| ZKsync Security Council Report | |
|---|---|
| Reporting period | 1 August 2025 – 31 July 2026 |
| Prepared for | ZKsync Token Assembly |
| Prepared by | ZKsync Security Council |
| Date | 9 September 2026 |
1. Executive Summary
This report covers the 12-month funding period established under TPP-6, from 1 August 2025 through 31 July 2026.
The ZKsync Security Council’s previous report covered activity through September 2025. Activity from August and September 2025 is included here only where necessary to provide a complete account of the TPP-6 funding period.
During the reporting period, the Security Council:
- approved four ZKsync Improvement Proposals;
- signed three Instant Upgrades, all classified as Security Patches;
- initiated no Emergency Responses, Soft Freezes or Hard Freezes;
- completed a restructuring from 12 to 8 members;
- reduced monthly Council compensation by approximately 71% from May 2026; and
- utilised the full 27.7 million ZK allocation approved under TPP-6.
2. Mandate and Composition
The Security Council is responsible for independently reviewing proposed protocol upgrades and responding to security-sensitive situations requiring an Instant Upgrade, Soft Freeze or Hard Freeze.
A full list of Council members and entity details is maintained in Schedule 3 of the ZKsync Governance Procedures.
At the beginning of the TPP-6 funding period, the Council comprised of a total of 12 members: eight entity members and four individual members.
During the reporting period, the Token Assembly approved ZIP-15: Update ZKsync Security Council Parameters.
ZIP-15 approved the following, taking effect from 1 May 2026:
- the Security Council was reduced from 12 to 8 members;
- compensation was standardised at $3,000 USDC per member per month;
- the signing threshold was updated to 6-of-8 when related to signing as part of the Emergency Board, and 4-of-8 for ZIP approval; and
- all members moved to a uniform six-hour signing SLA.
The restructuring reduced monthly Council compensation by approximately 71% while maintaining an eight-member Security Council made up of leading security entities.
3. Protocol Governance Activity
During the reporting period, the Security Council reviewed upgrades submitted through the ZKsync governance process.
The Security Council’s role during the Risk Review Period is to independently review and verify ZIP specifications before approving protocol upgrades.
| ZIP | Proposal | Status during reporting period |
|---|---|---|
| ZIP-12 | V29 Interop Messaging Upgrade | Approved |
| ZIP-13 | Adding a ZKsync OS CTM | Approved |
| ZIP-14 | Upgrade ZK Token with Permissionless Burn Function | Approved |
| ZIP-15 | Update ZKsync Security Council Parameters | Approved |
| ZIP-16 | ZKsync v31 Upgrade | Not approved as of 31 July 2026 |
4. Security Response
GAP-5: Update Emergency Upgrade Terminology and Classification replaced the public-facing term Emergency Upgrade with Instant Upgrade and introduced two classifications: Security Patch for preventative security updates and Emergency Response for active security incidents. The underlying governance process, authorities and security controls remain unchanged.
Instant Upgrades are now classified as either:
- Security Patch: a preventative security update where there is no evidence of active exploitation; or
- Emergency Response: an urgent intervention responding to an active or imminent threat.
The Security Council signed three Instant Upgrades during the reporting period. All three were classified as Security Patches.
| Signing date | Upgrade | Classification | Purpose |
|---|---|---|---|
| 23 January 2026 | v0.29.3 | Security Patch | Addressed three reported ZKsync Era circuit vulnerabilities, including a soundness issue. |
| 5 February 2026 | v0.29.4 | Security Patch | Addressed multiple reported circuit vulnerabilities involving over- and under-constraints. |
| 24 July 2026 | v0.29.5 | Security Patch | Fixed a circuit overconstraint that could prevent proofs for valid batches. |
All three upgrades were preventative security interventions. There was no evidence of active exploitation requiring an Emergency Response.
The Council did not initiate a Soft Freeze or Hard Freeze during the reporting period.
| Security response mechanism | Activity |
|---|---|
| Instant Upgrade: Security Patch | 3 |
| Instant Upgrade: Emergency Response | 0 |
| Soft Freeze | 0 |
| Hard Freeze | 0 |
5. Budget Utilisation
TPP-6 authorised a fixed allocation of 27.7 million ZK to fund Security Council compensation and legal and operational costs for 12 months.
The Security Council received a fixed number of ZK tokens. The USD value of those tokens fluctuated throughout the funding period. This materially increased the number of ZK required to meet the Council’s USD-denominated obligations. The impact was partially mitigated through conversions of ZK into stablecoins and the implementation of ZIP-15, which reduced ZKSC signer compensation. The increase demand for ZK assigned to fulfil signer compensation obligations was met through a reallocation of the budget from entity costs.
At the $0.04 reference price used when the proposal was executed, the allocation had an indicative value of $1.108 million, equivalent to approximately $277,000 per quarter.
To illustrate the change, the following table divides the 27.7 million ZK allocation into four equal portions of 6.925 million ZK and values each portion using the average ZK price for that quarter. This table does not represent the timing or value of actual token sales or expenditure. Payments and conversions occurred at different times and prices.
| Funding quarter | Average ZK price | Indicative value of 6.925m ZK | Change from $277,000 |
|---|---|---|---|
| Aug–Oct 2025 | $0.05260 | $364,300 | +31% |
| Nov 2025–Jan 2026 | $0.03824 | $264,800 | −4% |
| Feb–Apr 2026 | $0.02242 | $155,300 | −44% |
| May–Jul 2026 | $0.01245 | $86,200 | −69% |
Costs attributable to the reporting period
| Use of funds | USD amount |
|---|---|
| Security Council signer compensation | $828,000 |
| Professional director fees | $48,500 |
| Legal fees | $12,200 |
| Corporate administration and compliance | $12,300 |
| Total costs attributable to the period | $901,000 |
Amounts have been rounded to the nearest $100.
The USD figures reflect costs attributable to the reporting period. Payments were made using a combination of ZK and stablecoins, so the number of ZK required depended on the price at which ZK was paid or converted.
Funds were reallocated between the expenditure categories approved under TPP-6 as necessary to account for the fluctuation in token price.
6. Conclusion
During the TPP-6 funding period, the Security Council continued to perform its core governance and security responsibilities.
The Security Council approved four ZIPs, signed three preventative Security Patches and did not require an Emergency Response, Soft Freeze or Hard Freeze.
The Security Council was restructured through ZIP-15 from May 2026, reducing membership from 12 to 8 and reducing monthly compensation costs by approximately 71%.
The full 27.7 million ZK allocation was utilised within the scope approved under TPP-6. As the market price of ZK was reduced relative to the proposal’s reference price, tokens originally attributed to entity costs were reallocated to meet the Council’s fixed USD-denominated signer compensation obligations. This did not increase the total funding authorised by the Token Assembly or the compensation rates payable to Security Council members. At the end of the funding period, no ZK remained to be returned to the Token Assembly.
7. References
- [TPP-6: ZKsync Security Council v2.0 Funding](https://www.tally.xyz/gov/zksync/proposal/385420766284723606657612843068607731621671530281048557599735
- ZKsync Security Council multisig: 0xB5edBf47fC5eF24a7b7FE1F31f24fD2768Ea2C67