{
  "type": "option",
  "name": "OpenVM",
  "slug": "openvm",
  "section": {
    "id": "frameworks",
    "number": "02",
    "title": "Choosing a framework",
    "url": "https://zkpick.com/frameworks/"
  },
  "url": "https://zkpick.com/frameworks/openvm/",
  "markdown": "https://zkpick.com/md/frameworks/openvm.md",
  "category": "Modular zkVM framework",
  "summary": "OpenVM: Modular zkVM framework. Kind: Modular zkVM framework. Arithmetisation / backend: Plonky3 AIR, chip extensions. Setup: Wrapper only. Maintained by: Axiom. Licence: MIT / Apache-2.0. Status: Production-recommended; externally audited. Choose it when: Teams needing custom instructions, domain-specific precompiles, or an application-specific VM, who want to build on an audited modular base rather than fork a monolithic zkVM.",
  "description": "A zkVM framework with a no-CPU architecture: rather than one central processing chip, functionality is composed of independent chips and extensions, so custom instructions and precompiles can be added without forking the core.",
  "notes": [],
  "sections": [],
  "strengths": [
    "The strongest extensibility story — custom chips and ISA extensions are a first-class mechanism, not a fork",
    "Explicit production recommendation backed by audit evidence, including an external audit and a public audit competition, alongside its own formal-verification work over the RISC-V instruction set",
    "Built on a widely shared proving substrate"
  ],
  "tradeoffs": [
    "Modularity increases the configuration surface: your deployed security depends on which extensions you enable, so an audit of upstream does not fully cover your instantiation",
    "A critical soundness bug in an optimised pairing routine was assigned a CVE and fixed upstream — evidence the extension surface is where risk concentrates",
    "Younger than the two longest-running RISC-V zkVMs"
  ],
  "bestFit": "Teams needing custom instructions, domain-specific precompiles, or an application-specific VM, who want to build on an audited modular base rather than fork a monolithic zkVM.",
  "maintainers": "Axiom",
  "maturity": "Production-recommended; externally audited",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://github.com/openvm-org/openvm",
  "facts": [
    {
      "table": "Framework selection matrix",
      "url": "https://zkpick.com/frameworks/#frameworks-matrix-openvm",
      "name": "OpenVM",
      "kind": "Modular zkVM framework",
      "arith": "Plonky3 AIR, chip extensions",
      "setup": "Wrapper only",
      "by": "Axiom",
      "license": "MIT / Apache-2.0",
      "status": "Production-recommended; externally audited"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "OpenVM — modular zkVM framework",
      "url": "https://github.com/openvm-org/openvm",
      "kind": "project"
    },
    {
      "title": "Missing subfield membership check in OpenVM pairing — CVE-2026-46669",
      "url": "https://blog.zksecurity.xyz/posts/openvm-bugs/",
      "kind": "disclosure"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/frameworks/openvm/",
  "authors": [
    "MarketComp"
  ]
}