Summary of "Workshop: Verifying zk-SNARK Proofs (Circom & Noir) on Starknet"

This workshop, part of the Starknet Foundation Resolve hackathon series, focuses on building and verifying zero-knowledge SNARK proofs on Starknet using Circom and the Gaga Adapter. The session provides a practical introduction, demo, and resources for developers interested in zero-knowledge proofs (ZKPs), particularly in the context of Starknet’s unique cryptographic environment.

Key Technological Concepts and Features

Zero-Knowledge Proofs (ZKPs) Overview
- ZKPs allow proving off-chain computations with private inputs, verified on-chain with minimal gas costs.
- Circuits define the computation with private and public inputs; a witness is generated to prove correctness.
- Use cases include privacy-preserving identity verification (e.g., proving citizenship without revealing a passport), private money transfers, and confidential transactions.
Circom Language & Groth16 Proving System
- Circom is a popular domain-specific language (DSL) for writing ZK circuits, using the Groth16 proving system.
- Groth16 requires a trusted setup but is highly efficient and battle-tested (used by Tornado Cash and others).
- The workshop focuses on Groth16; Plonk (which uses a universal setup but is less efficient) is mentioned as an alternative, especially with Noir.
Starknet and Curve Compatibility Challenges
- Circom’s Groth16 circuits use the BN254 elliptic curve, compatible with EVM chains but incompatible with Starknet’s native Stark curve.
- Starknet uses a smaller Stark curve, requiring an adapter to verify BN254-based proofs on-chain.
Gaga Adapter
- Gaga is a critical tool that transforms Groth16 proofs (BN254 curve) into a format verifiable on Starknet’s Stark curve.
- It generates a Cairo verifier contract compatible with Starknet, enabling on-chain verification of Groth16 proofs.
- This adapter bridges the gap between Circom-generated proofs and Starknet’s verification environment.
Demo Application
- A simple age verification circuit in Circom proves a user is over 18 without revealing the exact age.
- The workflow:
  - User inputs age and salt (random number) in the front end.
  - Circom generates a Groth16 proof locally (using snarkjs).
  - The proof is sent to Gaga, which converts it into Starknet-compatible calldata (~2000 elements).
  - The converted proof is sent on-chain to a Gaga-generated verifier contract in Cairo on Starknet.
  - Verification occurs on-chain, confirming proof validity with minimal gas cost.
- The demo is deployed on Sepolia testnet and uses Ready wallet for interaction.
Project Setup and Tooling
- The workshop provides a GitHub repo with:
  - Circuits folder and age verification circuit.
  - Scripts for trusted setup, proof generation, verifier generation via Gaga, deployment, and front-end integration.
  - Instructions for deploying on Starknet testnets, including account setup and RPC configuration.
- Important libraries and tools include:
  - snarkjs for proof generation and verification locally.
  - Gaga for proof adaptation and verifier generation.
  - Starknet devnet and wallet SDKs for testing and integration.
Additional Topics Discussed
- Trusted setup vulnerabilities: mitigated by multi-party computation (MPC) where many participants contribute randomness, making it secure if at least one party is honest.
- Differences between SNARKs and STARKs:
  - SNARKs (Groth16) rely on elliptic curves and trusted setup but support zero-knowledge with private inputs.
  - STARKs use hash-based polynomial commitments, are post-quantum secure, and do not require trusted setup, but zero-knowledge STARKs are not yet widely available.
- Noir vs Circom:
  - Noir is easier to write and uses Plonk (universal setup), but less battle-tested than Circom/Groth16.
  - Circom has more TVL and security assurance due to maturity and wide adoption.
- Privacy applications like Tornado Cash and Privacy Pools, with distinctions between privacy (mixers) and confidentiality (hiding amounts but revealing sender/receiver).
Resources and Documentation
- The presenter shared a comprehensive resources list including:
  - Gaga GitHub and docs.
  - Starknet developer tools and SDKs.
  - Circom and snarkjs documentation.
  - Wallet integration guides (Ready, Braavos).
  - Example projects and blogs related to Gaga and Starknet ZK development.