The Succinct ZK residency is a 1 month in-person program hosted in Succinct’s San Francisco Office from September 23rd to October 18th. Recent advances in general-purpose ZK like SP1 have finally made it possible to iterate quickly with ZK with fast performance needed for real-world use-cases.

The purpose of the residency is to bring together teams that are either integrating ZK into an existing product or working on net-new ZK applications to an in-person hub to collaborate, exchange ideas, learn, get feedback and mentorship. Working together IRL to ideate and push the space forward.

• With existing products, we hope to accelerate development timelines with tight, in-person collaboration with the Succinct team.
• With new projects exploring novel use cases, we hope to enable exploration and ideation that can lead to longer term projects or even companies.

(Building with SP1 is not required, the residency is a broader gathering of the ZK ecosystem).

If you are interested in the program, apply now. Applications are accepted on a rolling basis (until August 30th) and due to limited space, we recommend that teams apply as early as possible.

On a personal note–my cofounder John and I met at the 0xPARC summer residency. It was one of the most generative times of my life. The people and teams that came out of that residency are working on the bleeding edge of interesting ideas in ZK & applied cryptography. We want to recreate a similar environment for the ZK builders of today.

Who should participate

Growth Stage ZK Integrators‍

If you have an established product that is integrating ZK, send engineering talent to work side by side with the Succinct team and other ZK practitioners to ship a year’s worth of progress in an intensely focused “1 month hackathon”.

‍Early Stage Builders

If you’re early in your product journey and ZK is a core component, join us and work together with other ZK natives for real time protocol design feedback. Get a peek at the bleeding edge of ZK being developed in real time.

Exploration Stage Devs

If you’re a solo builder or small group of devs exploring and experimenting with new ZK-powered ideas, join the residency to collaborate and ideate with others. Come and rapidly iterate through different ideas together.

Confirmed Teams:

• Several engineers from Polygon Labs are joining us to work on the AggLayer
• Shumo Chu (co-founder & CEO) and an engineer from Nebra are joining us to build out their 2nd generation proof aggregation protocol
• Sina.eth & Joe from Witness are building in the verifiable attestation space
• Aayush Gupta (co-founder) & other engineers from ZK Email are coming to build a more expressive ZK email experience

Focus Areas

Track 1: Upgrade the stack. ZKPs are critical to make blockchains actually scalable and private. This track is ideal for teams who have an existing product they want to make better with ZKPs or teams building next-generation versions of current blockchain infra built with ZKPs from the ground up. Ideas we are excited by include:

• Making existing rollup frameworks incorporate ZKPs (OP stack, Arbitrum Nitro, etc.)
• New rollup architectures (based rollup, etc.) that benefit from ZKPs
• Make every bridge a ZK bridge (integrating optimized ZK light clients across existing bridges that support modular security mechanisms).
• Make state machines provable (MoveVM, SVM, etc.)  
• Proof Aggregation
• Scaling Bitcoin with ZKP rollups
• Scaling onchain data access and computation with ZK coprocessors

Track 2: Real-world ZK. ZKPs have applications even beyond blockchain use cases. There are many teams exploring this nascent space. New ideas that excited us include:

• P2P payments
• ZK based identity and Self-Sovereign Identity
• Web Proofs
• An Adobe photoshop plugin that generates ZKPs for every image edit (attested image editing)
• ZKML
• Credible auctions
• Data supply chain

Confirmed Advisors & Programming

World class advisors and mentors: including Georgios (CTO @ Paradigm, built Reth, Foundry, etc.), Uma Roy (co-founder of Succinct), Dev Ojha (co-founder of Osmosis)

Weekly seminars and Q&A with industry leaders every Tuesday:

• Guillermo Angeris on resource pricing in a ZK world
• Shumo Chu on proof aggregation
• Howard Wu (founder of of Aleo)
• Jason Morton (founder of EZKL)
• and more to be announced soon!

Happy hours + team presentations with people across the ecosystem every Thursday

Other Details

When: September 23rd to October 18th (4 weeks)

Where: The Succinct office (in San Francisco, near the Embarcadero) where every resident will have a dedicated workspace + desks

Stipend: There will be optional shared AirBnbs for housing and weekday meals that will be covered by Succinct. Additional discretionary funding for flights + relocation reimbursement (if not covered by your company) can be covered by Succinct on a case by case basis.

Grant Funding Support: Additional discretionary grant funding is available for builders

Deliverables & Goals: A shipped integration or product throughout the course of the residency, along with a technical write up.

Apply Now

Because applications are accepted on a rolling basis and due to limited space we HIGHLY recommend teams to apply earlier than later. Fill out the application here.

Timeline:

• Submission due date: August 30th
• Final acceptance notifications: September 6th
• Program start: September 23rd
• Program end: October 18th

Our updated performance benchmarks for SP1’s latest production-ready release (v1.1.1). Experience unparalleled performance with our new GPU prover.

TL;DR: SP1’s new GPU prover achieves state of the art performance, with the cheapest cloud costs vs. alternative zkVMs by up to 10x, across a diverse set of blockchain workloads like light clients and EVM rollups.

SP1’s performance has improved by an order of magnitude since our launch in February, thanks to relentless performance engineering and our new GPU prover. With SP1’s v1.1.1 release, SP1 is the market-leading zkVM on both performance and cost for workloads like light clients and EVM rollups.

Get started with our latest prover today through the beta version of Succinct’s prover network (sign up here). Top teams like Polygon, Celestia, Avail and more have already generated more than 10,000 proofs and proven trillions of cycles on our prover network.

SP1’S new GPU prover achieves state-of-the-art performance with up to 10X+ cheaper cloud costs

We benchmark SP1 against RISC0 on three real-world workloads (Tendermint, Reth Block 17106222, and Reth Block 19409768) using a variety of cost-efficient AWS and Lambda Labs GPUs with on-demand pricing.

We note that RISC0’s latest benchmarks against SP1 misleadingly compared our CPU performance to their GPU results. We conducted a fair, apples-to-apples comparison on identical hardware, revealing the significant advantages of our highly optimized GPU prover and precompile-centric architecture.

Our benchmarks are performed across a variety of GPU instances, ranging from AWS g6.xlarge, AWS g6.2xlarge, AWS g6.16xlarge, Lambda Labs NVIDIA A6000, and Lambda Labs NVIDIA A100. We report the cheapest cost across all machines for each zkVM. For more methodology and a raw data sheet, refer to the methodology section.

Key Takeaway. If you’re building a rollup, SP1’s proving costs per block are 10x cheaper than any other zkVM. With readily-available GPU instances on the cloud, SP1 already achieves around a tenth of a cent proving cost per transaction for average Ethereum blocks.

Use it today. If your team wants to take advantage of our GPU prover, it is available on our prover network beta today. Follow the instructions here to sign up. It will be officially available for local usage in the upcoming weeks.

Why is SP1 the most performant ZKVM?

The performance gap between SP1 and alternative zkVMs is attributable to several key factors.

SP1’s precompile-centric architecture. SP1 has support for a flexible precompile system that can accelerate any operation, including secp256k1 and ed25519 signature verification, and sha256 and keccak256 hash functions, decreasing RISC-V cycle counts between 5-10x for many programs. Most real-world workloads (especially light clients and rollups) are dominated by repetitive operations like hashing and elliptic curve operations. SP1 has been designed from the ground up to have its precompiles (which are hand-written, optimized circuits for specific operations) offer performance competitive with ZK circuits for these use-cases, while preserving the flexibility and developer experience of a zkVM.

SP1 is 100% open-source, allowing teams like Argument (formerly known as Lurk Labs) and Scroll to implement custom precompiles for their own use-cases that have dramatically decreased cycle count and  accelerated proof generation time. Reach out here if you’re interested in doing something similar.

The idea of precompiles inside zkVMs has become an industry standard since we first introduced SP1, with it becoming a part of RISC0, Valida, Nexus, and Jolt's roadmaps. Today, SP1 is the only production-ready zkVM with extensive precompiles for all the cryptographic operations that matter (keccak256, sha256, secp256k1 and ed25519 signature verification, bn254 and bls12-381 arithmetic, and soon to include bn254 and bls12-381 pairing verification).

A two-phase prover for efficient read-write memory. SP1 uses a novel memory argument which uses a single challenge from the verifier to implement consistent memory across multiple proofs. Because of this, our proof system doesn’t pay the overhead of merkelized memory, which can add significant overhead to proving workloads.

Fundamental proof system efficiencies. We use a lower blowup factor (2 versus 4), use next-generation lookup arguments (i.e., the log derivative-based LogUp), and use a variant of FRI in Plonky3 that allows us to commit to tables of different sizes which gives us more efficient trace area utilization.

Methodology

We benchmark SP1 on v1.1.1 and RISC0 on v1.0.0. We describe the methodology to our benchmarks below.

• Real-world programs. We benchmark with programs that reflect genuine real-world usecases, like a Tendermint light client and Reth with 2 Ethereum blocks.
• End-to-end proving time. We measure only witness generation and proving time, excluding prover setup and verification.
• Constant proof size. Both systems generate proofs of constant size, using recursive verification of proofs for long RISC-V executions.
• Precompiles. Whenever available, we enable precompiles for both SP1 and RISC0.
• Hardware Acceleration. We enable hardware acceleration whenever available on both CPU and GPU. On CPU, SP1 has support for AVX and NEON, while RISC0 does not. On GPU, both SP1 and RISC0 have support for CUDA.

We do not benchmark against Valida and Jolt as the projects are still early in development and cannot run most of our benchmarking programs and do not have support for recursion.

Lastly, note that due to the very complex, multi-dimensional nature of zkVM performance (including factors like hardware, single-node vs. multi-node performance, memory usage, recursion cost, hash function selection) these benchmarks only present a simplified view of performance. We tried our best to provide as fair of a comparison as possible, although it is difficult for a single benchmark to capture all nuances.

All benchmarks are reproducible using the repository here and here is a full breakdown of our results.

Performance Roadmap

SP1’s performance is improving everyday and we expect it to continue improving significantly over the upcoming months. A quick preview of what to expect:

• A next-generation recursion system. We’re working on a new architecture for our recursion system which can combine the performance of circuit-based recursion while supporting precompiles. This will improve end-to-end performance by ~2x.
• Optimizing our two-phase prover approach. Right now we utilize a two-phase prover to have a more efficient representation of read-write memory. We recently discovered a method that will dramatically cut down the cost of phase 1 proving. This will improve end-to-end performance by 1.5x-2x.
• Better arithmetization in costly AIRs. We also have discovered better ways to arithmetize our mostly commonly used tables, such as the CPU, which will cut down proving time by another 33% for certain workloads. This will improve performance by 1.5x.
• And much more.

In the upcoming weeks, we’ll be sharing a more comprehensive overview of our performance roadmap and the future costs you can expect when proving with SP1.

Interested in using SP1?

SP1 is chosen by the best teams for production usage of ZKPs. We’re proud to be working with incredible partners, including Polygon, Celestia, Avail, Hyperlane, Taiko, Sovereign, Nebra, LayerN, Noble, Interchain Foundation, Witness, Nubit, Alpen and many others who are using SP1 for a diversity of use-cases such as rollups, interoperability, bridging, coprocessors, proof aggregation, verifiable attestations and more.

If you’re interested in using SP1 for any of your protocol’s ZKP needs, feel free to get started with the docs and also fill out this form to schedule a call with me or Uma.

In its February release, SP1 did not have recursion and onchain verification, limiting it to offchain use-cases. Today, we are excited to announce the implementation of SP1’s performant STARK recursion, enabling blazing fast end-to-end ZK proof generation with onchain verification on any EVM-compatible chain.

With this testnet launch, SP1 is the fastest, feature-complete zkVM for developers. It is the only zkVM that is fully open-source, supports the Rust standard library, has customizable precompiles for state of the art performance, and leverages the latest techniques in STARKs for performant recursion and onchain verification. Furthermore, SP1’s novel precompile-centric architecture for common operations like hashing, elliptic curve operations, and more allows for an order of magnitude performance gain for blockchain use-cases like ZK rollups, ZK bridges, and more.

Get started with the docs today or clone the project template.

SP1 is the fastest, feature-complete zkVM

Get started today: Developers can get started by following the installation instructions and creating a new project with “cargo prove new” or cloning the template repo here. Follow the docs to write programs that implement ZK light clients, ZK rollups and more. Using SP1’s SDK, developers can deploy an SP1 EVM verifier to any testnet of their choosing and generate Groth16 proofs that can be verified onchain for ~300,000 gas.

SP1 is the only zkVM with all of the features that developers need:

• Can write Rust (including std) and use existing crates: With SP1, developers can utilize existing Rust crates (including revm, alloy, tendermint-rs, serde, json, etc.) to write verifiable programs. SP1 has standard library support, allowing developers to code in Rust as they normally would.
• Recursion + Onchain verification: SP1 uses performant STARK recursion and a Groth16 STARK to SNARK wrapper to shrink the size of SP1 proofs to one that can be verifiable on any EVM chain for ~300k gas.
• Blazing fast performance: SP1’s novel “precompile-centric” architecture allows for extremely fast and cost-effective proof generation (often by an order of magnitude) for common blockchain applications like ZK rollups (including zkEVMs), ZK light clients and more.
• 100% open-source: SP1 is 100% open-source, with all constraint logic in the open and an MIT licensed codebase.
• SP1 recursion within SP1: for many use-cases, like proof aggregation or rollups, the ability to verify an SP1 proof within SP1 is critical for chaining together many proofs. SP1 supports efficient SP1 recursion and users can check out an example of this functionality in this example repository.

SP1 Mainnet Timeline: For the past few months, we have been getting SP1 audited by several world-class ZK auditing firms (alongside Plonky 3, one of SP1’s core open-source dependencies). Expect more details on SP1’s mainnet timeline in the upcoming weeks!

SP1 outperforms other zkVMs by an order of magnitude

Over the past few months, SP1’s performance has improved significantly thanks to support for AVX-512 in Plonky3, batched lookup arguments, optimized prover memory usage, and improved arithmetization. We benchmark SP1 and Risc0 on end to end proving time to get an onchain verifiable proof on a suite of realistic programs, including Merkle proof verification, a Tendermint light client and a type 1 zkEVM that leverages Reth.

We’re excited to see the vision of a precompile-centric architecture for zkVMs become a standard across the industry. RISC0 and Jolt have both recently announced that their roadmaps include adding support for precompiles. It will be interesting to revisit these results when these features get implemented by others.

Note that benchmarking is always a point in time comparison and given the complex, multi-dimensional nature of zkVM performance, any benchmark presents only a simplified view of performance. We choose to benchmark on CPU, similar to the open-source JOLT zkVM benchmark repo, but Risc0 also has support for GPUs.

SP1’s Recursion Architecture

To build performant recursion, we built an entirely new proving stack (the first open-source zkVM recursion stack) that allows for programmable verification of SP1 proofs.

• Recursion zkVM. A zkVM that implements our recursion-specific ISA (leveraging many similar primitives from our core RISC-V VM) and is heavily optimized for succinct verification.
• Recursion DSL. A custom Rust-based domain-specific-language that natively supports fields, extension fields, accelerated recursion primitives, and ZK-friendly memory. We implement a STARK verification program in this DSL.
• Recursion Compiler. A compiler that compiles programs written in the recursion DSL into multiple target backends, including our Recursion zkVM ISA and a Gnark circuit (used for PLONK-KZG verification of STARK proofs).

We believe that this toolchain, including our recursion DSL and recursion compiler, are generally useful public goods that can be utilized by many different teams to implement recursion for new proof systems, including JOLT and Binius. Please reach out to us if you’re interested in using this tooling and we are happy to provide guidance!

SP1’s updated performance vs. JOLT

We also benchmark SP1 against the newly released JOLT to provide an updated view of how SP1 compares, given its latest performance improvements. JOLT is still a work in progress, and currently does not support recursion or on-chain verification, cannot accelerate workloads with precompiles, has a relatively small upper bound on the maximum cycle count (~16 million), and only supports the RISCV32I variant of RISC-V which does not support instructions for multiplications or divisions. As a result, we can only benchmark JOLT on simple programs, such as their SHA-2 chain program used in their benchmarks (shown below). Nonetheless, given JOLT’s recency and room for further optimizations, we are impressed with its performance and find it quite an interesting line of work.

We show that SP1 out-performs JOLT for similar proof size and similar cycle count.

Appendix

End to end benchmarking on recursion and time to get to EVM verifiable Groth16 proof.

Benchmarking Methodology

The benchmarking programs can be found in this repo, including Merkle Proof Verification (SSZ withdrawals), the Tendermint ZK Light Client and SP1-Reth. For each program, we generated a proof for both zkVMs, and patched all relevant crates (including the revm, reth, sha2, crypto-bigint, curve25519-dalek and k256 crates). The “# of Cycles'” column is the number of RISC-V instructions executed by the program. The proof generation time is in seconds. Note that the cycle count for the Tendermint and Reth program is provided as 2 numbers because it is significantly smaller in the SP1 zkVM because of SP1's first-class support for precompiles. Note that all the times in the above table do not represent latency as that can be decreased with parallelized proof generation across the core and recursive stages. The core proving time + recursive proving time is the time it takes to get to a constant-sized proof. Note that SP1’s Groth16 wrapper time also includes a “shrinking” stage not present in Risc0 that adds a constant overhead of ~50 seconds, which is why the timing in that phase is longer.

SP1 was benchmarked using the poseidon2 hash function and all standard settings. All other settings were the default Risc0 prover settings in their version 0.21 release. The benchmark was run on a AWS Linux CPU machine (r7i.16xlarge) with 64 vCPUs and 512GB of RAM, with a 3-year reserved pricing of $1.92 per hour.

SP1 vs. JOLT benchmark

We benchmark JOLT with its default settings and SP1 using the poseidon hash function and with a shard size of 2^21 to make the proof size comparable to JOLT’s. The benchmark was run on a AWS Linux CPU machine (r7i.16xlarge) with 64 vCPUs and 512GB of RAM, with a 3-year reserved pricing of $1.92 per hour.

NB: Note that due to the very complex, multi-dimensional nature of zkVM performance (including factors like hardware, single-node vs. multi-node performance, memory usage, recursion cost, hash function selection) these benchmarks only present a simplified view of performance. We tried our best to provide as fair of a comparison as possible, although it is difficult for a single benchmark to capture all nuances.