一句话：首个对生产级零知识虚拟机安全漏洞与可用性问题的系统性实证研究，揭示漏洞类别、高价值攻击面与用户痛点。
零知识虚拟机（zkVM）是区块链 Layer 2 扩容的关键基础设施，可在执行任意程序的同时生成简洁的正确性证明。尽管投资已达数亿美元，快速演进的 zkVM 生态仍缺乏对其安全与可用性挑战的全面实证分析。本文开展首个系统性研究，从三个视角分析生产级 zkVM：专业审计中的 314 个安全漏洞、11,854 次提交反映的开发者实践，以及 1,150 个用户 issue 体现的使用体验。研究识别出普遍、严重且非传统的漏洞类别及其根因，揭示跨 zkVM 反复出现的高价值攻击面，并指出主要可用性问题；与既有研究对比后归纳出四个研究空白，为 zkVM 测试与分析工具的发展指明方向。
Zero-knowledge Virtual Machines (zkVMs) are emerging critical infrastructure for blockchain Layer 2 scaling solutions, enabling execution of arbitrary programs while generating succinct proofs of correct computation. Despite hundreds of millions of investment, the rapidly evolving zkVM ecosystem lacks comprehensive empirical analysis of its security and usability challenges. We present the first systematic study of zkVM vulnerability and usability issues, analyzing production zkVMs through three perspectives covering 314 security vulnerabilities (professional audits), 11,854 commits (developer practices), and 1,150 user issues (user experiences). We identify prevalent, severe, and non-traditional vulnerability categories and their root causes, reveal high-value attack surfaces that consistently emerge across zkVMs, and identify major usability issues that users struggle with. Comparing our findings against existing research reveals four gaps representing research and tool development opportunities for the testing and analysis of zkVMs.