Zero-Knowledge on L1
Kaspa's Toccata consensus ships native ZK-verify opcodes — script-level precompiles that check Groth16 and RISC Zero proofs. Working on the kUSD covenant stablecoin, we've been proving what they can actually do, live, under real consensus. Every claim below links to a confirmed on-chain transaction.
Testnet-10 only · unaudited research prototypes · not for real value · source opens with the kUSD framework release.
The primitives
One opcode, two proof systems. Costs below are measured on-chain, not from docs.
| tag | system | verify cost | ≈ compute mass | proof size | tradeoff |
|---|---|---|---|---|---|
| 0x20 | Groth16 · BN254 | 14M script units | ~294k / tx | 128 B | per-circuit trusted setup |
| 0x21 | R0Succinct · RISC Zero | 25M script units | ~474k / tx | ~222 KB | no setup — prove arbitrary Rust |
What's proven — step by step
Each step was proven live before building the next. Transaction links open the testnet-10 explorer.
A proof replaces a signature
A RISC Zero succinct receipt verifies through Kaspa’s R0Succinct precompile (tag 0x21) and authorizes a UTXO spend with no signature at all — a pure proof-gated unlock. 222 KB seal, ~474k compute mass, ~0.47 KAS fee floor.
Groth16 verifies at half the cost
First live Groth16 (tag 0x20, arkworks BN254) verify: a covenant bakes the verifying key; the spend reveals a 128-byte proof + public inputs. Measured 15.5M script units → ~294k mass, leaving ~206k headroom under the 500k limit for covenant logic.
Our own circuit verifies — then the real one does
A circuit we authored end-to-end (trusted setup → prove → serialize) clears the serialization risk, then the actual mixer statement — Poseidon commitment in a depth-20 Merkle tree + nullifier + bound recipient — verifies at the SAME ~294k mass as a trivial circuit. Groth16 verification is constant-size: the anonymity set is free on-chain.
A full shielded pool runs under consensus
zkpool.sil — a stateful singleton covenant with ZK-gated deposit and withdraw legs — ran its whole cycle live: genesis → deposit (proof advances the commitment root) → withdraw (5-input proof: membership + nullifier non-membership + spent-marker insertion, pays the recipient). Double-spend replay is rejected. Withdrawal fits in ~380k mass.
A real anonymity set, live
Multi-note run: three deposits grow one commitment tree, then a withdrawal proves “I own one of these notes” without revealing which. The deposit roots chain across all three transactions, and anonymity grows with deposits at zero extra on-chain cost per withdrawal.
What the numbers mean
Verification cost is constant
A depth-20 Poseidon-Merkle circuit verifies at the same ~294k mass as a toy circuit. Circuit complexity is paid off-chain in proving time — on-chain, only the 128-byte proof and the flat verify cost land.
One proof per transaction
At 14M script units per Groth16 verify against the 500k compute-mass ceiling, two proofs don’t fit in one tx. Protocol designs must budget exactly one verify, with ~206k mass left for covenant logic — enough, as the pool proves.
Proofs compose with covenants
The precompile isn’t just a fancy signature: it gates state transitions of a stateful covenant (commitment root, nullifier root), which is what turns “a proof verifies” into an actual protocol.
ZK is now a language primitive
A verifyGroth16(vk, proof, …inputs) builtin was added to the Silverscript compiler, lowering to the exact opcode sequence proven live — so ZK-gated covenants are written in the high-level language, not hand-assembled script.
What this is not (yet)
- Not a settlement prover. The bUSD bridge-validity circuit (Merkle-proving L2 state transitions) is designed but not written — the pool circuits prove ownership statements, not bridge state.
- Prototype cryptography parameters. The Poseidon constants are generated per-run; a deployment needs committed, audited parameters and a real trusted-setup ceremony for Groth16.
- Compiler support is local. The verifyGroth16 Silverscript builtin lives in our checkout, not upstream.
- Testnet-10 only, unaudited. Nothing here is deployed to mainnet or holds real value.
The kUSD framework source is private while under development — it opens with the release. Findings and design docs are published here in the meantime.