{
"creator": "RISC Zero",
"projectsForTvs": [
{
"projectId": "taiko",
"sinceTimestamp": 1730452800
},
{
"projectId": "bob",
"sinceTimestamp": 1752703200
},
{
"projectId": "megaeth",
"sinceTimestamp": 1763954183
},
{
"projectId": "soon",
"sinceTimestamp": 1765180787
}
],
"proofSystemInfo": "\n \n ## Description\n\n RISC Zero is the first zkVM proving RISC-V ISA programs. Its STARK proving system is based on a rather standard theoretical construction of [Ben-Sasson et al paper](https://eprint.iacr.org/2018/046) and [DEEP-ALI version of FRI](https://eprint.iacr.org/2019/336). The proof of zkVM execution is wrapped in Groth16 SNARK for efficient onchain verification. RISC Zero onchain verifier targets [96 bits of security](https://dev.risczero.com/api/security-model#cryptographic-security).\n\n ## Proof system\n\n ### RISC-V circuit\n\n RISC Zero implements a [circuit that proves RISC-V RV32IM instruction set](https://github.com/risc0/risc0/tree/main/risc0/circuit/rv32im) (see [here](https://dev.risczero.com/api/zkvm/zkvm-specification#the-zkvm-execution-model) for more details). Arithmetization of this circuit has different types of columns: control, data and accumulator. Control columns contain public data that describes the RISC-V program being executed and proven. Data and accumulator columns contain private data (accessible only to prover), data represents the running state of the processor and memory and accumulator is auxiliary data for the PLOOKUP argument.\n\n ### Recursion circuit\n\n RISC Zero prover supports recursive proving of RISC-V programs using [recursion circuit](https://github.com/risc0/risc0/tree/main/risc0/circuit/recursion). This is a separate STARK circuit that is designed to efficiently generate proofs for the verification of STARK proofs, it uses the same proving system as the RISC-V circuit.\n\n Big programs are split into several segments that are executed and proven in parallel. Segment receipts (i.e. proofs of correct execution) are verified with recursion circuits and succinct receipts are produced. These succinct receipts could be recursively joined in pairs of two until a single succinct proof of the whole execution is produced. \n\n ### Final wrap\n\n RISC Zero [implements a SNARK wrapping](https://github.com/risc0/risc0/tree/main/risc0/groth16) of a recursive succinct receipt into a Groth16 proof over BN254 curve for onchain verification. This Groth16 R1CS circuit uses a circuit-specific trusted setup, the ceremony was run by RISC Zero, see [below](#trusted-setups) for more details. \n\n The final wrap circuit has a [control root](https://dev.risczero.com/terminology#control-root) public input that depends on the RISC-V and recursion circuit versions. This design allows upgrading RISC Zero proving system without changing the final wrapper and thus without running a new trusted setup ceremony.\n ",
"techStack": {
"zkVM": [
{
"id": "RISC0",
"type": "STARK",
"name": "Risc0",
"description": "zkVM STARK proving system developed by RISC ZERO for RISC-V programs."
},
{
"id": "RISCV32",
"type": "ISA",
"name": "RISC-V 32bit",
"description": "Free and open-source universal 32-bit ISA used across a variety of hardware and software."
},
{
"id": "BabyBear",
"type": "Field",
"name": "Baby Bear",
"description": "Prime field of order p = 15 * 2**27 + 1."
}
],
"finalWrap": [
{
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"id": "Risc0",
"name": "Risc0 Groth16",
"risk": "green",
"shortDescription": "Circuit-specific trusted setup for Risc0 final wrap Groth16 onchain verifier. It was publicly announced and run with 238 participants.",
"longDescription": "\n Ceremony for a circuit-specific trusted setup run by Risc0 for Groth16 circuits verifying Risc0 STARK proof. \n It was publicly announced and run with 238 participants. Ceremony transcript, as well as instructions for participation and verification \n are publicly available.\n\n - Ceremony instructions: [https://risczero.com/blog/ceremony-contribution-public-instructions](https://risczero.com/blog/ceremony-contribution-public-instructions)\n - Link to the verification: [https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit](https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit)\n - Post with a call to community to participate: [https://x.com/RiscZero/status/1781110200923275769](https://x.com/RiscZero/status/1781110200923275769)\n "
}
],
"verifierHashes": [
{
"hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
"name": "RiscZero Soon verifier",
"hash": "0x1dcf73cbd51c9eba43c437c5a5ebc5328ca2d7a590c701a9a9bc1136eceeeea7",
"name": "RiscZero v2.0.0",
"sourceLink": "https://github.com/risc0/risc0/tree/v2.0.0",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0x455218fa82e96A6adCcf182EE8A90A93BE7a6Bc6"
"address": "eth:0xafB31f5b70623CDF4b20Ada3f7230916A5A79df9"
}
],
"verificationStatus": "unsuccessful",
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"description": "Verifier smart contract sources are not available on Etherscan, hash value is set to 0x0 to indicate that it is not known."
"verificationSteps": "\nVerification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.\n\n1. Install npm, rust, git-lfs:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt install npm git-lfs\n```\n\n2. Install snarkjs and circom v2.1.0 (from sources):\n```\nnpm install -g snarkjs\n\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.0\ncargo build --release\ncargo install --path circom\nexport PATH=\"$HOME/.cargo/bin:$PATH\"\n```\n\n3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:\n```\ngit clone https://github.com/risc0/risc0.git\ncd risc0\ngit checkout v2.0.0 # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38\ngit lfs install\ngit lfs pull --include=groth16_proof/groth16/stark_verify.circom\ncd groth16_proof/groth16\ncircom stark_verify.circom --r1cs\n\n# check that the circuit is correct:\nshasum -a 256 stark_verify.r1cs # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178\n```\n\n4. Download phase 1 and phase 2 trusted setup files, verify their correctness:\n```\nwget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau\nwget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey\n\nexport NODE_OPTIONS=\"--max-old-space-size=32768\" # without this snarkjs runs out of mem\nsnarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey\n```\n\n5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes16 value of CONTROL_ROOT_0, bytes16 value of CONTROL_ROOT_1."
},
{
"hash": "0x1dcf73cbd51c9eba43c437c5a5ebc5328ca2d7a590c701a9a9bc1136eceeeea7",
"name": "RiscZero v2.2.0",
"hash": "0xc6fcb1951eb5b45a669431346a01577df99f30d72baa9d5c7eea40ec6cccfab9",
"name": "RiscZero v2.0.0-rc.3",
"sourceLink": "https://github.com/risc0/risc0/tree/v2.0.0-rc.3",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0xafB31f5b70623CDF4b20Ada3f7230916A5A79df9"
"address": "eth:0x2a098988600d87650Fb061FfAff08B97149Fa84D"
},
{
"address": "eth:0x411e56a890c5fe0712f6F345977815Ba8E7785C3"
}
],
"verificationStatus": "notVerified",
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.\n\n1. Install npm, rust, git-lfs:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt install npm git-lfs\n```\n\n2. Install snarkjs and circom v2.1.0 (from sources):\n```\nnpm install -g snarkjs\n\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.0\ncargo build --release\ncargo install --path circom\nexport PATH=\"$HOME/.cargo/bin:$PATH\"\n```\n\n3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:\n```\ngit clone https://github.com/risc0/risc0.git\ncd risc0\ngit checkout v2.0.0-rc.3 # hash 99e8616b4e74203a5aa361a485e0196516b4b308\ngit lfs install\ngit lfs pull --include=groth16_proof/groth16/stark_verify.circom\ncd groth16_proof/groth16\ncircom stark_verify.circom --r1cs\n\n# check that the circuit is correct:\nshasum -a 256 stark_verify.r1cs # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178\n```\n\n4. Download phase 1 and phase 2 trusted setup files, verify their correctness:\n```\nwget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau\nwget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey\n\nexport NODE_OPTIONS=\"--max-old-space-size=32768\" # without this snarkjs runs out of mem\nsnarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey\n```\n\n5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes16 value of CONTROL_ROOT_0, bytes16 value of CONTROL_ROOT_1."
},
{
"hash": "0xc6fcb1951eb5b45a669431346a01577df99f30d72baa9d5c7eea40ec6cccfab9",
"name": "RiscZero v3.0.0",
"hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
"name": "RiscZero Soon verifier",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0x2a098988600d87650Fb061FfAff08B97149Fa84D"
},
"address": "eth:0x455218fa82e96A6adCcf182EE8A90A93BE7a6Bc6"
}
],
"verificationStatus": "unsuccessful",
"attesters": [
{
"address": "eth:0x7CCA385bdC790c25924333F5ADb7F4967F5d1599"
},
{
"address": "eth:0x411e56a890c5fe0712f6F345977815Ba8E7785C3"
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes16 value of CONTROL_ROOT_0, bytes16 value of CONTROL_ROOT_1."
"description": "Verifier smart contract sources are not available on Etherscan, hash value is set to 0x0 to indicate that it is not known."
}
]
}