Presentations and Review Recognition at USENIX Security’26

CySec researchers Zeta Avarikioti (TU Wien and Common Prefix), Matteo Maffei (TU Wien), Andrea Pelosi (University of Pisa, University of Camerino, and TU Wien), and Christos Stefo (TU Wien) contributed to the international research collaboration behind “Bridging Bitcoin to Second Layers via BitVM2” The work was carried out together with Robin Linus Woll (Stanford University and ZeroSync Association), Lukas Aumayr (University of Edinburgh and Common Prefix), Orfeas Stefanos Thyfronitis Litos (Imperial College London and Common Prefix), David Tse (Stanford University and Byzantine Research), and Alexei Zamyatin (BOB).

The study addresses a central challenge in the Bitcoin ecosystem: how to securely transfer Bitcoin assets between the Bitcoin blockchain and second-layer networks (L2s) or other blockchains without relying on trusted intermediaries. This challenge arises from Bitcoin’s design: its deliberately limited scripting language reduces the attack surface, but also restricts the applications that can run directly on the network. While payment channels scale payments off-chain, broader use cases such as decentralized finance require general-purpose L2s and secure bridges. Existing bridges usually rely on multisignature or threshold-signature schemes, where collusion or compromise of enough signers can put user funds at risk. To overcome this limitation, the researchers developed BITVM2-BRIDGE, presented as the first light-client-based Bitcoin bridge. Instead of requiring an honest majority, it remains secure if at least one participant in each relevant role behaves honestly, while permissionless verification allows anyone to challenge incorrect claims. Users lock BTC on Bitcoin and use a wrapped asset on an L2; when returning to Bitcoin, they burn the wrapped asset, and an operator provides BTC and proves that the burn occurred. False proofs can be challenged on-chain. The mechanism relies on BITVM2-CORE, which enables verification of complex computations on Bitcoin without changing its consensus rules. A production-level implementation has been developed and tested on the Bitcoin mainnet: in a worst-case dispute, settlement took under eight hours and cost less than 0.15 BTC in fees, while normal execution is substantially cheaper. By replacing trusted signer groups with permissionless verification and weaker trust assumptions, the work provides a stronger foundation for Bitcoin L2s, DeFi applications, and cross-chain infrastructure.

Stefano Trevisani (TU Wien) presented the research “Boosting Efficiency and Security in Arithmetization-Oriented Hashing for Zero-Knowledge Proof Systems,” developed together with Elena Andreeva (TU Wien), Rishiraj Bhattacharyya (University of Birmingham), and Arnab Roy (University of Innsbruck). The work introduces new methods for making cryptographic compression functions more efficient and secure in zero-knowledge proof systems. These functions are essential components of structures such as Merkle trees, which are widely used in ZK-SNARK and STARK frameworks to verify computations without revealing the underlying private data. The researchers focus on Arithmetization-Oriented (AO) hashing, which is designed specifically for algebraic proof systems and can be considerably more efficient than conventional bit-oriented approaches.

The team proposes two new families of compression modes, PA and PAX, as alternatives to the commonly used Sponge construction. The new designs provide strong formal security guarantees, including optimal resistance to collision and preimage attacks, while PAX additionally offers security properties comparable to an ideal random oracle. Experimental results also show substantial performance gains: for a 128-bit security level, the proposed methods can be up to twice as fast as Sponge-based alternatives in software implementations. In zero-knowledge proof frameworks, they can improve proof-generation performance by up to 10% in Groth16 and around 60% in Plonky2. These gains are especially relevant for large-scale proof systems, where thousands of cryptographic compression operations may be required for a single proof.

© Marco Squarcina

In the presentation “Arguzz: Testing zkVMs for Soundness and Completeness Bugs,” Christoph Hochrainer and Maria Christakis (TU Wien), together with Valentin Wüstholz from Diligence Security, introduced ARGUZZ, an automated testing tool for detecting critical correctness errors in zero-knowledge virtual machines. These systems are increasingly important for blockchain scalability, allowing computations to run off-chain while producing compact proofs of correctness, but their complex execution logic and constraint systems can contain bugs that either accept invalid computations or reject valid ones. ARGUZZ addresses this problem by testing zkVMs for both soundness and completeness bugs through a combination of metamorphic testing and fault injection. It generates equivalent Rust program variants, merges them into a test program, executes them inside a zkVM, and introduces controlled faults to simulate faulty or malicious provers, exposing both insufficient constraints and cases where correct execution is wrongly rejected.

The researchers evaluated ARGUZZ on six real-world zkVMs: RISC Zero, Nexus, Jolt, SP1, OpenVM, and Pico. The tool identified eleven correctness bugs in three systems, including three soundness and eight completeness bugs. One RISC Zero soundness bug received a $50,000 bounty, despite the system having previously undergone audits. This result highlights the limits of manual review and demonstrates the value of targeted automated testing for complex cryptographic software. As zkVMs become part of the trust base for rollups and verifiable computation, such flaws can affect protocol security and user assets. ARGUZZ provides a practical, adaptable testing approach that can be extended to other RISC-V-based zkVMs and potentially additional instruction sets, supporting systematic testing as a standard component of zkVM development and security assessment.

The symposium also recognized two our researchers for their service to the USENIX Security ’26 reviewing process. Daniel Arp received a USENIX Security ’26 Distinguished Reviewer Award, which honors program committee members who stood out through punctual and high-quality reviews, active participation in discussions, and additional responsibilities such as discussion lead or shepherding roles. Zeta Avarikioti was named a USENIX Security ’26 Notable Reviewer, a distinction given to reviewers who received several positive evaluations for their reviews, served in multiple shepherding roles, or were explicitly recommended by the vice chairs. Together, these recognitions highlight the researchers’ contribution not only through scientific work presented at the symposium, but also through their active role in maintaining the quality and rigor of the conference review process.