# RISC Zero

Markdown version of https://l2beat.com/zk-catalog/risc0

## Summary

- Creator: RISC Zero
- Total Value Secured: $386.52 M (-11.6% compared to seven days ago)
- Trusted setups for Snarkjs (Groth16):
  - Risc0 Groth16, risk yellow (medium risk) per the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381): Circuit-specific trusted setup for Risc0 final wrap Groth16 onchain verifier. It was built on top of 55 phase 1 contributions, and reached 238 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.
  - Used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [MegaETH](https://l2beat.com/layer2s/projects/megaeth), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko), [Soon Alpha Mainnet](https://l2beat.com/layer2s/projects/soon)
  - Verifiers: 5 successful (verified by [L2BEAT](https://l2beat.com)), 1 not verified (status reported by [L2BEAT](https://l2beat.com)), 1 unsuccessful (checked by [L2BEAT](https://l2beat.com))
- zkVM: Risc0 (STARK), RISC-V 32bit (ISA), Baby Bear (Field)
- Final wrap: Snarkjs (Groth16), BN254 (curve)

### About

RISC Zero (Risc0) is a zkVM proving system for RISC-V programs.

### Links

- Website: https://risczero.com
- Docs: https://dev.risczero.com/
- Repository: https://github.com/risc0/risc0
- Social: https://x.com/RiscZero, https://youtube.com/@risczero, https://discord.com/invite/risczero

## Value Secured

The interactive TVS chart is shown on [the HTML page](https://l2beat.com/zk-catalog/risc0#tvs).

## Proof System

### Description

RISC Zero is the first zkVM proving RISC-V ISA programs. Its STARK proving system is based on a rather standard theoretical construction of [Ben-Sasson et al paper](https://eprint.iacr.org/2018/046) and [DEEP-ALI version of FRI](https://eprint.iacr.org/2019/336). The proof of zkVM execution is wrapped in Groth16 SNARK for efficient onchain verification. RISC Zero onchain verifier targets [96 bits of security](https://dev.risczero.com/api/security-model#cryptographic-security).

### Proof system

#### RISC-V circuit

RISC Zero implements a [circuit that proves RISC-V RV32IM instruction set](https://github.com/risc0/risc0/tree/main/risc0/circuit/rv32im) (see [here](https://dev.risczero.com/api/zkvm/zkvm-specification#the-zkvm-execution-model) for more details). Arithmetization of this circuit has different types of columns: control, data and accumulator. Control columns contain public data that describes the RISC-V program being executed and proven. Data and accumulator columns contain private data (accessible only to prover), data represents the running state of the processor and memory and accumulator is auxiliary data for the PLOOKUP argument.

#### Recursion circuit

RISC Zero prover supports recursive proving of RISC-V programs using [recursion circuit](https://github.com/risc0/risc0/tree/main/risc0/circuit/recursion). This is a separate STARK circuit that is designed to efficiently generate proofs for the verification of STARK proofs, it uses the same proving system as the RISC-V circuit.

Big programs are split into several segments that are executed and proven in parallel. Segment receipts (i.e. proofs of correct execution) are verified with recursion circuits and succinct receipts are produced. These succinct receipts could be recursively joined in pairs of two until a single succinct proof of the whole execution is produced.

#### Final wrap

RISC Zero [implements a SNARK wrapping](https://github.com/risc0/risc0/tree/main/risc0/groth16) of a recursive succinct receipt into a Groth16 proof over BN254 curve for onchain verification. This Groth16 R1CS circuit uses a circuit-specific trusted setup, the ceremony was run by RISC Zero, see [below](https://l2beat.com/zk-catalog/risc0#trusted-setups) for more details.

The final wrap circuit has a [control root](https://dev.risczero.com/terminology#control-root) public input that depends on the RISC-V and recursion circuit versions. This design allows upgrading RISC Zero proving system without changing the final wrapper and thus without running a new trusted setup ceremony.

## Milestones & Incidents

- 2025-10-02 (incident): [[Disclosed vulnerability] Critical malicious host vulnerability](https://x.com/RiscZero/status/1973490104883990791). Release of risc0-zkvm versions 2.3.2 and 3.0.3 with a fix of critical vulnerability where a malicious host can write to an arbitrary memory location in the guest.
- 2025-08-05 (incident): [[Disclosed vulnerability] Underconstrained division vulnerability](https://x.com/RiscZero/status/1952503598056882225). Release of risc0-zkVM 2.2.0 with a fix of a signed integer division soundness vulnerability.
- 2025-06-18 (incident): [[Disclosed vulnerability] rv32im circuit soundness vulnerability](https://x.com/RiscZero/status/1935404812146725042). Release of risc0-zkVM 2.1.0 with a fix of a missing constraint in rv32im circuit that affected any 3-register RISC-V instruction.

## Trusted Setups

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Risc0 Groth16

- Risk: yellow (medium risk)
- Proof systems: Snarkjs (Groth16)

Ceremony for a circuit-specific trusted setup run by Risc0 for Groth16 circuits verifying Risc0 STARK proof.

Risc0 Groth16 builds on top of Polygon zkEVM ceremony <https://github.com/iden3/snarkjs/tree/master?tab=readme-ov-file> as phase 1. It contains 55 participants.

Phase 2 of the trusted setup was publicly announced and run with 238 participants. Ceremony transcript, as well as instructions for participation and verification
are publicly available.

- Phase 1 ceremony: <https://github.com/iden3/snarkjs/tree/master?tab=readme-ov-file>.
- Ceremony instructions: [https://risczero.com/blog/ceremony-contribution-public-instructions](https://risczero.com/blog/ceremony-contribution-public-instructions)
- Link to the verification: [https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit](https://dev.risczero.com/api/trusted-setup-ceremony#the-transcript-matches-the-circuit)
- Post with a call to community to participate: [https://x.com/RiscZero/status/1781110200923275769](https://x.com/RiscZero/status/1781110200923275769)

## Verifier IDs

List of different onchain verifiers for this proving system. Unique ID distinguishes different deployments of the same verifier from different verifiers (e.g. different versions).

### Groth16: Snarkjs

Circom / iden3 implementation of Groth16 proving system written in JS.

#### RiscZero v2.2.0

Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values.

- Verifier ID: `0xa42b7a9c647b7bea4f92660bfd9cd3c5afc91b4c40773f9fb410eb55c8402e40`
- Source: https://github.com/risc0/risc0/tree/v2.2.0/risc0
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [MegaETH](https://l2beat.com/layer2s/projects/megaeth), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko), [Soon Alpha Mainnet](https://l2beat.com/layer2s/projects/soon)

**Known deployments**

- [0xafB31f5b70623CDF4b20Ada3f7230916A5A79df9](https://etherscan.io/address/0xafB31f5b70623CDF4b20Ada3f7230916A5A79df9#code) on Ethereum, used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [MegaETH](https://l2beat.com/layer2s/projects/megaeth), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko), [Soon Alpha Mainnet](https://l2beat.com/layer2s/projects/soon)

##### Verification steps

Verification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.

To regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.

1. Install npm, rust, git-lfs:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env

sudo apt install npm git-lfs
```

2. Install snarkjs and circom v2.1.0 (from sources):
```
npm install -g snarkjs

git clone https://github.com/iden3/circom.git
cd circom
git checkout v2.1.0
cargo build --release
cargo install --path circom
export PATH="$HOME/.cargo/bin:$PATH"
```

3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:
```
git clone https://github.com/risc0/risc0.git
cd risc0
git checkout v2.0.0  # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38
git lfs install
git lfs pull --include=groth16_proof/groth16/stark_verify.circom
cd groth16_proof/groth16
circom stark_verify.circom --r1cs

# check that the circuit is correct:
shasum -a 256 stark_verify.r1cs   # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178
```

4. Download phase 1 and phase 2 trusted setup files, verify their correctness:
```
wget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau
wget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey

export NODE_OPTIONS="--max-old-space-size=32768"    # without this snarkjs runs out of mem
snarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey
```

5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.

6. Check out to the `v2.2.0` tag of risc0 repo: `git checkout v2.2.0`, commit hash should be `eff3c74bf9992401c2c68bea95eb6c93b27999ec`.
From the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`.
It will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0xce52bf56033842021af3cf6db8a50d1b7535c125a34f1a22c6fdcf002c5a1529` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.

#### RiscZero v3.0.0

Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values.

- Verifier ID: `0x10ab33bc472e3e9024d89e512d33781519ba9b1621e4fe0ffd80cd20523062a8`
- Source: https://github.com/risc0/risc0/tree/v3.0.0/risc0
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [MegaETH](https://l2beat.com/layer2s/projects/megaeth), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

**Known deployments**

- [0x2a098988600d87650Fb061FfAff08B97149Fa84D](https://etherscan.io/address/0x2a098988600d87650Fb061FfAff08B97149Fa84D#code) on Ethereum, used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)
- [0x411e56a890c5fe0712f6F345977815Ba8E7785C3](https://etherscan.io/address/0x411e56a890c5fe0712f6F345977815Ba8E7785C3#code) on Ethereum, used in: [MegaETH](https://l2beat.com/layer2s/projects/megaeth)

##### Verification steps

Verification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.

To regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.

1. Install npm, rust, git-lfs:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env

sudo apt install npm git-lfs
```

2. Install snarkjs and circom v2.1.0 (from sources):
```
npm install -g snarkjs

git clone https://github.com/iden3/circom.git
cd circom
git checkout v2.1.0
cargo build --release
cargo install --path circom
export PATH="$HOME/.cargo/bin:$PATH"
```

3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:
```
git clone https://github.com/risc0/risc0.git
cd risc0
git checkout v2.0.0  # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38
git lfs install
git lfs pull --include=groth16_proof/groth16/stark_verify.circom
cd groth16_proof/groth16
circom stark_verify.circom --r1cs

# check that the circuit is correct:
shasum -a 256 stark_verify.r1cs   # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178
```

4. Download phase 1 and phase 2 trusted setup files, verify their correctness:
```
wget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau
wget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey

export NODE_OPTIONS="--max-old-space-size=32768"    # without this snarkjs runs out of mem
snarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey
```

5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.

6. Check out to the `v3.0.0` tag of risc0 repo: `git checkout v3.0.0`, commit hash should be `96eef1c3c9c6dde65dcc2fc86791a4358fcc8e4d`.
From the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`.
It will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0xa54dc85ac99f851c92d7c96d7318af41dbe7c0194edfcc37eb4d422a998c1f56` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.

#### RiscZero Soon verifier

Verifier smart contract sources are not available on Etherscan, hash value is set to 0x0 to indicate that it is not known.

- Verifier ID: `0x0000000000000000000000000000000000000000000000000000000000000000`
- Verification: unsuccessful (checked by [L2BEAT](https://l2beat.com))
- Used in: none

**Known deployments**

- [0x455218fa82e96A6adCcf182EE8A90A93BE7a6Bc6](https://etherscan.io/address/0x455218fa82e96A6adCcf182EE8A90A93BE7a6Bc6#code) on Ethereum, used in: none

#### RiscZero v1.0.0

Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values.

- Verifier ID: `0x79325d9dc09af1afcea4dbf04db9fada7a71846045ad56daa1996bbebf9468d8`
- Source: https://github.com/risc0/risc0/tree/v1.0.0/risc0
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

**Known deployments**

- [0xf70aBAb028Eb6F4100A24B203E113D94E87DE93C](https://etherscan.io/address/0xf70aBAb028Eb6F4100A24B203E113D94E87DE93C#code) on Ethereum, used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

##### Verification steps

Verification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.

To regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.

1. Install npm, rust, git-lfs:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env

sudo apt install npm git-lfs
```

2. Install snarkjs and circom v2.1.0 (from sources):
```
npm install -g snarkjs

git clone https://github.com/iden3/circom.git
cd circom
git checkout v2.1.0
cargo build --release
cargo install --path circom
export PATH="$HOME/.cargo/bin:$PATH"
```

3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:
```
git clone https://github.com/risc0/risc0.git
cd risc0
git checkout v2.0.0  # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38
git lfs install
git lfs pull --include=groth16_proof/groth16/stark_verify.circom
cd groth16_proof/groth16
circom stark_verify.circom --r1cs

# check that the circuit is correct:
shasum -a 256 stark_verify.r1cs   # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178
```

4. Download phase 1 and phase 2 trusted setup files, verify their correctness:
```
wget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau
wget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey

export NODE_OPTIONS="--max-old-space-size=32768"    # without this snarkjs runs out of mem
snarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey
```

5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.

6. Check out to the `v1.0.0` tag of risc0 repo: `git checkout v1.0.0`, commit hash should be `f2d27817a953ca4548739164afaf065de4d9a54a`.
From the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`.
It will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0xa516a057c9fbf5629106300934d48e0e775d4230e41e503347cad96fcbde7e2e` and `0x0eb6febcf06c5df079111be116f79bd8c7e85dc9448776ef9a59aaf2624ab551`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.

#### Kailua v1.2.0 verifier

Kailua v1.2.0 introduces a dedicated KailuaVerifier wrapper contract (deployed behind a proxy) that gates proof verification with optional fault-proof permits before delegating to the underlying RISC Zero verifier at `RISC_ZERO_VERIFIER`.

- Verifier ID: `0x0000000000000000000000000000000000000000000000000000000000000000`
- Source: https://github.com/boundless-xyz/kailua/tree/v1.2.0/crates/contracts
- Verification: not verified (status reported by [L2BEAT](https://l2beat.com))
- Used in: [BOB](https://l2beat.com/layer2s/projects/bob)

**Known deployments**

- [0xa23bf38299bbCbAA01b9ea8a1d3412D9f405b97d](https://etherscan.io/address/0xa23bf38299bbCbAA01b9ea8a1d3412D9f405b97d#code) on Ethereum, used in: [BOB](https://l2beat.com/layer2s/projects/bob)

#### RiscZero v2.0.0-rc.3

Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values.

- Verifier ID: `0x55c1a9d623f4b589ad496bf8fde885abfafbcbf0129c67f1dbc78c8430b69eaf`
- Source: https://github.com/risc0/risc0/tree/v2.0.0-rc.3/risc0
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

**Known deployments**

- [0x20ff7C2Cf391a5F096A2Cc181cb41916680f8E97](https://etherscan.io/address/0x20ff7C2Cf391a5F096A2Cc181cb41916680f8E97#code) on Ethereum, used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

##### Verification steps

Verification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.

To regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.

1. Install npm, rust, git-lfs:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env

sudo apt install npm git-lfs
```

2. Install snarkjs and circom v2.1.0 (from sources):
```
npm install -g snarkjs

git clone https://github.com/iden3/circom.git
cd circom
git checkout v2.1.0
cargo build --release
cargo install --path circom
export PATH="$HOME/.cargo/bin:$PATH"
```

3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:
```
git clone https://github.com/risc0/risc0.git
cd risc0
git checkout v2.0.0  # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38
git lfs install
git lfs pull --include=groth16_proof/groth16/stark_verify.circom
cd groth16_proof/groth16
circom stark_verify.circom --r1cs

# check that the circuit is correct:
shasum -a 256 stark_verify.r1cs   # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178
```

4. Download phase 1 and phase 2 trusted setup files, verify their correctness:
```
wget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau
wget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey

export NODE_OPTIONS="--max-old-space-size=32768"    # without this snarkjs runs out of mem
snarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey
```

5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.

6. Check out to the `v2.0.0-rc.3` tag of risc0 repo: `git checkout v2.0.0-rc.3`, commit hash should be `99e8616b4e74203a5aa361a485e0196516b4b308`.
From the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`.
It will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0x539032186827b06719244873b17b2d4c122e2d02cfb1994fe958b2523b844576` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.

#### RiscZero v2.1.0

Custom verifier ID: SHA256 hash of the following values abi packed together: the bytes32 value of internal pure function verifier_key_digest() of the RiscZeroGroth16Verifier.sol, bytes32 value of `control_root` and bytes32 value of `bn254_control_id` of contract constructor values.

- Verifier ID: `0x23aae7a460d8470faa11d2b75a9005eee1d3e0bce0e88ac2288f1ada4e4664df`
- Source: https://github.com/risc0/risc0/tree/v2.1.0/risc0
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

**Known deployments**

- [0x54aCE3ED46529B4d4F3770C8Bad5dDC48717B9bF](https://etherscan.io/address/0x54aCE3ED46529B4d4F3770C8Bad5dDC48717B9bF#code) on Ethereum, used in: [Ronin](https://l2beat.com/layer2s/projects/ronin-network), [BOB](https://l2beat.com/layer2s/projects/bob), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

##### Verification steps

Verification works on a linux machine, 36 GiB of memory is enough to regenerate the verifier. Approximately 14 GiB of trusted setup files need to be downloaded.

To regenerate the verifier, both Groth16 verifier keys and constructor parameters `control_root` and `bn254_control_id` need to be regenerated.

1. Install npm, rust, git-lfs:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env

sudo apt install npm git-lfs
```

2. Install snarkjs and circom v2.1.0 (from sources):
```
npm install -g snarkjs

git clone https://github.com/iden3/circom.git
cd circom
git checkout v2.1.0
cargo build --release
cargo install --path circom
export PATH="$HOME/.cargo/bin:$PATH"
```

3. Clone risc0 repo, lfs pull the circuit for verifying Risc Zero STARK proofs and compile it into R1CS:
```
git clone https://github.com/risc0/risc0.git
cd risc0
git checkout v2.0.0  # hash 3f26f9d4c2fb8a7e5eb830ae2433c8eae67f5a38
git lfs install
git lfs pull --include=groth16_proof/groth16/stark_verify.circom
cd groth16_proof/groth16
circom stark_verify.circom --r1cs

# check that the circuit is correct:
shasum -a 256 stark_verify.r1cs   # output should be 84d3c34b7c0eb55ad1b16b24f75e0b9de307f7b74089ea4a20a998390ee24178
```

4. Download phase 1 and phase 2 trusted setup files, verify their correctness:
```
wget https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_23.ptau
wget https://risc0-artifacts.s3.us-west-2.amazonaws.com/tsc/2024-04-04/stark_verify_final.zkey

export NODE_OPTIONS="--max-old-space-size=32768"    # without this snarkjs runs out of mem
snarkjs zkey verify stark_verify.r1cs powersOfTau28_hez_final_23.ptau stark_verify_final.zkey
```

5. Export the solidity verifier. Check it manually against the deployed smart contract: `snarkjs zkey export solidityverifier stark_verify_final.zkey verifier.sol`.

6. Check out to the `v2.1.0` tag of risc0 repo: `git checkout v2.1.0`, commit hash should be `0f60032dce731863eba197c8494bdf455445c4af`.
From the risc0 repo root dir, call `RUST_LOG=info cargo xtask bootstrap`.
It will output computed `allowed_control_root` and `bn254_identity_control_id` that could be compared with the contract constructor values: `0x884389273e128b32475b334dec75ee619b77cb33d41c332021fe7e44c746ee60` and `0x04446e66d300eb7fb45c9726bb53c793dda407a62e9601618bb43c5c14657ac0`. Note that the bytes of `bn254_identity_control_id` will be output in the reversed order.

## Program Hashes

List of known guest zkVM programs used by this prover. Each program represents a piece of offchain execution that is verified onchain. The program hash serves as the program's unique identifier.

### Kailua fault proof program MegaETH

Program that executes OP Kona client to derive blocks and generate fault or validity proofs, is a part of ZK non-interactive kailua fault proof system. 

- Hash: `0xf0ce5d15fa89991210ca2667b7f7a8bb740ce551c0f2b20cc76f9debc55d22c2`
- Repository: code unknown
- Verification: unsuccessful
- Used in: [MegaETH](https://l2beat.com/layer2s/projects/megaeth)

#### Verification steps

The sources for this program are under development and not published yet. The hash cannot be independently regenerated.

### Proposal program of Raiko2 v0.8.0-rc1

Proves a Taiko Shasta proposal state transition with Raiko2.

- Hash: `0xd6ab71c22201c23ef512b706f2e2d720f6da1b559fb76834aa9d4e35276f6e10`
- Repository: https://github.com/taikoxyz/raiko2/blob/v0.8.0-rc1/guests/risc0/src/shasta_proposal.rs
- Verification: successful
- Used in: [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

#### Verification steps

Dependencies: Git, Rust/Cargo, Docker with a running daemon, and either `just` or the equivalent Cargo command below. The build pulls Docker images and locked Rust/git dependencies.

1. Check out the correct tag in [raiko2](https://github.com/taikoxyz/raiko2):
```
git clone https://github.com/taikoxyz/raiko2.git
cd raiko2
git checkout v0.8.0-rc1
```
Commit hash should be `8b2147a0e74ba6387938cf35544797fb1b61cc07`.
2. From the `raiko2` root dir, rebuild the Shasta guest ELFs from source:
```
just build-guest all --force
```
If `just` is unavailable, run the equivalent command:
```
cargo run -r -p xtask -- build-guest all --force
```
This exports fresh ELFs to `crates/guests/elf`.
3. Generate the guest digest summary from the rebuilt ELFs:
```
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output /tmp/raiko2-v0.8.0-rc1-guest-digests.json
```
4. In `/tmp/raiko2-v0.8.0-rc1-guest-digests.json`, find the entry with `object_name: "risc0_shasta_proposal"` and `digest_source: "image_id"`. Its `digest` field should match this program hash.

Reference: [Raiko2 v0.8.0-rc1 release](https://github.com/taikoxyz/raiko2/releases/tag/v0.8.0-rc1), rolled out by Taiko multisig proposal `0xa3cd408eabf658ce08f25450f837679f09269742eabc672fbbf4479db59ec2cf`.

### Aggregation program of Raiko2 v0.8.0-rc1

Aggregates Raiko2 proofs for multiple Taiko Shasta proposals.

- Hash: `0xdd9b8abff96c409ae2418edfb51d893ea2bd10f4873a0226f17a6998c1afc1b7`
- Repository: https://github.com/taikoxyz/raiko2/blob/v0.8.0-rc1/guests/risc0/src/shasta_aggregation.rs
- Verification: successful
- Used in: [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko)

#### Verification steps

Dependencies: Git, Rust/Cargo, Docker with a running daemon, and either `just` or the equivalent Cargo command below. The build pulls Docker images and locked Rust/git dependencies.

1. Check out the correct tag in [raiko2](https://github.com/taikoxyz/raiko2):
```
git clone https://github.com/taikoxyz/raiko2.git
cd raiko2
git checkout v0.8.0-rc1
```
Commit hash should be `8b2147a0e74ba6387938cf35544797fb1b61cc07`.
2. From the `raiko2` root dir, rebuild the Shasta guest ELFs from source:
```
just build-guest all --force
```
If `just` is unavailable, run the equivalent command:
```
cargo run -r -p xtask -- build-guest all --force
```
This exports fresh ELFs to `crates/guests/elf`.
3. Generate the guest digest summary from the rebuilt ELFs:
```
cargo run -r -p xtask-build-guest --bin guest-digests --features digests -- \
  --output /tmp/raiko2-v0.8.0-rc1-guest-digests.json
```
4. In `/tmp/raiko2-v0.8.0-rc1-guest-digests.json`, find the entry with `object_name: "risc0_shasta_aggregation"` and `digest_source: "image_id"`. Its `digest` field should match this program hash.

Reference: [Raiko2 v0.8.0-rc1 release](https://github.com/taikoxyz/raiko2/releases/tag/v0.8.0-rc1), rolled out by Taiko multisig proposal `0xa3cd408eabf658ce08f25450f837679f09269742eabc672fbbf4479db59ec2cf`.