fe520bd4 (main)
and
8fae7a1f (PR)
+10 -2
+10 -2
{
"creator": "Lighter",
"projectsForTvs": [
{
"projectId": "lighter",
"sinceTimestamp": 1759356000
},
{
"projectId": "lighter-robinhood",
"sinceTimestamp": 1782502424
}
],
"proofSystemInfo": "## Description\n\nLighter prover is a zk proving system for Lighter L2 based on [Plonky2](https://github.com/0xPolygonZero/plonky2/tree/main) circuits. It verifies the logic for regular state transition of Lighter L2, as well as state transitions in the “desert mode” when L2 is shut down and users exit, using different sets of circuits. The circuits are proven with a STARK which is wrapped into a Plonk SNARK before settling onchain.\n\n## Proof system\n\n[Plonky2](https://github.com/0xPolygonZero/plonky2) implements a circuit aritmetization based on TurboPlonk over Goldilocks field, but it replaces KZG polynomial commitment scheme with a FRI-based polynomial testing scheme. In this way proving Plonky2 circuits requires no trusted setup, i.e. it is a STARK. \n\nHowever Lighter wraps these STARK in a [gnark](https://github.com/Consensys/gnark) implementation of Plonk over BN254 curve, which requires a trusted setup.\n\n### Lighter Circuits\n\nThe proof system operates on Lighter STF circuits and desert mode circuits. All published circuits are available [here](https://github.com/elliottech/lighter-prover/tree/main). \n\nLighter proof system defines circuits for proving all transactions, including internal, L1 and L2 transactions. The full list of available transactions that define Lighter STF can be seen [here](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/transactions). \n\nTransaction circuits use custom implementations for arithmetic operations ([bigint](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/bigint), [uint](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/uint)), cryptographic primitives ([ecdsa](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/ecdsa) on the Secp256k1 curve, [eddsa](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/eddsa) on the ECgFp5 curve, [keccak](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/keccak), [poseidon_bn128](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/poseidon_bn128)) and other helper circuits.\n\n### Desert circuits\n\nLighter also provides [desert exit circuits](https://github.com/elliottech/lighter-prover/tree/main/desertexit) that allow users to permissionlessly exit L2 when it is in the desert mode. Users can use desert circuit to generate a proof of ownership of all their positions locally, which could be submitted on L1 for withdrawing funds.\n\n### Recursion\n\nLighter prover implements recursive aggregation of transaction proofs to make the whole pipeline more efficient and parallelizable. First, fixed-size blocks of consecutive transactions are processed and proven by [BlockTx circuit](https://github.com/elliottech/lighter-prover/blob/main/circuit/src/block_tx_constraints.rs), which can be done on separate machines. Next, arbitrary number of BlockTx proofs are aggregated into a single proof by [BlockTxChain circuit](https://github.com/elliottech/lighter-prover/blob/main/circuit/src/block_tx_chain_constraints.rs), which includes continuity checks across all BlockTx proofs.",
"techStack": {
"snark": [
{
"id": "Plonky2",
"type": "Plonk",
"name": "Plonky2",
"description": "Toolkit for developing transparent SNARKs based on PLONK and FRI developed by Polygon Zero team."
},
{
"id": "Goldilocks",
"type": "Field",
"name": "Goldilocks",
"description": "Prime field of order p = 2**64 - 2**32 + 1."
},
{
"id": "CustomCircuits",
"type": "Other",
"name": "App-specific circuits",
"description": "This project uses custom app-specific ZK circuits."
}
],
"finalWrap": [
{
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": "Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition)."
}
],
"verifierHashes": [
{
"hash": "0x836ea0348ed3ae0bf5136f58d874d57075d4094691b08c3ef02a6aaa332df363",
"name": "Lighter verifier",
"sourceLink": "https://github.com/elliottech/lighter-prover/tree/8c01ea010d6fd46bdb77ef2f93a79278d1adf0df/circuit/src",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0xf7b964eD0C05a7aA12fdC54865295531C9D2AEC1"
}
],
"verificationStatus": "notVerified",
"verificationSteps": "The sources for the verifier circuits are not published and thus the verifier cannot be independently regenerated.",
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "The verification process below is based on the `build_circuits.sh` [script](https://github.com/elliottech/lighter-prover/blob/8c01ea010d6fd46bdb77ef2f93a79278d1adf0df/build_circuits.sh) in the lighter-prover repository. It consumed around 100 GiB of memory at its peak, so we recommend rerunning it on a machine with 128 GiB of RAM.\n\nThe steps below are for Ubuntu 22.04.\n\n1. Install Rust, GCC, and Go version 1.21 or later.\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt update\nsudo apt install build-essential\n\n# One way to install Go 1.21 on Ubuntu 22.04\nwget https://go.dev/dl/go1.21.0.linux-amd64.tar.gz\nsudo tar -xvf go1.21.0.linux-amd64.tar.gz\nsudo mv go /usr/local\nexport GOROOT=/usr/local/go\nexport GOPATH=$HOME/go\nexport PATH=$GOPATH/bin:$GOROOT/bin:$PATH\nsource ~/.profile\n```\n\n2. Check out the `main` revision used for the verification and run the script to regenerate the keys.\n\n```\ngit clone https://github.com/elliottech/lighter-prover.git\ncd lighter-prover\ngit checkout 8c01ea010d6fd46bdb77ef2f93a79278d1adf0df\nchmod +x build_circuits.sh\n./build_circuits.sh\n```\n\nThe script generates a `final::....sol` file containing the verifier smart contract and verification keys.",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
},
{
"hash": "0x1ea7019dfa94b4b4c58254a958d8fa81a2a8d5d651477acae75bd9405ee5f181",
"name": "Lighter on Robinhood verifier",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "robinhood:0xA3c70B197AcE329D9e09C753DA7874B78F1D00f4"
}
],
"verificationStatus": "notVerified",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
},
{
"hash": "0xc8ffb171b6ebf0bba84df27eaa1021550c5242b146739c704221b456203630a9",
"name": "Lighter Desert verifier",
"sourceLink": "https://github.com/elliottech/lighter-prover/tree/23d1596b832db24f1007e20220ba1556d23b0c68/desertexit/circuits",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x866418061d4C1168e1c8E8f6facE79675395E008"
},
{
"address": "robinhood:0x56aeED6920DBB9E198C2C0072147A45684A06E10"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "The verification process below is based on the `build.sh` [script](https://github.com/elliottech/lighter-prover/blob/23d1596b832db24f1007e20220ba1556d23b0c68/desertexit/build.sh) in the lighter-prover repo. It consumed around 100 GiB of memory at the peak, so we recommend rerunning it on a machine with 128 GiB of RAM.\n\nThe steps below are for Ubuntu 22.04 OS.\n\n1. Install rust, gcc, go version 1.21 and later.\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n. .cargo/env\n\nsudo apt update\nsudo apt install build-essential\nsudo apt install jq\n\n# one way to install latest go on Ubuntu 22.04\nwget https://go.dev/dl/go1.21.0.linux-amd64.tar.gz\nsudo tar -xvf go1.21.0.linux-amd64.tar.gz\nsudo mv go /usr/local\nexport GOROOT=/usr/local/go\nexport GOPATH=$HOME/go\nexport PATH=$GOPATH/bin:$GOROOT/bin:$PATH\nsource ~/.profile\n```\n\n2. Run the correct version of the script to regenerate the keys.\n\n```\ngit clone https://github.com/elliottech/lighter-prover.git\ncd lighter-prover/desertexit\ngit checkout 23d1596b832db24f1007e20220ba1556d23b0c68\nchmod +x build.sh\n./build.sh\n```\n\nThe script will generate the `desertwrapper::....sol` file in the `lighter-prover/desertexit/artifacts` directory that contains the verifier smart contract with the verification keys.",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
}
]
}+3 -1
+3 -1
{
"creator": "Consensys",
"projectsForTvs": [
{
"projectId": "linea",
"sinceTimestamp": 1689112800
}
],
"proofSystemInfo": "## Description\n\n[Linea prover](https://github.com/Consensys/linea-monorepo/tree/main/prover) implements a zkEVM by creating a custom arithmetization of EVM state transition (including precompiles) and proving it in a series of recursive SNARKs (i.e. without implementing a zkVM). The proof is wrapped into a Plonk with KZG for efficient onchain verification. Linea prover targets 128 bits of security.\n\n## Proof system\n\nLinea prover includes Wizard-IOP framework for extending polynomial IOPs with more powerful queries, Arcane compiler of Wizard-IOP into polynomial IOP and Vortex list polynomial commitment (LPC) scheme.\n\nWizard-IOP represents an extension of polynomial IOP with a wider range of queries, including inclusion check, permutation check, range check etc. Vortex LPC is a batchable polynomial commitment that is based on [Ligero](https://eprint.iacr.org/2022/1608) with lattice-based hash functions. To achieve succinct proof size, Linea prover performs multiple rounds of self-recursion by arithmetizing the Vortex verifier in the Wizard-IOP framework.\n\n[Since April 2026](https://linea.build/blog/small-fields-faster-proving-on-linea-toward-real-time-finality), the zkEVM arithmetization is done over KoalaBear 31-bit field for performance reasons, utilizing its degree 4 extension for commitment openings. During the recursive rounds Plonk+KZG schemes over curves BW6, BLS12-377, and BN254 are used, creating a dependency on 3 trusted setups, see [below](#trusted-setups) for more details.\n\nLinea prover also introduces [limitless mode](https://github.com/Consensys/linea-monorepo/tree/main/prover/backend/execution/limitless), which segments the proving process into parallelizable jobs.\n\n### EVM circuits\n\nThis level of Linea prover produces execution proof and data availability proof after several rounds of self-recursive compression. Both of these are Plonk based proofs over KoalaBear field and BLS12-377 curve.\n\nExecution proof validates the correct execution of transactions within the EVM, including knowledge of correct EVM traces, correctness of precompiles and consistency of public inputs.\n\nData availability proof links compressed blob data, decompressed payloads, and execution-data commitments for EVM execution circuits.\n\n### Aggregation circuits\n\nAt this stage several proofs generated by execution and compression circuits are recursively verified within the aggregation circuit, which also checks the “connection” of all public inputs across all circuits. It leverages a composite proof system that combines several Plonk circuits on the BW6 and BLS12-377 curves with a goal of performant recursion.\n\n### Final wrap\n\nIn the end the Linea proof is wrapped in a [gnark](https://github.com/Consensys/gnark) implementation of Plonk over BN254 curve for even more efficiency onchain. For Plonk, Aztec Ignition trusted setup ceremony is used, see [below](#trusted-setups) for more details.",
"techStack": {
"zkVM": [
{
"id": "linea",
"type": "Plonk",
"name": "Linea",
"description": "Prover system of Linea written in Go, includes Vortex polynomial commitment and Arcane compiler."
},
{
"id": "EVM",
"type": "ISA",
"name": "EVM",
"description": "Instruction language for Ethereum VM."
},
{
"id": "BLS12-377",
"type": "curve",
"name": "BLS12-377",
"description": "Pairing-friendly 377-bit prime field Weierstrass elliptic curve."
},
{
"id": "BW6-761",
"type": "curve",
"name": "BW6-761",
"description": "Pairing-friendly 761-bit prime field elliptic curve introduced by Housni and Guillevic."
},
{
"id": "KoalaBear",
"type": "Field",
"name": "Koala Bear",
"description": "Prime field of order p = 2**31 - 2**24 + 1."
}
],
"finalWrap": [
{
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "AztecIgnition",
"name": "Aztec Ignition",
"participantCount": 176,
"risk": "green",
"shortDescription": "Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.",
"longDescription": "Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. \nIt included 176 participants and was publicly open for participation.\n\n- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).\n- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).\n- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition)."
},
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "Aleo",
"risk": "yellow",
"name": "Aleo stage I trusted setup",
"participantCount": 106,
"shortDescription": "Trusted setup for KZG commitments over BLS12-377 curve, initially run as Aleo's Stage I setup. Ceremony has 106 participants and was publicly open for participation.",
"longDescription": "Ceremony generated trusted setup for KZG commitments over BLS12-377 curve, it was originally run as stage I setup\nfor Aleo blockchain and later reused for Linea prover. Ceremony has 106 participants.\n\n- Repo with ceremony instructions [https://github.com/AleoNet/aleo-setup](https://github.com/AleoNet/aleo-setup)\n- Link to the ceremony details: [https://setup.aleo.org](https://setup.aleo.org/)"
},
{
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"id": "CeloPlumo",
"name": "Celo Plumo",
"participantCount": 55,
"risk": "yellow",
"shortDescription": "Trusted setup for KZG commitments over BW6-761 curve, initially run for Celo Plumo. Ceremony has 55 participants and was publicly open for participation.",
"longDescription": "Ceremony generated trusted setup for KZG commitments over BW6-761 curve, it was originally run for Celo\nPlumo and later reused for Linea prover. Ceremony has 55 participants.\n\n- Repo with ceremony instructions: [https://github.com/celo-org/snark-setup?tab=readme-ov-file](https://github.com/celo-org/snark-setup?tab=readme-ov-file)\n- Link to the ceremony details: [https://celo.org/plumo](https://celo.org/plumo) (it is broken. Archived version here: [https://web.archive.org/web/20221201203227/https://celo.org/plumo](https://web.archive.org/web/20221201203227/https://celo.org/plumo))\n- Links to ceremony transcript: [https://console.cloud.google.com/storage/browser/plumoceremonyphase1/chunks](https://console.cloud.google.com/storage/browser/plumoceremonyphase1/chunks)\n- Link to ceremony verification code: [https://github.com/Consensys/gnark-ignition-verifier/blob/feat/celo_parser/celo/main.go](https://github.com/Consensys/gnark-ignition-verifier/blob/feat/celo_parser/celo/main.go)"
}
],
"verifierHashes": [
{
"hash": "0x29483dd4b0cd0a98968ab25795ae2363ed422fe575a20f55ac331519c3e846e1",
"name": "Linea Plonk Type 0",
"sourceLink": "https://github.com/Consensys/linea-monorepo/tree/b90a3c0b6735ba39dc19356628c09c03e42c016d/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x218C3339ff3fea595c02Ac31Ca8A782f5028C4dc"
}
],
"verificationStatus": "successful",
"verificationSteps": "The regeneration process requires approximately 1 TiB of memory and approximately 400 GiB of disk space for trusted setup files and generated artifacts. It takes around 2 hours, excluding fetching 132 GiB of trusted setup assets.\nWe have verified the steps below on an Ubuntu machine.\n\n1. Install build prerequesits: `build-essential` and the latest version of go.\n2. Optionally, set up additional swap RAM. We used:\n```\nsudo apt install zram-tools\nvim /etc/default/zramswap # set algo to zstd, % to 20 and priority to 100\nsudo systemctl stop zramswap\nsudo systemctl start zramswap\n```\n3. Check out the correct version of [linea-monorepo](https://github.com/Consensys/linea-monorepo):\n```\ngit clone https://github.com/Consensys/linea-monorepo.git\ncd linea-monorepo\ngit checkout b90a3c0b6735ba39dc19356628c09c03e42c016d\n```\n4. Download trusted setup files (132 GiB) from the L2BEAT hosting server into the `prover/prover-assets/kzgsrs` dir:\n```\ncd prover/prover-assets/kzgsrs\nwget -r -np -nH --cut-dirs=1 -R \"index.html*\" https://trusted-setup-hosting.l2beat.com/files/\n```\n5. Build the circuits and the verifier contract, this step takes several hours:\n```\n# from the linea-monorepo/provers dir\nmake setup\n```\nThe build artifacts will be places into `prover/prover-assets/6.2.1/` dir, the generated verifier smart contract could be found in `prover/prover-assets/6.2.1/emulation/Verifier.sol`.",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
},
{
"hash": "0x6ffac481bc247d3ebf14238058f222f104b3b0c0d1617625c41b859045984621",
"name": "Linea Plonk Type 1",
"sourceLink": "https://github.com/Consensys/linea-monorepo/tree/477b0a4288fc54da185a992c47772c377d3ac1e9/prover",
"proofSystem": {
"id": "Gnark",
"type": "Plonk",
"name": "Gnark",
"description": "Consensys implementation of Plonk proving system written in Go."
},
"knownDeployments": [
{
"address": "eth:0x09ac9f7E5Fb37e241e0B1e52aaF01eFE0a488a77"
}
],
"verificationStatus": "notVerified",
"verificationStatus": "successful",
"verificationSteps": "The regeneration process requires approximately 1 TiB of memory and approximately 400 GiB of disk space for trusted setup files and generated artifacts. It takes around 2 hours, excluding fetching 132 GiB of trusted setup assets.\nWe have verified the steps below on an Ubuntu machine.\n\n1. Install build prerequisites: `build-essential` and the latest version of Go.\n2. Optionally, set up additional swap RAM. We used:\n```\nsudo apt install zram-tools\nvim /etc/default/zramswap # set algo to zstd, % to 20 and priority to 100\nsudo systemctl stop zramswap\nsudo systemctl start zramswap\n```\n3. Check out tag `releases/prover/v1.0.5` (commit `477b0a4288fc54da185a992c47772c377d3ac1e9`) of [linea-monorepo](https://github.com/Consensys/linea-monorepo):\n```\ngit clone https://github.com/Consensys/linea-monorepo.git\ncd linea-monorepo\ngit checkout releases/prover/v1.0.5\n```\n4. Download trusted setup files (132 GiB) from the L2BEAT hosting server into the `prover/prover-assets/kzgsrs` dir:\n```\ncd prover/prover-assets/kzgsrs\nwget -r -np -nH --cut-dirs=1 -R \"index.html*\" https://trusted-setup-hosting.l2beat.com/files/\n```\n5. Build the circuits and the verifier contract, this step takes several hours:\n```\n# from the linea-monorepo/prover dir\nmake setup\n```\nThe generated verifier smart contract can be found in the `prover/prover-assets` directory, under the `emulation/Verifier.sol` subdirectory.",
"description": "Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined."
}
]
}