Search
Search for projects by name
Tech Stack
About
Risc0 is a zkVM proving system for RISC-V programs.
Description
RISC Zero is the first zkVM proving RISC-V ISA programs. Its STARK proving system is based on a rather standard theoretical construction of Ben-Sasson et al paper and DEEP-ALI version of FRI. The proof of zkVM execution is wrapped in Groth16 SNARK for efficient onchain verification. RISC Zero onchain verifier targets 96 bits of security.
Proof system
RISC-V circuit
RISC Zero implements a circuit that proves RISC-V RV32IM instruction set (see here for more details). Arithmetization of this circuit has different types of columns: control, data and accumulator. Control columns contain public data that describes the RISC-V program being executed and proven. Data and accumulator columns contain private data (accessible only to prover), data represents the running state of the processor and memory and accumulator is auxiliary data for the PLOOKUP argument.
Recursion circuit
RISC Zero prover supports recursive proving of RISC-V programs using recursion circuit. This is a separate STARK circuit that is designed to efficiently generate proofs for the verification of STARK proofs, it uses the same proving system as the RISC-V circuit. Big programs are split into several segments that are executed and proven in parallel. Segment receipts (i.e. proofs of correct execution) are verified with recursion circuits and succinct receipts are produced. These succinct receipts could be recursively joined in pairs of two until a single succinct proof of the whole execution is produced.
Final wrap
RISC Zero implements a SNARK wrapping of a recursive succinct receipt into a Groth16 proof over BN254 curve for onchain verification. This Groth16 R1CS circuit uses a circuit-specific trusted setup, the ceremony was run by RISC Zero, see below for more details. The final wrap circuit has a control root public input that depends on the RISC-V and recursion circuit versions. This design allows upgrading RISC Zero proving system without changing the final wrapper and thus without running a new trusted setup ceremony.
Underconstrained division vulnerability
2025 Aug 5th
Release of risc0-zkVM 2.2.0 with a fix of a signed integer division soundness vulnerability.
Risc0 Groth16
Detailed description
Ceremony for a circuit-specific trusted setup run by Risc0 for Groth16 circuits verifying Risc0 STARK proof. It was publicly announced and run with 238 participants. Ceremony transcript, as well as instructions for participation and verification are publicly available.
- Ceremony instructions: https://risczero.com/blog/ceremony-contribution-public-instructions
- Link to the verification: https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit
- Post with a call to community to participate: https://x.com/RiscZero/status/1781110200923275769
List of different onchain verifiers for this proving system. Unique ID distinguishes differents deployments of the same verifier from different verifiers (e.g. different versions).