Zero-Knowledge Proofs Explained
Master the cryptography behind Layer 2 scaling and privacy protocols. Compare zk-SNARKs vs zk-STARKs, understand trusted setups, and learn which ZK systems power zkSync, StarkNet, and Polygon zkEVM.
What Are Zero-Knowledge Proofs?
A zero-knowledge proof (ZKP) allows one party to prove a statement is true without revealing the underlying information. For example, you can prove you know a password without revealing the password itself, or prove you have $1,000 without revealing your account balance. In blockchain, ZKPs enable Layer 2s to prove thousands of transactions are valid and settled without executing each transaction on Ethereum—reducing on-chain data by 99%+ and cutting costs from $50+ per transaction to <$0.01.
Understanding this concept is a prerequisite for making informed decisions in DeFi. Most losses in crypto come from misunderstanding the fundamentals.
The key properties of ZKPs are: (1) Completeness: honest proofs are always accepted. (2) Soundness: false statements cannot be proven (with overwhelming probability). (3) Zero-Knowledge: the proof reveals nothing but the truth of the statement. This magical property powers privacy coins like Zcash and rollups like zkSync Era.
zk-SNARKs: Succinct and Non-Interactive
What Does SNARK Stand For?
SNARK = Succinct Non-Interactive Arguments of Knowledge. "Succinct" means the proof is tiny (~128-256 bytes, ~40 times smaller than alternatives). "Non-interactive" means the prover generates a proof without back-and-forth with the verifier. "Argument" means soundness holds against polynomial-time attackers (not information-theoretically). SNARKs require a trusted setup: a one-time ceremony to generate public parameters (CRS—Common Reference String). If the randomness used to generate these parameters leaks, an attacker can forge proofs.
Trusted Setup: A Double-Edged Sword
zk-SNARKs rely on an assumption called "knowledge of exponent" (KOE), which requires destroying a piece of randomness after setup. zkSync Era uses the Ethereum Powers of Tau ceremony, a multi-party computation involving 200+ global contributors. If even one contributor properly destroys their randomness, the setup is secure. However, in theory, if all contributors collude and keep their randomness, they could create fake proofs. In practice, this is unlikely but remains a philosophical risk.
Why zkSync Era Chose SNARKs
zkSync Era uses zk-SNARK proofs with Boojum (a custom SNARK implementation). Proof size: 128-256 bytes. On-chain verification cost: 200K-400K gas (~$2-4 at 100 gwei). With ~6,000 transactions per proof (batching), the cost per transaction = $0.0003-0.0007. zkSync's TVL peaked at $450M in 2023 and holds ~$350M as of April 2026. The tradeoff: compact proofs, high throughput, minimal on-chain footprint. The risk: trusted setup assumption (distributed among 200+ parties, so practically acceptable).
zk-STARKs: Transparent and Scalable
What Does STARK Stand For?
STARK = Scalable Transparent Arguments of Knowledge. "Scalable" refers to proof generation and verification time (both grow sub-linearly with computation). "Transparent" means no trusted setup: all public parameters are derived from public randomness (like blockhashes), with no toxic waste. "Argument of Knowledge" is the same as SNARKs. STARKs use collision-resistant hash functions (SHA-256, Keccak) instead of elliptic curves, making them resistant to quantum algorithms (Shor's algorithm doesn't apply to hashes).
Proof Size: The Tradeoff
zk-STARK proofs are larger: 50-100 KB depending on the statement being proved. On-chain verification cost: 4M-6M gas (~$200-300 at 100 gwei). This is 50-100x more expensive than zk-SNARKs per proof. However, STARKs can be recursively composed: prove-of-proofs. StarkNet uses L2->L3 STARK compression, and Ethereum uses Ethereum Poseidon hashing to compress multiple STARKs into one final STARK. Over time, STARK proof size and verification costs have improved through techniques like FRI (Fast Reed-Solomon Interactive Oracle Proofs) and recursion.
StarkNet: The STARK Flagship
StarkNet uses Cairo (a Turing-complete language compiled to constraints) + zk-STARKs for proving. TVL: ~$120M (April 2026), vs zkSync Era's $350M. StarkNet's advantage: transparent setup, quantum resistance, long-term security model. Disadvantage: Cairo is a new language (not Solidity-compatible), smaller developer ecosystem, slower transaction processing. Transactions: ~30K/day on StarkNet vs 500K+/day on zkSync Era. StarkNet is betting on long-term adoption and quantum-proofing; zkSync is optimizing for current efficiency.
zk-SNARKs vs zk-STARKs Comparison
| Aspect | zk-SNARKs | zk-STARKs |
|---|---|---|
| Proof Size | 128-256 bytes | 50-100 KB |
| Verification Gas (Ethereum) | 200K-400K gas (~$2-4) | 4M-6M gas (~$200-300) |
| Trusted Setup? | Yes (Powers of Tau) | No (Transparent) |
| Quantum-Resistant? | No (Elliptic curves) | Yes (Hash-based) |
| Proof Gen Speed | Fast (seconds) | Slower (minutes on CPU) |
| Recursion Support | Yes (native) | Yes (with FRI compression) |
| Main Deployments | zkSync Era, Polygon zkEVM, Scroll | StarkNet, Starkware systems |
Real-World ZK Deployments
zkSync Era: The SNARK Speedrunner
zkSync Era is a zkEVM (EVM-compatible zk-rollup) using Boojum SNARKs. Deployed May 2023, ~$350M TVL, ~500K transactions/day. Transactions cost $0.0005-0.005 (vs $1-50 on Ethereum). Supported by Ethereum Foundation, used by projects like Aavee, Balancer, and Curve. The tradeoff: inherits SNARK security assumptions, but benefits from transparent setup (200+ contributors) distributing trust.
Polygon zkEVM: EVM-Equivalence
Polygon zkEVM launched January 2023, uses zk-SNARKs (Pil-powered), ~$200M TVL. Goal: bytecode-equivalent with Ethereum (vs zkEVM and others which are EVM-equivalent). All Solidity contracts work without modification. Backed by Polygon (Aave investor), supported by Matter Labs (zkSync creator) and Starkware. Proof size: 144 bytes, verification cost: 250K gas. Transactions: ~$0.0001-0.001. Large developer migration expected as Polygon upgrades infrastructure.
Scroll: The EVM-Compatible SNARK Layer 2
Scroll is an EVM-equivalent zk-rollup (not bytecode-equivalent) using Halo 2 SNARKs (no trusted setup variant). Deployed Sept 2024, ~$100M TVL, ~50K transactions/day. Transactions cost $0.0008-0.005. Scroll's innovation: Halo 2 SNARK eliminates toxic waste risk via recursive composition, providing SNARK efficiency without trusted setup. Smaller ecosystem than zkSync but growing developer interest due to pure EVM compatibility.
StarkNet: The STARK Challenger
StarkNet (by Starkware) uses Cairo + zk-STARKs. Deployed 2021, ~$120M TVL, ~30K transactions/day. Transactions cost $0.005-0.05 (higher than SNARK-based systems due to larger proofs). Advantage: quantum-resistant, transparent setup, long-term security model. Disadvantage: Cairo is a new language (not Solidity-compatible), smaller developer ecosystem, slower transaction processing. StarkNet is positioning as the long-term secure chain, attracting institutions and researchers focused on future-proofing.
Zcash: Privacy via zk-SNARKs
Zcash (ZCASH, $4B market cap) enables optional privacy using zk-SNARKs. Shielded transactions hide sender, recipient, and amount. ~30% of Zcash circulating supply held in shielded pools, ~70% transparent. Shielded transaction process: user proves (via SNARK) possession of funds without revealing them, proof verified on-chain in <100ms, new shielded notes created. Drawback: shielded transactions require 2-3 seconds client-side computation. Zcash pioneered practical privacy via ZKPs; trust in its trusted setup remains strong (Powers of Tau with 200+ participants).
Quantum Resistance and Future-Proofing
Why Quantum Computers Threaten SNARK Security
Elliptic curve cryptography (ECDSA, used in SNARKs) relies on the discrete logarithm problem being hard. Shor's algorithm, running on a quantum computer with ~2,000 logical qubits, can solve discrete logarithm in polynomial time, breaking elliptic curves. Current quantum computers: ~100-1,000 noisy qubits (not logical qubits). Timeline to cryptographically-relevant quantum computers (CRQCs): estimates range from 10-30 years (2035-2055). SNARKs secured by elliptic curves will be vulnerable then.
Why zk-STARKs Are Quantum-Safe
zk-STARKs rely on collision-resistant hash functions (SHA-256, Keccak). No known polynomial-time algorithm exists to break these under quantum attack (Grover's algorithm only provides quadratic speedup, not exponential). NIST Post-Quantum Cryptography Standards (finalized Nov 2022) recommend hash-based signatures (XMSS, LMS) for long-term security. STARKs fall into this category. If quantum computers arrive in 2040, STARK-based systems will continue to work, while SNARK systems will require security upgrades.
Mitigation Strategies for SNARKs
(1) Hybrid approaches: combine SNARKs with hash-based commitments for critical security. (2) Planned migrations: prepare upgrade paths to quantum-resistant SNARKs (lattice-based or pairing-based variants) as they mature. (3) Recursive compression: compress multiple SNARKs into one STARK for final verification on Ethereum, leveraging STARK quantum resistance. (4) Governance: DAOs can vote to upgrade protocols before quantum threat becomes critical. zkSync and Polygon are monitoring quantum developments and have 10-15 year runway to migrate if needed.
Use Cases: Privacy and Scaling
Layer 2 Scaling: Proving Without Executing
ZKPs enable rollups to prove 1,000s of transactions valid with a single on-chain proof. Example: zkSync batches 6,000 transactions, generates one SNARK proof (256 bytes), submits to Ethereum. Verification: 250K gas (~$2-4). Cost per transaction: $0.0003. Without ZKPs, optimistic rollups require ~4-7 day fraud proof periods for finality; ZK rollups finalize in ~20-30 minutes (next Ethereum block). This is why ZK rollups are winning the TVL race vs optimistic alternatives.
Privacy: Proving Without Revealing
Zcash shielded transactions prove a sender has funds and the transaction balances without revealing amounts or addresses. Use case: confidential corporate payments (no competitors see your suppliers/clients). Risk: regulators scrutinize privacy coins; some exchanges delisting them. Community-driven privacy research (Electric Coin Company) is pursuing privacy regulation frameworks, trying to position ZKP privacy as a public good (e.g., privacy for whistleblowers, journalists, domestic abuse victims) rather than a tool for money laundering.
Selective Disclosure: Prove Some Properties, Hide Others
Emerging use case: prove "I am over 18" or "I have $10K in assets" without revealing identity, exact age, or exact amount. Applications: decentralized KYC (Know Your Customer), undercollateralized loans (prove creditworthiness without identity), gated Discord/Discord roles based on holdings. Libraries like circom (for SNARKs) and Cairo (for STARKs) are enabling application developers to build ZKP circuits for these use cases.
FAQ
What is the main difference between zk-SNARKs and zk-STARKs?
zk-SNARKs produce tiny proofs (128-256 bytes) but require a trusted setup ceremony and are not quantum-resistant (rely on elliptic curves). zk-STARKs produce larger proofs (50-100 KB), require no trusted setup (transparent), and are quantum-resistant (hash-based). SNARKs dominate Layer 2 scaling (zkSync, Polygon zkEVM) due to efficiency. STARKs are preferred for long-term security and quantum-resistance (StarkNet). Choose SNARKs for cost optimization today; STARKs for future-proofing.
What is a trusted setup and why do zk-SNARKs need one?
A trusted setup is a cryptographic ceremony where random numbers (toxic waste) are generated and destroyed to create public parameters for SNARKs. If toxic waste is compromised, an attacker could forge false proofs. zkSync Era uses Powers of Tau with 200+ participants, distributing trust so compromise requires collusion across many parties. zk-STARKs eliminate this risk via transparent setup (no toxic waste). For practical purposes, distributed trusted setups are low-risk due to transparency and multi-party participation.
Are zero-knowledge proofs quantum-resistant?
zk-STARKs are quantum-resistant (hash-based cryptography, NIST-approved). zk-SNARKs are NOT quantum-resistant (elliptic curve cryptography breaks under Shor's algorithm). Cryptographically-relevant quantum computers estimated 10-30 years away. StarkNet chose STARKs specifically for quantum future-proofing. zkSync and Polygon (SNARK-based) have 10-15 year runway to migrate or upgrade. For long-term institutional adoption, STARKs are the safer bet.
How does proof size affect Layer 2 scalability?
Smaller proofs = cheaper on-chain verification. zk-SNARKs (128-256 bytes) verify in ~200K-400K gas (~$2-4 at 100 gwei). zk-STARKs (50-100 KB) verify in ~4M-6M gas (~$200-300). zkSync batches 6,000 transactions per proof, amortizing costs to <$0.0001/tx. StarkNet's larger STARK proofs reduce batching efficiency, raising per-tx costs to $0.005-0.05. For high-frequency trading and microsecond-sensitive applications, SNARKs win. For long-term security, STARKs are acceptable.
Which Layer 2 should I choose based on my use case?
zkSync Era ($350M TVL, SNARK-based): pick for DeFi trading, low costs, mature ecosystem, EVM compatibility. Polygon zkEVM ($200M TVL, SNARK-based): pick for bytecode-equivalence with Ethereum, minimal contract migration. StarkNet ($120M TVL, STARK-based): pick for quantum-resistant security, institutional adoption, long-term positioning. Scroll ($100M TVL, Halo 2 SNARKs): pick for pure EVM-equivalence without trusted setup assumptions. Compare TVL, ecosystem size, fee structure, and security philosophy when choosing.
How does Zcash use zero-knowledge proofs for privacy?
Zcash shielded transactions use zk-SNARKs to prove a sender has funds and transaction outputs balance inputs without revealing sender, recipient, or amount. Users enable shielded transactions; Zcash generates a SNARK proof (~2 KB) client-side in 2-3 seconds and submits to the blockchain. On-chain, the proof is verified (<100ms). ~30% of circulating Zcash ($1.2B) is held in shielded pools; ~70% is transparent. Zcash pioneered practical privacy and remains the leading privacy-focused cryptocurrency.
Educational disclaimer: This guide is for informational purposes only and does not constitute financial advice. Crypto involves significant risk — do your own research before making any decisions. Learn more about our team.
Educational disclaimer: This guide is for informational purposes only and does not constitute financial advice. Crypto involves significant risk — do your own research before making any decisions. Learn more about our team.