Neo X ZK DKG protocol audited by Hacken, ZK Trust Relay campaign launched

Neo has announced the completion of an audit of its zero-knowledge Distributed Key Generation protocol by Hacken, alongside the launch of the ZK Trust Relay campaign. The DKG protocol underpins Neo X’s anti-Maximal Extractable Value solution, which is designed to prevent block producers from reordering transactions for profit.

DKG protocol

Neo X’s anti-MEV system is built on enveloped transactions, a scheme that conceals transaction details from block producers until after a block is finalized.

When a user submits a transaction, it is encrypted under a collectively generated public key so that validators can include it in a block without knowing its contents. Transactions can only be decrypted once the block is finalized.

This process relies on Distributed Key Generation, which splits the decryption key across validators. A threshold of participants is required to reconstruct the key, ensuring no single validator can front-run, reorder, or suppress transactions.

By embedding this mechanism into Neo X, the network aims to create a more trustless and tamper-resistant foundation for DeFi activity.

Hacken audit

Hacken, a blockchain security company, identified 15 issues during the audit. Eleven were resolved and four were acknowledged. No critical vulnerabilities were found. The auditors highlighted the strength of the multi-curve cryptographic architecture and recursive proof system, while recommending improvements in testing and defensive programming.

Among the high-severity findings, Hacken noted missing subgroup validation for elliptic curve points, which could have weakened cryptographic assumptions. The issue was addressed by adding subgroup checks. A custom key derivation function was also replaced with a standard SHA3-based design to prevent cryptanalysis.

Medium-level findings included an array bounds bug, missing authentication tags in AES-GCM, and a hardcoded randomness beacon. These were either fixed or accepted with mitigation in place.

Broader risks were also noted, including reliance on a single smart contract for DKG, dependencies on external frameworks such as gnark, and exposure to cross-chain risks through bridge interactions.

Hacken emphasized the need for further integration and stress testing before production deployment.

ZK Trust Relay

To further reduce centralization risks and improve the robustness of the setup process, Neo X has introduced the ZK Trust Relay. The campaign uses multi-party computation, where independent participants contribute randomness to generate a final structured reference string.

The SRS acts as the trusted setup for the zero-knowledge system, and distributing its creation makes it resistant to compromise by any single participant.

Up to 15 developers will be selected to take part in the relay. Beginning Aug. 28, they will complete cryptographic tasks in sequence, with the process continuing until Sept. 18. The final SRS file will then be released for public verification. Each participant who completes their task will receive 20 GAS.

The campaign is aimed at developers with backgrounds in cryptography and distributed systems, reflecting its importance to the trust guarantees of Neo X’s anti-MEV protocol. Registration is open until Aug. 26.

The full Hacken audit report can be read at the link below:
https://hacken.io/audits/neo-x/l1-neo-x-zk-dkg-functionality-jun2025/

Source