The Proof

One settlement is one proof, but it is made of many. The pool coin’s script checks only the last one.

Why STARKs

The proofs are Circle STARKs over the M31 field, made with a fork of StarkWare’s stwo.

• No trusted setup. There is no secret ceremony whose leak could let someone mint coins nobody can see. (A flaw of that kind was found in Zcash in 2018.)
• Hash-based. Soundness rests on hashes (SHA-256 and Poseidon2), not on elliptic curves.
• Checkable by script. A STARK verifier is field arithmetic, hashing and Merkle paths, which GSR’s restored opcodes can do.

The price is size. A STARK is tens of kilobytes, and its verifier is tens of kilobytes of script.

The ladder

A wallet’s proof is small (~83 KB) and quick (about a second). A settlement can carry about 1,900 of them. Checking 1,900 proofs in script is out of the question, so proofs are recursive: a proof that checks other proofs.

spend proofs ──▶ band leaves (4 each) ──▶ band nodes (5 children each) ──▶ band top
records      ──▶ DA segments (14 each) ──▶ DA nodes (5 children each)  ──▶ DA top
                                   band top + DA top ──▶ settle-top ──▶ final proof

• A band leaf checks up to 4 spend proofs, inserts their notes and nullifiers into the trees at exactly the next free positions, chains their records, and sums their fees, deposits and payouts.
• A band node checks up to 5 leaves or nodes and joins their state changes end to end. Four levels cover 2,500 contributions.
• A DA segment takes 14 records and proves they continue both the Poseidon2 chain and the fingerprint (see records). DA nodes fold segments together.
• Settle-top joins the band top and the DA top (same chain, same totals) and outputs the settlement’s statement.
• The final proof re-proves settle-top in a shape a script can check: SHA-256 Merkle trees, 7 queries, a 30-bit proof-of-work grind. A streamed prover makes it in a few gigabytes of memory, where a plain prover would need about 170 GB.

Above 20 contributions, the ladder uses portable proving units: the first layers depend only on the contributions, not on the pool’s state, so they can be proved before the batch is fixed and reused if a batch is lost. That has been built and tested at small sizes, not run at full size.

Pinned circuits

Every circuit in the ladder has a fixed identity, a fingerprint of its wiring. A parent accepts a child’s proof only if the child’s identity is the one it was built to accept, so a settlement proof cannot be assembled from a modified circuit.

Changing any circuit changes its identity, which changes every parent up to the final circuit, which changes the verifier script and so the pool’s address. Redoing that chain is a re-pin: about 1.5 to 3 hours of computing on one Mac. Circuit changes are therefore bundled. The last re-pin was on 2026-11-07, for private prover pay.

Zero knowledge

The spend proof your wallet makes is masked: random padding is mixed in so that the values it exposes do not reveal the witness (your notes, keys and amounts).

The argument for this is written out (docs/zk-proof.md in the repository): lemmas about which revealed values are covered, a simulator, and a bound. Precisely, the spend proof is statistical zero-knowledge in the programmable random-oracle model, conditional on stated facts about stwo’s code, with coverage shown by sampled rank certificates. The argument has been checked by the project and by no one else. It is not “provably ZK” in the sense of a reviewed theorem, and these docs do not call it that.

The recursion proofs above the spend proofs are not masked. They check public proofs and public records, so they hold nothing of yours to hide.

Security level

The final proof is set at 100 nominal bits: 7 queries at 10 bits each, plus 30 bits of proof of work. “Nominal” means under the proximity-gap conjecture that every deployed FRI system relies on. Its strongest form was disproved in 2025. The proven figure for these parameters is about 40–65 bits, depending on which theorem one accepts.

The project’s own position: fine for a test network; for real money, at least 112 nominal bits (9 queries, about 11 kvB more per settlement), with the proven figure stated next to it. See security.