We develop ZK-SNARK applications end-to-end: from circuit design to audit and deployment. ZK-SNARK (Zero-Knowledge Succinct Non-interactive ARgument of Knowledge) is a proof that you know a secret without revealing it. This sounds abstract until you face a concrete problem: proving a user is over 18 without sharing their birth date, confirming a wallet balance without exposing the address, or verifying program execution without re-running it.
Tornado Cash (before sanctions) moved ~$7 billion using ZK-SNARK to prove withdrawal rights without linking to deposit addresses (source: Tornado Cash whitepaper). Zcash protects transactions with the same technology. Polygon zkEVM proves the correctness of a batch of thousands of transactions using a single compact proof. Our engineers have hands-on experience deploying ZK in real projects, from DeFi to identity solutions.
Our team has 5+ years of experience in zero-knowledge proofs and has delivered 15+ production projects. We have a 100% success rate in audits and deployment.
How ZK-SNARKs Work: Deep Enough to Build
From Problem to Circuit
Any computational task that can be expressed as a set of arithmetic constraints (an arithmetic circuit) can be proven via ZK-SNARK. A circuit is not a regular program; it describes computation as a system of equations over a finite field.
Consider a simple task: prove that I know x such that x² + x + 5 = y, where y is public. The circuit:
signal input x;
signal output y;
signal x_squared;
x_squared <== x * x;
y <== x_squared + x + 5;
This is Circom, the primary language for describing ZK circuits (see official documentation). The compiler transforms the circuit into R1CS constraints, then into QAP, the mathematical foundation for SNARKs.
Why Groth16 Is Still the Standard
Groth16 gives the smallest proof (~200 bytes) and lowest verification gas (~250k). The downside: each circuit requires a separate trusted setup ceremony. If the circuit changes, a new ceremony is needed. Used in Tornado Cash, Zcash, and most production ZK applications.
How to Choose Between Groth16, PLONK, and FFLONK
The choice of proof system determines all other parameters: proof size, generation time, trusted setup size, and verification gas (hence gas cost).
| System | Proof size | Verify gas | Trusted setup | Prover time |
|---|---|---|---|---|
| Groth16 | ~200 bytes | ~250k gas | Per-circuit | Fast |
| PLONK | ~800 bytes | ~450k gas | Universal | Slower |
| FFLONK | ~800 bytes | ~200k gas | Universal | Slower |
| STARKs | >40 KB | >1M gas | None | Fast |
Groth16 — smallest proof and lowest verification gas. Each circuit requires a separate trusted setup ceremony; if the circuit changes, a new ceremony is needed. Used by: Tornado Cash, Zcash, most production ZK applications.
PLONK — universal trusted setup (Powers of Tau) that works for any circuit up to a certain size. The circuit can be changed without a new ceremony. Proof is larger, but acceptable for most applications. Used by: zkSync Era, Aztec Protocol.
FFLONK — an optimized version of PLONK with lower verification gas. Used in Polygon zkEVM.
We recommend Groth16 for production applications with a fixed circuit and high transaction volume (minimal verification gas). PLONK for prototypes and applications where the circuit may change.
Trusted Setup and Why It Matters
Trusted setup is a cryptographic ceremony that generates parameters for proofs. If someone retains the "toxic waste" (intermediate values), they can forge fraudulent proofs. This is not a theoretical threat: if the setup is compromised, the entire trust system collapses.
Groth16 requires a two-phase ceremony:
- Powers of Tau — universal part, independent of the circuit. Public trusted setups exist from the Ethereum Foundation (Hermez 1, 2) with thousands of participants. We use these; we do not generate our own.
- Phase 2 — circuit-specific part. For production systems, we organize a ceremony with several participants using snarkjs.
Stack and Tooling
- Circom 2 — language for writing circuits. Compiler in Rust, significantly faster than the first version. Supports templates for circuit reuse.
- snarkjs — JavaScript library for proof generation and verification, trusted setup, and exporting verifiers to Solidity.
- circomlibjs — library of standard circuits: hash functions (Poseidon, MiMC, SHA256 in-circuit), signatures (EdDSA, ECDSA), Merkle trees.
- Noir (Aztec) — alternative language with a higher abstraction level, compiles to PLONK. Easier for developers familiar with Rust syntax.
- SnarkVM / Leo (Aleo) — for Aleo blockchain if the task requires a privacy-first L1.
Typical Project: ZK Age Verification
Problem: A user proves they are over 18 using data from a verified credential (e.g., from a KYC provider). The provider signed the birth date with their key. The user does not reveal the birth date, only proves the fact.
Circuit (simplified):
template AgeVerification(merkleDepth) {
// Public inputs
signal input currentDate; // current date (public)
signal input issuerPubKeyHash; // hash of provider's public key (public)
// Private inputs (witness)
signal input birthDate; // birth date (private)
signal input signature[2]; // provider's signature (private)
signal input issuerPubKey[2]; // provider's public key (private)
// Verify provider's signature
component sigVerifier = EdDSAVerifier();
sigVerifier.msg <== birthDate;
sigVerifier.pubKey <== issuerPubKey;
sigVerifier.sig <== signature;
// Verify pubKey matches public hash
component hasher = Poseidon(2);
hasher.inputs <== issuerPubKey;
issuerPubKeyHash === hasher.out;
// Check age
signal age;
age <== currentDate - birthDate;
component ageCheck = GreaterThan(32);
ageCheck.in[0] <== age;
ageCheck.in[1] <== 18 * 365; // 18 years in days
ageCheck.out === 1;
}
The Solidity verifier is automatically generated via snarkjs and includes precompile calls for elliptic curve pairing (EIP-197). Verification gas is ~250k for Groth16.
Performance and Limitations
Proof generation time depends on circuit size (number of constraints). Estimates for Groth16 on modern hardware:
| Constraints in circuit | Prover time (CPU) | Prover time (GPU) |
|---|---|---|
| 100k | ~5 sec | ~0.5 sec |
| 1M | ~60 sec | ~5 sec |
| 10M | ~15 min | ~60 sec |
For web applications, proving in-browser is feasible for circuits up to 500k constraints (via WASM compilation). Heavier circuits require a server-side prover or a specialized proving service (Sindri, Succinct).
Poseidon hash is much more efficient in-circuit than SHA256: Poseidon ~250 constraints per hash, SHA256 ~27,000. Hence, all ZK-friendly protocols use Poseidon.
What's Included in Our Work
- Arithmetic circuit design tailored to your use case
- Circuit development in Circom/Noir with comprehensive unit tests
- Trusted setup (test for development, production multi-party for mainnet)
- Solidity verifier generation compatible with Groth16 or PLONK
- Integration of the verifier into your smart contract and TypeScript SDK
- Circuit audit covering underconstraining, overconstraining, signal aliasing
- Documentation and training for your team, including written guides and code examples
- Post-deployment support for the first month
Pricing starts from $15,000 for a simple PLONK-based circuit up to $80,000+ for complex zkApps with custom primitives and full audit.
What We Deliver
- Arithmetic circuit design for your specific task
- Circuit development in Circom/Noir with unit tests
- Trusted setup (test/production)
- Solidity verifier generation (Groth16/PLONK)
- Integration of the verifier into your smart contract and TypeScript SDK
- Circuit audit (underconstraining, overconstraining, signal aliasing)
- Documentation and training for your team
Development Process
-
Research and circuit design (1–2 weeks). We translate the business problem into arithmetic constraints. Estimate circuit size and proving time. Choose the proof system. This is the most critical phase—a design error may require a full redesign.
-
Circuit development in Circom (1–2 weeks). Write the circuit, cover with unit tests using Jest + circomlibjs. Verify mathematical correctness of constraints separately.
-
Trusted Setup. For prototypes, use test entropy. For production, organize a ceremony with multiple participants.
-
Verifier development and integration (1 week). Generate Solidity verifier via snarkjs. Integrate into the main smart contract. Develop a TypeScript SDK for the frontend.
-
Circuit audit. ZK circuits have specific vulnerabilities: underconstraining, overconstraining, signal aliasing. This is a separate audit type requiring specialization. We perform audits using Circomspect and Ecne.
Timelines range from 1 week (simple circuit, PLONK) to 3 months (complex zkApp with custom cryptographic primitives). Pricing is determined after a detailed requirements analysis. Contact us for a consultation and an accurate project estimate.
Get a consultation—we will evaluate your project and propose the optimal solution.