Polygon zkEVM

View project's detail page

Number of verifiers

Aggregation
Shows if recursive proof aggregation is used.

Yes

Trusted setup
Shows if a trusted setup is used anywhere in the proving stack.

Yes

List of verifiers

Name

Verification status

PolygonZkEvmVerifier

Not verified

Submit or ask for verification

Verifier

0x0775…Df81

Last used

Today

Description

Polygon zkEVM utilizes PIL-STARK as the main proving stack for their system. PIL-STARK is an implementation of the eSTARK protocol. The circuits and the computations are represented using the PIL and zkASM custom languages. The protocol makes use of recursive proof aggregation. The final eSTARK proof is wrapped in a fflonk proof.

Name	Proof system	Arithmetization Shows how the computation is represented mathematically.	PCS Shows what Polynomial Commitment Scheme is used.	Trusted setup Shows if the proof system requires a trusted setup.	Source code
Final wrap	fflonk	Plonk	KZG-fflonk	Powers of Tau 28	—
Aggregation circuit	eSTARK	eAIR	FRI	None	—
Main circuit	eSTARK	eAIR	FRI	None	—

Ask for verification

Description

Name	Proof system	Arithmetization Shows how the computation is represented mathematically.	PCS Shows what Polynomial Commitment Scheme is used.	Trusted setup Shows if the proof system requires a trusted setup.	Source code
Final wrap	fflonk	Plonk	KZG-fflonk	Powers of Tau 28	—
Aggregation circuit	eSTARK	eAIR	FRI	None	—
Main circuit	eSTARK	eAIR	FRI	None	—

Description

Polygon zkEVM utilizes PIL-STARK as the main proving stack for their system. PIL-STARK is an implementation of the eSTARK protocol designed specifically to prove PIL specifications. eSTARK extends the STARK proof system to support eAIR, an intermediate representation that allows to succinctly express non-equality constraints. The circuits and the computations are represented using the PIL and zkASM custom languages. The scheme makes use of the Goldilocks field, which is much smaller than alt_bn128’s field.

The protocol makes use of recursive proof aggregation. Extensive documentation can be found here. The system doesn’t implement transaction data compression yet.

The final proof is wrapped into a fflonk proof. The CRS used is the powersOfTau28_hez_final that can be found here. The instructions to regenerate the verification keys can be found here.

The differences between the zkEVM and the EVM are listed here. The source code of the zkEVM can be found here.

List of required tools

Tool name	Version	Tool docs
circom	v2.1.8	More informationMore info