0xPolygonHermez/zisk v1.4.0-alpha on GitHub

⚠️ Disclaimer ⚠️

This version serves as the foundation for the production release and is currently undergoing security and correctness audits.

Although extensive testing and validation have been performed, additional bugs or vulnerabilities may still be discovered. Users should evaluate the software according to their own requirements and use it at their own discretion and responsibility.

Feedback and bug reports are highly appreciated and help improve the reliability of the project.

Summary

Critical soundness fixes and stricter failed-execution handling
Unified proof format, typed verifier API and trusted release verification keys
Pilfflonk support as the final SNARK, with BLAKE3 as the default published setup
STIR low-degree test and a compressed proof under 256 KB
Faster proving: leaner recursion circuits, lower GPU and CPU memory, and GPU witness generation
New Ed25519 verification and non-native Poseidon2 precompile
Improved distributed proving, support for inputs up to 2 GB and streamed remote execution
Enhanced guest runtime, precompile ABI and initial WASM translation support
Per-execution host randomness and reproducible execution support

Soundness and Execution Correctness

This release strengthens execution failure handling and fixes correctness and soundness issues affecting cryptographic operations.

Ensured that failed executions cannot produce valid proofs. Traps such as unimp, ebreak and c.ebreak, writes to read-only CSRs, and exits with a non-zero code now halt execution with an error before proving.
Fixed a pairing compatibility issue that caused BN254 and BLS12-381 pairing operations with more than 32 pairs to return EFAIL. Both implementations now support arbitrary pair counts, removing the previous limit that could cause consensus divergence.
Fixed the BLS12-381 MAP_FP2_TO_G2(0) result and improved G2 cofactor clearing.
Added explicit constraints to the BLAKE2b round-chain argument to prevent invalid round selection and zero-gap chain reads.
Fixed an assembly-emulator crash when the memory trace grew during a large DMA copy.
Fixed a ROM witness failure when several programs were set up in the same process.
Added a project security policy.

Proof Format, Verification and SNARK Configuration

Unified proof format: saved proofs use the same flat layout as get_proof_bytes. Files from 1.3.1 and earlier are not accepted.
Typed zisk-verifier API that checks against an expected program VK, with in-place verification for guests.
Trusted release keys: verification uses the keys shipped with the release, not the ones carried by the proof.
Faster verification: 4–5x on the host, 5–6x fewer steps inside a guest.
pilfflonk is the final SNARK for both hash modes, with a GPU prover and Solidity verifiers. BLAKE3 is the default published setup. PLONK remains selectable with --plonk; its keys and contracts are not bundled, so verify with --plonk-vk.
STIR low-degree test: the compressed proof is now under 256 KB.
Lighter verifier builds: verifier-only builds no longer depend on the native STARK C/C++ library.

Proving Performance and GPU Acceleration

Execution cost

Unaligned memory access is enabled by default in guest builds: −12–15% execution cost on Reth.
Modular exponentiation with long moduli is up to 84% cheaper.
U256 MOD/SMOD is 26–39% cheaper, and DIV/SDIV 9–12% cheaper.

Witness generation

Keccak-f and memory witnesses are generated on the GPU, cutting total job time by 5.1%.
Added GPU generation of memory AIR witness rows for Mem, RomData, InputData and MemAlign. In the tested four-GPU benchmark, median memory-witness contribution time decreased from 0.58 s to 0.18 s per block, and total job time decreased by 5.1%.
Denser Keccak-f AIR: it fits 7.4% more operations per instance, at 11% lower cost per operation.
Lookup multiplicities are collected by Proofman, removing the witness-side counting and its large caches.
The Frops (Frequent Operations) virtual table is now computed on a single node using assembly, reducing the number of instances.

Prover

Recursion: a single recursive1 verifies several proofs, FRI batching is per column, and the BLAKE3 recursion circuits are leaner.
GPU: commits happen in place and use less memory, so large AIRs run concurrently. The quotient, FRI and evals are faster, and scheduling is smarter.
CPU: Keccak-f's peak memory drops from 36.7 to 21.5 GiB.
Startup: trace pools use huge pages and come up 3.4x faster. The first proof after start-up is as fast as the following ones.

Cryptographic Precompiles and Guest Libraries

New cryptographic capabilities and improvements to existing operations extend ZisK's support for cryptographic workloads.

Added an Ed25519 point-add precompile and accelerated ed25519_verify and ed25519_verify_strict implementations compatible with ed25519-dalek 2.x. In the tested 32-byte message case, verification cost decreased from approximately 74 million to 1.8 million cost units.
Added a non-native Poseidon2 precompile for KoalaBear. In the tested agglayer guest, the cost of verifying a KoalaBear-based STARK proof decreased from 93.7B to 6.6B cost units.
Improved BLS12-381 G2 multi-scalar multiplication, reducing its cost by approximately 33% in the tested benchmarks.
Optimized KZG point evaluation by moving a scalar multiplication from G2 to G1, reducing the tested execution steps by 29.5% and proving cost by 18.3%.
Improved BLAKE2f execution by chaining round state through a bus instead of memory, reducing the maximum-round benchmark's total cost by 29% and avoiding the previous 16 GB minimal trace.

Distributed Proving, Memory and Large Inputs

Distributed proving has been improved to handle failures more reliably, reduce memory consumption and support larger remote workloads.

Increased the guest input region to 2 GB.
Added automatic gRPC streaming for remote inputs exceeding the inline request limit, allowing large inputs to be sent in chunks without requiring callers to implement their own streaming logic.
Added size validation for streamed inputs to prevent writes beyond shared memory. Oversized inputs now fail safely without corrupting worker memory or preventing subsequent proofs.
Fixed stale shared-memory input data that could cause proofs submitted after a large-input job to fail global constraints.
A remote job is now cancelled if its client stops waiting while its input is still being pushed.
Clients can cancel jobs on Ctrl-C or timeout, and dead ASM services are restarted for subsequent jobs.
A cancelled or failed job frees the worker in under 0.5 s, all MPI ranks stop together, and workers that cannot recover restart instead of blocking the cluster. This also fixes a deadlock and a worker crash on cancellation.
Jobs for programs that are not set up are now refused at submission.
Workers now stop cleanly on SIGTERM, SIGINT or SIGUSR1 and release their shared memory.
Reworked ASM shared-memory allocation so that programs in the same process share one set of segments instead of allocating approximately 15 GiB of locked shared memory per program.
Added coordinator metrics, worker telemetry, Prometheus integration and generated Grafana dashboards covering proof phases, job outcomes, worker states, resource usage and recovery events.
Improved GPU memory planning for large and sparse workloads, and fixed several memory-planning and witness-generation correctness issues.
Moved job metadata onto the standard job request, with --metadata in the CLI and .metadata() in the SDK.
Workers deployed with --with-snark (install script, Ansible or Helm) now register their final SNARK; previously they refused every wrap job.

Guest Runtime, ABI and Portability

Guest execution and precompile interfaces have been improved to reduce overhead and support additional workloads.

Changed affected multi-argument precompiles to receive memory addresses directly through instruction operands instead of guest-allocated parameter structs.
Updated the ziskos syscall interface and transpiler to support the new calling convention. Affected precompile operations eliminate two memory indirections, reduce bus data by 16 bytes per operation and shorten the corresponding AIR execution by two clocks.
Added support for an initial WASM format translation layer, with minimal WASI integration for the examples. Broader WASM support requires further development. Thank you to gballet for his contribution.
Improved U256 bitwise operations in the big-endian guest library by copying limbs directly rather than reversing bytes, reducing operation cost without changing results.
Documented the CSR instruction sequences used by the zkVM ABI, including inline and thunk calling conventions for accelerator operations and U256 functions.
Added the UNAL8 operation to check in a single instruction whether two values, typically pointers or counts, are not multiples of 8. On misalignment, execution branches to a longer path that handles alignment, leaving the aligned path unaffected.

Per-Execution Host Randomness

Added support for zkvm_random_u64, implementing a per-execution host randomness seed for reproducible zkVM execution.

Added a 256-bit seed drawn by the host from the operating system's CSPRNG for each execution.
Added --random-seed, ZISK_RANDOM_SEED and SDK request-builder support so executions can be reproduced across emulators, MPI ranks and distributed workers.
Ensured the coordinator selects a single seed per job and distributes it to all workers and ranks.
Included the seed in execution results and serialized proof metadata.
Added a coordinator policy that rejects client-provided seeds by default, with an explicit configuration option to allow them.

The host-randomness interface follows a draft EF zkVM standard. Its generated values are free witness values and are not constrained by proof verification. Guests using zkvm_random_u64 cannot use hints.

Breaking Changes and Migration Notes

Several changes affect proof compatibility, guest code and proving configuration.

Saved proof compatibility: proof files from versions 1.3.1 and earlier are rejected by the new saved-proof decoder.
Guest syscall ABI: the affected Syscall*Params structs have been removed. Guest code using the affected precompiles must be updated to the new syscall signatures and rebuilt.
Execution termination: guests that trap, write to read-only CSRs or exit with a non-zero code now fail before proving. Guests must exit with a0 = 0 for successful execution.
Setup and verification keys: regenerate the relevant setups and verification keys to match the updated ROM, AIR and recursion circuits.
SNARK selection: --plonk now means PLONK only and --pilfflonk selects pilfflonk, in both cargo-zisk and cargo-zisk-dev. --plonk with a pilfflonk key fails with a protocol-mismatch error. Distributed workers must use compatible SNARK configurations.
SNARK renames: preload_plonk, proving_key_plonk and --proving-key-plonk become preload_snark, proving_key_snark and --proving-key-snark, and the worker's --plonk / --preload-plonk become --snark / --preload-snark. The old names keep working as deprecated aliases. HashMode::supports_snark is removed; use has_bn128_recursivef.
ProofKind rename: ProofKind::Plonk becomes ProofKind::Snark (and DomainProofKind), since it names the final SNARK of either protocol. The old name still builds as a deprecated alias and still deserializes; the wire format is unchanged.
Randomness and hints: guests using zkvm_random_u64 cannot run with hints.
ASM binary cache: clear ~/.zisk/cache after upgrading so cached binaries are regenerated with support for the new reset request.
Worker service unit: update custom systemd units to match the provided one. mpirun must be stopped with SIGUSR1, the worker must be restarted on failure, and --snark must be passed along with --proving-key-snark, or the worker registers without a final SNARK.
Job metadata API: the *Ext coordinator service and SDK types are deprecated and will be removed in the first non-alpha release.
Prover API: ZiskProver::reset is removed, jobs are started with begin_job, and execution methods take a random seed.
Coordinator API: new error codes and configuration options for random seeds, job metadata, unavailable SNARKs and oversized inputs. See the coordinator API reference.

Known Limitations

WASM support: the current implementation provides the initial translation layer and minimal WASI integration for examples; broader support requires further development.
Host randomness standard: the EF zkVM randomness standard remains a draft, and sys_rand still uses a fixed seed.