StarkWare, led by Eli Ben-Sasson, a co-inventor of the zk-STARK proof system, is committed to pushing the boundaries of what’s possible with its tech. And the evolution of our proving systems is a prime example of this. Circuit-based recursive proving is delivering efficiency gains to our next-generation S-two prover that were not previously possible.
With recursive circuit proving, the validation process is being reduced from minutes of computational effort to just seconds. In addition, the costs and hardware requirements are being slashed with these tailored, optimized circuits. We’ll get into that and the difference between recursive proving and circuit-based recursive proving below.
Back to Basics: Proving Systems and the Validation Process
Most systems today still rely on trust. A payment goes through, a trade settles, a blockchain updates. And if you want to verify a transaction is valid, you need to re-execute it. Re-running transactions just to make sure they were executed correctly makes the entire network slow, expensive, and inefficient.
In the blockchain context, proving systems change this. One party, known as the prover, does the work and produces a proof. Another party, known as the verifier, checks the proof and concludes it was done correctly. The prover does not share the transaction’s data (things like sender, receiver, amount), as the verifier does not require it to verify the information.
Similar to the way that a proof attests to the validity of multiple transactions, with recursive proving, a single proof is generated that attests to the validity of multiple proofs. This allows large computations to be split, proven in parallel, and aggregated, keeping the final output small and fast, regardless of how much the underlying data grows.
Previously, recursive proving on Starknet was done using Cairo. Cairo allows expressing general computational statements that can be proven by STARK proofs and verified by the corresponding STARK verifiers. In the same way that the execution of Cairo code handling thousands of transactions can be proven, one can also prove the execution of Cairo code that verifies multiple STARK proofs. This method is effective, but comes with overhead, since Cairo is a general-purpose, high-level programming language. When done numerous times, as is the case with verification in recursive proving, this overhead becomes substantial.
The Upgrade from Cairo Recursion to Circuit-Based Recursion
Now, we are moving to circuit-based recursion, which overcomes the overhead experienced with Cairo-based recursive proving. Instead of running a general-purpose program on a larger field, we encode the verifier as a fixed arithmetic circuit over the smaller M31 field. The fact that the circuit is tailored to proving recursion makes it much more efficient. Building circuits is more challenging than writing code, but the result is worth it, as explained below.
Efficiency Gains with Circuit-Based Recursion
The circuit verifier enables much faster proving of verification itself while producing significantly smaller proofs, unlocking clear efficiency gains.
- Latency: Proving the Cairo verifier takes about 1 minute, while proving the circuit verifier takes just 3 seconds. That’s a 95% decrease in latency and computational resources!
- Hardware: Proving the circuit verifier is now possible on a common laptop, while proving the Cairo verifier required dedicated machines with ample memory.
- Reduced costs: Circuit-based recursion produces smaller proofs, which are cheaper to generate and verify.
What Circuit-Based Recursion Unlocks
Privacy
Until now, fast proving was a missing element for meaningful on-chain privacy. Confidential DeFi, private payments, and zk-identity systems all require a massive volume of proofs to remain secure without exposing user data. By leveraging S-two’s circuit recursion, these complex flows become computationally light enough for real-world, scalable adoption.
In the last month, Starknet has delivered major privacy announcements with STRK20 and strkBTC. STRK20 is a protocol-level framework that brings privacy capabilities to ERC20s on Starknet, enabling private transfers, staking, and anonymous swaps in DEXs. These private transactions require high throughput (and therefore efficient proving) at low cost, which is enabled by in-protocol S-two proofs.
Decentralization
As proving becomes more hardware-efficient, it becomes possible to distribute the workload across a broad network of participants rather than a few large operators. This is an important step towards a fully decentralized Starknet, where the proving layer itself can be decentralized.
Client-Side Proving
The reduced proving costs achieved by circuit-based recursion also bring S-two a step closer to client-side proving. Clients will be able to generate smaller proofs using circuit-based recursion and send smaller proofs over the network.
Faster Settlement
Starknet is working on achieving faster settlement times as an L2 on top of Ethereum. This requires faster proof aggregation by SHARP. To achieve this, SHARP will soon incorporate circuit-based recursive proving, and the L1 verifier (solidity) will be changed to verify a S-two circuit proof.
Stay Tuned
StarkWare is committed to consistently pushing its technology to greater heights. By advancing from Cairo-based recursion to circuit-based recursion, we are pushing our proving tech to be ever more efficient and optimized to fit more everyday use cases.
Stay tuned to learn about what’s next for S-two.
And keep an eye on the StarkWare website and the StarkWare and Starknet X handles to stay informed about other tech news and updates.
