Search

Search for projects by name or address

ZK Catalog

SP1 Hypercube logo
SP1 HypercubeSuccinct

About

SP1 Hypercube is a zk proving system for RISC-V programs built by Succinct, release v6.


  • Total Value SecuredTVS
    $17.94 B3.04%

  • Trusted Setups

    Used in

    Base Chain logoMantle logoCelo logoX Layer logoMorph logo

    Projects used in

    Search for projects used in

    Verifiers

    2by

    Used in

    X Layer logoApeChain logoFluent logoAppchain logo

    Verifiers

    1by

    Used in

    X Layer logoFluent logo

    Verifiers

    1by

    Used in

    Base Chain logoMantle logoCelo logoX Layer logoMorph logo

    Projects used in

    Search for projects used in

    Verifiers

    2by

    Used in

    X Layer logoApeChain logoFluent logoAppchain logo

    Verifiers

    1by

    Used in

    X Layer logoFluent logo

    Verifiers

    1by

    Tech Stack

    zkVM
    Plonky3
    RISC-V 64bit
    Baby Bear
    Koala Bear
    Final wrap
    Gnark
    SP1 v6.0.0
    SP1 v6.1.0
    BN254
  • Total Value SecuredTVS
    $17.94 B3.04%
  • About

    SP1 Hypercube is a zk proving system for RISC-V programs built by Succinct, release v6.



    Total
    Canonically BridgedCanonically Bridged ValueCanonical
    Natively MintedNatively Minted TokensNative
    Externally BridgedExternally Bridged ValueExternal

    ETH & derivatives
    Stablecoins
    BTC & derivatives
    Other

    Description

    SP1 Hypercube is the latest Succint’s RISC-VA free and open-source instruction set architecure (ISA) used in hardware and software. It is simple and well specified, for this reason it is chosen as an ISA for several zkVMs (usually 32-bit version with base integer instructions and multiplication extension RV32IM). zkVMA special type of zk proving system that proves the correctness of state transitions of a virtual machine. Computation is represented by a program in a specific instruction language, it can have private and public inputs and public outputs. Most of zkVMs are STARKs. using the Plonky3 stack. The zkVM execution is proven recursively and is wrapped into a SNARKShort for "succinct non-interactive argument of knowledge", a SNARK is a widely used type of zero-knowledge proof that is short and fast to verify. Different kinds of SNARKs are usually systematized by proof size, verification time, and type of setup. The most famous SNARKs are Groth16, PLONK/Marlin, Bulletproofs, and STARKs. for final verification. It provides tools to generate onchain Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. or PlonkA zk-SNARK proving system introduced by Gabizon, Williamson and Ciobotaru in 2019 that allows proving custom circuits. Plonk is based on KZG polynomial commitments and thus requires a universal trusted setup. verifiers. SP1 Hypercube provides 98 bits of proven security, as per Ethereum Foundation’s soundcalc evaluation.

    Proof systemThe infrastructure that allows projects to verify their state transitions. It is composed by onchain verifiers and offchain provers. The main two flavors are optimistic and ZK proof systems, but they can be combined in a hybrid model. In general though, if a system is able to accept state roots optimistically, even if it has a ZK component, it is considered an optimistic proof system.

    SP1 Hypercube is an iteration of the previous zkVM version, SP1 Turbo, introducing architectural changes that improve proverAn entity that generates the cryptographic proof to convince the verifier that the statement is true. In a ZK-Rollup, the prover generates the ZK (validity) proof to submit to the verifier contract. performance and memory efficiency.

    Hypercube proves execution of a 64-bit RISC-V VM using several ZK circuits, or chips, connected by lookup arguments (LogUp based on GKR protocol). VM execution trace is split into several shards of size approximately 2^22, that could be proven in parallel with a STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proving system. Additional arguments prove memory consistency across shards.

    The parallelized proofs are recursively checked by the next layer of STARK circuits. The correctness of the final STARK proof is verified with the final wrap SNARK program, the wrap SNARK proof is verified onchain.

    Hypercube vs. Turbo

    Proving time and memory optimizations of SP1 Hypercube are based on several design improvements compared to SP1 Turbo.

    Hypercube implements a multilinear polynomial STARK compared to univariate polynomials in Turbo. Multilinear polynomial based proving systems are more efficient than univariate because manipulating them reduces usage of log-linear FFT algorithm.

    Multilinear polynomials also allow Hypercube to innovate on a polynomial commitmentA commitment scheme that commits to a polynomial and allows generating the proof of opening the polynomial at a given point against the commitment. scheme, implementing Jagged PCS (defined in this preprint). Jagged PCS allows efficient packing of computation traces of zkVM chips with different lengths, optimizing the prover memory requirement. More efficient LogUp based on GKR is also made possible because of multilinear polynomials.

    Recursion circuits

    SP1 Hypercube provides tools for recursive proof generation by verifying proofs in a zkVM. This uses the same toolkit as top-level proof system, but proves the correct verification of all proofs generated on the previous step.

    First, proofs for correctness of separate shards are generated. These shards may have different trace shape, so in the next step they are normalized. Finally, normalized shard proofs are recursively compressed in batches of 3-4 to a single zkVM proof. For further details see this page.

    Final wrap

    SP1 Hypercube supports Plonk (with KZGA polynomial commitment scheme that allows a prover to compute a commitment to a polynomial, with the properties that this commitment can later be opened at any position: the prover shows that the value of the polynomial at a certain position is equal to a claimed value. KZG is widely used as it’s applicable both for univariate and k-variate polynomials, is efficient for batch proofs, and is able to generate many proofs at once relatively fast. It is also proof generation time efficient: the time for prover to commit to a polynomial is linear on the degree of the polynomial. polynomial commitments) or Groth16 final SNARK wrap of the STARK proof for performant onchain proof verification (link). The https://github.com/Consensys/gnark implementation of these proof systems over BN254 curve is used. For Plonk, Aztec Ignition trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. ceremony is used, for Groth16 Succinct run internal circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.-dependent phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. trusted setup (todo: link to trusted setups section).

    Aztec Ignition

    Gnark

    Detailed description

    Aztec Ignition is a trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. ceremony for KZG commitmentsA polynomial commitment scheme that allows a prover to compute a commitment to a polynomial, with the properties that this commitment can later be opened at any position: the prover shows that the value of the polynomial at a certain position is equal to a claimed value. KZG is widely used as it’s applicable both for univariate and k-variate polynomials, is efficient for batch proofs, and is able to generate many proofs at once relatively fast. It is also proof generation time efficient: the time for prover to commit to a polynomial is linear on the degree of the polynomial. over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.


    SP1 Hypercube v6.1.0 Groth16 circuit-specific setup

    SP1 v6.1.0

    Detailed description

    SP1 Hypercube v6.1.0 Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. builds on top of the first 54 contributions to the Perpetual Powers of Tau ceremony as its phase 1For Groth16 trusted setup, phase 1 represents circuit-independent part of the trusted setup (e.g. Perpetual Powers of Tau), which could be reused across different circuits. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 1 trusted setup ceremony is known, arbitrary proofs could be forged. setup.

    Phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. of the ceremony was run among 18 participants affiliated with Etherealize, Polygon, OP Labs, Alpen Labs, Offchain Labs, Succinct, Coinbase, Across Protocol. It generated circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.-specific setup parameters for Groth16 wrapper of SP1 Hypercube zkVMA special type of zk proving system that proves the correctness of state transitions of a virtual machine. Computation is represented by a program in a specific instruction language, it can have private and public inputs and public outputs. Most of zkVMs are STARKs..


    SP1 Hypercube Groth16 circuit-specific setup

    SP1 v6.0.0

    Detailed description

    SP1 Hypercube v6.0.0 Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. builds on top of the first 54 contributions to the Perpetual Powers of Tau ceremony as its phase 1For Groth16 trusted setup, phase 1 represents circuit-independent part of the trusted setup (e.g. Perpetual Powers of Tau), which could be reused across different circuits. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 1 trusted setup ceremony is known, arbitrary proofs could be forged. setup.

    Phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. of the ceremony was run among 12 participants affiliated with Across Protocol, OP Labs, Offchain Labs, Succinct Labs, Conduit, Ethrealize and 1 independent participant. It generated circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.-specific setup parameters for Groth16 wrapper of SP1 Hypercube zkVMA special type of zk proving system that proves the correctness of state transitions of a virtual machine. Computation is represented by a program in a specific instruction language, it can have private and public inputs and public outputs. Most of zkVMs are STARKs..

    List of different onchain verifiers for this proving system. Unique ID distinguishes different deployments of the same verifier from different verifiers (e.g. different versions).

    Groth16: SP1 v6.1.0

    Succinct's Groth16 final wrap circuit for SP1 zkVM v6.1.0

    Verifier
    Verification
    Used in
    Known deployments
    SP1 Hypercube Groth16 v6.1.0
    by
    X Layer logoApeChain logoFluent logoAppchain logo
    Groth16: SP1 v6.0.0

    Succinct's Groth16 final wrap circuit for SP1 zkVM v6.0.0

    Verifier
    Verification
    Used in
    Known deployments
    SP1 Hypercube Groth16 v6.0.0
    by
    X Layer logoFluent logo
    Plonk: Gnark

    Consensys implementation of Plonk proving system written in Go.

    Verifier
    Verification
    Used in
    Known deployments
    SP1 Hypercube Plonk v6.1.0
    by
    Base Chain logoMantle logoCelo logoX Layer logoMorph logo

    Projects used in

    Search for projects used in

    SP1 Hypercube Plonk v6.0.0
    by
    Mantle logoCelo logoRISE logoTaiko Alethia logo

    Projects used in

    Search for projects used in

    List of known guest zkVM programs used by this prover. Each program represents a piece of offchain execution that is verified onchain. The program hash serves as the program's unique identifier.

    Name
    Hash
    Repository
    Verification
    Used in
    0x005f...efdb
    Vector logo
    0x00b4...0745
    Molten Network logoBlobstream logo
    0x0064...28e1
    ApeChain logoAppchain logoMolten Network logo
    0x0029...0b3e
    ApeChain logoAppchain logoMolten Network logo
    0x00f5...568a
    Base Chain logo
    0x25e0...7c21
    Base Chain logo
    0x00b0...4be4
    Celo logo
    0x1dd6...5c94
    Celo logo
    0x00e3...7334
    Code unknown
    Fluent logo
    0x00f2...a34b
    Fluent logo
    0x0007...363b
    Katana logo
    0x5ae1...75b1
    Katana logo
    0x00fa...6bbf
    Mantle logo
    0x1e2b...8fdb
    Mantle logo
    0x00c4...c25c
    Morph logo
    0x00b4...0c63
    Morph logo
    0x0061...7bda
    RISE logo
    0x0285...e162
    RISE logo
    0x0025...e7c7
    Taiko Alethia logo
    0x12a1...e7c7
    Taiko Alethia logo
    0x0051...3be6
    Taiko Alethia logo
    0x28d6...3be6
    Taiko Alethia logo
    0x00d9...a085
    Code unknown
    None
    X Layer logo
    0x464b...46fc
    Code unknown
    None
    X Layer logo