitis Litos (Imperial College London and Common Prefix), David Tse (Stanford University and Byzantine Research), and Alexei Zamyatin (BOB).

The work addresses a central challenge in the Bitcoin ecosystem: how to securely transfer Bitcoin assets between the Bitcoin blockchain and second-layer networks (L2s) or other blockchains without relying on trusted intermediaries. This challenge arises from Bitcoin’s design: its deliberately limited scripting language reduces the attack surface, but also restricts the applications that can run directly on the network. While payment channels already allow Bitcoin payments to be scaled off-chain, broader use cases such as decentralized finance require general-purpose L2s and secure bridges between these systems and Bitcoin.

Existing Bitcoin bridges typically rely on multisignature or threshold-signature schemes, in which a group of signers controls locked BTC. If enough signers collude, are compromised, or are bribed, user funds may be lost. The researchers address this limitation with BITVM2-BRIDGE, presented as the first light-client-based Bitcoin bridge. Its main advance is a weaker trust assumption: instead of depending on an honest majority, the system can remain secure if at least one participant in each relevant role behaves honestly. Verification is also permissionless, allowing any user to challenge an incorrect claim.

The bridge allows users to lock BTC on Bitcoin and use a wrapped version of the asset on an L2. To return to Bitcoin, users burn the wrapped asset on the L2; an operator then provides BTC to the user and submits proof that the burn occurred. If the proof is valid, the operator recovers the locked BTC. If it is false, any challenger can dispute it on-chain and prevent the operator from reclaiming their deposit. This process is enabled by BITVM2-CORE, which allows complex computations to be verified on Bitcoin without changing Bitcoin’s consensus rules.

A production-level implementation of BITVM2-CORE has been developed, and a full challenge-verification process has already been executed on the Bitcoin mainnet. In a worst-case dispute, settlement took under eight hours and cost less than 0.15 BTC in fees, while the normal execution path is much cheaper and can be further optimized. The significance of this work lies in its potential to expand Bitcoin beyond payments while preserving its conservative security model. By replacing trusted signer groups with permissionless verification and weaker trust assumptions, BITVM2-BRIDGE provides a stronger foundation for Bitcoin L2s, DeFi applications, and cross-chain infrastructure.

In the presentation “Arguzz: Testing zkVMs for Soundness and Completeness Bugs,” Christoph Hochrainer and Maria Christakis (TU Wien), together with Valentin Wüstholz from Diligence Security, introduced ARGUZZ, an automated testing tool for detecting critical correctness errors in zero-knowledge virtual machines.

Zero-knowledge virtual machines are becoming an important part of blockchain infrastructure. They allow computations to be performed off-chain while producing compact cryptographic proofs that the results are correct. This is valuable for decentralized applications and rollups, where scalability and verifiability are both essential. However, zkVMs rely on complex execution logic and constraint systems. Bugs in these components can lead to serious failures: a system may accept an invalid computation or reject a valid one.

ARGUZZ systematically tests zkVM implementations for both soundness and completeness bugs. It combines metamorphic testing with fault injection by creating equivalent Rust program variants whose outputs should match, merging them into a single test program, and executing it inside a zkVM. The tool then introduces controlled faults that simulate a faulty or malicious prover. This reveals cases where the zkVM’s constraints are too weak to detect invalid execution, as well as cases where correct execution is wrongly rejected.

The researchers evaluated ARGUZZ on six real-world zkVMs: RISC Zero, Nexus, Jolt, SP1, OpenVM, and Pico. The tool found eleven correctness bugs in three of them, including three soundness bugs and eight completeness bugs. One RISC Zero soundness bug received a $50,000 bounty, despite the system having previously undergone audits. This result highlights the limits of manual review and demonstrates the value of targeted automated testing for complex cryptographic software.

The significance of this work is that zkVMs are increasingly becoming part of the trust base for blockchain scalability and verifiable computation. As more applications depend on them, implementation flaws can directly affect protocol security, user assets, and confidence in rollup-based systems. ARGUZZ offers a practical and adaptable way to strengthen this infrastructure: it can be extended to other RISC-V-based zkVMs with moderate engineering effort and may later support additional instruction sets. By uncovering bugs in real systems, the work shows that systematic testing should become a standard part of zkVM development and security assessment.

The symposium also recognized two our researchers for their service to the USENIX Security ’26 reviewing process. Daniel Arp received a USENIX Security ’26 Distinguished Reviewer Award, which honors program committee members who stood out through punctual and high-quality reviews, active participation in discussions, and additional responsibilities such as discussion lead or shepherding roles. Zeta Avarikioti was named a USENIX Security ’26 Notable Reviewer, a distinction given to reviewers who received several positive evaluations for their reviews, served in multiple shepherding roles, or were explicitly recommended by the vice chairs. Together, these recognitions highlight the researchers’ contribution not only through scientific work presented at the symposium, but also through their active role in maintaining the quality and rigor of the conference review process.