{
  "type": "option",
  "name": "Manual circuit and constraint review",
  "slug": "manual-circuit-review",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/manual-circuit-review/",
  "markdown": "https://zkpick.com/md/audit/manual-circuit-review.md",
  "category": "Human review",
  "summary": "Manual circuit and constraint review: Human review. Layer: Circuit. Characteristic finds: Underconstraint, missing range checks, composition errors, and application-semantic bugs no tool models. Blind to: Large repetitive constraint sets where attention degrades; anything outside the read scope. Coverage claim: None — unmeasurable. Cost profile: High, reviewer-limited. Choose it when: Every engagement, as the backbone. Highest value on novel application logic, custom gadgets, and cross-component composition — anywhere a specification exists to check against.",
  "description": "Line-by-line review of the arithmetisation by reviewers fluent in the DSL and proof system: is every witness value constrained, are ranges enforced, are components composed with their preconditions satisfied, is every public input actually bound. In practice the reviewer builds a model of what the constraint system permits and then searches for a satisfying assignment the developer did not intend.",
  "notes": [],
  "sections": [],
  "strengths": [
    "Covers arbitrary bug classes, including application-semantic ones no tool models",
    "Works on any DSL and arithmetisation, including new ones with no tooling",
    "Produces design feedback and explanations, not just alerts",
    "Can identify security properties the specification forgot to require"
  ],
  "tradeoffs": [
    "Quality varies enormously with the individual reviewer's ZK experience",
    "Does not scale to large repetitive constraint sets such as zkVM chip tables",
    "Point-in-time: invalidated by any constraint change",
    "No coverage metric — you cannot measure what was not read",
    "Reviewer supply is scarce, and scarcer still for the less common DSLs"
  ],
  "bestFit": "Every engagement, as the backbone. Highest value on novel application logic, custom gadgets, and cross-component composition — anywhere a specification exists to check against.",
  "maintainers": null,
  "maturity": "Production standard",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://github.com/0xPARC/zk-bug-tracker",
  "facts": [
    {
      "table": "What each assurance technique can and cannot find",
      "url": "https://zkpick.com/audit/#audit-matrix-manual-circuit-review",
      "tech": "Manual circuit review",
      "layer": "Circuit",
      "catches": "Underconstraint, missing range checks, composition errors, and application-semantic bugs no tool models",
      "blind": "Large repetitive constraint sets where attention degrades; anything outside the read scope",
      "coverage": "None — unmeasurable",
      "cost": "High, reviewer-limited"
    }
  ],
  "relatedFailureModes": [
    {
      "name": "Circuit and verifier version drift",
      "url": "https://zkpick.com/audit/failure-modes/circuit-and-verifier-version-drift/"
    }
  ],
  "sources": [
    {
      "title": "0xPARC ZK Bug Tracker — bug taxonomy (frozen since late 2024; Circom/application-circuit skew)",
      "url": "https://github.com/0xPARC/zk-bug-tracker",
      "kind": "reference"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/manual-circuit-review/",
  "authors": [
    "MarketComp"
  ]
}