Audit reports

All Case Studies

Case Studies

About

Careers

Brand Assets

Invest

Company

Audits 

Services

Mitigate weaknesses in your smart contract and improve its functionality with a double line-to-line code analysis and a separate review by a lead auditor.

Secure the entire architecture and implementation layers of your blockchain protocol with professional security audits and testing.

Proactively detect vulnerabilities in your Web3 project by subjecting your systems to a simulated cyberattack in a secure and controlled environment.

Secure your cloud with Hacken's expert penetration testing. Our certified team delivers tailored security solutions for AWS, Azure, Kubernetes, and more, ensuring your data's safety.

Identify vulnerabilities in applications interacting with blockchain networks with secure code review and static security analysis.

Code review & static security analysis for crypto wallet apps.

Code review & security analysis for cross-chain crypto bridges.

Receive only relevant bug reports or undergo crowdsourced penetration testing with the help of thousands of ethical hackers curated by HackenProof.

Enhance transparency in crypto exchanges with independent on-chain proof of assets’ true collateralization.

Assess and strengthen your security practices, identify vulnerabilities, and safeguard valuable digital assets in the ever-evolving cryptocurrency landscape.

Ensure your token model robustness and efficiency and convey trust to investors and community with our thorough, independent audit of protocol economic security.

Solutions

Featured ecosystems

By Languages

Blog

Company 

Discover

Insights

Industry news

Network

Hacken news

Resources

Smart Contract Audit

Blockchain Protocol Audit 

Blockchain Penetration Testing

dApp Audit

Cross-Chain Bridge Audit

Crypto Wallet Audit

Bug Bounty

Proof of Reserves Audit

Solidity

Rust

Move

Solana

Near

Polkadot 

Cosmos 

Optimism

Ethereum (EVM) 

Avalanche

Fantom

Polygon

Aptos

zkSync

Arbitrum

Radix

Linea

MetaMask

Smart Contract Audit Solutions

Terms and Conditions 

Privacy Policy

<p>In the evolving blockchain landscape, <a href="https://hacken.io/discover/zero-knowledge-proof/">zero knowledge proofs</a> have emerged as the most powerful cryptographic technology allowing more privacy and scalability. Also known as arguments of knowledge, they generate proof that some computation has a particular output while verifying that proof very quickly. The zero knowledge (ZK) part is an additional privacy bonus that keeps some inputs of the computation hidden.</p>



<p>ZK-SNARK is the first and most popular implementation of this cryptographic technology, but modern ZK-EVMs also employ zk-STARK for better efficiency. In this article, we'll review and compare these two ZK-protocols – <strong>zk-SNARKs vs. zk-STARKs</strong> – shedding light on how they tackle blockchain’s <a href="https://hacken.io/discover/l1-l2-scalability/">scalability trilemma</a>.</p>



<h2 class="wp-block-heading">Brief Intro To Zero Knowledge Proofs</h2>



<p>Zero-knowledge protocol, a method that uses ZK-proofs, allows one party to quickly prove that a computation has a particular output without revealing specific inputs to that computation. The secret information to be proved and validated is called a witness.</p>



<p>Sometimes, complex concepts are better understood with simpler, everyday analogies:</p>



<p class="has-text-color has-background" style="color:#1b7bdb;background-color:#acffff">Imagine you're a baker claiming you know a secret ingredient that produces a unique gold crust when added to a basic bread recipe and baked 100 times in a special oven. Instead of making someone bake it 100 times to verify, you provide a quick method to confirm the crust without revealing the secret ingredient. Like the baker's method, the proof confirms the statement about the secret number without revealing it or undergoing a lengthy process.</p>



<p>In the realm of blockchain, consider the process akin to mining a block:</p>



<p class="has-text-color has-background" style="color:#1b7bdb;background-color:#acffff">Imagine a miner claiming, "I have found a nonce that, when appended to a specific block's header and hashed through SHA256, produces a hash value starting with a certain number of zeros." Instead of having every participant in the network compute the hash to confirm its validity, which would be immensely time-consuming and energy-draining, the miner provides a succinct proof. This proof allows anyone to rapidly validate the claim without redoing the extensive hashing or discerning the exact nonce used.</p>



<p>Just like in the original scenario, the core idea is verifying a statement quickly without unveiling the specific secrets or redoing all the work.</p>



<h2 class="wp-block-heading">How Does It Even Work?</h2>



<p>ZK-proofs are powered by some really clever but very complex math, which we will only outline here. Consider a massive computation where we encode something with an input number and hash it one million times. A "succinct" proof aims to verify a certain output will come out of the computation without mirroring every step. Instead of checking each computation piece, a verifier, through random sampling, examines only a small share of the total parts. If these checks pass, it's assumed that the entire computation is likely correct.</p>



<h3 class="wp-block-heading">The Immense Value Of ZK-Proofs For Blockchain</h3>



<p>ZK-proofs bring two crucial benefits:</p>



<ol>
<li><strong>Scalability</strong>: For a block that takes ages to verify, only one person can do the computation and produce proofs, like zk-SNARs or zk-STARKs. Other network participants only have to verify the proof.</li>



<li><strong>Privacy</strong>: Leveraging ZK to conceal computation inputs enables parties to transact with enhanced privacy, preventing the disclosure of extraneous information to the public. For instance, you can validate having sufficient ETH in your balance to purchase without exposing the original sender of the cryptocurrency.</li>
</ol>



<p>Owing to these powerful advantages, cryptographic tools like zk-SNARKs and zk-STARs are ideal for layer 2 scalability – reliably confirming off-chain transitions without re-execution on the main network.</p>



<h2 class="wp-block-heading">ZK-SNARKs vs. ZK-STARKs</h2>



<p>Both zk-SNARKs and zk-STARKs refer to the same cryptographic technology of validating proofs in a really efficient and private way. However, these two tools are different in their implementation. SNARKs produce succinct and non-interactive proofs, while STARKs produce scalable and transparent ones. We’ll cover the difference next.</p>



<h2 class="wp-block-heading">What Are ZK-SNARKs?</h2>



<h3 class="wp-block-heading">ZK-SNARK Definition</h3>



<p>ZK-SNARKs, or "Zero Knowledge Succinct Non-Interactive Argument of Knowledge," are cryptographic proofs that allow one to validate the claim without repeating lengthy computations and keeping some inputs private.</p>



<h3 class="wp-block-heading">Inner Workings &amp; Principles</h3>



<p>The <strong>Succinct</strong> part ensures that the verification process doesn’t take as much time as the computation. Otherwise, the verifiers would compute the output themselves. You can achieve this with <em>random sampling</em>, but the process will be fragile: a random check would never spot a deliberately inserted error. The answer to the problem is <strong>polynomial commitments, </strong>and the three main ways they’re implemented are <strong>FRI</strong>, <strong>bulletproofs</strong>, and <strong>Kate</strong>. We won’t go into details because it’s really heavy in the math department, but you can read <a href="https://vitalik.ca/general/2021/01/26/snarks.html">Buterin’s article</a>.</p>



<p>An important feature of SNARKs is the <strong>Non-Interactive</strong> part, where there’s no need for constant interaction between the prover and verifier. Interactive proving requires both parties, which limits its power. Any generated proof couldn't be independently verified without initiating a new conversation between the prover and verifier, which is not cost-effective.</p>



<p>With a shared key (a.k.a public parameters) between the prover and verifier, these proofs allowed the prover to establish knowledge of certain data without actually revealing it. Non-interactive proofs streamlined the process, necessitating just one round of communication. The prover inputs the secret data into an algorithm to generate a zero-knowledge proof, which the verifier then checks using another algorithm. Once established, this proof can be verified by anyone with a shared key.</p>



<h3 class="wp-block-heading">Importance Of A Trusted Setup In ZK-SNARKs</h3>



<p>​​The shared key used for non-interactive proofing, known as the <strong>Common Reference String (CRS)</strong>, is crucial for the protocol's security. Any compromise in CRS can enable dishonest provers to fabricate false proofs. <strong>Multi-party computation (MPC)</strong> is utilized to counteract these threats, with multiple participants contributing random values during a trusted setup ceremony.</p>



<p>The zk-SNARK protocol's integrity relies heavily on this trusted setup phase. Any missteps can threaten the security of all circuits of the ZK-EVM. Given its importance, we recommend undergoing a <a href="https://hacken.io/services/blockchain-security/blockchain-protocol-security/">blockchain protocol audit</a> to ensure the setup is executed correctly.</p>



<h3 class="wp-block-heading">Applications &amp; Use Cases</h3>



<p>The first real use case of zk-SNARK in Web3 is Z.cash – a cryptocurrency that utilizes ZK-proofs for enhanced transaction privacy. Before its launch in 2016, zk-SNARK was just academic research.<br><br>Z.cash has contributed to the widespread use of this concept in ZK-rollups to enhance scalability. ZK-SNARKs have been applied in layer 2 protocols known as ZK-rollups to enhance scalability. Popular ZK-rollups include Loopring, zkSync, ZKSpace, Aztec, etc.&nbsp;</p>



<h2 class="wp-block-heading">What Are ZK-STARKs?</h2>



<h3 class="wp-block-heading">Definition</h3>



<p>ZK-STARKs, or “Zero Knowledge Scalable Transparent Argument of Knowledge,” are a specific type of zk-SNARKs. STARK protocols are ideal when working with witnesses of large size. They also provide higher transparency.</p>



<h3 class="wp-block-heading">Inner Workings &amp; Principles</h3>



<p>ZK-STARKs have higher verification overhead than zk-SNARK, but they are way more cost-effective when working with big witnesses. In other words, STARK is a great solution when you need <strong>scale</strong>.&nbsp;</p>



<p>Another important feature of the STARK protocol is no need for a trusted setup because it uses publicly verifiable randomness to generate public parameters. Hence, it’s considered more transparent for situations where the credibility of the CRS process is unknown.</p>



<h3 class="wp-block-heading">Applications &amp; Use Cases</h3>



<p>Like zkSNARKs, zkSTARKs are used for generating validity proofs to confirm the integrity of all the computations and transactions for ZK-Rollups. The pioneer project in zk-STARKs is Starkware. The company has developed its ZK-friendly language Cairo and the Starknet layer 2.</p>



<h2 class="wp-block-heading">Comparing ZK-SNARKs vs ZK-STARKs</h2>



<figure class="wp-block-table is-style-stripes"><table><tbody><tr><td></td><td><strong>ZK-SNARK</strong></td><td><strong>ZK-STARK</strong></td></tr><tr><td><strong>Proof Size</strong></td><td>Low. Allow for EVM data availability</td><td>High. Driving the costs up</td></tr><tr><td><strong>Trust Setup</strong></td><td>Requires a trusted setup</td><td>Does not require a trusted setup</td></tr><tr><td><strong>Verification Time</strong></td><td>Fast verification times</td><td>Faster times only with large datasets</td></tr><tr><td><strong>Quantum Security</strong></td><td>Not quantum-resistant</td><td>Quantum-resistant</td></tr><tr><td><strong>Transparency</strong></td><td>Less transparent due to trusted setup</td><td>More transparent using public verifiable randomness</td></tr><tr><td><strong>Scalability</strong></td><td>Less scalable, linear increase</td><td>Highly scalable</td></tr><tr><td><strong>Use Cases</strong></td><td>Best for systems where proof size and speed are key</td><td>Best where transparency and quantum-resistance are priorities</td></tr></tbody></table></figure>



<h3 class="wp-block-heading"><strong>Differences</strong>:</h3>



<ul>
<li><strong>Data Availability</strong>: The largest advantage of zk-SNARK over zk-STARK is data availability, which explains why they are more popular, especially in L1 rollups.</li>



<li><strong>Security: </strong>ZK-SNARKs require a trusted setup involving the creation of a Common Reference String (CRS). If malicious actors access this setup data, they could produce false proofs. One potential solution is an MPC ceremony that relies on honest participants. Conversely, zk-STARKs don't rely on such setups, making them quantum-resistant and less susceptible to potential threats.</li>



<li><strong>Transparency: </strong>ZK-SNARK's trusted setup might be perceived as less transparent due to its reliance on a CRS and the need for trust in participants to act honestly. In contrast, zk-STARKs are innately more transparent, depending on public randomness to establish parameters, which ensures open and trustless verification.</li>



<li><strong>Scalability: </strong>Both cryptographic methods offer scalability for blockchains. ZK-SNARKs scale <em>linearly</em> with the size of the underlying computation, while zk-STARKs, although having larger proof sizes, are better suited for larger computations. Their proving and verification times increase quasilinearly, which can make them faster than zk-SNARKs for extensive datasets.</li>



<li><strong>Use Cases: </strong>ZK-SNARKs are commonly used in privacy coins, identity verification, and decentralized finance (DeFi), benefiting from their compact proof sizes and consistent verification times. Meanwhile, zk-STARKs, due to their transparency and scalability benefits, are prominently utilized in Layer-2 solutions.</li>
</ul>



<h2 class="wp-block-heading">SNARK and STARK in ZK-EVM</h2>



<p>A critical and emerging transition in the block validation process is the rise of <a href="https://vitalik.ca/general/2022/08/04/zkevm.html">ZK-EVMs</a>.&nbsp;</p>



<p>ZK-EVM enables EVM (Ethereum Virtual Machine) execution for layer 2 protocols known as ZK-rollups. Some of these rollups are already in progress: ZK-EVM Community Solution, Polygon zkEVM, ZKSync Era, Scroll’s ZK-EVM, and others.</p>



<p>There are generally four types of ZK-EVM depending on the level of compatibility and equivalency with EVM. For example, Ty[e 1 ZK-EVM permits a 1:1 EVM compatibility: smart contracts written for Ethereum can be deployed <em>as it is</em> on ZK-EVM-based layer 2. So, Solidity can be used instead of dedicated languages for ZK-proofs like Circom and Cairo.</p>



<p>Here, it’s important to mention that modern ZK-EVMs employ both SNARK and STARK for higher efficiency. Another caveat is that "zero knowledge" is not used in existing ZK-Rollups, only succinctness (computation compression).</p>



<h2 class="wp-block-heading">Conclusions &amp; Final Thoughts</h2>



<h3 class="wp-block-heading">Key Features Of ZK-SNARKs:&nbsp;</h3>



<ul>
<li>High data availability but linear scalability.</li>



<li>Possibility of a non-interactive computation.</li>



<li>The security of zk-SNARKs hinges on the CRS setup. An error here would affect all circuits and allow false proof generation.</li>



<li>ZK-SNARKs are preferred for their compact proof sizes and consistent verification time, making them cost-effective for L1 verification in ZK-rollups.</li>
</ul>



<h3 class="wp-block-heading">Key Features Of ZK-STARKs:&nbsp;</h3>



<ul>
<li>No need for the initial trusted setup.</li>



<li>Very salable. Especially when handling extensive data, as their proving and verification times increase slower than zk-SNARKs.</li>



<li>Larger proof sizes result in higher verification costs.</li>



<li>ZK-STARKs are resistant to quantum computing threats.</li>
</ul>



<p>ZK-SNARKs and ZK-STARKs are groundbreaking cryptographic tools that can revolutionize how we view scalability and privacy in blockchain systems. Many believe that ZK-STARKs is an improvement from zk-SNARKs because of its quantum-resistance, scalability, and transparency. Yet, the current downside with STARKs is larger proof sizes and higher costs. Hence, SNARKs won’t go anywhere anytime soon.</p>



<p>As research progresses, it's clear that both will continue to play pivotal roles in shaping the future of decentralized systems and ensuring cheap, swift, and private transactions.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<h2 class="wp-block-heading">Resources</h2>



<p>Ben-Sasson, E., Bentov, I., Horesh, Y., &amp; Riabzev, M. (2018). “Scalable, transparent, and post-quantum secure computational integrity.” <a href="https://eprint.iacr.org/2018/046">https://eprint.iacr.org/2018/046</a>&nbsp;</p>



<p>Buterin, V. (2022). “Some ways to use ZK-SNARKs for privacy.” <a href="https://vitalik.ca/general/2022/06/15/using_snarks.html">https://vitalik.ca/general/2022/06/15/using_snarks.html</a></p>



<p>Buterin, V. (2021). “An approximate introduction to how ZK-SNARKs are possible.” <a href="https://vitalik.ca/general/2021/01/26/snarks.html">https://vitalik.ca/general/2021/01/26/snarks.html</a>&nbsp;</p>



<p>Chen, T., Hui Lu, H., Kunpittaya, T., &amp; Luo, A. (2022). “A Review of ZK-SNARKs.” <a href="https://arxiv.org/abs/2202.06877">https://arxiv.org/abs/2202.06877</a>&nbsp;</p>



<p>Ethereum.org (2023). “Zero Knowledge Rollups.” <a href="https://ethereum.org/en/developers/docs/scaling/zk-rollups/">https://ethereum.org/en/developers/docs/scaling/zk-rollups/</a>&nbsp;&nbsp;</p>

Comparing ZK-SNARKs & ZK-STARKs: Key Distinctions In Blockchain Privacy Protocols

Andriy Kashcheyev

Get our latest updates and expert insights on Web3 security