zkasper In development

Ethereum’s security,
everywhere.

Proof that an Ethereum checkpoint was finalised by two thirds of the full validator set. Any chain that verifies a SNARK reads Ethereum state with Ethereum’s own security.

Read the code How it works

The problem

Every Ethereum light client shipping today trusts the same 512 validators.

one lit dot = 512 validators 2,048 dots = the active validator set

Helios, SP1 Helios and Telepathy all verify the Altair sync committee: 512 validators, resampled every 27 hours. The lit dot is all of them, to scale.

Sample size is not the problem. Sync committee messages are not slashable. Altair defines no slashing condition for them. A corrupted committee can sign a header for a chain that does not exist and lose nothing.

A million BLS signatures per epoch was out of reach in 2021. That has changed.

The difference

What the proof is actually backed by.

Property Sync committee light clients zkasper
Signers Sync committee512, rotating ~27h zkasperFull validator set
Slashable Sync committeeNo zkasperYes
Security backing Sync committeeHonest-majority assumption on a small sample zkasper~1/3 of total stake at risk

Forging the proof is an economic problem, not a cryptographic one. It costs a third of all staked ETH, slashed. That is the collateral securing Ethereum itself.

How it works

Five stages, folded into one proof.

The beacon chain stores validators in an SSZ tree, 40 levels deep, hashed with SHA-256. zkasper keeps a parallel accumulator: 22 levels, Poseidon2 over Goldilocks.

  1. Bootstrap

    Build the accumulator from a trusted beacon state.

  2. Epoch diff

    Carry it forward one epoch, tracking exact effective balances.

  3. Slot proof

    Check one slot’s attestations in a single multi-pairing.

  4. Justification

    Fold an epoch’s slot proofs. Check the two-thirds threshold.

  5. Finalisation

    Pair two justifications. That is Casper FFG finality.

Slot proofs run in parallel as attestations arrive. Target: Zisk.

Engineering

Measured, not estimated.

Measured on real mainnet data: 960,974 active validators, 99.7% attesting balance.

16.3×
Accumulator node vs SSZ node Poseidon2 at 3,033 cost units against SHA-256 at 50,662 — and 22 levels instead of 40.
27.9×
Public key aggregation Driving the raw curve-add precompile at 2,428, against 67,854 through the safe wrapper.
~13×
Cost per epoch, so far 180.5B down to about 13.9B cost units, across five separate optimisations.
54×
GPU against CPU 67,452,592 cost units per second on an RTX 5090, against 1,244,523 on a desktop CPU.
98
Tests passing Verified against real mainnet state.

Cost units are Zisk trace area, hardware-independent. End-to-end proving latency is still being measured and is not quoted here.

Built

  • Five circuits, bootstrap to finalisation
  • Poseidon2-Goldilocks accumulator
  • One multi-pairing per slot
  • Recursive composition, outputs bound
  • Witness generator on live beacon data
  • Streaming pipeline to the finality threshold

Shipping next

  • EVM and Solana verifiers
  • Continuous mainnet proving
  • Light client integration