LineaConsensys

Description

Linea prover implements a zkEVM by creating a custom arithmetization of EVM state transition and proving it in a series of recursive SNARKs (i.e. without implementing a zkVM). The proof is wrapped into a Plonk with KZG for efficient onchain verification. Linea prover targets 128 bits of security.

Proof system

Linea prover includes Wizard-IOP framework for extending polynomial IOPs with more powerful queries, Arcane compiler of Wizard-IOP into polynomial IOP and Vortex list polynomial commitment (LPC) scheme. Wizard-IOP represents an extension of polynomial IOP with a wider range of queries, including inclusion check, permutation check, range check etc. Vortex LPC is a batchable polynomial commitment that is based on Ligero with lattice-based hash functions. To achieve succinct proof size, Linea prover performs multiple rounds of self-recursion by arithmetizing the Vortex verifier in the Wizard-IOP framework. During these rounds Plonk+KZG schemes over curves BW6, BLS12-377, and BN254 are used, creating a dependency on 3 trusted setups, see below for more details.

EVM circuits

This level of Linea prover produces execution proof and compression proof after several rounds of self-recursive compression. Both of these are Plonk based proofs over BLS12-377 curve. Execution proof validates the correct execution of transactions within the EVM, including knowledge of correct EVM traces, correctness of precompiles and consistency of public inputs. Compression proof verifies effective and correct compression of inputs for EVM execution circuits.

Aggregation circuits

At this stage several proofs generated by execution and compression circuits are recursively verified within the finalization (or aggregation) circuit, which also checks the “connection” of all public inputs across all circuits. It leverages a composite proof system that combines several Plonk circuits on the BW6, BLS12-377, and BN254 curve with a goal of performant recursion.

Final wrap

In the end the Linea proof is wrapped in a gnark implementation of Plonk over BN254 curve for even more efficiency onchain. For Plonk, Aztec Ignition trusted setup ceremony is used.