A multi-circuit STARK proving system built on Plonky3.
Prove and verify multiple AIR circuits in a single proof, with cross-circuit lookup arguments for shared state.
- Multi-circuit proofs — bundle multiple AIR circuits into one proof with independent trace heights
- Lookup arguments — push/pull interactions of arbitrary length between circuits, enforced via accumulator-based multiset checks
- Preprocessed tables — commit to fixed tables once, reuse across proofs
- Generic over field, hash, and PCS — the protocol is parameterized by a
StarkGenericConfig(base field via the PCS, challenge field, challenger); a batteries-included Goldilocks/Keccak instantiation is provided - Serialization —
Proof::to_bytes/Proof::from_bytesvia bincode - Parallel proving — opt-in via the
parallelfeature flag
The protocol (system, prover, verifier modules) is generic over
StarkGenericConfig. The crate ships one production
configuration, GoldilocksBlake3Config in types:
| Component | Choice |
|---|---|
| Field | Goldilocks (p = 2^64 - 2^32 + 1) |
| Extension | Degree-2 binomial extension (~2^128 elements) |
| Hash | Keccak-256 |
| PCS | FRI over Merkle trees |
A second instantiation (BabyBear field, degree-4 extension, Poseidon2 hashing) lives in the test suite to keep the protocol honest about its genericity. When writing your own configuration, pick a challenge field large enough for the target security level — the Schwartz-Zippel terms of the soundness error scale with 1/|challenge field|.
Security level is configurable via FriParameters. With log_blowup = 1 and
num_queries = 100, FRI provides ~2^(-100) conjectured soundness error
(~2^(-50) under the proven Johnson bound). See the
verifier module docs for the full soundness argument.
⚠️ Not zero-knowledge. Proofs are succinct arguments of knowledge, but traces are committed without blinding — FRI query responses reveal witness data. Do not use this when the witness must remain hidden from the verifier.
Minimal prove-and-verify (no lookups):
cargo run --example simple_proof --releasePreprocessed trace with lookups (byte range-check table):
cargo run --example preprocessed_proof --releaseMulti-circuit with lookup arguments:
cargo run --example lookup_proof --releasecargo bench --bench multi_stark --features parallelBenchmarks cover prove and verify at 2^12, 2^13, and 2^14 trace rows
using a U32 addition circuit with lookups and a preprocessed byte table.
Use --features parallel for representative numbers. Native SIMD instructions
are enabled by default via .cargo/config.toml.
MIT or Apache-2.0