7475c5df (main)
and
14767274 (PR)
+4 -2
+4 -2
{
"creator": "Matter Labs",
"projectsForTvs": [
{
"projectId": "adi",
"sinceTimestamp": 1764107759
}
],
"proofSystemInfo": "\n ## Description\n\n Airbender is the most advanced zkVM developed by Matter Labs. It operates on RISC-V ISA and is designed to prove state transition function of [zk stack](https://zkstack.io) chains in combination with [ZKsync OS](https://github.com/matter-labs/zksync-os), but also more general RISC-V programs. Airbender proofs could be [wrapped into Fflonk SNARK](https://github.com/matter-labs/zkos-wrapper) for efficient onchain verification. Airbender initial release [targets 81 bits of security](https://x.com/eth_proofs/status/1942468407896543694).\n\n ## Proof system\n\n Airbender implements a rather standard zkVM: AIR constraints, [DEEP-FRI](https://eprint.iacr.org/2019/336) polynomial testing, RISC-V instructions with the program being stored in read-only memory and accessed by lookup arguments, recursive proving. \n\n Many parts of the stack are optimized for speed and efficiency, including a small Mersenne31 field over which the computation trace is generated and a simple degree 2 AIR constraints. Airbender prover could also be run in application mode without signed multiplication and division operations, thus reducing circuit complexity.\n\n ### Recursion circuits\n\n Airbender targets proving batches of size 2**22 (~4 M) clock cycles. The proofs of such batches are pairwise recursively aggregated using zkVM in recursion mode. For onchain verification, the final Airbender STARK is [compressed using Boojum compressor](https://github.com/matter-labs/zkos-wrapper) and then wrapped into a Fflonk SNARK with KZG. The KZG commitment is done over BN254 curve and it uses Aztec Ignition trusted setup ceremony, see [below](#trusted-setups) for more details.\n ",
"techStack": {
"zkVM": [
{
"id": "Airbender",
"type": "STARK",
"name": "Airbender",
"description": "zkVM STARK proving system operating on RISC-V ISA, developed by Matter Labs."
},
{
"id": "RISCV32",
"type": "ISA",
"name": "RISC-V 32bit",
"description": "Free and open-source universal 32-bit ISA used across a variety of hardware and software."
},
{
"id": "Mersenne31",
"type": "Field",
"name": "Mersenne31",
"description": "Prime field of order p = 2**31 - 1."
}
],
"finalWrap": [
{
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
},
{
"proofSystem": {
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0x6f36a08c517b060fa97308cdb3e23b04842ff839d451a753ec8fae1a5408304a",
"name": "Airbender Fflonk Adi verifier",
"proofSystem": {
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
"knownDeployments": [
{
"address": "eth:0xF6b3708BE4192CE4526c2F87D4c3eABA79230E6A"
}
],
"verificationStatus": "notVerified"
},
{
"hash": "0x124ebcd537a1e1c152774dd18f67660e35625bba0b669bf3b4836d636b105337",
"name": "Airbender Plonk Adi verifier",
"proofSystem": {
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
"knownDeployments": [
{
"address": "eth:0x08513A4646d1Bc8c348C67A3680bb19626E7F13F"
}
],
"verificationStatus": "notVerified",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
]
}
]
}+2 -1
+2 -1
{
"creator": "Aztec",
"projectsForTvs": [
{
"projectId": "aztec",
"sinceTimestamp": 1615762800
}
],
"proofSystemInfo": "\n ## Proof system\n\n Aztec v1 prover is a [monolithic zk-SNARK proving system](https://github.com/AztecProtocol/aztec-v1/tree/develop/packages/aztec.js) over BN254 curve for proving state transitions of Aztec v1 (Zk.money) L2. It implements the following custom circuits and contains verifiers for them: [joinsplit](https://github.com/AztecProtocol/aztec-v1/blob/a47d3d9ea38cd1363ede730998145da663df6091/packages/protocol/contracts/ACE/validators/joinSplit/JoinSplit.sol#L9) for proving private token transfers in a UTXO-like note model, [swap](https://github.com/AztecProtocol/aztec-v1/blob/a47d3d9ea38cd1363ede730998145da663df6091/packages/protocol/contracts/ACE/validators/swap/Swap.sol) for proving exchange of two notes between counterparties, [dividend](https://github.com/AztecProtocol/aztec-v1/blob/a47d3d9ea38cd1363ede730998145da663df6091/packages/protocol/contracts/ACE/validators/dividend/Dividend.sol) for proving that a note is equal to a public percentage of a second note, [public](https://github.com/AztecProtocol/aztec-v1/blob/a47d3d9ea38cd1363ede730998145da663df6091/packages/protocol/contracts/ACE/validators/publicRange/PublicRange.sol) and [private](https://github.com/AztecProtocol/aztec-v1/blob/a47d3d9ea38cd1363ede730998145da663df6091/packages/protocol/contracts/ACE/validators/privateRange/PrivateRange.sol) range for proving comparison of a note with either a public value or with another note.\n",
"techStack": {
"snark": [
{
"id": "AztecV1",
"type": "Plonk",
"name": "AztecV1",
"description": "First version of Aztec implementation of Plonk proving system, originally developed for zk.money (AZTEC v1)."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "CustomCircuits",
"type": "Other",
"name": "App-specific circuits",
"description": "This project uses custom app-specific ZK circuits."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "AztecV1",
"type": "Plonk",
"name": "AztecV1",
"description": "First version of Aztec implementation of Plonk proving system, originally developed for zk.money (AZTEC v1)."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0x7c8a64f644c60e33445be862185b65bf2096c00c9691f49bd03df5f3ce6b6abf",
"name": "Aztec v1 verifier",
"sourceLink": "https://github.com/AztecProtocol/aztec-v1/tree/develop",
"proofSystem": {
"id": "AztecV1",
"type": "Plonk",
"name": "AztecV1",
"description": "First version of Aztec implementation of Plonk proving system, originally developed for zk.money (AZTEC v1)."
},
"knownDeployments": [
{
"address": "eth:0x48Cb7BA00D087541dC8E2B3738f80fDd1FEe8Ce8"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed array of uint256 obtained from flattening VerificationKey structure returned by get_verification_key() of Rollup1x2Vk library."
}
]
}+2 -1
+2 -1
{
"creator": "Aztec",
"projectsForTvs": [
{
"projectId": "aztecnetwork",
"sinceTimestamp": 1774821600
}
],
"proofSystemInfo": "\n## Description\n\nBarretenberg is a C++ library that implements several Plonk-based proof systems, developed by Aztec. It notably includes UltraHonk SNARK as an optimized version of previous Plonk implementation, and CHONK (Client-side Highly Optimized ploNK) SNARK for client-side proving on weaker devices. Barretenberg implements actual zero-knowledge SNARK modifications that allow proving over private data, and provides tools to generate UltraHonk smart contract verifiers. It also contains circuits to prove private and public transactions on Aztec L2.\n\n## Proof system\n\nThe main application of Barretenberg is proving Aztec L2 state transition, which includes users locally proving private transactions with true ZK CHONK and more powerful nodes proving public transactions using UltraHonk. CHONK proofs must be verified within UltraHonk, so Barretenberg also includes tools for recursive proving. Both proving systems operate on arithmetic circuits that could be compiled from [Noir](https://github.com/noir-lang/noir) programs into ACIR, which is a [native circuit representation for Barretenberg](https://barretenberg.aztec.network/docs/#relationship-with-noir). \n\n### UltraHonk\n\nUltraHonk is built on top of [Plonk](https://eprint.iacr.org/archive/2019/953/1624533038.pdf) proof system, with several optimizations for performance. It also serves as a basis for CHONK. The main optimization comes from using sumcheck protocol over the boolean hypercube as described in the [HyperPlonk paper](https://eprint.iacr.org/2022/1355). This trick allows reducing prover time and memory requirements at the expense of larger proofs. Barretenberg also contains code for circuits [verifying Honk proofs within UltraHonk verifier](https://github.com/AztecProtocol/aztec-packages/tree/next/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier), allowing prover recursion. For more technical details on UltraHonk see [here](https://github.com/AztecProtocol/aztec-packages/tree/99c1647e91c83a3b1b3e040fce481fb4c7265522/barretenberg/cpp/src/barretenberg/ultra_honk#readme).\n\n### CHONK\n\nCHONK is the proof system that is most optimized for client side proving in memory-restricted environments like mobile and browsers. In addition, CHONK has zero-knowledge property to protect prover private inputs, which is achieved by adding random masking polynomials at several stages of the pipeline and some other measures. For the full description of ZK-related modifications see [here](https://github.com/AztecProtocol/aztec-packages/tree/99c1647e91c83a3b1b3e040fce481fb4c7265522/barretenberg/cpp/src/barretenberg/ultra_honk#zero-knowledge).\n\nOne of CHONK’s key innovations is Goblin architecture that efficiently manages elliptic curve operations over BN254 used e.g. in signatures. Elliptic curve operations are collected in a queue during the circuit proving, but the proof of their correctness is deferred to the very end of the proving process. The final step of the proving is done over a different curve called Grumpkin, which is chosen to make these EC operations native (i.e. extremely efficient). The correctness of translation between BN254 and Grumpkin is handled by the [Translator VM](https://github.com/AztecProtocol/aztec-packages/blob/7d03c441df4935ec5b08069446f3e8d59966532e/barretenberg/cpp/src/barretenberg/translator_vm/README.md) and the correctness of EC operations is proven by the [ECCVM](https://github.com/AztecProtocol/aztec-packages/blob/7d03c441df4935ec5b08069446f3e8d59966532e/barretenberg/cpp/src/barretenberg/eccvm/README.md).\n\nCHONK also introduces a folding scheme inspired by [HyperNova](https://eprint.iacr.org/2023/573) for more memory-efficient proving of recursive smart contract calls. In this case different smart contract are represented by different circuits, which are proven separately and then aggregated. The folding scheme allows efficient aggregation of these proofs that results in only one expensive polynomial commitment check in the end, instead of having to check it for each smart contract call.\n\nFor more technical details on CHONK see [here](https://github.com/AztecProtocol/aztec-packages/tree/7d03c441df4935ec5b08069446f3e8d59966532e/barretenberg/cpp/src/barretenberg/chonk#readme).\n\n### Noir and trusted setups\n\nAlthough not technically a part of Barretenberg proving repo, [Noir language](https://noir-lang.org) represents the most developer-friendly way to create circuits to be proven with UltraHonk or CHONK. It’s a domain-specific language inspired by Rust.\n\nAll Barretenberg proving systems extend Plonk, which is based on KZG commitment schemes. That requires a trusted setup, which is chosen to be Aztec Ignition trusted setup. Some internal proofs, like ECCVM proof, are based on IPA (inner product argument) and thus they require no trusted setup.\n ",
"techStack": {
"zkVM": [
{
"id": "UltraHonk",
"type": "Plonk",
"name": "UltraHonk",
"description": "A KZG-based PLONKish proving system featuring many optimizations, including a sumcheck argument over a boolean hypercube. Developed by Aztec as a part of Barretenberg library."
},
{
"id": "CHONK",
"type": "Plonk",
"name": "CHONK",
"description": "PLONKish proving system, designed for client-side proving. Includes sumcheck argument over a hypercube, HyperNova-like folding schemes and GoblinPlonk EC operation optimization over Grumpkin curve. Developed by Aztec as a part of Barretenberg library."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "Grumpkin",
"type": "curve",
"name": "Grumpkin",
"description": "Curve that forms a curve cycle together with BN254, which allows highly efficient recursive proof composition by switching between these two curves."
},
{
"id": "AVM",
"type": "ISA",
"name": "AVM",
"description": "VM that executes the public part of Aztec L2 transactions, conceptually similar to EVM."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "UltraHonk",
"type": "Plonk",
"name": "UltraHonk",
"description": "A KZG-based PLONKish proving system featuring many optimizations, including a sumcheck argument over a boolean hypercube. Developed by Aztec as a part of Barretenberg library."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0x059ad02b037fcfd4df2b9db771777d067a400f06fc55cf45fa601511e58e2c3e",
"name": "Barretenberg Aztec verifier v4",
"sourceLink": "https://github.com/AztecProtocol/aztec-packages/tree/v4/noir-projects/noir-protocol-circuits",
"proofSystem": {
"id": "UltraHonk",
"type": "Plonk",
"name": "UltraHonk",
"description": "A KZG-based PLONKish proving system featuring many optimizations, including a sumcheck argument over a boolean hypercube. Developed by Aztec as a part of Barretenberg library."
},
"knownDeployments": [
{
"address": "eth:0x70aEDda427f26480D240bc0f4308ceDec8d31348"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nThe regeneration process consumed 32 GiB memory on the peak. It could be done on macOS or Linux machines, however in our experience Linux setup was smoother. \nThe steps below worked for clean Ubuntu 22.04.\n\n1. Install necessary dependencies.\n\n```\nsudo apt-get install jq build-essential parallel ninja-build\n\n# Install clang-format-20\nwget https://apt.llvm.org/llvm.sh \nchmod +x llvm.sh \nsudo ./llvm.sh 20 \nsudo apt-get install clang-format-20\n\n# Install latest cmake\ncurl -fsSL https://apt.kitware.com/kitware-archive.sh | sudo sh\nsudo apt-get install cmake\n\n# Install zig 0.13.0\nwget https://ziglang.org/download/0.13.0/zig-linux-x86_64-0.13.0.tar.xz \ntar xf zig-linux-x86_64-0.13.0.tar.xz \nsudo mv zig-linux-x86_64-0.13.0 /usr/local/zig \nsudo ln -s /usr/local/zig/zig /usr/local/bin/zig\n\n# Install yarn\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash\nnvm install 20\nnpm install -g yarn\n\n# Install gcc 13\nsudo add-apt-repository ppa:ubuntu-toolchain-r/test\nsudo apt-get update\nsudo apt-get install g++-13\n\n# Install docker\ncurl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -\nsudo add-apt-repository \"deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable\"\nsudo apt install -y docker-ce\nsudo usermod -aG docker ${USER}\n\n# Install rust\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n```\n\n2. Clone the repo and checkout the correct version\n```\ngit clone https://github.com/AztecProtocol/aztec-packages.git\ncd aztec-packages\ngit checkout v4 # commit hash 408ff4d64fad09b8a11b0f54b56295271a113325\ngit submodule update --init --recursive\n```\n\n3. Build preliminary components\n```\n# build avm-transpiler binary\ncd avm-transpiler\nNO_CACHE=1 ./bootstrap.sh build_native\n\n# build barretenberg binary\ncd ../barretenberg/cpp\nNO_CACHE=1 ./bootstrap.sh build_native\n\n# build nargo binary\ncd ../../noir\nNO_CACHE=1 ./bootstrap.sh\n```\n\n4. Remove the pinned build files and build the verifier smart contract:\n```\ncd ../noir-projects/noir-protocol-circuits\nrm pinned-build.tar.gz\ncorepack enable\nNO_CACHE=1 ./bootstrap.sh\n```\nThe build should produce correct onchain verifier in `target/keys/rollup_root_verifier.sol`.\n "
}
]
}+4 -2
+4 -2
{
"creator": "Matter Labs",
"projectsForTvs": [
{
"projectId": "zklinknova",
"sinceTimestamp": 1709217961
},
{
"projectId": "zksync2",
"sinceTimestamp": 1689544800
},
{
"projectId": "abstract",
"sinceTimestamp": 1737932400
},
{
"projectId": "sophon",
"sinceTimestamp": 1734476400
},
{
"projectId": "cronoszkevm",
"sinceTimestamp": 1723672800
},
{
"projectId": "zeronetwork",
"sinceTimestamp": 1731366000
},
{
"projectId": "lens",
"sinceTimestamp": 1743717600
},
{
"projectId": "wonder",
"sinceTimestamp": 1746741600
},
{
"projectId": "zkcandy",
"sinceTimestamp": 1743976800
},
{
"projectId": "grvt",
"sinceTimestamp": 1734649200
},
{
"projectId": "lachain",
"sinceTimestamp": 1747692000
},
{
"projectId": "sxt",
"sinceTimestamp": 1746741600
}
],
"proofSystemInfo": "\n ## Description\n\n Boojum is a proving system operating on [EraVM](https://matter-labs.github.io/zksync-era/core/latest/guides/advanced/12_alternative_vm_intro.html) ISA and supporting [zk stack](https://zkstack.io) chains. It includes recursive STARK proving of zkVM execution, as well as the final wrap with [Plonk](https://github.com/matter-labs/franklin-crypto/tree/dev/src/plonk) or [Fflonk](https://github.com/matter-labs/zksync-crypto/blob/main/crates/fflonk/docs/spec.pdf) SNARK proving system. Boojum targets [100 bits of security](https://github.com/matter-labs/era-boojum?tab=readme-ov-file#for-curions-in-benchmarks-only).\n\n ## Proof system\n\n ### zkVM component\n\n [Boojum](https://github.com/matter-labs/era-boojum/tree/main)'s core is an implementation of the [**Redshift**](https://eprint.iacr.org/2019/1400.pdf) protocol which uses the Plonk IOP with a polynomial commitment scheme based on List Polynomial Commitments (LPCs), which is in turn based on FRI, making the scheme transparent. The scheme makes use of the Goldilocks field, which is much smaller than BN254's field. This part of boojum implements a zkVM for EraVM, which is closely aligned with EVM but has essential differences like 16 registers.\n\n ### Recursion circuits\n\n The protocol makes use of several layers of recursive proof aggregation for 15 types of [circuits](https://github.com/matter-labs/era-zkevm_test_harness/blob/3cd647aa57fc2e1180bab53f7a3b61ec47502a46/circuit_definitions/src/circuit_definitions/recursion_layer/mod.rs#L29). In particular, node and scheduler circuits aggregate zk proofs and compressor and wrapper circuits reduce the final proof size. Further information about the aggregation architecture can be found [**here**](https://github.com/matter-labs/zksync-era/blob/1b61d0797062ab8b0aa2c1e92b23a3a0d8fd2c61/docs/guides/advanced/15_prover_keys.md#circuits).\n\n ### Final wrap\n\n The final proof could either be wrapped into a [Plonk](https://github.com/matter-labs/era-zkevm_test_harness/blob/3cd647aa57fc2e1180bab53f7a3b61ec47502a46/circuit_definitions/src/circuit_definitions/aux_layer/wrapper.rs)+KZG proof, or into [Fflonk](https://github.com/matter-labs/zksync-crypto/tree/main/crates/fflonk)+KZG for cheap verification. The KZG commitment is done over BN254 curve and it uses Aztec Ignition trusted setup ceremony, see [below](#trusted-setups) for more details.\n ",
"techStack": {
"zkVM": [
{
"id": "Boojum",
"type": "STARK",
"name": "Boojum",
"description": "zkVM STARK proving system developed by Matter Labs for proving state transition of ZKsync Era."
},
{
"id": "EraVM",
"type": "ISA",
"name": "EraVM",
"description": "Instruction language for ZKsync Era virtual machine."
},
{
"id": "Goldilocks",
"type": "Field",
"name": "Goldilocks",
"description": "Prime field of order p = 2**64 - 2**32 + 1."
}
],
"finalWrap": [
{
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
{
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
},
{
"proofSystem": {
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0x6f36a08c517b060fa97308cdb3e23b04842ff839d451a753ec8fae1a5408304a",
"name": "Boojum Fflonk core-v29.1.0",
"sourceLink": "https://github.com/matter-labs/zksync-era/tree/core-v29.1.0/prover",
"proofSystem": {
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
"knownDeployments": [
{
"address": "eth:0x1AC4F629Fdc77A7700B68d03bF8D1A53f2210911"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification requires an Ubuntu 22.04 machine with an NVIDIA GPU. We used a g6.4xlarge aws instance with 24 GiB GPU memory and 64 GiB RAM. \nThe setup part is based on [this guide](https://paragraph.com/@zksync/from-integration-to-verification-completing-the-first-steps-in-zksync-s-prover-network) with modifications, the verification is done using [this script](https://github.com/matter-labs/zksync-era/tree/main/prover/crates/bin/vk_setup_data_generator_server_fri).\n\n1. Install rust, yarn, some essential libraries, docker and cmake:\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash\nexport NVM_DIR=$HOME/.nvm\n. .bashrc\nnvm install 20\nnpm install -g yarn\nyarn set version 1.22.19\n\nsudo apt-get update\nsudo apt-get install -y build-essential pkg-config cmake clang lldb lld libssl-dev postgresql apt-transport-https ca-certificates curl software-properties-common\ncargo install sqlx-cli --version 0.8.1\n\n# install the latest version of cmake\nsudo apt remove cmake\ncurl -fsSL https://apt.kitware.com/kitware-archive.sh | sudo sh\nsudo apt-get install cmake\n```\n\n2. Install CUDA drivers and toolkit 12.2, export necessary env vars. On Ubuntu 22.04 this requires updating gcc to version 12.\n\n```\nsudo apt-get install gcc-12 g++-12\nsudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100\nsudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 100\n\nwget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb\nsudo dpkg -i cuda-keyring_1.1-1_all.deb\nsudo apt-get update\nsudo apt-get install -y cuda-drivers-535\nsudo apt-get install -y cuda-toolkit-12-2\n```\n\nReboot the machine to apply the drivers.\n\n3. Install `foundryup-zksync`.\n\n```\ncurl -L https://raw.githubusercontent.com/matter-labs/foundry-zksync/main/install-foundry-zksync | bash\n. ~/.bashrc\nfoundryup-zksync\n```\n\n4. Build bellman-cuda. We used the tag version `prerelease-dev-a87a309`, commit hash `a87a309e7c07ef6b3fc5532e50d5d244aab9f4d0`.\n```\nexport CUDA_HOME=/usr/local/cuda\nexport LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64\nexport PATH=$PATH:$CUDA_HOME/bin\n\ngit clone https://github.com/matter-labs/era-bellman-cuda.git\ncd era-bellman-cuda\ngit checkout prerelease-dev-a87a309\ngit submodule update --init --recursive\ncmake -B./build -DCMAKE_BUILD_TYPE=Release\ncmake --build ./build\nexport BELLMAN_CUDA_DIR=$HOME/era-bellman-cuda\n```\n\n5. Run all scripts to regenerate verification keys. The correct tag version of the repo is `core-v29.1.0`, commit hash `3b61f62b3361404c0c94635caee68c855ce2b9f8`.\n```\ncd ~ \ngit clone https://github.com/matter-labs/zksync-era.git\ncd zksync-era/\ngit checkout core-v29.1.0\n\n# Download compact CRS for the compressor data step, put in repo root\ncurl -o setup_compact.key https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_compact.key\nexport COMPACT_CRS_FILE=~/zksync-era/setup_compact.key\n\ncd prover/crates/bin/vk_setup_data_generator_server_fri\nCRS_FILE=https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_2^24.key ZKSYNC_HOME=$HOME \n\n# Run regeneration steps\ncargo run --release --bin key_generator generate-vk\ncargo run --features gpu --release --bin key_generator generate-compressor-data\n```\n\nThe output of the last command will contain the required `fflonk_snark_wrapper` value.\n "
},
{
"hash": "0x64b347c642ea60114c98b3976124ea8a7e0bb778bd7e479aedc02f994486c8a1",
"name": "Boojum Plonk prover-v22.0.0",
"sourceLink": "https://github.com/matter-labs/zksync-era/tree/prover-v22.0.0/prover",
"proofSystem": {
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
"knownDeployments": [
{
"address": "eth:0x2db2ffdecb7446aaab01FAc3f4D55863db3C5bd6"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification requires an Ubuntu 22.04 machine with an NVIDIA GPU. We used a g6.4xlarge aws instance with 24 GiB GPU memory and 64 GiB RAM. \nThe setup part is based on [this guide](https://paragraph.com/@zksync/from-integration-to-verification-completing-the-first-steps-in-zksync-s-prover-network) with modifications, the verification is done using [this script](https://github.com/matter-labs/zksync-era/tree/main/prover/crates/bin/vk_setup_data_generator_server_fri).\n\n1. Install rust, yarn, some essential libraries, docker and cmake:\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash\nexport NVM_DIR=$HOME/.nvm\n. .bashrc\nnvm install 20\nnpm install -g yarn\nyarn set version 1.22.19\n\nsudo apt-get update\nsudo apt-get install -y build-essential pkg-config cmake clang lldb lld libssl-dev postgresql apt-transport-https ca-certificates curl software-properties-common\ncargo install sqlx-cli --version 0.8.1\n\n# install the latest version of cmake\nsudo apt remove cmake\ncurl -fsSL https://apt.kitware.com/kitware-archive.sh | sudo sh\nsudo apt-get install cmake\n```\n\n2. Install CUDA drivers and toolkit 12.2, export necessary env vars. On Ubuntu 22.04 this requires updating gcc to version 12.\n\n```\nsudo apt-get install gcc-12 g++-12\nsudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100\nsudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 100\n\nwget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb\nsudo dpkg -i cuda-keyring_1.1-1_all.deb\nsudo apt-get update\nsudo apt-get install -y cuda-drivers-535\nsudo apt-get install -y cuda-toolkit-12-2\n```\n\nReboot the machine to apply the drivers.\n\n3. Install `foundryup-zksync`.\n\n```\ncurl -L https://raw.githubusercontent.com/matter-labs/foundry-zksync/main/install-foundry-zksync | bash\n. ~/.bashrc\nfoundryup-zksync\n```\n\n4. Build bellman-cuda. We used the tag version `prerelease-dev-a87a309`, commit hash `a87a309e7c07ef6b3fc5532e50d5d244aab9f4d0`.\n```\nexport CUDA_HOME=/usr/local/cuda\nexport LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64\nexport PATH=$PATH:$CUDA_HOME/bin\n\ngit clone https://github.com/matter-labs/era-bellman-cuda.git\ncd era-bellman-cuda\ngit checkout prerelease-dev-a87a309\ngit submodule update --init --recursive\ncmake -B./build -DCMAKE_BUILD_TYPE=Release\ncmake --build ./build\nexport BELLMAN_CUDA_DIR=$HOME/era-bellman-cuda\n```\n\n5. Run all scripts to regenerate verification keys. The correct tag version of the repo is `prover-v22.0.0`, commit hash `157045b4f67546629fc2f7fb32cbbcb4daa2054d`.\n```\ncd ~ \ngit clone https://github.com/matter-labs/zksync-era.git\ncd zksync-era/\ngit checkout prover-v22.0.0\n\n# Download compact CRS for the compressor data step, put in repo root\ncurl -o setup_compact.key https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_compact.key\nexport COMPACT_CRS_FILE=~/zksync-era/setup_compact.key\n\ncd prover/crates/bin/vk_setup_data_generator_server_fri\nCRS_FILE=https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_2^24.key ZKSYNC_HOME=$HOME \n\n# Run regeneration steps\ncargo run --release --bin key_generator generate-vk\ncargo run --features gpu --release --bin key_generator generate-compressor-data\n```\n\nThe output of the last command will contain the required `snark_wrapper` value.\n "
},
{
"hash": "0x8574e152c41dc39a2ecab984545e1cf21cb3ec250b919018a8053f2fa270784f",
"name": "Boojum Plonk zkLinkNova verifier",
"proofSystem": {
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
"knownDeployments": [
{
"address": "linea:0x902C3806A84f4e855a8746e92d7F1C9a51400458"
}
],
"verificationStatus": "notVerified"
},
{
"hash": "0x49eae0bf5c7ea580f4979b366e52b386adc5f42e2ce50fc1d3c4de9a86052bff",
"name": "Boojum Fflonk core-v29.4.0",
"sourceLink": "https://github.com/matter-labs/zksync-era/tree/core-v29.4.0/prover",
"proofSystem": {
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
"knownDeployments": [
{
"address": "eth:0xD324a7c8556A059371B207fB96FD77bE24E2042c"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification requires an Ubuntu 22.04 machine with an NVIDIA GPU. We used a g6.4xlarge aws instance with 24 GiB GPU memory and 64 GiB RAM. \nThe setup part is based on [this guide](https://paragraph.com/@zksync/from-integration-to-verification-completing-the-first-steps-in-zksync-s-prover-network) with modifications, the verification is done using [this script](https://github.com/matter-labs/zksync-era/tree/main/prover/crates/bin/vk_setup_data_generator_server_fri).\n\n1. Install rust, yarn, some essential libraries, docker and cmake:\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash\nexport NVM_DIR=$HOME/.nvm\n. .bashrc\nnvm install 20\nnpm install -g yarn\nyarn set version 1.22.19\n\nsudo apt-get update\nsudo apt-get install -y build-essential pkg-config cmake clang lldb lld libssl-dev postgresql apt-transport-https ca-certificates curl software-properties-common\ncargo install sqlx-cli --version 0.8.1\n\n# install the latest version of cmake\nsudo apt remove cmake\ncurl -fsSL https://apt.kitware.com/kitware-archive.sh | sudo sh\nsudo apt-get install cmake\n```\n\n2. Install CUDA drivers and toolkit 12.2, export necessary env vars. On Ubuntu 22.04 this requires updating gcc to version 12.\n\n```\nsudo apt-get install gcc-12 g++-12\nsudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100\nsudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 100\n\nwget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb\nsudo dpkg -i cuda-keyring_1.1-1_all.deb\nsudo apt-get update\nsudo apt-get install -y cuda-drivers-535\nsudo apt-get install -y cuda-toolkit-12-2\n```\n\nReboot the machine to apply the drivers.\n\n3. Install `foundryup-zksync`.\n\n```\ncurl -L https://raw.githubusercontent.com/matter-labs/foundry-zksync/main/install-foundry-zksync | bash\n. ~/.bashrc\nfoundryup-zksync\n```\n\n4. Build bellman-cuda. We used the tag version `prerelease-dev-a87a309`, commit hash `a87a309e7c07ef6b3fc5532e50d5d244aab9f4d0`.\n```\nexport CUDA_HOME=/usr/local/cuda\nexport LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64\nexport PATH=$PATH:$CUDA_HOME/bin\n\ngit clone https://github.com/matter-labs/era-bellman-cuda.git\ncd era-bellman-cuda\ngit checkout prerelease-dev-a87a309\ngit submodule update --init --recursive\ncmake -B./build -DCMAKE_BUILD_TYPE=Release\ncmake --build ./build\nexport BELLMAN_CUDA_DIR=$HOME/era-bellman-cuda\n```\n\n5. Run all scripts to regenerate verification keys. The correct tag version of the repo is `core-v29.4.0`, commit hash `fe0a73730853b291c3c1dd514a42a45625704b7b`.\n```\ncd ~ \ngit clone https://github.com/matter-labs/zksync-era.git\ncd zksync-era/\ngit checkout core-v29.4.0\n\n# Download compact CRS for the compressor data step, put in repo root\ncurl -o setup_compact.key https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_compact.key\nexport COMPACT_CRS_FILE=~/zksync-era/setup_compact.key\n\ncd prover/crates/bin/vk_setup_data_generator_server_fri\nCRS_FILE=https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_2^24.key ZKSYNC_HOME=$HOME \n\n# Run regeneration steps\ncargo run --release --bin key_generator generate-vk\ncargo run --features gpu --release --bin key_generator generate-compressor-data\n```\n\nThe output of the last command will contain the required `fflonk_snark_wrapper` value.\n "
},
{
"hash": "0x1ffc56111a5cfaf5db387f6a31408ad20217e9bc1f31f2f5c1bd38b0d6d7968b",
"name": "Boojum Plonk prover-v23.2.0",
"sourceLink": "https://github.com/matter-labs/zksync-era/tree/prover-v23.2.0/prover",
"proofSystem": {
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
"knownDeployments": [
{
"address": "eth:0xe201837d151E5aC33Af3305f287Ad6F6a7Dfccd7"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification requires an Ubuntu 22.04 machine with an NVIDIA GPU. We used a g6.4xlarge aws instance with 24 GiB GPU memory and 64 GiB RAM. \nThe setup part is based on [this guide](https://paragraph.com/@zksync/from-integration-to-verification-completing-the-first-steps-in-zksync-s-prover-network) with modifications, the verification is done using [this script](https://github.com/matter-labs/zksync-era/tree/main/prover/crates/bin/vk_setup_data_generator_server_fri).\n\n1. Install rust, yarn, some essential libraries, docker and cmake:\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash\nexport NVM_DIR=$HOME/.nvm\n. .bashrc\nnvm install 20\nnpm install -g yarn\nyarn set version 1.22.19\n\nsudo apt-get update\nsudo apt-get install -y build-essential pkg-config cmake clang lldb lld libssl-dev postgresql apt-transport-https ca-certificates curl software-properties-common\ncargo install sqlx-cli --version 0.8.1\n\n# install the latest version of cmake\nsudo apt remove cmake\ncurl -fsSL https://apt.kitware.com/kitware-archive.sh | sudo sh\nsudo apt-get install cmake\n```\n\n2. Install CUDA drivers and toolkit 12.2, export necessary env vars. On Ubuntu 22.04 this requires updating gcc to version 12.\n\n```\nsudo apt-get install gcc-12 g++-12\nsudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100\nsudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 100\n\nwget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb\nsudo dpkg -i cuda-keyring_1.1-1_all.deb\nsudo apt-get update\nsudo apt-get install -y cuda-drivers-535\nsudo apt-get install -y cuda-toolkit-12-2\n```\n\nReboot the machine to apply the drivers.\n\n3. Install `foundryup-zksync`.\n\n```\ncurl -L https://raw.githubusercontent.com/matter-labs/foundry-zksync/main/install-foundry-zksync | bash\n. ~/.bashrc\nfoundryup-zksync\n```\n\n4. Build bellman-cuda. We used the tag version `prerelease-dev-a87a309`, commit hash `a87a309e7c07ef6b3fc5532e50d5d244aab9f4d0`.\n```\nexport CUDA_HOME=/usr/local/cuda\nexport LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64\nexport PATH=$PATH:$CUDA_HOME/bin\n\ngit clone https://github.com/matter-labs/era-bellman-cuda.git\ncd era-bellman-cuda\ngit checkout prerelease-dev-a87a309\ngit submodule update --init --recursive\ncmake -B./build -DCMAKE_BUILD_TYPE=Release\ncmake --build ./build\nexport BELLMAN_CUDA_DIR=$HOME/era-bellman-cuda\n```\n\n5. Run all scripts to regenerate verification keys. The correct tag version of the repo is `prover-v23.2.0`, commit hash `2b188cd7ac139430d3cb1f27babc9693a2c83df6`.\n```\ncd ~ \ngit clone https://github.com/matter-labs/zksync-era.git\ncd zksync-era/\ngit checkout prover-v23.2.0\n\n# Download compact CRS for the compressor data step, put in repo root\ncurl -o setup_compact.key https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_compact.key\nexport COMPACT_CRS_FILE=~/zksync-era/setup_compact.key\n\ncd prover/crates/bin/vk_setup_data_generator_server_fri\nCRS_FILE=https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_2^24.key ZKSYNC_HOME=$HOME \n\n# Run regeneration steps\ncargo run --release --bin key_generator generate-vk\ncargo run --features gpu --release --bin key_generator generate-compressor-data\n```\n\nThe output of the last command will contain the required `snark_wrapper` value.\n "
},
{
"hash": "0xb2f50340e0edbe49dc657d4eb298e07f13860c1be0fe2e438e44ef8fad133d84",
"name": "Boojum Plonk core-v29.11.1",
"sourceLink": "https://github.com/matter-labs/zksync-era/tree/core-v29.11.1/prover",
"proofSystem": {
"id": "Bellman",
"type": "Plonk",
"name": "Bellman",
"description": "Bellman Rust library for Plonk proving system, originally developed for ZCash."
},
"knownDeployments": [
{
"address": "eth:0x7f33D100f482093182111d69a4a457289e99f4ec"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\n Verification requires an Ubuntu 22.04 machine with an NVIDIA GPU. We used a g6.4xlarge aws instance with 24 GiB GPU memory and 64 GiB RAM. \n The setup part is based on [this guide](https://paragraph.com/@zksync/from-integration-to-verification-completing-the-first-steps-in-zksync-s-prover-network) with modifications, the verification is done using [this script](https://github.com/matter-labs/zksync-era/tree/main/prover/crates/bin/vk_setup_data_generator_server_fri).\n \n 1. Install rust, yarn, some essential libraries, docker and cmake:\n \n ```\n curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n . .cargo/env\n \n curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash\n export NVM_DIR=$HOME/.nvm\n . .bashrc\n nvm install 20\n npm install -g yarn\n yarn set version 1.22.19\n \n sudo apt-get update\n sudo apt-get install -y build-essential pkg-config cmake clang lldb lld libssl-dev postgresql apt-transport-https ca-certificates curl software-properties-common\n cargo install sqlx-cli --version 0.8.1\n \n # install the latest version of cmake\n sudo apt remove cmake\n curl -fsSL https://apt.kitware.com/kitware-archive.sh | sudo sh\n sudo apt-get install cmake\n ```\n \n 2. Install CUDA drivers and toolkit 12.2, export necessary env vars. On Ubuntu 22.04 this requires updating gcc to version 12.\n \n ```\n sudo apt-get install gcc-12 g++-12\n sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100\n sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 100\n \n wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb\n sudo dpkg -i cuda-keyring_1.1-1_all.deb\n sudo apt-get update\n sudo apt-get install -y cuda-drivers-535\n sudo apt-get install -y cuda-toolkit-12-2\n ```\n \n Reboot the machine to apply the drivers.\n \n 3. Install `foundryup-zksync`.\n \n ```\n curl -L https://raw.githubusercontent.com/matter-labs/foundry-zksync/main/install-foundry-zksync | bash\n . ~/.bashrc\n foundryup-zksync\n ```\n \n 4. Build bellman-cuda. We used the tag version `prerelease-dev-a87a309`, commit hash `a87a309e7c07ef6b3fc5532e50d5d244aab9f4d0`.\n ```\n export CUDA_HOME=/usr/local/cuda\n export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64\n export PATH=$PATH:$CUDA_HOME/bin\n \n git clone https://github.com/matter-labs/era-bellman-cuda.git\n cd era-bellman-cuda\n git checkout prerelease-dev-a87a309\n git submodule update --init --recursive\n cmake -B./build -DCMAKE_BUILD_TYPE=Release\n cmake --build ./build\n export BELLMAN_CUDA_DIR=$HOME/era-bellman-cuda\n ```\n \n 5. Run all scripts to regenerate verification keys. The correct tag version of the repo is `core-v29.11.1`, commit hash `3f71cb2230fb9c365c095ce7bcf3373ea63fbec2`.\n ```\n cd ~ \n git clone https://github.com/matter-labs/zksync-era.git\n cd zksync-era/\n git checkout core-v29.11.1\n \n # Download compact CRS for the compressor data step, put in repo root\n curl -o setup_compact.key https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_compact.key\n export COMPACT_CRS_FILE=~/zksync-era/setup_compact.key\n \n cd prover/crates/bin/vk_setup_data_generator_server_fri\n CRS_FILE=https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_2^24.key ZKSYNC_HOME=$HOME \n \n # Run regeneration steps\n cargo run --release --bin key_generator generate-vk\n cargo run --features gpu --release --bin key_generator generate-compressor-data\n ```\n \n The output of the last command will contain the required `snark_wrapper` value.\n "
},
{
"hash": "0xc8cd705a0db89577146137de78eba6bd1f1c9c3f66dc52f7627e7c2df30895b2",
"name": "Boojum Fflonk core-v29.11.1",
"sourceLink": "https://github.com/matter-labs/zksync-era/tree/core-v29.11.1/prover",
"proofSystem": {
"id": "Zksync",
"type": "Fflonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Fflonk improvement over standard Plonk proving system."
},
"knownDeployments": [
{
"address": "eth:0xa38a0Df579F9eCA29fbA560b9885B1113b1Df442"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification requires an Ubuntu 22.04 machine with an NVIDIA GPU. We used a g6.4xlarge aws instance with 24 GiB GPU memory and 64 GiB RAM. \nThe setup part is based on [this guide](https://paragraph.com/@zksync/from-integration-to-verification-completing-the-first-steps-in-zksync-s-prover-network) with modifications, the verification is done using [this script](https://github.com/matter-labs/zksync-era/tree/main/prover/crates/bin/vk_setup_data_generator_server_fri).\n\n1. Install rust, yarn, some essential libraries, docker and cmake:\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash\nexport NVM_DIR=$HOME/.nvm\n. .bashrc\nnvm install 20\nnpm install -g yarn\nyarn set version 1.22.19\n\nsudo apt-get update\nsudo apt-get install -y build-essential pkg-config cmake clang lldb lld libssl-dev postgresql apt-transport-https ca-certificates curl software-properties-common\ncargo install sqlx-cli --version 0.8.1\n\n# install the latest version of cmake\nsudo apt remove cmake\ncurl -fsSL https://apt.kitware.com/kitware-archive.sh | sudo sh\nsudo apt-get install cmake\n```\n\n2. Install CUDA drivers and toolkit 12.2, export necessary env vars. On Ubuntu 22.04 this requires updating gcc to version 12.\n\n```\nsudo apt-get install gcc-12 g++-12\nsudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100\nsudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 100\n\nwget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb\nsudo dpkg -i cuda-keyring_1.1-1_all.deb\nsudo apt-get update\nsudo apt-get install -y cuda-drivers-535\nsudo apt-get install -y cuda-toolkit-12-2\n```\n\nReboot the machine to apply the drivers.\n\n3. Install `foundryup-zksync`.\n\n```\ncurl -L https://raw.githubusercontent.com/matter-labs/foundry-zksync/main/install-foundry-zksync | bash\n. ~/.bashrc\nfoundryup-zksync\n```\n\n4. Build bellman-cuda. We used the tag version `prerelease-dev-a87a309`, commit hash `a87a309e7c07ef6b3fc5532e50d5d244aab9f4d0`.\n```\nexport CUDA_HOME=/usr/local/cuda\nexport LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64\nexport PATH=$PATH:$CUDA_HOME/bin\n\ngit clone https://github.com/matter-labs/era-bellman-cuda.git\ncd era-bellman-cuda\ngit checkout prerelease-dev-a87a309\ngit submodule update --init --recursive\ncmake -B./build -DCMAKE_BUILD_TYPE=Release\ncmake --build ./build\nexport BELLMAN_CUDA_DIR=$HOME/era-bellman-cuda\n```\n\n5. Run all scripts to regenerate verification keys. The correct tag version of the repo is `core-v29.11.1`, commit hash `3f71cb2230fb9c365c095ce7bcf3373ea63fbec2`.\n```\ncd ~ \ngit clone https://github.com/matter-labs/zksync-era.git\ncd zksync-era/\ngit checkout core-v29.11.1\n\n# Download compact CRS for the compressor data step, put in repo root\ncurl -o setup_compact.key https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_compact.key\nexport COMPACT_CRS_FILE=~/zksync-era/setup_compact.key\n\ncd prover/crates/bin/vk_setup_data_generator_server_fri\nCRS_FILE=https://storage.googleapis.com/matterlabs-setup-keys-us/setup-keys/setup_2^24.key ZKSYNC_HOME=$HOME \n\n# Run regeneration steps\ncargo run --release --bin key_generator generate-vk\ncargo run --features gpu --release --bin key_generator generate-compressor-data\n```\n\nThe output of the last command will contain the required `fflonk_snark_wrapper` value.\n "
}
]
}+2 -1
+2 -1
{
"creator": "Espresso Systems",
"projectsForTvs": [
{
"projectId": "espresso",
"sinceTimestamp": 1730830799
}
],
"proofSystemInfo": "\n ## Description\n\n Espresso proof system implements a light client of HotShot consensus of Espresso network, i.e. it verifies that a sufficient number of Espresso nodes have correctly signed consensus message. It is implemented by a [Jellyfish Plonk](https://github.com/EspressoSystems/jellyfish) proof system on a [custom circuit](https://github.com/EspressoSystems/espresso-network/blob/2c166fe13a730733d18198d3989d3be2b4c42da8/hotshot-state-prover/src/v3/circuit.rs) that checks all necessary conditions. Jellyfish is a Rust implementation of [Plonk system](https://eprint.iacr.org/2019/953.pdf) without significant modifications. [This code](https://github.com/EspressoSystems/espresso-network/blob/2c166fe13a730733d18198d3989d3be2b4c42da8/contracts/rust/gen-vk-contract/src/main.rs) generates a Solidity verifier to check zk proofs within EVM.\n ",
"techStack": {
"snark": [
{
"id": "Jellyfish",
"type": "Plonk",
"name": "Jellyfish",
"description": "Open-source toolkit of various cryptographic primitives, including an implementation of Plonk SNARK, developed in Rust by Espresso Systems."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "CustomCircuits",
"type": "Other",
"name": "App-specific circuits",
"description": "This project uses custom app-specific ZK circuits."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Jellyfish",
"type": "Plonk",
"name": "Jellyfish",
"description": "Open-source toolkit of various cryptographic primitives, including an implementation of Plonk SNARK, developed in Rust by Espresso Systems."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0x060faa7957cb2ffdc75de8ea20d1eb50277c7fb0d2f48ecb7e2db7956d0bdad4",
"name": "Espresso verifier v3",
"sourceLink": "https://github.com/EspressoSystems/jellyfish",
"proofSystem": {
"id": "Jellyfish",
"type": "Plonk",
"name": "Jellyfish",
"description": "Open-source toolkit of various cryptographic primitives, including an implementation of Plonk SNARK, developed in Rust by Espresso Systems."
},
"knownDeployments": [
{
"address": "eth:0x098C593361d12DD638Ce7dBf34c8C6a655f8274c"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed flattened VerifyingKey structure returned by _getVk() function on the Espresso Light Client contract (0x95Ca91Cea73239b15E5D2e5A74d02d6b5E0ae458)."
}
]
}+2 -1
+2 -1
{
"creator": "INTMAX",
"projectsForTvs": [
{
"projectId": "intmax",
"sinceTimestamp": 1750888800
}
],
"proofSystemInfo": "\n \n ## Description\n\n INTMAX prover is a zk proving system for privacy-preserving INTMAX L2 based on [Plonky2](https://github.com/0xPolygonZero/plonky2/tree/main) circuits, optimized for client side proving and using not only succinctness, but also zero knowledge properties of Plonky2. INTMAX circuits are proven with a STARK which is wrapped into a Plonk SNARK before settling onchain.\n\n ## Proof system\n\n Plonky2 implements a circuit aritmetization based on TurboPlonk over Goldilocks field, but it replaces KZG polynomial commitment scheme with a FRI-based polynomial testing scheme. In this way proving Plonky2 circuits requires no trusted setup, i.e. it is a STARK. However the circuit design is different from zkVM STARKs, so INTMAX custom logic is implemented as custom circuits rather than a zkVM program.\n\n ### Circuits\n\n INTMAX prover works with [several different circuits](https://github.com/InternetMaximalism/intmax2-zkp/blob/main/README.md) that could be proven by different entities in the network (e.g. [users, validity provers, aggregators](https://docs.network.intmax.io/developers-hub/intmax-nodes/provers)). This design support local proving and enables private transactions on the L2.\n\n Available circuits are: [validity](https://github.com/InternetMaximalism/intmax2-zkp/tree/main/src/circuits/validity) for proving public state transition, [balance](https://github.com/InternetMaximalism/intmax2-zkp/tree/main/src/circuits/balance) for proving correct updates of individual user accounts based on private information, [withdrawal](https://github.com/InternetMaximalism/intmax2-zkp/tree/main/src/circuits/withdrawal) for proving the validity of withdrawing funds from L2 to the host chain, [claim](https://github.com/InternetMaximalism/intmax2-zkp/tree/main/src/circuits/claim) for proving user eligibility for privacy mining program and [proof of innocence](https://github.com/InternetMaximalism/intmax2-zkp/tree/main/src/circuits/proof_of_innocence) for proving certain claims about deposits and withdrawals.\n\n ### Recursion and final wrap\n\n INTMAX circuits are based on recursive architecture, where generating a new STARK requires validating a previous STARK proof (e.g. processing a new balance update requires validating all previous balance updates). Several entities are responsible for providing these recursive proofs: users or [balance provers](https://docs.network.intmax.io/developers-hub/intmax-nodes/provers#balance-prover) for balance updates, [validity provers](https://docs.network.intmax.io/developers-hub/intmax-nodes/validity-prover) for validity circuit, [claim](https://docs.network.intmax.io/developers-hub/intmax-nodes/claim-aggregator) and [withdrawal](https://docs.network.intmax.io/developers-hub/intmax-nodes/withdrawal-aggregator) aggregators for processing claim and withdrawal proofs.\n\n Only claim and withdrawal proofs are posted onchain to be verified, all other proofs are verified only by the nodes in INTMAX network. Onchain proofs are wrapped in a [gnark](https://github.com/Consensys/gnark) implementation of Plonk over BN254 curve, which requires a trusted setup (see [below](#trusted-setups) for more details).\n ",
"techStack": {
"snark": [
{
"id": "Plonky2",
"type": "Plonk",
"name": "Plonky2",
"description": "Toolkit for developing transparent SNARKs based on PLONK and FRI developed by Polygon Zero team."
},
{
"id": "Goldilocks",
"type": "Field",
"name": "Goldilocks",
"description": "Prime field of order p = 2**64 - 2**32 + 1."
},
{
"id": "CustomCircuits",
"type": "Other",
"name": "App-specific circuits",
"description": "This project uses custom app-specific ZK circuits."
}
],
"finalWrap": [
{
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0x664dceea25b57766a5b550cf25cca24a7305f36fd60a5835f9e0505bec14ce8e",
"name": "Intmax verifier",
"sourceLink": "https://github.com/InternetMaximalism/intmax2-zkp",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "scr:0x1d38545a33740Ab3480d9035bB3126914404423d"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
}
]
}+2 -1
+2 -1
{
"creator": "Lighter",
"projectsForTvs": [
{
"projectId": "lighter",
"sinceTimestamp": 1759356000
}
],
"proofSystemInfo": "\n## Description\n\nLighter prover is a zk proving system for Lighter L2 based on [Plonky2](https://github.com/0xPolygonZero/plonky2/tree/main) circuits. It verifies the logic for regular state transition of Lighter L2, as well as state transitions in the “desert mode” when L2 is shut down and users exit, using different sets of circuits. The circuits are proven with a STARK which is wrapped into a Plonk SNARK before settling onchain.\n\n## Proof system\n\n[Plonky2](https://github.com/0xPolygonZero/plonky2) implements a circuit aritmetization based on TurboPlonk over Goldilocks field, but it replaces KZG polynomial commitment scheme with a FRI-based polynomial testing scheme. In this way proving Plonky2 circuits requires no trusted setup, i.e. it is a STARK. \n\nHowever Lighter wraps these STARK in a [gnark](https://github.com/Consensys/gnark) implementation of Plonk over BN254 curve, which requires a trusted setup.\n\n### Lighter Circuits\n\nThe proof system operates on Lighter STF circuits and desert mode circuits. All published circuits are available [here](https://github.com/elliottech/lighter-prover/tree/main). \n\nLighter proof system defines circuits for proving all transactions, including internal, L1 and L2 transactions. The full list of available transactions that define Lighter STF can be seen [here](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/transactions). \n\nTransaction circuits use custom implementations for arithmetic operations ([bigint](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/bigint), [uint](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/uint)), cryptographic primitives ([ecdsa](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/ecdsa) on the Secp256k1 curve, [eddsa](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/eddsa) on the ECgFp5 curve, [keccak](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/keccak), [poseidon_bn128](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/poseidon_bn128)) and other helper circuits.\n\n### Desert circuits\n\nLighter also provides [desert exit circuits](https://github.com/elliottech/lighter-prover/tree/main/desertexit) that allow users to permissionlessly exit L2 when it is in the desert mode. Users can use desert circuit to generate a proof of ownership of all their positions locally, which could be submitted on L1 for withdrawing funds.\n\n### Recursion\n\nLighter prover implements recursive aggregation of transaction proofs to make the whole pipeline more efficient and parallelizable. First, fixed-size blocks of consecutive transactions are processed and proven by [BlockTx circuit](https://github.com/elliottech/lighter-prover/blob/main/circuit/src/block_tx_constraints.rs), which can be done on separate machines. Next, arbitrary number of BlockTx proofs are aggregated into a single proof by [BlockTxChain circuit](https://github.com/elliottech/lighter-prover/blob/main/circuit/src/block_tx_chain_constraints.rs), which includes continuity checks across all BlockTx proofs.\n",
"techStack": {
"snark": [
{
"id": "Plonky2",
"type": "Plonk",
"name": "Plonky2",
"description": "Toolkit for developing transparent SNARKs based on PLONK and FRI developed by Polygon Zero team."
},
{
"id": "Goldilocks",
"type": "Field",
"name": "Goldilocks",
"description": "Prime field of order p = 2**64 - 2**32 + 1."
},
{
"id": "CustomCircuits",
"type": "Other",
"name": "App-specific circuits",
"description": "This project uses custom app-specific ZK circuits."
}
],
"finalWrap": [
{
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0x16992bb868b32c1f4bd94d70267468928932f15df9b6ac22e62719f26b0eb221",
"name": "Lighter verifier",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0xAa0b5b65890162C5C96D82F088822247EC5Df5D6"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nThe verification process below is based on the `build_circuits.sh` [script](https://github.com/elliottech/lighter-prover/blob/main/build_circuits.sh) in the lighter-prover repo. It consumed around 100 GiB of memory at the peak, so we recommend rerunning it on a machine with 128 GiB of RAM.\n\nThe steps below are for Ubuntu 22.04 OS.\n\n1. Install rust, gcc, go version 1.21 and later.\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt update\nsudo apt install build-essential\n\n# one way to install latest go on Ubuntu 22.04\nwget https://go.dev/dl/go1.21.0.linux-amd64.tar.gz\nsudo tar -xvf go1.21.0.linux-amd64.tar.gz\nsudo mv go /usr/local\nexport GOROOT=/usr/local/go\nexport GOPATH=$HOME/go\nexport PATH=$GOPATH/bin:$GOROOT/bin:$PATH\nsource ~/.profile\n```\n\n2. Run the correct version of the script to regenerate the keys.\n\n```\ngit clone https://github.com/elliottech/lighter-prover.git\ncd lighter-prover\ngit checkout 90af1be311ffce17e6c58f9983fa5ec1c8d3a097\nchmod +x build_circuits.sh\n./build_circuits.sh\n```\n\nThe script will generate the `final::....sol` file that contains the verifier smart contract with the verification keys.\n",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
},
{
"hash": "0x6048c1a7d7e5439f458f927009811f3d95775d8b52775688db857cf6c70a816f",
"name": "Lighter Desert verifier",
"sourceLink": "https://github.com/elliottech/lighter-prover/tree/aec951b36ffcdb67818ff7e237209d547b4bb78f/desertexit/circuits",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x2aDBd91742B64105a097bC37D20Ebbca9a496085"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nThe verification process below is based on the `build.sh` [script](https://github.com/elliottech/lighter-prover/blob/main/desertexit/build.sh) in the lighter-prover repo. It consumed around 100 GiB of memory at the peak, so we recommend rerunning it on a machine with 128 GiB of RAM.\n\nThe steps below are for Ubuntu 22.04 OS.\n\n1. Install rust, gcc, go version 1.21 and later.\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt update\nsudo apt install build-essential\nsudo apt install jq\n\n# one way to install latest go on Ubuntu 22.04\nwget https://go.dev/dl/go1.21.0.linux-amd64.tar.gz\nsudo tar -xvf go1.21.0.linux-amd64.tar.gz\nsudo mv go /usr/local\nexport GOROOT=/usr/local/go\nexport GOPATH=$HOME/go\nexport PATH=$GOPATH/bin:$GOROOT/bin:$PATH\nsource ~/.profile\n```\n\n2. Run the correct version of the script to regenerate the keys.\n\n```\ngit clone https://github.com/elliottech/lighter-prover.git\ncd lighter-prover/desertexit\ngit checkout aec951b36ffcdb67818ff7e237209d547b4bb78f\nchmod +x build.sh\n./build.sh\n```\n\nThe script will generate the `desertwrapper::....sol` file in the `lighter-prover/desertexit/artifacts` directory that contains the verifier smart contract with the verification keys.\n ",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
}
]
}+6 -3
+6 -3
{
"creator": "Consensys",
"projectsForTvs": [
{
"projectId": "linea",
"sinceTimestamp": 1689112800
}
],
"proofSystemInfo": "\n\n## Description\n\n[Linea prover](https://github.com/Consensys/linea-monorepo/tree/main/prover) implements a zkEVM by creating a custom arithmetization of EVM state transition (including precompiles) and proving it in a series of recursive SNARKs (i.e. without implementing a zkVM). The proof is wrapped into a Plonk with KZG for efficient onchain verification. Linea prover targets 128 bits of security.\n\n## Proof system\n\nLinea prover includes Wizard-IOP framework for extending polynomial IOPs with more powerful queries, Arcane compiler of Wizard-IOP into polynomial IOP and Vortex list polynomial commitment (LPC) scheme.\n\nWizard-IOP represents an extension of polynomial IOP with a wider range of queries, including inclusion check, permutation check, range check etc. Vortex LPC is a batchable polynomial commitment that is based on [Ligero](https://eprint.iacr.org/2022/1608) with lattice-based hash functions. To achieve succinct proof size, Linea prover performs multiple rounds of self-recursion by arithmetizing the Vortex verifier in the Wizard-IOP framework.\n\n[Since April 2026](https://linea.build/blog/small-fields-faster-proving-on-linea-toward-real-time-finality), the zkEVM arithmetization is done over KoalaBear 31-bit field for performance reasons, utilizing its degree 4 extension for commitment openings. During the recursive rounds Plonk+KZG schemes over curves BW6, BLS12-377, and BN254 are used, creating a dependency on 3 trusted setups, see [below](#trusted-setups) for more details.\n\nLinea prover also introduces [limitless mode](https://github.com/Consensys/linea-monorepo/tree/main/prover/backend/execution/limitless), which segments the proving process into parallelizable jobs.\n\n### EVM circuits\n\nThis level of Linea prover produces execution proof and data availability proof after several rounds of self-recursive compression. Both of these are Plonk based proofs over KoalaBear field and BLS12-377 curve.\n\nExecution proof validates the correct execution of transactions within the EVM, including knowledge of correct EVM traces, correctness of precompiles and consistency of public inputs.\n\nData availability proof links compressed blob data, decompressed payloads, and execution-data commitments for EVM execution circuits.\n\n### Aggregation circuits\n\nAt this stage several proofs generated by execution and compression circuits are recursively verified within the aggregation circuit, which also checks the “connection” of all public inputs across all circuits. It leverages a composite proof system that combines several Plonk circuits on the BW6 and BLS12-377 curves with a goal of performant recursion.\n\n### Final wrap\n\nIn the end the Linea proof is wrapped in a [gnark](https://github.com/Consensys/gnark) implementation of Plonk over BN254 curve for even more efficiency onchain. For Plonk, Aztec Ignition trusted setup ceremony is used, see [below](#trusted-setups) for more details.\n ",
"techStack": {
"zkVM": [
{
"id": "linea",
"type": "Plonk",
"name": "Linea",
"description": "Prover system of Linea written in Go, includes Vortex polynomial commitment and Arcane compiler."
},
{
"id": "EVM",
"type": "ISA",
"name": "EVM",
"description": "Instruction language for Ethereum VM."
},
{
"id": "BLS12-377",
"type": "curve",
"name": "BLS12-377",
"description": "Pairing-friendly 377-bit prime field Weierstrass elliptic curve."
},
{
"id": "BW6-761",
"type": "curve",
"name": "BW6-761",
"description": "Pairing-friendly 761-bit prime field elliptic curve introduced by Housni and Guillevic."
},
{
"id": "KoalaBear",
"type": "Field",
"name": "Koala Bear",
"description": "Prime field of order p = 2**31 - 2**24 + 1."
}
],
"finalWrap": [
{
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
},
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "Aleo",
"risk": "yellow",
"name": "Aleo stage I trusted setup",
"participantCount": 106,
"shortDescription": "Trusted setup for KZG commitments over BLS12-377 curve, initially run as Aleo's Stage I setup. Ceremony has 106 participants and was publicly open for participation.",
"longDescription": "\n Ceremony generated trusted setup for KZG commitments over BLS12-377 curve, it was originally run as stage I setup\n for Aleo blockchain and later reused for Linea prover. Ceremony has 106 participants.\n\n - Repo with ceremony instructions [https://github.com/AleoNet/aleo-setup](https://github.com/AleoNet/aleo-setup)\n - Link to the ceremony details: [https://setup.aleo.org](https://setup.aleo.org/)\n "
"longDescription": "\nCeremony generated trusted setup for KZG commitments over BLS12-377 curve, it was originally run as stage I setup\nfor Aleo blockchain and later reused for Linea prover. Ceremony has 106 participants.\n\n- Repo with ceremony instructions [https://github.com/AleoNet/aleo-setup](https://github.com/AleoNet/aleo-setup)\n- Link to the ceremony details: [https://setup.aleo.org](https://setup.aleo.org/)\n "
},
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "CeloPlumo",
"name": "Celo Plumo",
"participantCount": 55,
"risk": "yellow",
"shortDescription": "Trusted setup for KZG commitments over BW6-761 curve, initially run for Celo Plumo. Ceremony has 55 participants and was publicly open for participation.",
"longDescription": "\n Ceremony generated trusted setup for KZG commitments over BW6-761 curve, it was originally run for Celo\n Plumo and later reused for Linea prover. Ceremony has 55 participants.\n\n - Repo with ceremony instructions: [https://github.com/celo-org/snark-setup?tab=readme-ov-file](https://github.com/celo-org/snark-setup?tab=readme-ov-file)\n - Link to the ceremony details: [https://celo.org/plumo](https://celo.org/plumo) (it is broken. Archived version here: [https://web.archive.org/web/20221201203227/https://celo.org/plumo](https://web.archive.org/web/20221201203227/https://celo.org/plumo))\n - Links to ceremony transcript: [https://console.cloud.google.com/storage/browser/plumoceremonyphase1/chunks](https://console.cloud.google.com/storage/browser/plumoceremonyphase1/chunks)\n - Link to ceremony verification code: [https://github.com/Consensys/gnark-ignition-verifier/blob/feat/celo_parser/celo/main.go](https://github.com/Consensys/gnark-ignition-verifier/blob/feat/celo_parser/celo/main.go)\n "
"longDescription": "\nCeremony generated trusted setup for KZG commitments over BW6-761 curve, it was originally run for Celo\nPlumo and later reused for Linea prover. Ceremony has 55 participants.\n\n- Repo with ceremony instructions: [https://github.com/celo-org/snark-setup?tab=readme-ov-file](https://github.com/celo-org/snark-setup?tab=readme-ov-file)\n- Link to the ceremony details: [https://celo.org/plumo](https://celo.org/plumo) (it is broken. Archived version here: [https://web.archive.org/web/20221201203227/https://celo.org/plumo](https://web.archive.org/web/20221201203227/https://celo.org/plumo))\n- Links to ceremony transcript: [https://console.cloud.google.com/storage/browser/plumoceremonyphase1/chunks](https://console.cloud.google.com/storage/browser/plumoceremonyphase1/chunks)\n- Link to ceremony verification code: [https://github.com/Consensys/gnark-ignition-verifier/blob/feat/celo_parser/celo/main.go](https://github.com/Consensys/gnark-ignition-verifier/blob/feat/celo_parser/celo/main.go)\n "
}
],
"verifierHashes": [
{
"hash": "0x29483dd4b0cd0a98968ab25795ae2363ed422fe575a20f55ac331519c3e846e1",
"name": "Linea Plonk Type 0",
"sourceLink": "https://github.com/Consensys/linea-monorepo/tree/b90a3c0b6735ba39dc19356628c09c03e42c016d/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x218C3339ff3fea595c02Ac31Ca8A782f5028C4dc"
}
],
"verificationStatus": "successful",
"verificationSteps": "\nThe regeneration process requires approximately 1 TiB of memory and approximately 400 GiB of disk space for trusted setup files and generated artifacts. It takes around 2 hours, excluding fetching 132 GiB of trusted setup assets.\nWe have verified the steps below on an Ubuntu machine.\n\n1. Install build prerequesits: `build-essential` and the latest version of go.\n2. Optionally, set up additional swap RAM. We used:\n```\nsudo apt install zram-tools\nvim /etc/default/zramswap # set algo to zstd, % to 20 and priority to 100\nsudo systemctl stop zramswap\nsudo systemctl start zramswap\n```\n3. Check out the correct version of [linea-monorepo](https://github.com/Consensys/linea-monorepo):\n```\ngit clone https://github.com/Consensys/linea-monorepo.git\ncd linea-monorepo\ngit checkout b90a3c0b6735ba39dc19356628c09c03e42c016d\n```\n4. Download trusted setup files (132 GiB) from the L2BEAT hosting server into the `prover/prover-assets/kzgsrs` dir:\n```\ncd prover/prover-assets/kzgsrs\nwget -r -np -nH --cut-dirs=1 -R \"index.html*\" https://trusted-setup-hosting.l2beat.com/files/\n```\n5. Build the circuits and the verifier contract, this step takes several hours:\n```\n# from the linea-monorepo/provers dir\nmake setup\n```\nThe build artifacts will be places into `prover/prover-assets/6.2.1/` dir, the generated verifier smart contract could be found in `prover/prover-assets/6.2.1/emulation/Verifier.sol`.\n ",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
},
{
"hash": "0xd92b8281296cbfe1963093c23f9fb7fef6f9debfa9115622ca412c32b848aa52",
"name": "Linea Plonk Type 1",
"sourceLink": "https://github.com/Consensys/linea-monorepo/tree/988bbce27b61a5e5a29913468d06d0a124dea8e4/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x0D0f070386edC441A63fB8FAe8FB937Bbd88c5Cb"
}
],
"verificationStatus": "successful",
"verificationSteps": "\nThe regeneration process requires approximately 1 TiB of memory and approximately 400 GiB of disk space for trusted setup files and generated artifacts. It takes around 2 hours, excluding fetching 132 GiB of trusted setup assets.\nWe have verified the steps below on an Ubuntu machine.\n\n1. Install build prerequesits: `build-essential` and the latest version of go.\n2. Optionally, set up additional swap RAM. We used:\n```\nsudo apt install zram-tools\nvim /etc/default/zramswap # set algo to zstd, % to 20 and priority to 100\nsudo systemctl stop zramswap\nsudo systemctl start zramswap\n```\n3. Check out the correct version of [linea-monorepo](https://github.com/Consensys/linea-monorepo):\n```\ngit clone https://github.com/Consensys/linea-monorepo.git\ncd linea-monorepo\ngit checkout 988bbce27b61a5e5a29913468d06d0a124dea8e4\n```\n4. Download trusted setup files (132 GiB) from the L2BEAT hosting server into the `prover/prover-assets/kzgsrs` dir:\n```\ncd prover/prover-assets/kzgsrs\nwget -r -np -nH --cut-dirs=1 -R \"index.html*\" https://trusted-setup-hosting.l2beat.com/files/\n```\n5. Build the circuits and the verifier contract, this step takes several hours:\n```\n# from the linea-monorepo/provers dir\nmake setup\n```\nThe build artifacts will be places into `prover/prover-assets/7.0.1/` dir, the generated verifier smart contract could be found in `prover/prover-assets/7.0.1/emulation/Verifier.sol`.\n ",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
}
]
}+2 -1
+2 -1
{
"creator": "Loopring",
"projectsForTvs": [
{
"projectId": "loopring",
"sinceTimestamp": 1582758000
}
],
"proofSystemInfo": "\n ## Proof system\n\n Loopring prover is a monolithic Groth16 SNARK proving system over BN254 curve that generates validity proofs for the state transition of Loopring L2. This system has [custom R1CS circuits](https://github.com/Loopring/protocol3-circuits.git) designed to prove the specific state transition function of the L2, including deposits and withdrawals, transfers, spot trades and curve AMM swaps, NFT operations. Loopring uses [Ethsnarks prover library](https://github.com/HarryR/ethsnarks). \n ",
"techStack": {
"snark": [
{
"id": "EthSnarks",
"type": "Groth16",
"name": "EthSnarks",
"description": "EthSnarks implementation of Groth16 proving system written in C++."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "CustomCircuits",
"type": "Other",
"name": "App-specific circuits",
"description": "This project uses custom app-specific ZK circuits."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "EthSnarks",
"type": "Groth16",
"name": "EthSnarks",
"description": "EthSnarks implementation of Groth16 proving system written in C++."
},
"id": "Loopring",
"name": "Loopring Stack",
"participantCount": 5,
"risk": "red",
"shortDescription": "Two circuit-specific trusted setups for Groth16 verifiers of two L2s built with Loopring zk rollup stack. One contains 5 contributions, another 16 contributions.",
"longDescription": "\n This entry incorporates two different trusted setups with very similar properties. Namely, these are \n circuit-specific trusted setups for Groth16 circuits over BN254 curve of DeGate and Loopring app chains \n that are built with Loopring zk tech stack. DeGate trusted setup includes 5 phase 2 (i.e. circuit-specific) \n contributions, Loopring trusted setup includes 16 phase 2 contributions. Circuit-specific phase builds on top \n of the [Perpetual Powers of Tau ceremony](https://github.com/privacy-scaling-explorations/perpetualpowersoftau).\n\n - Repo for Loopring trusted setup: [https://github.com/Loopring/trusted_setup/tree/master](https://github.com/Loopring/trusted_setup/tree/master), repo for DeGate trusted setup: [https://github.com/degatedev/trusted_setup/tree/master](https://github.com/degatedev/trusted_setup/tree/master)\n - Post for DeGate ceremony: [https://medium.com/degate/degate-completes-zk-trusted-setup-ceremony-4752301e379f](https://medium.com/degate/degate-completes-zk-trusted-setup-ceremony-4752301e379f)\n "
"longDescription": "\nThis entry incorporates two different trusted setups with very similar properties. Namely, these are \ncircuit-specific trusted setups for Groth16 circuits over BN254 curve of DeGate and Loopring app chains \nthat are built with Loopring zk tech stack. DeGate trusted setup includes 5 phase 2 (i.e. circuit-specific) \ncontributions, Loopring trusted setup includes 16 phase 2 contributions. Circuit-specific phase builds on top \nof the [Perpetual Powers of Tau ceremony](https://github.com/privacy-scaling-explorations/perpetualpowersoftau).\n\n- Repo for Loopring trusted setup: [https://github.com/Loopring/trusted_setup/tree/master](https://github.com/Loopring/trusted_setup/tree/master), repo for DeGate trusted setup: [https://github.com/degatedev/trusted_setup/tree/master](https://github.com/degatedev/trusted_setup/tree/master)\n- Post for DeGate ceremony: [https://medium.com/degate/degate-completes-zk-trusted-setup-ceremony-4752301e379f](https://medium.com/degate/degate-completes-zk-trusted-setup-ceremony-4752301e379f)\n "
}
],
"verifierHashes": [
{
"hash": "0x4c18cccb70be9bd6c438cc6d558d3451114af2fcd2e45a4286afecf2f327b80d",
"name": "Loopring verifier block size 16",
"sourceLink": "https://github.com/Loopring/protocols/tree/master/packages/loopring_v3",
"proofSystem": {
"id": "EthSnarks",
"type": "Groth16",
"name": "EthSnarks",
"description": "EthSnarks implementation of Groth16 proving system written in C++."
},
"knownDeployments": [
{
"address": "eth:0x6150343E0F43A17519c0327c41eDd9eBE88D01ef"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed vk array obtained by calling getVerificationKey(blockType = 0, blockSize = 16, blockVersion = 17) on the verifier smart contract."
},
{
"hash": "0xf29dd53bbc041a71ed0ce5812b2795151a93d233f0b3d73205eaf1e3b5ebbb18",
"name": "Loopring verifier block size 32",
"sourceLink": "https://github.com/Loopring/protocols/tree/master/packages/loopring_v3",
"proofSystem": {
"id": "EthSnarks",
"type": "Groth16",
"name": "EthSnarks",
"description": "EthSnarks implementation of Groth16 proving system written in C++."
},
"knownDeployments": [
{
"address": "eth:0x6150343E0F43A17519c0327c41eDd9eBE88D01ef"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed vk array obtained by calling getVerificationKey(blockType = 0, blockSize = 32, blockVersion = 17) on the verifier smart contract."
},
{
"hash": "0xc1b762cee5cb2d339e88e5fc7ef9b3ab62887b150929f6e3599fef289838bae0",
"name": "Loopring verifier block size 64",
"sourceLink": "https://github.com/Loopring/protocols/tree/master/packages/loopring_v3",
"proofSystem": {
"id": "EthSnarks",
"type": "Groth16",
"name": "EthSnarks",
"description": "EthSnarks implementation of Groth16 proving system written in C++."
},
"knownDeployments": [
{
"address": "eth:0x6150343E0F43A17519c0327c41eDd9eBE88D01ef"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed vk array obtained by calling getVerificationKey(blockType = 0, blockSize = 64, blockVersion = 17) on the verifier smart contract."
},
{
"hash": "0x998a7b6031386f1ce64bbbfc9375b341ee4385289c1d4f121a62f1e3c73d3efb",
"name": "Loopring verifier block size 128",
"sourceLink": "https://github.com/Loopring/protocols/tree/master/packages/loopring_v3",
"proofSystem": {
"id": "EthSnarks",
"type": "Groth16",
"name": "EthSnarks",
"description": "EthSnarks implementation of Groth16 proving system written in C++."
},
"knownDeployments": [
{
"address": "eth:0x6150343E0F43A17519c0327c41eDd9eBE88D01ef"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed vk array obtained by calling getVerificationKey(blockType = 0, blockSize = 128, blockVersion = 17) on the verifier smart contract."
},
{
"hash": "0x765eff9d78d1abfe496040f999714d58df54c49753db801633762dd48b74f9ae",
"name": "Loopring verifier block size 256",
"sourceLink": "https://github.com/Loopring/protocols/tree/master/packages/loopring_v3",
"proofSystem": {
"id": "EthSnarks",
"type": "Groth16",
"name": "EthSnarks",
"description": "EthSnarks implementation of Groth16 proving system written in C++."
},
"knownDeployments": [
{
"address": "eth:0x6150343E0F43A17519c0327c41eDd9eBE88D01ef"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed vk array obtained by calling getVerificationKey(blockType = 0, blockSize = 256, blockVersion = 17) on the verifier smart contract."
}
]
}+2 -1
+2 -1
{
"creator": "Axiom",
"projectsForTvs": [
{
"projectId": "scroll",
"sinceTimestamp": 1697493600
}
],
"proofSystemInfo": "\n \n ## Description\n\n [OpenVM](https://github.com/openvm-org/openvm?tab=readme-ov-file) is a STARK proving system based on [Plonky3 proving library](https://github.com/Plonky3/Plonky3), that has “no-CPU” design paradigm and allows adding new custom instructions to its instruction set architecture (ISA). It supports [recursive STARK aggregation](https://docs.openvm.dev/book/guest-libraries/verify-stark) and provides an [SDK](https://github.com/openvm-org/openvm-solidity-sdk) for creating Solidity verifier smart contracts. \n\n ## Proof system\n\n The proof system is split into ZK frontend, i.e. arithmetization, and ZK backend, i.e. a polynomial IOP with the Fiat-Shamir heuristic. In practice, a batched FRI-based polynomial commitment is used as the backend. OpenVM backend relies on Plonky3 prover system.\n\n OpenVM arithmetizes the execution trace using AIR with Interactions over BabyBear prime field. Interactions which include LogUp, permutation check and others.\n\n ### zkVM design\n\n OpenVM uses read-only program memory, read/write data memory as well as inputs and hints from host to enable non-deterministic computation. The execution logic is organized into a set of system chips and custom chips, without any centralized CPU-like chip. Interactions between chips are managed by program, execution and memory buses.\n\n Currently OpenVM ISA supports RISC-V instructions, keccak-256 and SHA256 hash functions, int256 arithmetic, modular arithmetic over arbitrary fields, some elliptic curve operations for the secp256k1 and secp256r1 curves and pairing operations on the BN254 and BLS12-381 curves.\n\n ### Recursion circuits\n\n OpenVM supports recursive proving and continuations, i.e. splitting a single execution trace into several rather independent ones, by recursive verification of generated STARK proofs in a specialized OpenVM program optimized for efficient proof verification (called native VM).\n\n ### Final wrap\n\nThe STARK proof is wrapped in Halo2 SNARK with KZG commitments over BN254 curve for efficient onchain processing. KZG commitment relies on Perpetual Powers of Tau trusted setup ceremony, see [below](#trusted-setups) for more details.\n",
"techStack": {
"zkVM": [
{
"id": "Plonky3",
"type": "STARK",
"name": "Plonky3",
"description": "Toolkit that implements a set of primitives for STARK-based zkVMs developed by Polygon Zero team."
},
{
"id": "OpenVM",
"type": "ISA",
"name": "OpenVM",
"description": "Extensible instruction set for OpenVM zkVM developed by Axiom."
},
{
"id": "BabyBear",
"type": "Field",
"name": "Baby Bear",
"description": "Prime field of order p = 15 * 2**27 + 1."
}
],
"finalWrap": [
{
"id": "Halo2",
"type": "Plonk",
"name": "Halo2",
"description": "Rust implementation of Halo2 SNARK proving system, originally developed for ZCash."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "KZG",
"type": "PCS",
"name": "KZG",
"description": "Polynomial commitment scheme that requires a universal trusted setup, introduced by Kate, Zaverucha and Goldberg."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Halo2",
"type": "Plonk",
"name": "Halo2",
"description": "Rust implementation of Halo2 SNARK proving system, originally developed for ZCash."
},
"id": "Halo2KZG",
"name": "Halo2 KZG over BN254",
"participantCount": 71,
"risk": "yellow",
"shortDescription": "Trusted setup for KZG commitments managed by Halo2 team on the base of the first 71 contributions to the Perpetual Powers of Tau contributions.",
"longDescription": "\n A trusted setup used for KZG commitments over BN254 curve for Halo2 SNARK proving system \n (when it is set up not in a transparent way). De-facto it is the first 71 entries in the Perpetual Powers of Tau\n ceremony that were converted to a particular format.\n\n - The main coordination point is this Halo2 KZG repo to convert pptau format into Halo2-suitable format: [https://github.com/han0110/halo2-kzg-srs?tab=readme-ov-file#perpetual-powers-of-tau](https://github.com/han0110/halo2-kzg-srs?tab=readme-ov-file#perpetual-powers-of-tau)\n - Ceremony is [Perpetual Powers of Tau](https://github.com/weijiekoh/perpetualpowersoftau): [https://github.com/scroll-tech/scroll-prover/blob/main/circuit-assets.md](https://github.com/scroll-tech/scroll-prover/blob/main/circuit-assets.md)\n "
"longDescription": "\nA trusted setup used for KZG commitments over BN254 curve for Halo2 SNARK proving system \n(when it is set up not in a transparent way). De-facto it is the first 71 entries in the Perpetual Powers of Tau\nceremony that were converted to a particular format.\n\n- The main coordination point is this Halo2 KZG repo to convert pptau format into Halo2-suitable format: [https://github.com/han0110/halo2-kzg-srs?tab=readme-ov-file#perpetual-powers-of-tau](https://github.com/han0110/halo2-kzg-srs?tab=readme-ov-file#perpetual-powers-of-tau)\n- Ceremony is [Perpetual Powers of Tau](https://github.com/weijiekoh/perpetualpowersoftau): [https://github.com/scroll-tech/scroll-prover/blob/main/circuit-assets.md](https://github.com/scroll-tech/scroll-prover/blob/main/circuit-assets.md)\n "
}
],
"verifierHashes": [
{
"hash": "0x30af8474d8e13b8ce6a96eae63293310e7c1072b890bde77f96786497a9e5f4b",
"name": "OpenVM Feynman",
"sourceLink": "https://github.com/scroll-tech/zkvm-prover/tree/v0.5.0/crates/prover",
"proofSystem": {
"id": "Halo2",
"type": "Plonk",
"name": "Halo2",
"description": "Rust implementation of Halo2 SNARK proving system, originally developed for ZCash."
},
"knownDeployments": [
{
"address": "eth:0x39854DF30b3482Ef546F68B8981Fae5A2C426eA4"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nThe verification steps are based on [this guide](https://github.com/scroll-tech/scroll-sc-tools/tree/feat/feynman?tab=readme-ov-file), with slight adjustments to resolve build failures. Memory usage peaks around 60 GiB on an ubuntu machine.\n\n1. Install dependency packages: `sudo apt-get update && sudo apt-get install build-essential pkg-config libssl-dev`.\n2. Install specifically required rust toolchain and solidity compiler:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\nrustup toolchain install nightly-2025-02-14\n\ncargo install svm-rs\nsvm install 0.8.19\nsolc --version # should be 0.8.19\n```\n3. Check out the correct version of the [scroll-sc-tools](https://github.com/scroll-tech/scroll-sc-tools) repo: `git checkout feat/feynman`. The commit hash should be `74c0bd1994171dcb69c6da82e93cf6d273f9b984`.\n4. Modify the script to download all required trusted setup params: line 8 of `scripts/download-params.sh` should be changed to `degrees=(\"22\" \"24\")`.\n5. Download trusted setup params (around 3 GiB): `bash scripts/download-params.sh`.\n6. Generate the verifier file and output its code hash: `RUST_MIN_STACK=16777216 cargo run --release -- generate-verifier`.\n7. Verify that the deployed verifier smart contract has the same codehash: `cast keccak $(cast code 0x39854DF30b3482Ef546F68B8981Fae5A2C426eA4 --rpc-url )`.\n ",
"description": "Custom verifier ID: solidity codehash of the verifier smart contract, i.e. keccak256 of the EVM bytecode."
},
{
"hash": "0xf86ce35d4f5b1478f21194d9c6fc825f8d8afc0468425c981dc017149f0cac5e",
"name": "OpenVM Galileo",
"sourceLink": "https://github.com/scroll-tech/zkvm-prover/tree/v0.7.0/crates/prover",
"proofSystem": {
"id": "Halo2",
"type": "Plonk",
"name": "Halo2",
"description": "Rust implementation of Halo2 SNARK proving system, originally developed for ZCash."
},
"knownDeployments": [
{
"address": "eth:0x749fC77A1a131632a8b88e8703E489557660C75e"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"description": "Custom verifier ID: solidity codehash of the verifier smart contract, i.e. keccak256 of the EVM bytecode.",
"verificationSteps": "\nThe verification steps are based on [this guide](https://github.com/scroll-tech/scroll-sc-tools/tree/feat/galileo?tab=readme-ov-file), with slight adjustments to resolve build failures. Memory usage peaks around 50 GiB on an ubuntu machine.\n\n1. Install dependency packages: `sudo apt-get update && sudo apt-get install build-essential pkg-config libssl-dev`.\n2. Install specifically required rust toolchain and solidity compiler:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\nrustup toolchain install nightly-2025-02-14\n\ncargo install svm-rs\nsvm install 0.8.19\nsolc --version # should be 0.8.19\n```\n3. Check out the correct version of the [scroll-sc-tools](https://github.com/scroll-tech/scroll-sc-tools) repo: `git checkout feat/galileo`. The commit hash should be `f880a705954dc205cae7e1add474bd9e6cad1610`.\n4. Modify the script to download all required trusted setup params: line 8 of `scripts/download-params.sh` should be changed to `degrees=(\"22\" \"23\" \"24\")`.\n5. Download trusted setup params (around 4 GiB): `bash scripts/download-params.sh`.\n6. Generate the verifier file and output its code hash: `RUST_MIN_STACK=16777216 cargo run --release -- generate-verifier --recompute`. If this step produces a build failure because of `SOLC_VERSION_0_8_31_CHECKSUM` duplication, open the problematic `builds.rs` file and remove all occurances of the duplicate (second version of `SOLC_VERSION_0_8_31_CHECKSUM`). This requires altering several lines, including changing the hardcoded length of `ALL_SOLC_VERSIONS` array. Rerun the command after altering the file.\n7. Verify that the deployed verifier smart contract has the same codehash: `cast keccak $(cast code 0x749fC77A1a131632a8b88e8703E489557660C75e --rpc-url )`.\n "
}
]
}+4 -4
+4 -4
{
"attributes": [
{
"id": "immutable",
"label": "Immutable",
"description": "Core smart contract code cannot be changed."
},
{
"id": "enforcedCompliance",
"label": "Enforced compliance",
"description": "Centralised ASPs (association set providers) can refuse deposits before they are withdrawn and forcibly remove them from the anonymity set."
},
{
"id": "anyAmount",
"label": "Any amount",
"description": "Deposits and withdrawals can have any size."
},
{
"id": "sourceAvailable",
"label": "Source available",
"description": "There is at least one practical way to exclusively use auditable, source-available software to interact with this protocol."
}
],
"riskSummary": "## Funds can be stolen if\n1. the zk proof system is broken, allowing invalid withdrawals.\n2. the [trusted setup](#trusted-setups) is compromised or all ceremony participants collude, allowing invalid withdrawals.\n3. the Entrypoint owner deploys a malicious [upgrade](#upgrades-and-governance) that steals new deposits.\n
\n## Funds can be lost if\n1. a user loses the secret and nullifier required to spend their deposit.\n
\n## Privacy can be lost if\n1. no relayer is available and the withdrawal must be submitted from an address that can be linked to the user.\n2. the ASP manager refuses to whitelist a deposit, forcing the user to either wait or exit publicly through ragequit.",
"tokens": [
{
"token": {
"address": "0x6440f144b7e50D6a8439336510312d2F54beB01D",
"iconUrl": "https://coin-images.coingecko.com/coins/images/56069/large/BOLD_logo.png?1748265087",
"symbol": "BOLD",
"decimals": 18,
"priceId": "liquity-bold-2",
"sinceTimestamp": 1770806867
},
"buckets": [
{
"id": "privacy-pools-BOLD",
"type": "pool",
"label": "BOLD pool",
"address": "eth:0xb4b5Fd38Fd4788071d7287e3cB52948e0d10b23E",
"sinceTimestamp": 1770806867,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
"iconUrl": "https://assets.coingecko.com/coins/images/9956/large/Badge_Dai.png?1696509996",
"symbol": "DAI",
"decimals": 18,
"priceId": "dai",
"sinceTimestamp": 1752848471
},
"buckets": [
{
"id": "privacy-pools-DAI",
"type": "pool",
"label": "DAI pool",
"address": "eth:0x1c31C03B8CB2EE674D0F11De77135536db828257",
"sinceTimestamp": 1752848471,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE",
"iconUrl": "https://assets.coingecko.com/coins/images/279/large/ethereum.png?1595348880",
"symbol": "ETH",
"decimals": 18,
"priceId": "ethereum",
"sinceTimestamp": 1743265259
},
"buckets": [
{
"id": "privacy-pools-ETH",
"type": "pool",
"label": "ETH pool",
"address": "eth:0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
"sinceTimestamp": 1743265259,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0xCAcd6fd266aF91b8AeD52aCCc382b4e165586E29",
"iconUrl": "https://coin-images.coingecko.com/coins/images/53963/large/frxUSD.png?1737792154",
"symbol": "frxUSD",
"decimals": 18,
"priceId": "frax-usd",
"sinceTimestamp": 1754583623
},
"buckets": [
{
"id": "privacy-pools-frxUSD",
"type": "pool",
"label": "frxUSD pool",
"address": "eth:0xC6C769fac7AABEadd31a03fAe5Ca0Ec5B4C50f84",
"sinceTimestamp": 1754583623,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0x085780639CC2cACd35E474e71f4d000e2405d8f6",
"iconUrl": "https://coin-images.coingecko.com/coins/images/36202/large/fxUSD.jpg?1710833113",
"symbol": "fxUSD",
"decimals": 18,
"priceId": "f-x-protocol-fxusd",
"sinceTimestamp": 1765446455
},
"buckets": [
{
"id": "privacy-pools-fxUSD",
"type": "pool",
"label": "fxUSD pool",
"address": "eth:0xD14F4B36E1D1D98c218db782c49149876042BC56",
"sinceTimestamp": 1765446455,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD",
"iconUrl": "https://coin-images.coingecko.com/coins/images/52721/large/sUSDS_Coin.png?1734086971",
"symbol": "sUSDS",
"decimals": 18,
"priceId": "susds",
"sinceTimestamp": 1752782999
},
"buckets": [
{
"id": "privacy-pools-sUSDS",
"type": "pool",
"label": "sUSDS pool",
"address": "eth:0xBBdA2173CDFEA1c3bD7F2908798F1265301d750c",
"sinceTimestamp": 1752782999,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d",
"iconUrl": "https://coin-images.coingecko.com/coins/images/54977/large/USD1_1000x1000_transparent.png?1749297002",
"symbol": "USD1",
"decimals": 18,
"priceId": "usd1-wlfi",
"sinceTimestamp": 1754583179
},
"buckets": [
{
"id": "privacy-pools-USD1",
"type": "pool",
"label": "USD1 pool",
"address": "eth:0xc0A8Bc0F4F982b4d4f1fFae8F4FCCb58c9B29c98",
"sinceTimestamp": 1754583179,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
"iconUrl": "https://assets.coingecko.com/coins/images/6319/large/usdc.png?1696506694",
"symbol": "USDC",
"decimals": 6,
"priceId": "usd-coin",
"sinceTimestamp": 1753353035
},
"buckets": [
{
"id": "privacy-pools-USDC",
"type": "pool",
"label": "USDC pool",
"address": "eth:0xb419c2867aB3CBc78921660cB95150d95A94ce86",
"sinceTimestamp": 1753353035,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0x4c9EDD5852cd905f086C759E8383e09bff1E68B3",
"iconUrl": "https://assets.coingecko.com/coins/images/33613/large/3466ef_3c088c66c7d941e8856339d0bddf33cc_mv2.png?1702514458",
"symbol": "USDe",
"decimals": 18,
"priceId": "ethena-usde",
"sinceTimestamp": 1754583083
},
"buckets": [
{
"id": "privacy-pools-USDe",
"type": "pool",
"label": "USDe pool",
"address": "eth:0xe6D36B33b00A7C0cB0C2a8d39D07e7dB0c526Abc",
"sinceTimestamp": 1754583083,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0xdC035D45d973E3EC169d2276DDab16f1e407384F",
"iconUrl": "https://coin-images.coingecko.com/coins/images/39926/large/usds.webp?1726666683",
"symbol": "USDS",
"decimals": 18,
"priceId": "usds",
"sinceTimestamp": 1752503003
},
"buckets": [
{
"id": "privacy-pools-USDS",
"type": "pool",
"label": "USDS pool",
"address": "eth:0x05e4DBD71B56861eeD2Aaa12d00A797F04B5D3c0",
"sinceTimestamp": 1752503003,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7",
"iconUrl": "https://assets.coingecko.com/coins/images/325/large/Tether.png?1696501661",
"symbol": "USDT",
"decimals": 6,
"priceId": "tether",
"sinceTimestamp": 1753352915
},
"buckets": [
{
"id": "privacy-pools-USDT",
"type": "pool",
"label": "USDT pool",
"address": "eth:0xe859C0bD25f260BaEE534Fb52e307D3b64D24572",
"sinceTimestamp": 1753352915,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599",
"iconUrl": "https://assets.coingecko.com/coins/images/7598/large/wrapped_bitcoin_wbtc.png?1696507857",
"symbol": "WBTC",
"decimals": 8,
"priceId": "wrapped-bitcoin",
"sinceTimestamp": 1753975703
},
"buckets": [
{
"id": "privacy-pools-WBTC",
"type": "pool",
"label": "WBTC pool",
"address": "eth:0xF973f4B180A568157Cd7A0E6006449139E6Bfc32",
"sinceTimestamp": 1753975703,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0xDcEe70654261AF21C44c093C300eD3Bb97b78192",
"iconUrl": "https://coin-images.coingecko.com/coins/images/29734/large/woeth-200x200.png?1714796686",
"symbol": "wOETH",
"decimals": 18,
"priceId": "wrapped-oeth",
"sinceTimestamp": 1756377743
},
"buckets": [
{
"id": "privacy-pools-wOETH",
"type": "pool",
"label": "wOETH pool",
"address": "eth:0x7d2959bCFb936a84531518e8391DdBa844e03ebE",
"sinceTimestamp": 1756377743,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
},
{
"token": {
"address": "0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0",
"iconUrl": "https://assets.coingecko.com/coins/images/18834/large/wstETH.png?1696518295",
"symbol": "wstETH",
"decimals": 18,
"priceId": "wrapped-steth",
"sinceTimestamp": 1753975583
},
"buckets": [
{
"id": "privacy-pools-wstETH",
"type": "pool",
"label": "wstETH pool",
"address": "eth:0x1A604E9DFa0EFDC7FFda378AF16Cb81243b61633",
"sinceTimestamp": 1753975583,
"deposit": {
"event": "0xe3b53cd1a44fbf11535e145d80b8ef1ed6d57a73bf5daa7e939b6b01657d6549",
"extractor": "privacyPoolsValue",
"params": {}
},
"withdrawal": {
"event": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
"extractor": "privacyPoolsValue",
"params": {}
}
}
]
}
],
"trustedSetup": {
"id": "PrivacyPools",
"name": "Privacy Pools",
"risk": "green",
"participantCount": 513,
"shortDescription": "Trusted setup for two Groth16 Privacy Pools circuits, with 514 and 513 participants.",
"longDescription": "\n Trusted setup for two Groth16 Privacy Pools circuits: the Exit circuit and the Private Withdrawal circuit.\n The ceremony was publicly announced, open to anonymous and identified participants, and concluded in March 2025.\n The finalized zKeys were published for independent verification, and the ceremony code and UI were open-sourced.\n\n - Ceremony completion announcement: [https://0xbow.io/blog/celebrating-the-conclusion-of-the-trusted-setup-ceremony](https://0xbow.io/blog/celebrating-the-conclusion-of-the-trusted-setup-ceremony)\n - Ceremony page with finalized zKeys: [https://ceremony.pse.dev/projects/Privacy%20Pools%20Ceremony](https://ceremony.pse.dev/projects/Privacy%20Pools%20Ceremony)\n - Initial ceremony announcement: [https://0xbow.io/blog/privacy-pools-trusted-setup-ceremony-join-us-in-strengthening-privacy](https://0xbow.io/blog/privacy-pools-trusted-setup-ceremony-join-us-in-strengthening-privacy)\n - Privacy Pools repository: [https://github.com/0xbow-io/privacy-pools-core](https://github.com/0xbow-io/privacy-pools-core)\n "
"risk": "yellow",
"participantCount": 55,
"shortDescription": "Trusted setup for two Groth16 Privacy Pools circuits. It was built on top of 55 phase 1 contributions, with 513 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.",
"longDescription": "\nTrusted setup for two Groth16 Privacy Pools circuits: the Ragequit circuit and the private Withdrawal circuit.\n\nThis trusted setup ceremony [builds on top of Polygon zkEVM ceremony](https://github.com/0xbow-io/privacy-pools-core/blob/a80836a47451e662f127af17e11430ffa976c234/packages/circuits/package.json#L19-L21) as phase 1, which contains 55 participants.\n\nPhase 2 of the ceremony was publicly announced, open to anonymous and identified participants, and concluded in March 2025. It contains 514 contributions to the Withdraw circuit and 513 participants to the Ragequit circuit.\nThe finalized zKeys were published for independent verification, and the ceremony code and UI were open-sourced.\n\n- Phase 1 ceremony: .\n- Ceremony completion announcement: [https://0xbow.io/blog/celebrating-the-conclusion-of-the-trusted-setup-ceremony](https://0xbow.io/blog/celebrating-the-conclusion-of-the-trusted-setup-ceremony)\n- Ceremony page with finalized zKeys: [https://ceremony.pse.dev/projects/Privacy%20Pools%20Ceremony](https://ceremony.pse.dev/projects/Privacy%20Pools%20Ceremony)\n- Initial ceremony announcement: [https://0xbow.io/blog/privacy-pools-trusted-setup-ceremony-join-us-in-strengthening-privacy](https://0xbow.io/blog/privacy-pools-trusted-setup-ceremony-join-us-in-strengthening-privacy)\n- Privacy Pools repository: [https://github.com/0xbow-io/privacy-pools-core](https://github.com/0xbow-io/privacy-pools-core)\n "
},
"upgradesAndGovernance": "The 2/4 Privacy Pools Multisig can instantly change the system’s critical configs, including the Entrypoint implementation and ASP root used for private withdrawals. The ASP postman (EOA) can also remove any deposit from the whitelist at any time, forcing a public rage-quit if the affected party wishes to withdraw. The guaranteed immutable escape hatch is pool-level ragequit (public withdrawal) to the original depositor address, because that logic lives in the immutable pool contracts and does not depend on the Entrypoint registry and config. This means the system is permissioned in its deposit logic and deposit privacy, but non-custodial for deposited assets. Past, successful (non-ragequit) withdrawals can not be deanonymized by the protocol."
}+4 -4
+4 -4
{
"attributes": [
{
"id": "upgradeable",
"label": "Upgradeable",
"description": "DAO can vote on upgrades that are executable with a 7d delay."
},
{
"id": "optCompliance",
"label": "Opt compliance",
"description": "Optional 'proofs of innocence' (POIs), can disassociate a deposit from a list of flagged addresses. They are not enforced by the protocol but can be enforced by relayers."
},
{
"id": "transfers",
"label": "Transfers",
"description": "Private transfers within the shielded pool."
},
{
"id": "defi",
"label": "DeFi",
"description": "Interop with DeFi (swaps, vaults) from within the shielded pool."
},
{
"id": "anyAmount",
"label": "Any amount",
"description": "Deposits and withdrawals can have any size."
},
{
"id": "sourceAvailable",
"label": "Source available",
"description": "There is at least one practical way to exclusively use auditable, source-available software to interact with this protocol."
}
],
"riskSummary": "## Funds can be stolen if\n1. the zk proof system is broken, allowing invalid spends or withdrawals.\n2. the [trusted setup](#trusted-setups) is compromised or all ceremony participants collude, allowing invalid spends or withdrawals.\n3. the DAO passes a malicious [upgrade](#upgrades-and-governance) and users do not react before the 7-day execution delay expires.\n
\n## Funds can be lost if\n1. a user loses the private keys required to control their private balance.\n
\n## Privacy can be lost if\n1. no broadcaster is available and transactions must be sent from a public address that can be linked to the user.",
"tokens": [
{
"token": {
"address": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
"iconUrl": "https://assets.coingecko.com/coins/images/2518/large/weth.png?1696503332",
"symbol": "WETH",
"decimals": 18,
"priceId": "weth",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-WETH",
"type": "pool",
"label": "WETH",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
}
}
}
]
},
{
"token": {
"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7",
"iconUrl": "https://assets.coingecko.com/coins/images/325/large/Tether.png?1696501661",
"symbol": "USDT",
"decimals": 6,
"priceId": "tether",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-USDT",
"type": "pool",
"label": "USDT",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xdAC17F958D2ee523a2206206994597C13D831ec7"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xdAC17F958D2ee523a2206206994597C13D831ec7"
}
}
}
]
},
{
"token": {
"address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
"iconUrl": "https://assets.coingecko.com/coins/images/6319/large/usdc.png?1696506694",
"symbol": "USDC",
"decimals": 6,
"priceId": "usd-coin",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-USDC",
"type": "pool",
"label": "USDC",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
}
}
}
]
},
{
"token": {
"address": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
"iconUrl": "https://assets.coingecko.com/coins/images/9956/large/Badge_Dai.png?1696509996",
"symbol": "DAI",
"decimals": 18,
"priceId": "dai",
"sinceTimestamp": 1574121600
},
"buckets": [
{
"id": "railgun-DAI",
"type": "pool",
"label": "DAI",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x6B175474E89094C44Da98b954EedeAC495271d0F"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x6B175474E89094C44Da98b954EedeAC495271d0F"
}
}
}
]
},
{
"token": {
"address": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599",
"iconUrl": "https://assets.coingecko.com/coins/images/7598/large/wrapped_bitcoin_wbtc.png?1696507857",
"symbol": "WBTC",
"decimals": 8,
"priceId": "wrapped-bitcoin",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-WBTC",
"type": "pool",
"label": "WBTC",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599"
}
}
}
]
},
{
"token": {
"address": "0x85F17Cf997934a597031b2E18a9aB6ebD4B9f6a4",
"iconUrl": "https://coin-images.coingecko.com/coins/images/71681/large/near.png?1768905174",
"symbol": "NEAR",
"decimals": 24,
"priceId": "rainbow-bridged-near-ethereum",
"sinceTimestamp": 1768867200
},
"buckets": [
{
"id": "railgun-NEAR",
"type": "pool",
"label": "NEAR",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1768867200,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x85F17Cf997934a597031b2E18a9aB6ebD4B9f6a4"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x85F17Cf997934a597031b2E18a9aB6ebD4B9f6a4"
}
}
}
]
},
{
"token": {
"address": "0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb",
"iconUrl": "https://coin-images.coingecko.com/coins/images/14688/large/Logo_1_%28brighter%29.png?1734430693",
"symbol": "FLUID",
"decimals": 18,
"priceId": "instadapp",
"sinceTimestamp": 1623801600
},
"buckets": [
{
"id": "railgun-FLUID",
"type": "pool",
"label": "FLUID",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb"
}
}
}
]
},
{
"token": {
"address": "0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D",
"iconUrl": "https://coin-images.coingecko.com/coins/images/16840/large/railgun.jpeg?1696516407",
"symbol": "RAIL",
"decimals": 18,
"priceId": "railgun",
"sinceTimestamp": 1625270400
},
"buckets": [
{
"id": "railgun-RAIL",
"type": "pool",
"label": "RAIL",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D"
}
}
}
]
}
],
"trustedSetup": {
"id": "Railgun",
"name": "Railgun",
"risk": "green",
"participantCount": 304,
"shortDescription": "Circuit-specific trusted setup for 54 Groth16 Railgun circuits over BN254, publicly announced and completed in December 2022 with 328 named contributors (304 contributions on the 1x1 circuit).",
"longDescription": "\n Circuit-specific Phase 2 trusted setup for Railgun's 54 Groth16 circuits (parameterised by\n transaction input/output counts) over the BN254 curve. It builds on the\n [Perpetual Powers of Tau ceremony](https://github.com/privacy-scaling-explorations/perpetualpowersoftau)\n as Phase 1 and was run as a separate Phase 2 per circuit. The ceremony was publicly announced,\n open to anonymous and identified participants, and wrapped up in late December 2022.\n\n Verified against the ceremony artifact IPFS hash\n `QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne`: the\n `/contributors` directory contains 328 sequentially-numbered attestation files with\n GitHub or Twitter handles, and the `/zkeys` directory contains 54 final zkey files (one\n per circuit). Parsing the final zkey binary for the 1x1 circuit shows 304 Phase 2\n contributions on that circuit.\n\n - Ceremony artifacts on IPFS: [https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne](https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne)\n - Ceremony announcement: [https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312](https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312)\n - Advanced Circuit ceremony user guide: [https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242](https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242)\n - Docs overview of the trusted setup: [https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony](https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony)\n - Railgun circuits repository with ceremony scripts: [https://github.com/Railgun-Privacy/circuits-v2](https://github.com/Railgun-Privacy/circuits-v2)\n "
"risk": "yellow",
"participantCount": 55,
"shortDescription": "Circuit-specific trusted setup for 54 Groth16 Railgun circuits over BN254. It was built on top of 55 phase 1 contributions, with 304 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.",
"longDescription": "\nCircuit-specific Phase 2 trusted setup for Railgun's 54 Groth16 circuits (parameterised by\ntransaction input/output counts) over the BN254 curve. It [builds on the\nPolygon zkEVM ceremony](https://github.com/Railgun-Privacy/circuits-v2/blob/d0ec02dea0cbc8cd02a3b727b28de16e51f9a741/prepare_for_ceremony.sh#L13) as phase 1, which contains 55 participants.\n\nA separate Phase 2 ceremony was publicly announced,\nopen to anonymous and identified participants, and wrapped up in late December 2022.\n\nVerified against the ceremony artifact IPFS hash\n`QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne`: the\n`/contributors` directory contains 328 sequentially-numbered attestation files with\nGitHub or Twitter handles, and the `/zkeys` directory contains 54 final zkey files (one\nper circuit). Parsing the final zkey binary for the 1x1 circuit shows 304 Phase 2\ncontributions on that circuit.\n\n- Phase 1 ceremony: .\n- Ceremony artifacts on IPFS: [https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne](https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne)\n- Ceremony announcement: [https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312](https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312)\n- Advanced Circuit ceremony user guide: [https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242](https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242)\n- Docs overview of the trusted setup: [https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony](https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony)\n- Railgun circuits repository with ceremony scripts: [https://github.com/Railgun-Privacy/circuits-v2](https://github.com/Railgun-Privacy/circuits-v2)\n "
},
"upgradesAndGovernance": "Railgun features an omnipotent DAO governed by the stakers of the RAIL token. The DAO has the authority to change ZK circuit logic on the core Railgun contract, which can arbitrarily change the rules for shielded tokens; as well as manage blacklisted tokens, mint RAIL tokens and manage governance rewards. See docs here: \n\n## Governance flow\n\n1. Users stake RAIL token in the Staking contract ([0xEE6A649Aa3766bD117e12C161726b693A1B2Ee20](https://etherscan.io/address/0xEE6A649Aa3766bD117e12C161726b693A1B2Ee20)). Voting power is proportional to the staked amount and can be delegated to another address. Unstaking has 1mo delay.\n2. Anyone can create a new proposal with an IPFS link and onchain calldata on the Voting contract ([0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC](https://etherscan.io/address/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC)). It enters a Sponsorship stage of 1mo, where it has to be supported by 500 K RAIL stake.\n3. After a 2d delay, the actual voting starts. \"Yay\" votes need to be cast within 5d, \"Nay\" have 6d. Proposal needs to reach the quorum of 2.00 M RAIL.\n4. A passed proposal (simple majority) waits for 7d before execution and then must be executed within 14d by anyone. Execution goes via the Delegator smart contract ([0xB6d513f6222Ee92Fff975E901bd792E2513fB53B](https://etherscan.io/address/0xB6d513f6222Ee92Fff975E901bd792E2513fB53B)), which actually has permissions to modify the Railgun protocol values."
}+4 -3
+4 -3
{
"creator": "RISC Zero",
"projectsForTvs": [
{
"projectId": "taiko",
"sinceTimestamp": 1730452800
},
{
"projectId": "bob",
"sinceTimestamp": 1752703200
},
{
"projectId": "megaeth",
"sinceTimestamp": 1763954183
},
{
"projectId": "soon",
"sinceTimestamp": 1765180787
},
{
"projectId": "base",
"sinceTimestamp": 1779825599
},
{
"projectId": "roninnetwork",
"sinceTimestamp": 1780557929
}
],
"proofSystemInfo": "\n \n ## Description\n\n RISC Zero is the first zkVM proving RISC-V ISA programs. Its STARK proving system is based on a rather standard theoretical construction of [Ben-Sasson et al paper](https://eprint.iacr.org/2018/046) and [DEEP-ALI version of FRI](https://eprint.iacr.org/2019/336). The proof of zkVM execution is wrapped in Groth16 SNARK for efficient onchain verification. RISC Zero onchain verifier targets [96 bits of security](https://dev.risczero.com/api/security-model#cryptographic-security).\n\n ## Proof system\n\n ### RISC-V circuit\n\n RISC Zero implements a [circuit that proves RISC-V RV32IM instruction set](https://github.com/risc0/risc0/tree/main/risc0/circuit/rv32im) (see [here](https://dev.risczero.com/api/zkvm/zkvm-specification#the-zkvm-execution-model) for more details). Arithmetization of this circuit has different types of columns: control, data and accumulator. Control columns contain public data that describes the RISC-V program being executed and proven. Data and accumulator columns contain private data (accessible only to prover), data represents the running state of the processor and memory and accumulator is auxiliary data for the PLOOKUP argument.\n\n ### Recursion circuit\n\n RISC Zero prover supports recursive proving of RISC-V programs using [recursion circuit](https://github.com/risc0/risc0/tree/main/risc0/circuit/recursion). This is a separate STARK circuit that is designed to efficiently generate proofs for the verification of STARK proofs, it uses the same proving system as the RISC-V circuit.\n\n Big programs are split into several segments that are executed and proven in parallel. Segment receipts (i.e. proofs of correct execution) are verified with recursion circuits and succinct receipts are produced. These succinct receipts could be recursively joined in pairs of two until a single succinct proof of the whole execution is produced. \n\n ### Final wrap\n\n RISC Zero [implements a SNARK wrapping](https://github.com/risc0/risc0/tree/main/risc0/groth16) of a recursive succinct receipt into a Groth16 proof over BN254 curve for onchain verification. This Groth16 R1CS circuit uses a circuit-specific trusted setup, the ceremony was run by RISC Zero, see [below](#trusted-setups) for more details. \n\n The final wrap circuit has a [control root](https://dev.risczero.com/terminology#control-root) public input that depends on the RISC-V and recursion circuit versions. This design allows upgrading RISC Zero proving system without changing the final wrapper and thus without running a new trusted setup ceremony.\n ",
"techStack": {
"zkVM": [
{
"id": "RISC0",
"type": "STARK",
"name": "Risc0",
"description": "zkVM STARK proving system developed by RISC ZERO for RISC-V programs."
},
{
"id": "RISCV32",
"type": "ISA",
"name": "RISC-V 32bit",
"description": "Free and open-source universal 32-bit ISA used across a variety of hardware and software."
},
{
"id": "BabyBear",
"type": "Field",
"name": "Baby Bear",
"description": "Prime field of order p = 15 * 2**27 + 1."
}
],
"finalWrap": [
{
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"id": "Risc0",
"name": "Risc0 Groth16",
"risk": "green",
"shortDescription": "Circuit-specific trusted setup for Risc0 final wrap Groth16 onchain verifier. It was publicly announced and run with 238 participants.",
"longDescription": "\n Ceremony for a circuit-specific trusted setup run by Risc0 for Groth16 circuits verifying Risc0 STARK proof. \n It was publicly announced and run with 238 participants. Ceremony transcript, as well as instructions for participation and verification \n are publicly available.\n\n - Ceremony instructions: [https://risczero.com/blog/ceremony-contribution-public-instructions](https://risczero.com/blog/ceremony-contribution-public-instructions)\n - Link to the verification: [https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit](https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit)\n - Post with a call to community to participate: [https://x.com/RiscZero/status/1781110200923275769](https://x.com/RiscZero/status/1781110200923275769)\n "
"participantCount": 55,
"risk": "yellow",
"shortDescription": "Circuit-specific trusted setup for Risc0 final wrap Groth16 onchain verifier. It was built on top of 55 phase 1 contributions, and reached 238 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.",
"longDescription": "\nCeremony for a circuit-specific trusted setup run by Risc0 for Groth16 circuits verifying Risc0 STARK proof.\n\nRisc0 Groth16 builds on top of Polygon zkEVM ceremony as phase 1. It contains 55 participants.\n\nPhase 2 of the trusted setup was publicly announced and run with 238 participants. Ceremony transcript, as well as instructions for participation and verification \nare publicly available.\n\n- Phase 1 ceremony: .\n- Ceremony instructions: [https://risczero.com/blog/ceremony-contribution-public-instructions](https://risczero.com/blog/ceremony-contribution-public-instructions)\n- Link to the verification: [https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit](https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit)\n- Post with a call to community to participate: [https://x.com/RiscZero/status/1781110200923275769](https://x.com/RiscZero/status/1781110200923275769)\n "
}
],
"verifierHashes": [
{
"hash": "0xa42b7a9c647b7bea4f92660bfd9cd3c5afc91b4c40773f9fb410eb55c8402e40",
"name": "RiscZero v2.2.0",
"sourceLink": "https://github.com/risc0/risc0/tree/v2.2.0",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0xafB31f5b70623CDF4b20Ada3f7230916A5A79df9",
"overrideUsedIn": [
"taiko",
"bob",
"megaeth",
"soon"
]
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.\n\nTo regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.\n\n1. Install npm, rust, git-lfs:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt install npm git-lfs\n```\n\n2. Install snarkjs and circom v2.1.0 (from sources):\n```\nnpm install -g snarkjs\n\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.0\ncargo build --release\ncargo install --path circom\nexport PATH=\"$HOME/.cargo/bin:$PATH\"\n```\n\n3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:\n```\ngit clone https://github.com/risc0/risc0.git\ncd risc0\ngit checkout v2.0.0 # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38\ngit lfs install\ngit lfs pull --include=groth16_proof/groth16/stark_verify.circom\ncd groth16_proof/groth16\ncircom stark_verify.circom --r1cs\n\n# check that the circuit is correct:\nshasum -a 256 stark_verify.r1cs # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178\n```\n\n4. Download phase 1 and phase 2 trusted setup files, verify their correctness:\n```\nwget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau\nwget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey\n\nexport NODE_OPTIONS=\"--max-old-space-size=32768\" # without this snarkjs runs out of mem\nsnarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey\n```\n\n5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.\n\n6. Check out to the `v2.2.0` tag of risc0 repo: `git checkout v2.2.0`, commit hash should be `eff3c74bf9992401c2c68bea95eb6c93b27999ec`. \nFrom the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`. \nIt will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0xce52bf56033842021af3cf6db8a50d1b7535c125a34f1a22c6fdcf002c5a1529` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values."
},
{
"hash": "0x10ab33bc472e3e9024d89e512d33781519ba9b1621e4fe0ffd80cd20523062a8",
"name": "RiscZero v3.0.0",
"sourceLink": "https://github.com/risc0/risc0/tree/v3.0.0",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0x2a098988600d87650Fb061FfAff08B97149Fa84D",
"overrideUsedIn": [
"bob",
"taiko"
]
},
{
"address": "eth:0x411e56a890c5fe0712f6F345977815Ba8E7785C3"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.\n\nTo regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.\n\n1. Install npm, rust, git-lfs:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt install npm git-lfs\n```\n\n2. Install snarkjs and circom v2.1.0 (from sources):\n```\nnpm install -g snarkjs\n\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.0\ncargo build --release\ncargo install --path circom\nexport PATH=\"$HOME/.cargo/bin:$PATH\"\n```\n\n3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:\n```\ngit clone https://github.com/risc0/risc0.git\ncd risc0\ngit checkout v2.0.0 # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38\ngit lfs install\ngit lfs pull --include=groth16_proof/groth16/stark_verify.circom\ncd groth16_proof/groth16\ncircom stark_verify.circom --r1cs\n\n# check that the circuit is correct:\nshasum -a 256 stark_verify.r1cs # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178\n```\n\n4. Download phase 1 and phase 2 trusted setup files, verify their correctness:\n```\nwget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau\nwget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey\n\nexport NODE_OPTIONS=\"--max-old-space-size=32768\" # without this snarkjs runs out of mem\nsnarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey\n```\n\n5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.\n\n6. Check out to the `v3.0.0` tag of risc0 repo: `git checkout v3.0.0`, commit hash should be `96eef1c3c9c6dde65dcc2fc86791a4358fcc8e4d`. \nFrom the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`. \nIt will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0xa54dc85ac99f851c92d7c96d7318af41dbe7c0194edfcc37eb4d422a998c1f56` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values."
},
{
"hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
"name": "RiscZero Soon verifier",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0x455218fa82e96A6adCcf182EE8A90A93BE7a6Bc6"
}
],
"verificationStatus": "unsuccessful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"description": "Verifier smart contract sources are not available on Etherscan, hash value is set to 0x0 to indicate that it is not known."
},
{
"hash": "0x79325d9dc09af1afcea4dbf04db9fada7a71846045ad56daa1996bbebf9468d8",
"name": "RiscZero v1.0.0",
"sourceLink": "https://github.com/risc0/risc0/tree/v1.0.0",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0xf70aBAb028Eb6F4100A24B203E113D94E87DE93C"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.\n\nTo regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.\n\n1. Install npm, rust, git-lfs:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt install npm git-lfs\n```\n\n2. Install snarkjs and circom v2.1.0 (from sources):\n```\nnpm install -g snarkjs\n\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.0\ncargo build --release\ncargo install --path circom\nexport PATH=\"$HOME/.cargo/bin:$PATH\"\n```\n\n3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:\n```\ngit clone https://github.com/risc0/risc0.git\ncd risc0\ngit checkout v2.0.0 # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38\ngit lfs install\ngit lfs pull --include=groth16_proof/groth16/stark_verify.circom\ncd groth16_proof/groth16\ncircom stark_verify.circom --r1cs\n\n# check that the circuit is correct:\nshasum -a 256 stark_verify.r1cs # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178\n```\n\n4. Download phase 1 and phase 2 trusted setup files, verify their correctness:\n```\nwget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau\nwget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey\n\nexport NODE_OPTIONS=\"--max-old-space-size=32768\" # without this snarkjs runs out of mem\nsnarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey\n```\n\n5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.\n\n6. Check out to the `v1.0.0` tag of risc0 repo: `git checkout v1.0.0`, commit hash should be `f2d27817a953ca4548739164afaf065de4d9a54a`.\nFrom the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`. \nIt will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0xa516a057c9fbf5629106300934d48e0e775d4230e41e503347cad96fcbde7e2e` and `0x0eb6febcf06c5df079111be116f79bd8c7e85dc9448776ef9a59aaf2624ab551`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values."
},
{
"hash": "0x55c1a9d623f4b589ad496bf8fde885abfafbcbf0129c67f1dbc78c8430b69eaf",
"name": "RiscZero v2.0.0-rc.3",
"sourceLink": "https://github.com/risc0/risc0/tree/v2.0.0-rc.3",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0x20ff7C2Cf391a5F096A2Cc181cb41916680f8E97"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.\n\nTo regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.\n\n1. Install npm, rust, git-lfs:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt install npm git-lfs\n```\n\n2. Install snarkjs and circom v2.1.0 (from sources):\n```\nnpm install -g snarkjs\n\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.0\ncargo build --release\ncargo install --path circom\nexport PATH=\"$HOME/.cargo/bin:$PATH\"\n```\n\n3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:\n```\ngit clone https://github.com/risc0/risc0.git\ncd risc0\ngit checkout v2.0.0 # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38\ngit lfs install\ngit lfs pull --include=groth16_proof/groth16/stark_verify.circom\ncd groth16_proof/groth16\ncircom stark_verify.circom --r1cs\n\n# check that the circuit is correct:\nshasum -a 256 stark_verify.r1cs # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178\n```\n\n4. Download phase 1 and phase 2 trusted setup files, verify their correctness:\n```\nwget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau\nwget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey\n\nexport NODE_OPTIONS=\"--max-old-space-size=32768\" # without this snarkjs runs out of mem\nsnarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey\n```\n\n5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.\n\n6. Check out to the `v2.0.0-rc.3` tag of risc0 repo: `git checkout v2.0.0-rc.3`, commit hash should be `99e8616b4e74203a5aa361a485e0196516b4b308`. \nFrom the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`. \nIt will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0x539032186827b06719244873b17b2d4c122e2d02cfb1994fe958b2523b844576` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values."
},
{
"hash": "0x23aae7a460d8470faa11d2b75a9005eee1d3e0bce0e88ac2288f1ada4e4664df",
"name": "RiscZero v2.1.0",
"sourceLink": "https://github.com/risc0/risc0/tree/v2.1.0",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0x54aCE3ED46529B4d4F3770C8Bad5dDC48717B9bF"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nVerification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.\n\nTo regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.\n\n1. Install npm, rust, git-lfs:\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt install npm git-lfs\n```\n\n2. Install snarkjs and circom v2.1.0 (from sources):\n```\nnpm install -g snarkjs\n\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.0\ncargo build --release\ncargo install --path circom\nexport PATH=\"$HOME/.cargo/bin:$PATH\"\n```\n\n3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:\n```\ngit clone https://github.com/risc0/risc0.git\ncd risc0\ngit checkout v2.0.0 # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38\ngit lfs install\ngit lfs pull --include=groth16_proof/groth16/stark_verify.circom\ncd groth16_proof/groth16\ncircom stark_verify.circom --r1cs\n\n# check that the circuit is correct:\nshasum -a 256 stark_verify.r1cs # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178\n```\n\n4. Download phase 1 and phase 2 trusted setup files, verify their correctness:\n```\nwget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau\nwget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey\n\nexport NODE_OPTIONS=\"--max-old-space-size=32768\" # without this snarkjs runs out of mem\nsnarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey\n```\n\n5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.\n\n6. Check out to the `v2.1.0` tag of risc0 repo: `git checkout v2.1.0`, commit hash should be `0f60032dce731863eba197c8494bdf455445c4af`. \nFrom the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`. \nIt will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0x884389273e128b32475b334dec75ee619b77cb33d41c332021fe7e44c746ee60` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values."
}
]
}+8 -5
+8 -5
{
"creator": "Succinct",
"projectsForTvs": [
{
"projectId": "fluent",
"sinceTimestamp": 1776599267
},
{
"projectId": "celo",
"sinceTimestamp": 1771445567
},
{
"projectId": "vector",
"sinceTimestamp": 1771445567
},
{
"projectId": "sophon",
"sinceTimestamp": 1771445567
},
{
"projectId": "lens",
"sinceTimestamp": 1771445567
},
{
"projectId": "galxegravity",
"sinceTimestamp": 1771445567,
"untilTimestamp": 1763420400
},
{
"projectId": "rari",
"sinceTimestamp": 1771445567
},
{
"projectId": "blobstream",
"sinceTimestamp": 1771445567
},
{
"projectId": "molten",
"sinceTimestamp": 1771445567
},
{
"projectId": "winr",
"sinceTimestamp": 1771445567
},
{
"projectId": "phala",
"sinceTimestamp": 1771445567
},
{
"projectId": "kroma",
"sinceTimestamp": 1771445567
},
{
"projectId": "taiko",
"sinceTimestamp": 1774964687
},
{
"projectId": "mantle",
"sinceTimestamp": 1778001356
},
{
"projectId": "morph",
"sinceTimestamp": 1779354407
},
{
"projectId": "base",
"sinceTimestamp": 1779825599
},
{
"projectId": "appchain",
"sinceTimestamp": 1780326419
},
{
"projectId": "apechain",
"sinceTimestamp": 1780346337
}
],
"proofSystemInfo": "\n## Description\n\nSP1 Hypercube is the latest Succint's RISC-V zkVM using the [Plonky3](https://github.com/Plonky3/Plonky3) stack. The zkVM execution is proven recursively and is wrapped into a SNARK for final verification. It provides tools to generate onchain Groth16 or Plonk verifiers. SP1 Hypercube provides 98 bits of proven security, as per [Ethereum Foundation’s soundcalc evaluation](https://github.com/ethereum/soundcalc/blob/main/reports/sp1.md).\n\n## Proof system\n\nSP1 Hypercube is an iteration of the previous zkVM version, SP1 Turbo, introducing architectural changes that improve prover performance and memory efficiency.\n\nHypercube proves execution of a 64-bit RISC-V VM using several ZK circuits, or chips, connected by lookup arguments ([LogUp based on GKR protocol](https://docs.succinct.xyz/docs/sp1/hypercube/logupgkr)). VM execution trace is split into several shards of size approximately 2^22, that could be proven in parallel with a STARK proving system. Additional arguments prove memory consistency across shards. \n\nThe parallelized proofs are recursively checked by the next layer of STARK circuits. The correctness of the final STARK proof is verified with the final wrap SNARK program, the wrap SNARK proof is verified onchain.\n\n### Hypercube vs. Turbo\n\nProving time and memory optimizations of SP1 Hypercube are based on several design improvements compared to SP1 Turbo.\n\nHypercube implements a [multilinear polynomial](https://github.com/succinctlabs/sp1/tree/v6.0.0/slop/crates/multilinear) STARK compared to univariate polynomials in Turbo. Multilinear polynomial based proving systems are more efficient than univariate because manipulating them reduces usage of log-linear FFT algorithm.\n\nMultilinear polynomials also allow Hypercube to innovate on a polynomial commitment scheme, implementing [Jagged PCS](https://docs.succinct.xyz/docs/sp1/hypercube/jagged) (defined in [this preprint](https://eprint.iacr.org/2025/917)). Jagged PCS allows efficient packing of computation traces of zkVM chips with different lengths, optimizing the prover memory requirement. More efficient LogUp based on GKR is also made possible because of multilinear polynomials.\n\n### Recursion circuits\n\nSP1 Hypercube provides tools for recursive proof generation by [verifying proofs in a zkVM](https://docs.succinct.xyz/docs/sp1/writing-programs/proof-aggregation#verifying-proofs-inside-the-zkvm). This uses the same toolkit as top-level proof system, but proves the correct verification of all proofs generated on the previous step.\n\nFirst, proofs for correctness of separate shards are generated. These shards may have different trace shape, so in the next step they are normalized. Finally, normalized shard proofs are recursively compressed in batches of 3-4 to a single zkVM proof. For further details see [this page](https://docs.succinct.xyz/docs/sp1/hypercube/recursion).\n\n### Final wrap\n\nSP1 Hypercube supports Plonk (with KZG polynomial commitments) or Groth16 final SNARK wrap of the STARK proof for performant onchain proof verification ([link](https://docs.succinct.xyz/docs/sp1/generating-proofs/proof-types#compressed)). The implementation of these proof systems over BN254 curve is used. For Plonk, Aztec Ignition trusted setup ceremony is used, for Groth16 Succinct run internal circuit-dependent phase 2 trusted setup (todo: link to trusted setups section).\n \n ",
"techStack": {
"zkVM": [
{
"id": "Plonky3",
"type": "STARK",
"name": "Plonky3",
"description": "Toolkit that implements a set of primitives for STARK-based zkVMs developed by Polygon Zero team."
},
{
"id": "RISCV64",
"type": "ISA",
"name": "RISC-V 64bit",
"description": "Free and open-source universal 64-bit ISA used across a variety of hardware and software."
},
{
"id": "BabyBear",
"type": "Field",
"name": "Baby Bear",
"description": "Prime field of order p = 15 * 2**27 + 1."
},
{
"id": "KoalaBear",
"type": "Field",
"name": "Koala Bear",
"description": "Prime field of order p = 2**31 - 2**24 + 1."
}
],
"finalWrap": [
{
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
{
"id": "SP1_v6_0_0",
"type": "Groth16",
"name": "SP1 v6.0.0",
"description": "Succinct's Groth16 final wrap circuit for SP1 zkVM v6.0.0"
},
{
"id": "SP1_v6_1_0",
"type": "Groth16",
"name": "SP1 v6.1.0",
"description": "Succinct's Groth16 final wrap circuit for SP1 zkVM v6.1.0"
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
},
{
"proofSystem": {
"id": "SP1_v6_1_0",
"type": "Groth16",
"name": "SP1 v6.1.0",
"description": "Succinct's Groth16 final wrap circuit for SP1 zkVM v6.1.0"
},
"id": "SP1HypercubeGroth16_v6_1_0",
"name": "SP1 Hypercube v6.1.0 Groth16 circuit-specific setup",
"participantCount": 18,
"risk": "red",
"shortDescription": "Trusted setup ceremony for SP1 Hypercube (release v6.0.0) Groth16 final wrap circuits. Ceremony was organized by Succinct and includes 18 participants from 8 different organizations, without public calls to participate.",
"longDescription": "\nCeremony was run among 18 participants affiliated with Etherealize, Polygon, OP Labs, Alpen Labs, Offchain Labs, Succinct, Coinbase, Across Protocol. It generated circuit-specific setup parameters for Groth16 wrapper of SP1 Hypercube zkVM.\n\n- Ceremony info on Succinct docs page: .\n- Ceremony instructions and verification instructions: [https://github.com/succinctlabs/semaphore-gnark-11/tree/main](https://github.com/succinctlabs/semaphore-gnark-11/tree/main).\n- Link to transcript and other artifacts (Note: will immediately start downloading .tar.gz file): .\n "
"shortDescription": "Trusted setup ceremony for SP1 Hypercube (release v6.0.0) Groth16 final wrap circuits. Phase 2 of the ceremony was organized by Succinct and includes 18 participants from 8 different organizations, without public calls to participate.",
"longDescription": "\nSP1 Hypercube v6.1.0 Groth16 trusted setup builds on top of the first 54 contributions to the [Perpetual Powers of Tau](https://github.com/privacy-ethereum/perpetualpowersoftau) ceremony as its phase 1 setup.\n\nPhase 2 of the ceremony was run among 18 participants affiliated with Etherealize, Polygon, OP Labs, Alpen Labs, Offchain Labs, Succinct, Coinbase, Across Protocol. It generated circuit-specific setup parameters for Groth16 wrapper of SP1 Hypercube zkVM.\n\n- Phase 1 ceremony (first 54 contributions are used): .\n- Ceremony info on Succinct docs page: .\n- Ceremony instructions and verification instructions: [https://github.com/succinctlabs/semaphore-gnark-11/tree/main](https://github.com/succinctlabs/semaphore-gnark-11/tree/main).\n- Link to transcript and other artifacts (Note: will immediately start downloading .tar.gz file): .\n "
},
{
"proofSystem": {
"id": "SP1_v6_0_0",
"type": "Groth16",
"name": "SP1 v6.0.0",
"description": "Succinct's Groth16 final wrap circuit for SP1 zkVM v6.0.0"
},
"id": "SP1HypercubeGroth16",
"name": "SP1 Hypercube Groth16 circuit-specific setup",
"participantCount": 12,
"risk": "red",
"shortDescription": "Trusted setup ceremony for SP1 Hypercube (release v6.0.0) Groth16 final wrap circuits. Ceremony was organized by Succinct and includes 12 participants from 7 different organizations, without public calls to participate.",
"longDescription": "\nCeremony was run among 12 participants affiliated with Across Protocol, OP Labs, Offchain Labs, Succinct Labs, Conduit, Ethrealize and 1 independent participant. It generated circuit-specific setup parameters for Groth16 wrapper of SP1 Hypercube zkVM.\n\n- Ceremony info on Succinct docs page: (link is updated and points to a different ceremony now).\n- Ceremony instructions and verification instructions: [https://github.com/succinctlabs/semaphore-gnark-11/tree/main](https://github.com/succinctlabs/semaphore-gnark-11/tree/main).\n- Link to transcript and other artifacts (Note: will immediately start downloading .tar.gz file): .\n "
"shortDescription": "Trusted setup ceremony for SP1 Hypercube (release v6.0.0) Groth16 final wrap circuits. Phase 2 of the ceremony was organized by Succinct and includes 12 participants from 7 different organizations, without public calls to participate.",
"longDescription": "\nSP1 Hypercube v6.0.0 Groth16 trusted setup builds on top of the first 54 contributions to the [Perpetual Powers of Tau](https://github.com/privacy-ethereum/perpetualpowersoftau) ceremony as its phase 1 setup.\n\nPhase 2 of the ceremony was run among 12 participants affiliated with Across Protocol, OP Labs, Offchain Labs, Succinct Labs, Conduit, Ethrealize and 1 independent participant. It generated circuit-specific setup parameters for Groth16 wrapper of SP1 Hypercube zkVM.\n\n- Phase 1 ceremony (first 54 contributions are used): .\n- Ceremony info on Succinct docs page: (link is updated and points to a different ceremony now).\n- Ceremony instructions and verification instructions: [https://github.com/succinctlabs/semaphore-gnark-11/tree/main](https://github.com/succinctlabs/semaphore-gnark-11/tree/main).\n- Link to transcript and other artifacts (Note: will immediately start downloading .tar.gz file): .\n "
}
],
"verifierHashes": [
{
"hash": "0x4388a21c687fdd5f218d7e3d13190cac4c5355818d3605fd5fb811df468ee696",
"name": "SP1 Hypercube Groth16 v6.1.0",
"sourceLink": "https://github.com/succinctlabs/sp1/tree/v6.1.0/crates/prover",
"proofSystem": {
"id": "SP1_v6_1_0",
"type": "Groth16",
"name": "SP1 v6.1.0",
"description": "Succinct's Groth16 final wrap circuit for SP1 zkVM v6.1.0"
},
"knownDeployments": [
{
"address": "eth:0xb69f2584CBcFf99a58C4e7002E8b89Af54a6f4e2"
},
{
"address": "eth:0xD9d5C8456a168Dd25561064F47bF116111131B1D"
},
{
"address": "arb1:0xD9d5C8456a168Dd25561064F47bF116111131B1D"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\n The regeneration process consumed around 70 GiB of memory on the peak.\n \n 1. Install necessary dependencies: rust, docker, sp1 toolkit, go.\n \n ```\n sudo apt update\n sudo apt install build-essential golang-go protobuf-compiler\n \n curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n . .cargo/env\n cargo install --debug --locked cargo-make\n \n curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -\n sudo add-apt-repository \"deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable\"\n sudo apt install -y docker-ce\n sudo usermod -aG docker ${USER}\n \n curl -L https://sp1up.succinct.xyz/ | bash\n source ~/.bashrc\n sp1up\n ```\n \n 2. Clone [sp1 repo](https://github.com/succinctlabs/sp1), set `SP1_ALLOW_DEPRECATED_HOOKS` for correct compilation and run the script to build groth16 circuit file.\n \n ```\n git clone https://github.com/succinctlabs/sp1.git\n cd sp1/crates/prover\n git checkout v6.1.0 # commit should be d454975ac7c1126097e36eceda9bce2cb9899da4\n export SP1_ALLOW_DEPRECATED_HOOKS=true # fixes compilation errors\n \n make build-circuits\n ```\n \n This script will generate `groth16_circuit.bin` file in the `prover/build/groth16` directory, however it will not generate correct prover and verifier keys.\n \n 3. Generate correct pk and vk using the correct SP1 trusted setup. This will require [semaphore-gnark-11](https://github.com/succinctlabs/semaphore-gnark-11/tree/main) repo.\n \n ```\n cd\n git clone https://github.com/succinctlabs/semaphore-gnark-11.git # tested on commit hash 6d6ebc3608e609ec879e9ba99abee6b6b97d937d\n cd semaphore-gnark-11\n # Download the trusted setup transcript\n curl \"https://sp1-circuits.s3-us-east-2.amazonaws.com/v6.1.0-trusted-setup.tar.gz\" -o trusted-setup.tar.gz\n \n # Extract trusted setup transcript.\n tar -xzf trusted-setup.tar.gz\n \n # Build the binary.\n go build\n \n # Generate keys. They are outputted to the files pk and vk in the root directory.\n ./semaphore-gnark-11 key trusted-setup/phase1 trusted-setup/phase2-17 trusted-setup/evals /path/to/sp1/crates/prover/build/groth16/groth16_circuit.bin\n ```\n The last step will take several hours to complete.\n \n 4. Compute the hash of generated `vk` file: `shasum vk -a 256`.\n "
},
{
"hash": "0x0e78f4db7a6771a3a6a7d9c3b0de6fe73d58781368967a7fe84d87aefffec896",
"name": "SP1 Hypercube Groth16 v6.0.0",
"sourceLink": "https://github.com/succinctlabs/sp1/tree/v6.0.0/crates/prover",
"proofSystem": {
"id": "SP1_v6_0_0",
"type": "Groth16",
"name": "SP1 v6.0.0",
"description": "Succinct's Groth16 final wrap circuit for SP1 zkVM v6.0.0"
},
"knownDeployments": [
{
"address": "eth:0x99A74A05a0FaBEB217C1A329b0dac59a1FA52508"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\n The regeneration process consumed around 70 GiB of memory on the peak.\n \n 1. Install necessary dependencies: rust, docker, sp1 toolkit, go.\n \n ```\n sudo apt update\n sudo apt install build-essential golang-go protobuf-compiler\n \n curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n . .cargo/env\n cargo install --debug --locked cargo-make\n \n curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -\n sudo add-apt-repository \"deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable\"\n sudo apt install -y docker-ce\n sudo usermod -aG docker ${USER}\n \n curl -L https://sp1up.succinct.xyz/ | bash\n source ~/.bashrc\n sp1up\n ```\n \n 2. Clone [sp1 repo](https://github.com/succinctlabs/sp1), set `SP1_ALLOW_DEPRECATED_HOOKS` for correct compilation and run the script to build groth16 circuit file.\n \n ```\n git clone https://github.com/succinctlabs/sp1.git\n cd sp1/crates/prover\n git checkout v6.0.0 # commit should be f87f8d6ff005d542db22e241928319f5e96a4609\n export SP1_ALLOW_DEPRECATED_HOOKS=true # fixes compilation errors\n \n make build-circuits\n ```\n \n This script will generate `groth16_circuit.bin` file in the `prover/build/groth16` directory, however it will not generate correct prover and verifier keys.\n \n 3. Generate correct pk and vk using the correct SP1 trusted setup. This will require [semaphore-gnark-11](https://github.com/succinctlabs/semaphore-gnark-11/tree/main) repo.\n \n ```\n cd\n git clone https://github.com/succinctlabs/semaphore-gnark-11.git # tested on commit hash 6d6ebc3608e609ec879e9ba99abee6b6b97d937d\n cd semaphore-gnark-11\n # Download the trusted setup transcript\n curl \"https://sp1-circuits.s3-us-east-2.amazonaws.com/v6.0.0-trusted-setup.tar.gz\" -o trusted-setup.tar.gz\n \n # Extract trusted setup transcript.\n tar -xzf trusted-setup.tar.gz\n \n # Build the binary.\n go build\n \n # Generate keys. They are outputted to the files pk and vk in the root directory.\n ./semaphore-gnark-11 key trusted-setup/phase1 trusted-setup/phase2-11 trusted-setup/evals /path/to/sp1/crates/prover/build/groth16/groth16_circuit.bin\n ```\n The last step will take several hours to complete.\n \n 4. Compute the hash of generated `vk` file: `shasum vk -a 256`.\n "
},
{
"hash": "0x5a093a2fcb46394f5cadfe55c44d4d572fad9cec7aeb38026b0278322ef07fac",
"name": "SP1 Hypercube Plonk v6.1.0",
"sourceLink": "https://github.com/succinctlabs/sp1/tree/v6.1.0/crates/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0xc3c6dDDAc8829b233Dc6536Ec024775a57b0AF2A"
},
{
"address": "arb1:0xc3c6dDDAc8829b233Dc6536Ec024775a57b0AF2A"
},
{
"address": "eth:0x9774CE99E8Ab3f13582bC6c2Bd2832e5A25C4624"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nThe regeneration process consumed around 100 GiB of memory on the peak.\n\n1. Install necessary dependencies: rust, docker, sp1 toolkit, go.\n\n```\nsudo apt update\nsudo apt install build-essential golang-go protobuf-compiler\n\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\ncargo install --debug --locked cargo-make\n\ncurl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -\nsudo add-apt-repository \"deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable\"\nsudo apt install -y docker-ce\nsudo usermod -aG docker ${USER}\n\ncurl -L https://sp1up.succinct.xyz/ | bash\nsource ~/.bashrc\nsp1up\n```\n\n2. Clone [sp1 repo](https://github.com/succinctlabs/sp1), set `SP1_ALLOW_DEPRECATED_HOOKS` for correct compilation and run the script to regenerate verifiers.\n\n```\ngit clone https://github.com/succinctlabs/sp1.git\ncd sp1/crates/prover\ngit checkout v6.1.0 # commit should be d454975ac7c1126097e36eceda9bce2cb9899da4\nexport SP1_ALLOW_DEPRECATED_HOOKS=true # fixes compilation errors\n\nmake build-circuits\n```\n \nThe script will generate Plonk verifier smart contract with verification keys and the verifier hash in `build/plonk` dir.\n "
},
{
"hash": "0xbb1a6f2930e94bfe8b35e794faf43133214534a17d2ad8e51358cad437b3c317",
"name": "SP1 Hypercube Plonk v6.0.0",
"sourceLink": "https://github.com/succinctlabs/sp1/tree/v6.0.0/crates/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x8a0fd5e825D14368d90Fe68F31fceAe3E17AFc5C"
},
{
"address": "arb1:0x8a0fd5e825D14368d90Fe68F31fceAe3E17AFc5C"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\n The regeneration process consumed around 70 GiB of memory on the peak.\n \n 1. Install necessary dependencies: rust, docker, sp1 toolkit, go.\n \n ```\n sudo apt update\n sudo apt install build-essential golang-go protobuf-compiler\n \n curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n . .cargo/env\n cargo install --debug --locked cargo-make\n \n curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -\n sudo add-apt-repository \"deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable\"\n sudo apt install -y docker-ce\n sudo usermod -aG docker ${USER}\n \n curl -L https://sp1up.succinct.xyz/ | bash\n source ~/.bashrc\n sp1up\n ```\n \n 2. Clone [sp1 repo](https://github.com/succinctlabs/sp1), set `SP1_ALLOW_DEPRECATED_HOOKS` for correct compilation and run the script to regenerate verifiers.\n \n ```\n git clone https://github.com/succinctlabs/sp1.git\n cd sp1/crates/prover\n git checkout v6.0.0 # commit should be f87f8d6ff005d542db22e241928319f5e96a4609\n export SP1_ALLOW_DEPRECATED_HOOKS=true # fixes compilation errors\n \n make build-circuits\n ```\n \n The script will generate Plonk verifier smart contract with verification keys and the verifier hash in `build/plonk` dir.\n "
}
]
}+5 -3
+5 -3
{
"creator": "Succinct",
"projectsForTvs": [
{
"projectId": "fluent",
"sinceTimestamp": 1776599267
},
{
"projectId": "forknet",
"sinceTimestamp": 1753882500
},
{
"projectId": "katana",
"sinceTimestamp": 1751328000
},
{
"projectId": "blobstream",
"sinceTimestamp": 1717608107
},
{
"projectId": "vector",
"sinceTimestamp": 1720128227
},
{
"projectId": "sophon",
"sinceTimestamp": 1745341091
},
{
"projectId": "lens",
"sinceTimestamp": 1745359200
},
{
"projectId": "plumenetwork",
"sinceTimestamp": 1746735060,
"untilTimestamp": 1763420400
},
{
"projectId": "galxegravity",
"sinceTimestamp": 1745880540,
"untilTimestamp": 1763420400
},
{
"projectId": "rari",
"sinceTimestamp": 1734562800
},
{
"projectId": "winr",
"sinceTimestamp": 1747088280
},
{
"projectId": "molten",
"sinceTimestamp": 1731480840
},
{
"projectId": "taiko",
"sinceTimestamp": 1730452800
},
{
"projectId": "lumia",
"sinceTimestamp": 1753882500
},
{
"projectId": "polygonzkevm",
"sinceTimestamp": 1753882500
},
{
"projectId": "xlayer",
"sinceTimestamp": 1753882500
},
{
"projectId": "silicon",
"sinceTimestamp": 1753882500
},
{
"projectId": "facet",
"sinceTimestamp": 1751407200
},
{
"projectId": "ethscriptions",
"sinceTimestamp": 1767735587
},
{
"projectId": "ternoa",
"sinceTimestamp": 1753882500
},
{
"projectId": "wirex",
"sinceTimestamp": 1753882500
},
{
"projectId": "penchain",
"sinceTimestamp": 1753882500
},
{
"projectId": "phala",
"sinceTimestamp": 1736290800
},
{
"projectId": "mantle",
"sinceTimestamp": 1757973600
},
{
"projectId": "zircuit",
"sinceTimestamp": 1756072800
},
{
"projectId": "morph",
"sinceTimestamp": 1737359447
},
{
"projectId": "gpt",
"sinceTimestamp": 1753882500
},
{
"projectId": "astarzkevm",
"sinceTimestamp": 1753882500
},
{
"projectId": "witness",
"sinceTimestamp": 1753882500
},
{
"projectId": "kroma",
"sinceTimestamp": 1739228400
},
{
"projectId": "haust",
"sinceTimestamp": 1756808195
},
{
"projectId": "celo",
"sinceTimestamp": 1765324800
},
{
"projectId": "appchain",
"sinceTimestamp": 1776165024,
"untilTimestamp": 1780326419
}
],
"proofSystemInfo": "\n ## Description\n\n SP1 Turbo is a RISC-V zkVM using the [Plonky3](https://github.com/Plonky3/Plonky3) stack. The zkVM execution is proven recursively and is wrapped into a SNARK for final verification. It provides tools to generate onchain Groth16 or Plonk verifiers. SP1 targets [100 bits of security based on unproven proximity gaps conjecture](https://docs.succinct.xyz/docs/v5/sp1/security/security-model#conjectures-for-fris-security), so the actual security is likely lower.\n\n ## Proof system\n\n SP1 Turbo proves execution of a 32 bit RISC-V VM (RV32IM) using several ZK circuits connected by lookup arguments, as implemented in Plonky3. VM execution trace is split into several chunks that could be proven in parallel with a STARK proving system. The parallelized proofs are recursively checked by the next layer of STARK circuits. The correctness of the final STARK proof is verified with the final wrap SNARK program, the wrap SNARK proof is verified onchain.\n\n ### zkVM component\n\n Verifies execution of a RISC-V program in a zkVM. See [here](https://docs.succinct.xyz/docs/v5/sp1/security/rv32im-implementation) for more details on the exact RISC-V standard implemented. Uses [Plonky3](https://github.com/Plonky3/Plonky3) STARK toolkit with AIR arithmetization and FRI-based polynomial commitment scheme within the [BabyBear field](https://docs.succinct.xyz/docs/v5/sp1/security/security-model#hash-functions-and-the-random-oracle-model).\n\n ### Recursion circuits\n\n SP1 provides tools for recursive proof generation by [verifying proofs in a zkVM](https://docs.succinct.xyz/docs/v5/sp1/writing-programs/proof-aggregation#verifying-proofs-inside-the-zkvm). This uses the same toolkit as top-level proof system, but proves the correct verification of all proofs generated on the previous step.\n\n ### Final wrap\n\n SP1 supports Plonk (with KZG polynomial commitments) or Groth16 final SNARK wrap of the STARK proof for performant onchain proof verification ([link](https://docs.succinct.xyz/docs/v5/sp1/generating-proofs/proof-types#compressed)). The [gnark](https://github.com/Consensys/gnark) implementation of these proof systems over BN254 curve is used. For Plonk, Aztec Ignition trusted setup ceremony is used, for Groth16 Succinct run internal circuit-dependent phase 2 trusted setup, see [below](#trusted-setups) for more details.\n ",
"techStack": {
"zkVM": [
{
"id": "Plonky3",
"type": "STARK",
"name": "Plonky3",
"description": "Toolkit that implements a set of primitives for STARK-based zkVMs developed by Polygon Zero team."
},
{
"id": "RISCV32",
"type": "ISA",
"name": "RISC-V 32bit",
"description": "Free and open-source universal 32-bit ISA used across a variety of hardware and software."
},
{
"id": "BabyBear",
"type": "Field",
"name": "Baby Bear",
"description": "Prime field of order p = 15 * 2**27 + 1."
}
],
"finalWrap": [
{
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
{
"id": "Gnark",
"type": "Groth16",
"name": "Gnark",
"description": "Consensys implementation of Groth16 proving system written in Go."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
},
{
"proofSystem": {
"id": "Gnark",
"type": "Groth16",
"name": "Gnark",
"description": "Consensys implementation of Groth16 proving system written in Go."
},
"id": "SP1TurboGroth16",
"name": "SP1 Turbo Groth16 circuit-specific setup",
"participantCount": 7,
"risk": "red",
"shortDescription": "Succinct's internally run trusted setup for SP1 Turbo (release v5.0.0) Groth16 final wrap circuits. Ceremony was run among 7 contributors to the SP1 project without public calls to participate.",
"longDescription": "\n Ceremony was run among 7 contributors to the SP1 project without public calls to participate. It generated setup parameters for Groth16 wrapper of SP1 zkVM.\n\n - Ceremony info on Succinct docs page: [https://docs.succinct.xyz/docs/v5/sp1/security/security-model#options](https://docs.succinct.xyz/docs/v5/sp1/security/security-model#options).\n - Ceremony instructions and verification instructions: [https://github.com/succinctlabs/semaphore-gnark-11/tree/main](https://github.com/succinctlabs/semaphore-gnark-11/tree/main).\n - Link to transcript and other artifacts (Note: will immediately start downloading .tar.gz file): [https://sp1-circuits.s3.us-east-2.amazonaws.com/v4.0.0-rc.3-trusted-setup.tar.gz](https://sp1-circuits.s3.us-east-2.amazonaws.com/v4.0.0-rc.3-trusted-setup.tar.gz).\n "
"shortDescription": "Succinct's internally run trusted setup for SP1 Turbo (release v5.0.0) Groth16 final wrap circuits. Phase 2 of the ceremony was run among 7 contributors to the SP1 project without public calls to participate.",
"longDescription": "\nSP1 Turbo Groth16 trusted setup builds on top of the first 54 contributions to the [Perpetual Powers of Tau](https://github.com/privacy-ethereum/perpetualpowersoftau) ceremony as its phase 1 setup.\n\nPhase 2 of the ceremony was run among 7 contributors to the SP1 project without public calls to participate. It generated setup parameters for Groth16 wrapper of SP1 zkVM.\n\n- Phase 1 ceremony (first 54 contributions are used): .\n- Ceremony info on Succinct docs page: [https://docs.succinct.xyz/docs/v5/sp1/security/security-model#options](https://docs.succinct.xyz/docs/v5/sp1/security/security-model#options).\n- Ceremony instructions and verification instructions: [https://github.com/succinctlabs/semaphore-gnark-11/tree/main](https://github.com/succinctlabs/semaphore-gnark-11/tree/main).\n- Link to transcript and other artifacts (Note: will immediately start downloading .tar.gz file): [https://sp1-circuits.s3.us-east-2.amazonaws.com/v4.0.0-rc.3-trusted-setup.tar.gz](https://sp1-circuits.s3.us-east-2.amazonaws.com/v4.0.0-rc.3-trusted-setup.tar.gz).\n "
}
],
"verifierHashes": [
{
"hash": "0xd4e8ecd2357dd882209800acd6abb443d231cf287d77ba62b732ce937c8b56e7",
"name": "SP1 Turbo Plonk v5.0.0",
"sourceLink": "https://github.com/succinctlabs/sp1/tree/v5.0.0/crates/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x0459d576A6223fEeA177Fb3DF53C9c77BF84C459"
},
{
"address": "eth:0xFF5Adab685362DC4C33536a65aF5873738D1216B"
},
{
"address": "arb1:0x0459d576A6223fEeA177Fb3DF53C9c77BF84C459"
},
{
"address": "eth:0x059adC0Db833f7cCb12dC41BE0017626337AfA63"
},
{
"address": "eth:0x294a1Ee119C4B2510530572481A6a50892A9ae9f"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nThe regeneration process consumed around 50 GiB of memory on the peak. Also, due to some os indeterminism, \nthe sp1 repo must be cloned into `/home/aurel/dev/sp1-wip/` directory, so we recommend creating `aurel` user on an Ubuntu 24.04 machine.\n\n1. Create a new `aurel` user on a linux os and login as this user.\n2. Install necessary dependencies: rust, sp1 toolkit, go.\n\n```\nsudo apt update\nsudo apt install build-essential golang-go\n\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\ncargo install --debug --locked cargo-make\n\ncurl -L https://sp1up.succinct.xyz/ | bash\nsp1up\n```\n\n3. Clone sp1 repo in the correct directory, set `SP1_ALLOW_DEPRECATED_HOOKS` for correct compilation and run the script to regenerate verifiers.\n\n```\nmkdir -p dev/sp1-wip/\ncd dev/sp1-wip/\ngit clone https://github.com/succinctlabs/sp1.git\ncd sp1/crates/prover\ngit checkout v5.0.0 # commit should be 38f0f143dece864e8bffafad64196a924f190336\nexport SP1_ALLOW_DEPRECATED_HOOKS=true # fixes compilation errors\n\nmake build-circuits\n```\n \nThe script will generate Plonk verifier smart contract with verification keys and the verifier hash in `build/plonk` dir.\n "
},
{
"hash": "0xa4594c59bbc142f3b81c3ecb7f50a7c34bc9af7c4c444b5d48b795427e285913",
"name": "SP1 Turbo Groth16 v5.0.0",
"proofSystem": {
"id": "Gnark",
"type": "Groth16",
"name": "Gnark",
"description": "Consensys implementation of Groth16 proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x50ACFBEdecf4cbe350E1a86fC6f03a821772f1e5"
},
{
"address": "arb1:0xC513d6E8C8f915B1DA2f6eAC4C6d755ff3d5f21D"
}
],
"verificationStatus": "unsuccessful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nWe performed the following steps, which according to the Succinct team should have lead to a successful regeneration of the verifier's hash.\nHowever these steps produced a verifier smart contract with `VERIFIER_HASH = 0xf7ba6320608dadd905f3483d51c2fa0fb55473e3136bdfb37c96a10f158ab9fe`, which differs from the value onchain. \n\n1. Create a new `aurel` user on a linux os and login as this user.\n2. Install necessary dependencies: rust, sp1 toolkit, go.\n\n```\nsudo apt update\nsudo apt install build-essential golang-go\n\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\ncargo install --debug --locked cargo-make\n\ncurl -L https://sp1up.succinct.xyz/ | bash\nsp1up\n```\n\n3. Clone sp1 repo in the correct directory, set `SP1_ALLOW_DEPRECATED_HOOKS` for correct compilation and run the script to regenerate verifiers.\n\n```\nmkdir -p dev/sp1-wip/\ncd dev/sp1-wip/\ngit clone https://github.com/succinctlabs/sp1.git\ncd sp1/crates/prover\ngit checkout v5.0.0 # commit should be 38f0f143dece864e8bffafad64196a924f190336\nexport SP1_ALLOW_DEPRECATED_HOOKS=true # fixes compilation errors\n\nmake build-circuits\n```\n "
},
{
"hash": "0xffea2d2e12ed24da258af874d77eee7ee91a1e050ee197052908089e57681e67",
"name": "SP1 Turbo Plonk Morph",
"sourceLink": "https://github.com/succinctlabs/sp1/tree/v5.0.0/crates/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x045d4BC73Bd1918192f34e98532A5272Ef620423"
}
],
"verificationStatus": "notVerified"
}
]
}+4 -4
+4 -4
{
"attributes": [
{
"id": "immutable",
"label": "Immutable",
"description": "Core smart contract code cannot be changed."
},
{
"id": "unconditionalPrivacy",
"label": "Unconditional privacy",
"description": "Deposits and withdrawals cannot be censored or linked by the protocol."
},
{
"id": "fixedAmounts",
"label": "Fixed amounts",
"description": "Pre-defined transfer amounts use distinct buckets (anonymity sets)."
},
{
"id": "sourceAvailable",
"label": "Source available",
"description": "There is at least one practical way to exclusively use auditable, source-available software to interact with this protocol."
}
],
"riskSummary": "## Funds can be stolen if\n1. the zk proof system is broken, allowing invalid withdrawals.\n2. the [trusted setup](#trusted-setups) is compromised or all ceremony participants collude, allowing invalid withdrawals.\n
\n## Funds can be lost if\n1. a user loses the note secrets required to withdraw. \n
\n## Privacy can be lost if\n1. no relayer is available and the withdrawal must be submitted from an address that can be linked to the user (see [best practice page](/publications/privacy-best-practices) for more info).",
"tokens": [
{
"token": {
"address": "0x5d3a536E4D6DbD6114cc1Ead35777bAB948E3643",
"iconUrl": "https://assets.coingecko.com/coins/images/9281/large/cDAI.png?1696509390",
"symbol": "cDAI",
"decimals": 8,
"priceId": "cdai",
"sinceTimestamp": 1577297782
},
"buckets": [
{
"id": "tornado-cDAI-5000",
"type": "denomination",
"label": "cDAI 5000",
"address": "eth:0x22aaA7720ddd5388A3c0A3333430953C68f1849b",
"sinceTimestamp": 1577297782,
"denomination": "5000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000"
}
}
},
{
"id": "tornado-cDAI-50000",
"type": "denomination",
"label": "cDAI 50000",
"address": "eth:0x03893a7c7463AE47D46bc7f091665f1893656003",
"sinceTimestamp": 1616155055,
"denomination": "50000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "5000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "5000000000000"
}
}
},
{
"id": "tornado-cDAI-500000",
"type": "denomination",
"label": "cDAI 500000",
"address": "eth:0x2717c5e28cf931547B621a5dddb772Ab6A35B701",
"sinceTimestamp": 1616135923,
"denomination": "500000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "50000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "50000000000000"
}
}
},
{
"id": "tornado-cDAI-5000000",
"type": "denomination",
"label": "cDAI 5000000",
"address": "eth:0xD21be7248e0197Ee08E0c20D4a96DEBdaC3D20Af",
"sinceTimestamp": 1616115450,
"denomination": "5000000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000000"
}
}
}
]
},
{
"token": {
"address": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
"iconUrl": "https://assets.coingecko.com/coins/images/9956/large/Badge_Dai.png?1696509996",
"symbol": "DAI",
"decimals": 18,
"priceId": "dai",
"sinceTimestamp": 1576534688
},
"buckets": [
{
"id": "tornado-DAI-100",
"type": "denomination",
"label": "DAI 100",
"address": "eth:0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3",
"sinceTimestamp": 1576534688,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
}
},
{
"id": "tornado-DAI-1000",
"type": "denomination",
"label": "DAI 1000",
"address": "eth:0xFD8610d20aA15b7B2E3Be39B396a1bC3516c7144",
"sinceTimestamp": 1577297383,
"denomination": "1000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000000"
}
}
},
{
"id": "tornado-DAI-10000",
"type": "denomination",
"label": "DAI 10000",
"address": "eth:0x07687e702b410Fa43f4cB4Af7FA097918ffD2730",
"sinceTimestamp": 1616114822,
"denomination": "10000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000000"
}
}
},
{
"id": "tornado-DAI-100000",
"type": "denomination",
"label": "DAI 100000",
"address": "eth:0x23773E65ed146A459791799d01336DB287f25334",
"sinceTimestamp": 1616115387,
"denomination": "100000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000000"
}
}
}
]
},
{
"token": {
"address": "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE",
"iconUrl": "https://assets.coingecko.com/coins/images/279/large/ethereum.png?1595348880",
"symbol": "ETH",
"decimals": 18,
"priceId": "ethereum",
"sinceTimestamp": 1576523323
},
"buckets": [
{
"id": "tornado-ETH-0.1",
"type": "denomination",
"label": "ETH 0.1",
"address": "eth:0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc",
"sinceTimestamp": 1576523323,
"denomination": "0.1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000"
}
}
},
{
"id": "tornado-ETH-1",
"type": "denomination",
"label": "ETH 1",
"address": "eth:0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
"sinceTimestamp": 1576534673,
"denomination": "1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000"
}
}
},
{
"id": "tornado-ETH-10",
"type": "denomination",
"label": "ETH 10",
"address": "eth:0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
"sinceTimestamp": 1576536415,
"denomination": "10",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000"
}
}
},
{
"id": "tornado-ETH-100",
"type": "denomination",
"label": "ETH 100",
"address": "eth:0xA160cdAB225685dA1d56aa342Ad8841c3b53f291",
"sinceTimestamp": 1577296976,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
}
}
]
},
{
"token": {
"address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
"iconUrl": "https://assets.coingecko.com/coins/images/6319/large/usdc.png?1696506694",
"symbol": "USDC",
"decimals": 6,
"priceId": "usd-coin",
"sinceTimestamp": 1577298068
},
"buckets": [
{
"id": "tornado-USDC-100",
"type": "denomination",
"label": "USDC 100",
"address": "eth:0xd96f2B1c14Db8458374d9Aca76E26c3D18364307",
"sinceTimestamp": 1577298068,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
}
},
{
"id": "tornado-USDC-1000",
"type": "denomination",
"label": "USDC 1000",
"address": "eth:0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D",
"sinceTimestamp": 1577298155,
"denomination": "1000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
}
}
]
},
{
"token": {
"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7",
"iconUrl": "https://assets.coingecko.com/coins/images/325/large/Tether.png?1696501661",
"symbol": "USDT",
"decimals": 6,
"priceId": "tether",
"sinceTimestamp": 1577298900
},
"buckets": [
{
"id": "tornado-USDT-100",
"type": "denomination",
"label": "USDT 100",
"address": "eth:0x169AD27A470D064DEDE56a2D3ff727986b15D52B",
"sinceTimestamp": 1577298900,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
}
},
{
"id": "tornado-USDT-1000",
"type": "denomination",
"label": "USDT 1000",
"address": "eth:0x0836222F2B2B24A3F36f98668Ed8F0B38D1a872f",
"sinceTimestamp": 1577298985,
"denomination": "1000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
}
}
]
},
{
"token": {
"address": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599",
"iconUrl": "https://assets.coingecko.com/coins/images/7598/large/wrapped_bitcoin_wbtc.png?1696507857",
"symbol": "WBTC",
"decimals": 8,
"priceId": "wrapped-bitcoin",
"sinceTimestamp": 1616123193
},
"buckets": [
{
"id": "tornado-WBTC-0.1",
"type": "denomination",
"label": "WBTC 0.1",
"address": "eth:0x178169B423a011fff22B9e3F3abeA13414dDD0F1",
"sinceTimestamp": 1616134868,
"denomination": "0.1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "10000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "10000000"
}
}
},
{
"id": "tornado-WBTC-1",
"type": "denomination",
"label": "WBTC 1",
"address": "eth:0x610B717796ad172B316836AC95a2ffad065CeaB4",
"sinceTimestamp": 1616123193,
"denomination": "1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
}
},
{
"id": "tornado-WBTC-10",
"type": "denomination",
"label": "WBTC 10",
"address": "eth:0xbB93e510BbCD0B7beb5A853875f9eC60275CF498",
"sinceTimestamp": 1616135758,
"denomination": "10",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
}
}
]
}
],
"trustedSetup": {
"id": "TornadoCash",
"name": "Tornado Cash",
"risk": "green",
"participantCount": 1114,
"shortDescription": "Circuit-specific trusted setup for Groth16 Tornado Cash circuits, contains 1114 contributions.",
"longDescription": "\n Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was publicly announced as a Phase 2 ceremony\n built on top of the 30th contribution to the Perpetual Powers of Tau ceremony, and completed in May 2020. It\n collected 1114 contributions over 10 days, with 450 identified contributors and 664 anonymous ones. Tornado Cash\n published the participant list, archive of contributions and artifacts, and the generated verifier contract.\n\n - Ceremony completion announcement: [https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa](https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa)\n - Ceremony page with participant list and archive download: [https://ceremony.tornado.cash/](https://ceremony.tornado.cash/)\n - Initial ceremony announcement: [https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1)\n - Ceremony code repository: [https://github.com/tornadocash/phase2-bn254](https://github.com/tornadocash/phase2-bn254)\n "
"risk": "yellow",
"participantCount": 30,
"shortDescription": "Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was built on top of 30 phase 1 contributions, and reached 1114 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.",
"longDescription": "\nCircuit-specific trusted setup for Groth16 Tornado Cash circuits. It was publicly announced as a Phase 2 ceremony\nbuilt on top of the [30th contribution to the Perpetual Powers of Tau ceremony], and completed in May 2020. It\ncollected 1114 contributions over 10 days, with 450 identified contributors and 664 anonymous ones. Tornado Cash\npublished the participant list, archive of contributions and artifacts, and the generated verifier contract.\n\n- Phase 1 ceremony (first 30 contributions are used): .\n- Ceremony completion announcement: [https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa](https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa)\n- Ceremony page with participant list and archive download: [https://ceremony.tornado.cash/](https://ceremony.tornado.cash/)\n- Initial ceremony announcement: [https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1)\n- Ceremony code repository: [https://github.com/tornadocash/phase2-bn254](https://github.com/tornadocash/phase2-bn254)\n "
},
"upgradesAndGovernance": "\nTornado cash has a TORN DAO, which does not have the authority to upgrade or modify existing pools in any way. However it controls a significant portion of the Tornado cash protocol and periphery, including:\n\n1. **Default router for deposits and withdrawals and the official registry of supported pools**. Malicious upgrades of these components could lead to users losing deposited tokens. \n2. **Standard UI IPFS hash registered on ENS** ([link](https://app.ens.domains/tornadocash.eth)). Malicious upgrades of these components could lead to users losing deposited tokens. \n3. **TORN token itself**. Malicious upgrades of the token could lead to token transfers being frozen. \n4. **Registered relayers**. Malicious upgrades of these components could remove all registered relayers, disrupting user-relayer coordination and complicating private withdrawals.\n\n### **Governance flow**\n\n1. Users lock TORN token in the Governance contract ([0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce)). After voting or proposing, staked tokens are locked for 5d 6h after proposal ends, preventing governance hopping. The stake can be delegated to another address. \n2. Anyone with at least 1.00 K TORN can create a proposal. The proposal spends 1m 15s in the Pending state, where voting is still disabled, followed by 5d of Active state, when votes are cast. If the vote outcome changes in the last 1h, the voting period is extended by another 6h. \n3. Proposal is accepted by the simple majority with a required quorum of 100 K TORN. Once accepted, 2d of Timelocked state allow exiting the protocol to everyone who disagrees with the proposal. Afterwards, the proposal can be permissionlessly executed within 3d. \n "
}+2 -1
+2 -1
{
"creator": "Polygon Labs",
"projectsForTvs": [
{
"projectId": "polygonzkevm",
"sinceTimestamp": 1679868000,
"untilTimestamp": 1764716400
},
{
"projectId": "silicon",
"sinceTimestamp": 1724796000
},
{
"projectId": "ternoa",
"sinceTimestamp": 1738105200
},
{
"projectId": "penchain",
"sinceTimestamp": 1749938400
},
{
"projectId": "wirex",
"sinceTimestamp": 1724796000
},
{
"projectId": "astarzkevm",
"sinceTimestamp": 1709679600
},
{
"projectId": "gpt",
"sinceTimestamp": 1724450400
},
{
"projectId": "witness",
"sinceTimestamp": 1719871200
}
],
"proofSystemInfo": "\n \n ## Description\n\n zkProver is a STARK proving system designed to implement the zkEVM component of Polygon zkEVM. It proves the execution of EVM transactions in a zkVM running on [zkASM](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/#zero-knowledge-assembly) ISA. zkProver allows recursive STARK aggregation as well as the final wrap in a [Fflonk](https://hecmas.github.io/events/2023fflonk/) SNARK for efficient onchain verification. zkProver onchain verifier targets 128 bits of security.\n\n ## Proof system\n\n zkProver toolkit introduces two new domain specific languages: zkASM and PIL. zkASM is the instruction language of the internal zkVM, and the execution of EVM transactions is proven with a specific zkASM program called [ROM](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/main-state-machine/#the-rom). PIL is a language for creating circuits, conceptually similar to [circom](https://docs.circom.io).\n\n zkProver is based on [eSTARK paper](https://eprint.iacr.org/2023/474), meaning that it implements a FRI-based STARK with AIR arithmetization extended with additional arguments. It also [provides tools](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/stark-recursion/composition-recursion-aggregation/#setup-phase) to automatically generate circom arithmetic circuits for verifying the STARK proof, which plays an essential role in proof compression and recursive proving. \n\n ### Polynomial Identity Language (PIL)\n\n The polynomial constraints that define circuits within zkProver are specified using a language called [polynomial identity language](https://github.com/0xPolygon/pilcom) (PIL). PIL supports complicated and powerful polynomial constraints, like [permutation](https://docs.polygon.technology/tools/zkevm/spec/pil/permutation-arguments/), [inclusion](https://docs.polygon.technology/tools/zkevm/spec/pil/inclusion-arguments/) and [connection](https://docs.polygon.technology/tools/zkevm/spec/pil/connection-arguments/) arguments. PIL was designed to be applicable in other zk tools as well. The next iteration of PIL called PIL2 could be found [here](https://github.com/0xPolygonHermez/pil2-compiler).\n\n ### State machine\n\n zkProver state machine (zkVM) consists of [13 separate state machines](https://github.com/0xPolygon/zkevm-prover/tree/main/src/sm) specified in PIL, including [main SM](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/main-state-machine/), [arithmetic SM](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/arithmetic-sm/), [binary SM](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/binary-sm/), etc. Each state machine creates its own execution trace, which is connected to the rest using connection argument. The state machine has access to EVM state trie, EVM memory and the ROM program that implements verification of EVM transactions in zkASM language. \n\n ### Recursion circuits\n\n [Proving architecture](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/stark-recursion/proving-architecture/) of zkProver consists of several stages. Compression stage reduces the size of STARK proofs of zkEVM batch execution for efficiency of further computations. Normalization stage prepares for aggregation by correctly aligning public inputs across several batches. Aggregation stage repeatedly joins pairs of STARK proofs to produce a single proof of multiple zkEVM batches. Final STARK stage changes the field over which the proof is generated to prepare for the SNARK wrap. Finally, SNARK stage produces a Fflonk proof to be posted onchain.\n\n Each recursion step uses a circom R1CS arithmetic circuit to verify input PIL-STARK proofs (see [here](https://docs.polygon.technology/tools/zkevm/architecture/zkprover/stark-recursion/composition-recursion-aggregation/#stark-to-circuit-or-s2c-sub-process)). The proof of verification is a PIL-STARK that is generated on the Plonkish arithmetization of this circom circuit.\n ",
"techStack": {
"zkVM": [
{
"id": "PIL-STARK",
"type": "STARK",
"name": "PIL-STARK",
"description": "zkVM STARK proving system that works with Polynomial Identity Language (PIL) developed by Polygon Zero team."
},
{
"id": "ZkASM",
"type": "ISA",
"name": "zkASM",
"description": "Instruction language for Polygon zkEVM virtual machine."
},
{
"id": "Goldilocks",
"type": "Field",
"name": "Goldilocks",
"description": "Prime field of order p = 2**64 - 2**32 + 1."
}
],
"finalWrap": [
{
"id": "Snarkjs",
"type": "Fflonk",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Fflonk improvement over standard Plonk proving system written in JS."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Snarkjs",
"type": "Fflonk",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Fflonk improvement over standard Plonk proving system written in JS."
},
"id": "PolygonZkEVM",
"name": "Polygon zkEVM",
"participantCount": 55,
"risk": "yellow",
"shortDescription": "Trusted setup for KZG commitments over BN254 curve used by Polygon zkEVM, includes 55 participants. Is a subset of Perpetual Powers of Tau ceremony.",
"longDescription": "\n Ceremony uses 54 first contributions from the [Perpetual Powers of Tau ceremony](https://github.com/privacy-scaling-explorations/perpetualpowersoftau)\n and adds one more contribution to the total of 55 participants.\n\n - Ceremony used: [https://github.com/privacy-scaling-explorations/perpetualpowersoftau?tab=readme-ov-file](https://github.com/privacy-scaling-explorations/perpetualpowersoftau?tab=readme-ov-file)\n - Public announcement: [https://medium.com/coinmonks/announcing-the-perpetual-powers-of-tau-ceremony-to-benefit-all-zk-snark-projects-c3da86af8377](https://medium.com/coinmonks/announcing-the-perpetual-powers-of-tau-ceremony-to-benefit-all-zk-snark-projects-c3da86af8377)\n - Final data and verification steps in this repo: [https://github.com/iden3/snarkjs/tree/master?tab=readme-ov-file](https://github.com/iden3/snarkjs/tree/master?tab=readme-ov-file)\n "
"longDescription": "\nCeremony uses 54 first contributions from the [Perpetual Powers of Tau ceremony](https://github.com/privacy-scaling-explorations/perpetualpowersoftau)\nand adds one more contribution to the total of 55 participants.\n\n- Ceremony used: [https://github.com/privacy-scaling-explorations/perpetualpowersoftau?tab=readme-ov-file](https://github.com/privacy-scaling-explorations/perpetualpowersoftau?tab=readme-ov-file)\n- Public announcement: [https://medium.com/coinmonks/announcing-the-perpetual-powers-of-tau-ceremony-to-benefit-all-zk-snark-projects-c3da86af8377](https://medium.com/coinmonks/announcing-the-perpetual-powers-of-tau-ceremony-to-benefit-all-zk-snark-projects-c3da86af8377)\n- Final data and verification steps in this repo: [https://github.com/iden3/snarkjs/tree/master?tab=readme-ov-file](https://github.com/iden3/snarkjs/tree/master?tab=readme-ov-file)\n "
}
],
"verifierHashes": [
{
"hash": "0x28ddf3744fb9b64bc428bee318e026bee0cf210e23ff5932f645e32aa916c28f",
"proofSystem": {
"id": "Snarkjs",
"type": "Fflonk",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Fflonk improvement over standard Plonk proving system written in JS."
},
"name": "zkProver Fflonk verifier Wirex",
"knownDeployments": [
{
"address": "eth:0x0775e11309d75aA6b0967917fB0213C5673eDf81"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the following values from the verifier smart contract, abi packed in the same order they are defined: verification key data, omegas, verifier preprocessed inputs (all values from k1 to X2y2)."
},
{
"hash": "0x237bc5d6efad6d844534c4a45f5f19fa86344615ac00054821915c219e9abd81",
"name": "zkProver Fflonk v8.0.0-fork.12",
"sourceLink": "https://github.com/0xPolygon/zkevm-proverjs/tree/v8.0.0-fork.12",
"proofSystem": {
"id": "Snarkjs",
"type": "Fflonk",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Fflonk improvement over standard Plonk proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0x9B9671dB83CfcB4508bF361942488C5cA2b1286D"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "\nThe verification steps are based on [this guide](https://github.com/agglayer/agglayer-contracts/blob/b9a795523317eca29319f3dca56f7199a117fb78/verifyMainnetDeployment/verifyMainnetProofVerifier.md).\n\n1. Get a machine with at least 512GB of RAM and 32 cores (e.g. r6a.16xlarge aws instance). This guide assumes Ubuntu 22.04 LTS OS.\n\n2. Do basic OS preparation\n\n```jsx\nsudo apt update\nsudo apt install -y tmux git curl jq\nsudo apt install -y build-essential libomp-dev libgmp-dev nlohmann-json3-dev libpqxx-dev nasm libgrpc++-dev libprotobuf-dev grpc-proto libsodium-dev uuid-dev libsecp256k1-dev\n```\n\n3. Tweak the OS to accept high amount of memory\n\n```jsx\necho \"vm.max_map_count=655300\" | sudo tee -a /etc/sysctl.conf\nsudo sysctl -w vm.max_map_count=655300\nexport NODE_OPTIONS=\"--max-old-space-size=230000\"\n```\n\n4. Install node, npm, python deps\n\n```jsx\ncurl -sL https://deb.nodesource.com/setup_18.x -o nodesource_setup.sh\nsudo bash nodesource_setup.sh\nsudo apt install -y nodejs\nnode -v\napt install python3-pip\npip install z3-solver==4.13.0.0\n```\n\nThe version of node should be: 18 (e.g. 18.19.0 ) Note that hardhat will complain that this node version is not supported byt hardhat. It seems to be just a warning and `v24.8.0` produces the same contract bytecode, so maybe it can be ignored.\n\n5. Download and prepare circom\n\n```jsx\ncd ~\ngit clone https://github.com/iden3/circom.git\ncd circom\ngit checkout v2.1.8\ngit log --pretty=format:'%H' -n 1\n```\n\nThe hash of the commit should be: f0deda416abe91e5dd906c55507c737cd9986ab5.\n\n```jsx\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\ncd ~\ncd circom\ncargo build --release\ncargo install --path circom\nexport PATH=$PATH:~/.cargo/bin\necho 'PATH=$PATH:~/.cargo/bin' >> ~/.profile\ncircom --version\n```\n\nThe version of circom should be: 2.1.8.\n\n6. Prepare fast build constant tree tool and fflonk setup\n\n```jsx\ncd ~\ngit clone https://github.com/0xPolygonHermez/zkevm-prover.git\ncd zkevm-prover\ngit checkout v8.0.0-RC9\ngit submodule init\ngit submodule update\nsed -i -E 's|^(SRCS_BCT := .*./src/starkpil/stark_info\\.\\*)|\\1 ./tools/sm/sha256/sha256.cpp ./tools/sm/sha256/bcon/bcon_sha256.cpp|' Makefile\nmake -j bctree fflonk_setup\n```\n\n7. Prepare and launch setup (zkevm-proverjs). This step is quite long, it takes approximately 4.5 hours.\n\n```jsx\ncd ~\ngit clone https://github.com/0xPolygonHermez/zkevm-proverjs.git\ncd zkevm-proverjs\ngit checkout v8.0.0-fork.12\nrm -f package-lock.json\nsed -i -E 's|https://hermez\\.s3-eu-west-1\\.amazonaws\\.com/powersOfTau28_hez_final\\.ptau|https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final.ptau|g' package.json\nnpm install\ntmux -c \"npm run buildsetup --bctree=../zkevm-prover/build/bctree --fflonksetup=../zkevm-prover/build/fflonkSetup --mode=25\"\n```\n\nThe last step generates the `zkevm-proverjs_build_proof_build_final.fflonk.verifier.sol` file which contains the verification keys that can be checked against the onchain deployment.\n ",
"description": "Custom verifier ID: SHA256 hash of the following values from the verifier smart contract, abi packed in the same order they are defined: verification key data, omegas, verifier preprocessed inputs (all values from k1 to X2y2)."
}
]
}+2 -1
+2 -1
{
"creator": "Matter Labs",
"projectsForTvs": [
{
"projectId": "zksync",
"sinceTimestamp": 1592431200
},
{
"projectId": "zkspace",
"sinceTimestamp": 1639954800
}
],
"proofSystemInfo": "\n ## Proof system\n\n ZKSync Lite prover is a monolithic SNARK proving system that generates validity proofs for the state transition of ZKSync Lite L2. It is a [Plonk system](https://docs.lite.zksync.io/userdocs/security/#primitives) over BN254 curve with [custom circuits](https://github.com/matter-labs/zksync/tree/master/core/lib/circuit/src) designed to prove the specific state transition function of the L2, including deposits and withdrawals, transfers, swaps, NFT operations. The proof system itself is implemented in the [bellman library](https://github.com/matter-labs/bellman), while many base cryptographic primitives are implemented in [franklin library](https://github.com/matter-labs/franklin-crypto/tree/dev). \n ",
"techStack": {
"snark": [
{
"id": "Zksync",
"type": "Plonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Plonk proving system, originally developed for ZKsync Lite (old ZKsync)."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "CustomCircuits",
"type": "Other",
"name": "App-specific circuits",
"description": "This project uses custom app-specific ZK circuits."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Zksync",
"type": "Plonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Plonk proving system, originally developed for ZKsync Lite (old ZKsync)."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": " \n Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \n It included 176 participants and was publicly open for participation.\n \n - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
"longDescription": " \nAztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).\n "
}
],
"verifierHashes": [
{
"hash": "0xfa15bba967ebf892d9657359fb8ff07aea13e152c0d5160143a494abb4bc9df3",
"name": "ZKsync Lite verifier 1",
"proofSystem": {
"id": "Zksync",
"type": "Plonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Plonk proving system, originally developed for ZKsync Lite (old ZKsync)."
},
"knownDeployments": [
{
"address": "eth:0x57B09100e6160503aBDEBC76012b6c358eA4e462"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed array of uint256 obtained from flattening VerificationKey structure returned by getVkAggregated1()"
},
{
"hash": "0xdfd9cbc5d113efddf3bfe382bcdd2cd67a9548fb62d758e9b18c8d8821ef1f22",
"name": "ZKsync Lite verifier 4",
"proofSystem": {
"id": "Zksync",
"type": "Plonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Plonk proving system, originally developed for ZKsync Lite (old ZKsync)."
},
"knownDeployments": [
{
"address": "eth:0x57B09100e6160503aBDEBC76012b6c358eA4e462"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed array of uint256 obtained from flattening VerificationKey structure returned by getVkAggregated4()"
},
{
"hash": "0xdfd12090ec7d5f3cc8c98dcad49e938e9e33f6807b70679c6bdfe61fdf9fd329",
"name": "ZKsync Lite verifier 8",
"proofSystem": {
"id": "Zksync",
"type": "Plonk",
"name": "Zksync",
"description": "Matter Labs Rust implementation of Plonk proving system, originally developed for ZKsync Lite (old ZKsync)."
},
"knownDeployments": [
{
"address": "eth:0x57B09100e6160503aBDEBC76012b6c358eA4e462"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of the abi packed array of uint256 obtained from flattening VerificationKey structure returned by getVkAggregated8()"
}
]
}