Talks

ZisK proves unbounded executions with continuations: each chip's trace is split into segments that are proven separately and then recursively aggregated into a single final proof. This talk lays out a Lean 4 roadmap for formally verifying that recursion. It states the soundness theorem the final proof must imply (every proof in the tree verifies, the tree is well formed, and the buses balance), specifies the STARK verifier in Lean, proves the recursive verifier circuits sound against it, and works toward generating the entire proving setup from Lean.

Proof aggregation compresses multiple proofs into one, revolutionizing proving frameworks. In this talk, I'll show how this concept generalizes to sharding programs into smaller pieces, enabling efficient proof generation and verification in zkVMs.

VADCOP is a proving method using STARKs to achieve cost-efficiency by focusing on active parts of the execution trace rather than the entire trace. Traditional modular designs, which divide machines into components and use relational arguments, face inefficiencies due to the padding of unused cells with dummy values. VADCOPs optimize performance by allowing maximum modularity and avoiding unused components, making proof generation precise and efficient without unnecessary redundancy.

After a quick intro to ZK rollups and the current zkEVM logic, we present the eSTARK proving system, followed by a live walkthrough of the Polygon zkEVM toolstack. The second half of the session, by Brian Seong, covers Plonky3.

This talk aims to demystify cryptographic pairings by explaining their implementation within Polygon's zkEVM, which presents considerable resource restrictions for such feat.

We explain how ZK rollups will benefit from EIP-4844 to reduce the prices for L2 transactions, dive into the challenges of implementing this EIP, and discuss data compression and how it complements it.

An introduction to the Polygon zkEVM as a ZK rollup and to how its prover works: batches are proven with eSTARK, recursively compressed and aggregated, and finally wrapped in a fflonK proof that is verified on L1, with real prover costs and timings. We then look at the zkEVM as a tailor-made processor (zkASM and PIL), present the hackathon tracks, including implementing the Monolith hash function in Circom, and walk through the zkEVM stack live.

PlonK is a zk-SNARK that is currently being widely adopted as the underlying proving system in numerous projects not only because it possesses a small proof size and verification time, but also because it does not require a specific trusted setup. fflonK is a variant of PlonK that offers significantly improved verifier performance, albeit at the cost of roughly tripling the prover time. fflonK achieves this through the use of a variant of the KZG polynomial commitment scheme that reduces the opening of multiple polynomials at a single point to the opening of a single polynomial at multiple points via an "FFT-like" construction.

However, the increased prover time of fflonK is not a significant concern in the context of the zkEVM, as the size of the circuit that fflonK is being applied to is relatively small thanks to a series of reductions via proof composition of a STARK-based proving system (our eSTARK). Furthermore, we have made slight modifications to fflonK to ensure a faster prover and gave the option of turning it zero-knowledge in a PlonK-style manner.