Zero Knowledge Proofs in Solidity: SnarkJS Verifiers Tutorial

EIP 2537 proposes adding pre-compiled operations for the BLS12-381 elliptic curve to Ethereum. This modern curve supports pairings, enabling cryptographic aggregation that allows over a million validators to sign blocks efficiently. Unlike the older BN254 curve (80-bit security), BLS12-381 provides approximately 128 bits of security. Precompiles provide native implementations bypassing the EVM, significantly reducing gas costs for complex cryptographic operations like point addition, scalar multiplication, and pairings.

Real-time proving enables light validation, allowing users on mobile devices to validate blocks within seconds. For clients to become ZK clients, they need real-time proving to verify new blocks quickly. The EVM in EVM pre-compile allows EVM execution within the EVM, taking pre-state, post-state, state diff, and proofs as input. This enables native rollups that are easy to program (one line of code), correct by construction, and enable governance synchrony where L1 hard forks immediately update all native rollups.

Standard Ethereum pre-compiles are built-in EVM opcodes for cryptographic operations that would be prohibitively expensive in gas. Examples include EC_RECOVER (recover account from signature), MOD_EXP (modular exponentiation), and others. These are implemented in Rust and exposed to the EVM at specific addresses. They enable contracts to perform cryptographic operations efficiently. Moonbeam can extend this by adding custom pre-compiles for parachain-specific functionality.

Implementing consensus verification on-chain is prohibitively expensive due to two major challenges: tracking all validators' staked amounts and managing state changes (withdrawals, additions, slashing), and verifying BLS 12-381 signatures which EVM lacks pre-compiles for. Ethereum 2.0's sync committee reduces this to 512 randomly chosen validators every 27 hours, but verification remains too gas-expensive. The solution is zero knowledge proofs (ZK SNARKs), which move expensive computation off-chain and roll it up into succinct proofs that can be verified on-chain very cheaply. This enables gas-efficient light clients and scales cross-chain composability by making consensus verification accessible across diverse blockchains.

An EVM interpreter precompile serves as a trustworthy compute engine for executing bytecode on-chain. It provides context data including stack state after operations and execution statistics. The system accepts bytecode, input, gas limit, and value parameters, returning ABI-encoded results. This enables composing and executing bytecode fragments directly in a spreadsheet environment, with analysis performed on-chain in a trustless, controlled environment. The approach eliminates reliance on centralized entities for correct computing, leveraging the mainnet global environment and EVM for trustworthy computation.

WebAssembly enables safe sandboxed execution of programs in browsers, allowing users to execute ZK programs locally on their machines. Users provide inputs without sending them to third parties, producing results and proofs that are then shared with services. Since execution happens locally and disconnected from the internet, sensitive data cannot be exposed. This enables trustless and privacy-preserving verification where platforms receive only proof results, not underlying data.

Privacy is a critical but underappreciated aspect of blockchain adoption. Most business owners would not feel comfortable publishing all their financial transactions online, yet many blockchains lack privacy features. Local proving enables full privacy preservation because sensitive data never leaves the user's machine - only encrypted data is sent to the network. For transactions, only the sender and recipient need to know the amount, while no one else can learn transaction details. SAI Protocol supports both local proving and network proving to accommodate different use cases. For privacy-preserving applications, users generate all proofs locally. For devices with limited resources, users can generate only signature witnesses and send them to network provers, who generate the full proofs.

Client-side proof verification extends the privacy paradigm from proof generation to proof validation. While initial implementations required sending proofs to on-chain contracts for verification, client-side verification allows users to validate proofs directly within their wallets or signers. This approach leverages peer-to-peer networks where proofs can be shared and verified locally before any on-chain submission. By performing verification locally, the on-chain footprint is dramatically reduced, lowering transaction costs and improving user experience. This represents a significant advancement in making privacy-preserving applications accessible and efficient for everyday use.

Light Protocol moves program logic from on-chain Solana programs to client-side using ZK circuits, which encode rules for creating zero-knowledge proofs. Proof generation takes 0.5-2 seconds on typical devices (100-300ms in node environments). The proof is sent on-chain and verified in a single transaction, enabling private transactions without revealing state details. Shielding moves tokens from public Solana addresses to private Light Protocol balances via a token PDA, where users receive encrypted UTXOs. Unshielding reverses this process. This creates a private liquidity pool while maintaining the ability to move funds in and out. Privacy should be combined with transparency for mainstream adoption—for NFT trading, everyone should see listings (public state) but not trade execution details (private state).

Fast client-side proof generation is essential for privacy-preserving systems usable on consumer devices. Noir uses multiple cryptographic protocols to achieve operations like proving email provenance in 5 seconds on a phone. Privacy-preserving systems interacting with the real world must validate Web2 cryptography within ZK environments, requiring library support for messy Web2 cryptographic primitives from the late 90s and 2000s. The speaker emphasizes that supporting this messy legacy infrastructure is critical for real-world integration. This enables systems to talk to real-world systems using existing Web2 infrastructure while maintaining privacy guarantees.

This video presents a comprehensive comparison of three Zero Knowledge Proof DSLs (Circom, Halo2, and Noir) for app developers, demonstrating through hands-on integer division implementation that each tool has distinct trade-offs: Circom offers the fastest browser proving (up to 20 million constraints) and easiest prototyping but requires cryptographer-like thinking due to R1CS constraints; Halo2 provides the fastest proving speed and most flexibility with custom gates but has higher learning curve; Noir offers the best developer experience with native-like syntax and automatic range checking but currently has slower proving times and is less production-ready. The speaker recommends Noir for beginners (0 to 1), Circom for production apps (0.5 to n), and Halo2 for maximum flexibility despite its complexity.

Noir is a domain-specific language (DSL) designed to abstract away low-level circuit construction from ZK-provable programming, enabling developers without cryptographic expertise to write privacy-preserving applications. The language compiles to an intermediate representation (ACIR) that can be optimized and compiled to various proving systems like Aztec's Breitenberg backend (using TurboPlonk), Marlin, or Halo2. Noir provides a Rust-like syntax with features including field types (254-bit for Aztec), compound data types (arrays, tuples, structs), control flow (loops, conditionals), and a standard library with optimized cryptographic primitives like Pedersen hash and Merkle tree operations. The development workflow involves three steps: setup (writing Noir programs with nargo), prove (generating ZK proofs), and verify (verifying proofs), with public inputs specified using the 'pub' keyword.

Noir is a Rust-based programming language for building zero-knowledge proof applications, serving as the frontend for the Aztec protocol. Unlike Circom which focuses on writing circuits based on R1CS constraints, Noir allows developers to write actual code rather than circuits, making it more developer-friendly. The language compiles to ACIR (Abstract Intermediate Circuit Representation), which can then be optimized and compiled to various backend proving systems like PLONK and Marlin. Noir is backend-agnostic and can interface with Solidity verifier contracts for deployment on blockchains like Ethereum.

Zero-knowledge proof development follows a standardized workflow across different domain-specific languages (DSLs): developers create circuits defining mathematical assertions, generate proofs using private and public inputs, compile Solidity verifier contracts, and deploy them on EVM-compatible blockchains like Scroll to enable privacy-preserving smart contracts where computations can be verified without revealing sensitive data.

Zero knowledge proofs (zkSNARKs) enable the creation of strategic games with incomplete information on blockchains by allowing players to maintain private state while proving valid state transitions. In Dark Forest, an MMO space-conquest game, players discover and conquer planets in a procedurally-generated universe by submitting hash commitments and zero knowledge proofs that verify their moves without revealing their actual locations. This cryptographic fog of war creates strategic depth impossible in traditional blockchain games, where players must balance exploration, resource management, and strategic positioning while keeping their positions hidden from opponents.

Dark Forest is a decentralized massively multiplayer online real-time strategy game built with zero-knowledge snarks on Ethereum. Players compete in an infinitely procedurally generated universe, harvesting resources and conquering planets through alliances, trade, or war. Unlike traditional games with backend servers, all game state and rules are stored in smart contracts, with every move being an on-chain transaction. The game features hidden information—individual players only access a small slice of the total map, creating the characteristic 'Dark Forest' feeling. This paradox of private state on transparent blockchains is solved through ZK snarks, enabling incomplete information games on-chain.

Implementing distributed ZK-SNARKs requires overcoming fundamental technical barriers: multiplying polynomials of degree in the billions, representing these as terabit-sized arrays, accessing large shared memory pools, and synchronizing state across machines. The core challenge lies in efficiently evaluating summations from Quadratic Arithmetic Programs (QAPs) where matrix A is 'almost sparse' - mostly sparse but with some dense rows/columns. Standard distributed join techniques (block join, skew join) fail because they either create impractically large tables or provide minimal advantage. The solution involves pre-processing density counts, isolating dense/sparse vectors, and performing hybrid joins that replicate only minimal unique elements, eliminating stragglers and enabling efficient distributed computation.

In ZK gaming, players run the game locally, generate a proof that they followed rules, and send the proof to the game contract. The contract verifies the proof and updates the game state. Players never reveal their moves. The proof ensures players cannot cheat by proving they followed all rules. The game state is updated based on these proofs, creating a trustless gaming environment where no central server is needed. This enables new types of multiplayer games where players never see each other's moves.

Blockchains like Ethereum are designed as transparent 'coaxial cables' requiring auditability for legitimacy, but this creates mechanical weaknesses since many coordination systems require information asymmetry. Programmable cryptography addresses this by enabling read, write, and execute permissions on the data stream. ZK snarks can permission who reads data while maintaining verifiable correctness. This enables decentralized games like Dark Forest where fog of war mechanics work by hiding base locations while ensuring fair gameplay, demonstrating how information asymmetry can coexist with verifiable fairness.