Blog

ZKM's Ziren zkVM has successfully completed an independent security review by Veridise, validating its execution model as a deterministic and well-defined machine under adversarial conditions. The audit focused on machine-level failures and established core properties, including execution determinism, sound memory and syscall semantics, and trace integrity. Crucially, all high- and critical-severity findings were identified, fixed, and re-verified during the process. This post-audit status confirms Ziren as fully deployable infrastructure suitable for use as an execution layer in live systems, such as rollup architectures like GOAT Network, and applications built on BitVM-style verification.

We introduce the GKR protocol, explaining how it recursively verifies the correctness of layered circuit computation through the multivariate Sumcheck protocol. It elaborates on the circuit’s layered relationships, constraint construction, and verification procedures, demonstrating the efficiency and scalability of GKR in zero-knowledge proofs.

This month we shipped Ziren v1.2.0 (interop + DX), open-sourced GPU prover binaries for reproducible acceleration, verified determinism in Ziren’s arithmetic core with Veridise, and outlined an x402 infrastructure path for agent-native payments. 

x402 has recently become one of the most discussed ideas in crypto. It revives the long-dormant HTTP “402 Payment Required” status code, enabling micropayments to occur directly within web requests. The basic premise is simple: agents and applications can pay one another as easily as they exchange data.

Ziren targets a deterministic execution model: identical inputs must yield identical outputs across all circuit paths. Determinism at the chip level (e.g. ALU primitives) is a prerequisite for soundness and proof reproducibility.

Ziren v1.2.0 is a major update focused on interoperability and developer experience, introducing compressed-to-Groth16 proof conversion, a no-std STARK verifier, enhanced network prover capabilities, and a new CLI tool to initialize the Ziren project template.

Ziren is now live in the wild. GOAT Network is the first production deployment using Ziren as its default proving engine - verifying L2 state transitions on Bitcoin, securing the native bridge, and enabling low-latency proofs.+

Thank you to every contributor who supported ZKM: testing the zkVM across releases, submitting and reviewing changes on GitHub, producing clear technical content, and keeping discussions active and constructive across our channels. We value sustained, hands-on participation and appreciate the time, rigor, and consistency you’ve brought to the project. While the best is surely still yet to come, it’s already been quite the journey.

A question that frequently arises is: “What is the relationship between ZKM and GOAT Network?” ZKM built the core proving and execution stack - Ziren (ZKM’s MIPS-based zkVM), the distributed prover, and the verification toolchain - that underpins GOAT Network. GOAT is the first production deployment where Ziren is the default proving engine across the system: proving L2 state transitions, securing the native bridge, and enabling low-latency proof generation for Bitcoin-aligned flows.

ProofLab has conducted an independent evaluation of Ziren v1.1.4 across three codebases: the core VM, the distributed prover, and the WASM verifier. This is an external technical read on Ziren’s current state: what works, what is unique, where performance comes from, and where production risks remain.

This work systematically explains how various common constraints can be reduced to the Multivariate Sumcheck Protocol. The core idea is to use random linear combinations and logarithmic-derivative techniques to transform “pointwise verification” of universal assertions into a “global summation” form, which can then be efficiently verified by sumcheck. The main methods include: ZeroCheck: Using equality kernels to reduce the

ZKM is the only general-purpose zkVM that optimizes for proof longevity. In ZK systems, the durable asset is the audited constraint system and the reproducible behavior of the base machine

This month marked a giant leap in accessibility: the release of Ziren’s new verifier. Built from a single Rust codebase compiled to both native binaries and WASM for browsers, it supports STARK, Groth16, and Plonk proofs. Developers and users can now verify full Ethereum block proofs client-side, without custom infrastructure.

The Ziren verifier is now live on Ethproofs - making proof verification accessible directly in the browser, without requiring dedicated infrastructure.

Everyone is talking about scaling Bitcoin. Almost nobody is talking about the machine actually making it possible. The spotlight falls on networks like @GOATRollup and other members of the BitVM Alliance

The Multivariate Sumcheck Protocol is an important PIOP (Polynomial IOP) component in zero-knowledge proofs. It mainly proves the correctness of the following equation:

The Logup-GKR protocol constructs and verifies lookup arguments using rational polynomials.

This month marked a defining milestone for ZKM: the launch of Ziren - a heavily upgraded and rebranded zkMIPS.

GOAT Network just launched the first public beta testnet of its BitVM2 zkBridge, enabling peg-outs from Bitcoin with real-time proof verification. It’s an important milestone for Bitcoin Rollups - and one that quietly depended on Ziren.

Matrix Structure Overview

In Zero-knowledge systems, every line of code, every instruction, and every system-level choice becomes a part of a circuit that needs to be reproducible, verifiable, and secure not just today, but years from now. This is why getting architectural decisions right, all the way down to the ISA, is essential.

Ziren verifies the correct execution of programs through zero-knowledge proofs. The process involves code compilation, virtual machine execution, generation of the execution trace, and the use of technologies such as STARK, PLONK, and Groth16 to produce efficient and verifiable proofs, enabling on-chain verification and privacy protection.

zkMIPS 1.0 introduced a performant, auditable zkVM with leading CPU-based benchmarks. But proving on CPU alone is not enough. Scaling real-world ZK applications requires more than raw throughput - it demands accelerated proving, distributed systems, and a clean developer experience.

For years, ZK has promised to transform every layer of blockchain - from core infrastructure to custom applications - but has remained inaccessible to most developers, locked behind custom languages, niche tooling, and high implementation complexity. zkVMs emerged as a solution, abstracting away constraint logic and making ZK accessible to general developers. But instead of building for verifiability from the ground up, most zkVM teams defaulted to sub-optimal ISAs like RISC-V and focused on superficial abstraction rather than constraint efficiency. The result: systems that work, but compromise on stability and performance at the root.

In Part 1, we laid out the architectural reasons ZKM selected MIPS32r2 as the foundation for our zkVM: higher opcode density, stable specification, and hardware-proven toolchain maturity. In this follow-up, we go a level deeper - exploring how microarchitectural traits of MIPS align with zero-knowledge circuit design, and where RISC-V introduces complexity that must be actively mitigated.

A month of system-level upgrades, design-level clarity, and a coordinated signal toward the next big release.

The conversion from STARK to SNARK begins with the construction of recursive circuits. These recursive circuits are designed to compress the original large STARK proof into a smaller SNARK proof. The process involves several key components: the root circuit, the aggregation circuit, and the block circuit. Below is an introduction to the roles of each of these circuits:

ZKM began as an internal research-driven effort to integrate zero-knowledge proofs into blockchain infrastructure. In 2022, as discussions around Ethereum scaling intensified, the idea of hybrid rollups began to take shape. Rather than abandoning the Optimistic Rollup model, the proposal was to combine it with zk-proofs to create a hybrid architecture that could deliver both developer flexibility and cryptographic finality. This would later evolve into the vision behind our MIPS-based zkVM.

As the number of zkVMs continues to grow, the choice facing developers is no longer whether to use one - but rather which to use. With an ever-growing number of zkVMs offering different tradeoffs, it’s becoming increasingly difficult to tell which zkVM actually delivers what matters.

Memory checking in a zkVM is used to allow a prover to demonstrate to a verifier that read/write memory operations are performed correctly. In such a memory system, a value v can be written to an address a, and later retrieved from address a by the program. This technique enables the verifier to efficiently confirm that the prover has followed memory access rules—specifically, that any read returns the latest value written to that memory address.

MemoryStark ensures that memory access operations proceed in chronological and address order, and that the values read align with the previously written ones. LogicSNARK guarantees the correctness of logical operations.

May was the biggest month in ZKM’s history to date. We launched zkMIPS 1.0 - the first production-ready MIPS-based zkVM - while deepening integrations across Ethereum and Bitcoin, advancing our work through live deployments, industry benchmarks, and research publications.

Zero-knowledge systems are quickly moving from research to production, and the industry is converging around a core assumption: ZK is the cryptographic foundation for how trustless systems will operate at scale.

With the release of zkMIPS 1.0, ZKM has opened up a new paradigm. After months of intensive engineering, zkMIPS is now production-ready, performance-optimized, and actively proving Ethereum mainnet blocks and powering Bitcoin-native applications like GOAT Network. But this milestone isn’t the end - it’s the beginning. And we want YOU to be a part of it.

Until recently, many zkVMs have remained experimental, slow, and costly to run at scale. With the release of zkMIPS 1.0, a supremely performant production-grade zkVM, ZKM aims to change that.

zkMIPS 1.0 is here - our most significant leap toward real-time proving, following months of careful engineering and system-level breakthroughs.

zkMIPS 1.0 is almost here - the momentum is building and the industry is starting to take notice. The ZKM team has been heads-down, hardcore building, ready for an explosive May. But April has still been a notable month, with new research releases on provers and hash circuits, and appearances across global events.

When designing a zkVM, choosing the right instruction set architecture (ISA) is foundational. While most new zkVM projects default to RISC-V due to its simplicity and growing ecosystem, ZKM deliberately took a more difficult route: building on MIPS32r2.

In zero-knowledge proofs, the lookup operation is used to verify the relationships between multiple tables. First, the data from the multiple tables is aggregated to form a query condition. Then, through the lookup, records that meet the condition are searched in the target table. Finally, the zero-knowledge proof generates a proof to verify the correctness of the query result without revealing any specific data.

The emulator primarily implements the simulation of the MIPS instruction set and provides interfaces for running MIPS ELF programs and generating segments. All code can be found in the zkm/emulator directory.

Last month at ZKM, all attention was on one thing: performance.

The ZKM Prover employs Plonky2 to construct a zero-knowledge proof system. Its primary steps involve generating, aggregating, and compressing proofs for each Plonkish table. The process is detailed below.

Lookup Argument is an important cryptographic primitive used to prove that elements of one set (or structured objects like polynomials) belong to another precomputed set or structure. It plays a crucial role in zero-knowledge proof systems by enforcing data consistency and constraints without revealing sensitive information.In the context of zkVM applications, the Lookup Argument is used for efficiently verifying the inclusion relationship between inputs and precomputed tables. This is particularly important in the following scenarios:

zkVM (Zero-Knowledge Virtual Machine) is a virtual machine that utilizes Zero-Knowledge Proofs (ZKP) to ensure the correctness, integrity, and privacy of computations.

February was an eventful month for ZKM, with key research developments, in-depth discussions on zkVMs, and the first internal testing of zkMIPS+ - a significant step in our work toward high-performance zero-knowledge execution. At the recent ETHDenver event, we engaged in deep technical panels, explored our role in ETHProofs, and discussed our latest research in zkVM optimization.

When representing computations as circuits, there are often complex operations such as bitwise XOR and bitwise AND. For example, performing a bitwise XOR operation on two 32-bit bitstrings usually requires hundreds of addition and multiplication gates, significantly increasing circuit size. Introducing the Lookup argument protocol effectively reduces circuit complexity.

Recursive Zero-Knowledge Proof (Recursive ZKP) is a type of zero-knowledge proof that utilizes the concept of recursion to generate proofs that are more efficiently verifiable. In some cases, it can even combine multiple proofs into a single proof. This is particularly important in blockchain systems, where efficiency and scalability are crucial.

Plonky2 is a zkSNARK protocol based on polynomial commitment and the Plonk-based PIOP interactive proof. It focuses on achieving efficient zkSNARK through the FRI technique. The primary goal of Plonky2 is to improve the efficiency of traditional zkSNARKs in recursive zero-knowledge proof scenarios while enhancing post-quantum security. Its core concept is leveraging the FRI (Fast Reed-Solomon Interactive Oracle Proof of Proximity) to allow efficient polynomial verification and using random sampling to enhance the integrity and security of the protocol.

The FRI protocol is an interactive proof system designed to prove the low degree (degree constraint) of a polynomial. The Prover commits to a polynomial form, and the Verifier ensures that the polynomial is of low degree by sampling several points from it, performing multiple random linear combinations, and polynomial folding. This interactive proof system is particularly important in zero-knowledge proofs, as it allows the verification of the polynomial’s properties without revealing the polynomial itself.

zkGM and welcome to the latest edition of the ZKM Newsletter, where we bring you all the key updates, highlights, and behind-the-scenes insights from our activities from the past month.

Fast Reed-Solomon Interactive Oracle Proof of Proximity (FRI) is an interactive protocol used to check if the degree of a committed polynomial is less than a specific value . The general idea is as follows:

Poseidon hash function uses the following sponge structure for its design, where P is the permutation function of each round of Poseidon, and I is the initial state. Assume the initial state I is a zero vector, and a message m=m1||m2||m3||m4 is given, with the output being h=h1||h2. Each mi and hi are of length r. The computation follows this pattern:

A polynomial is a fundamental concept in algebra, expressed as a linear combination of variables and coefficients, denoted as:

2024 was a significant year for ZKM, with several key milestones and technical developments contributing to a solidified status of thought-leadership in the ZK space. Here we provide an overview of these achievements and begin to outline the future direction for our technology and ecosystem contributions.

ZKM has released zkMIPS v0.2.0, featuring three major updates designed to simplify and enhance the developer experience for building ZK applications:

One of the more stimulating talks I saw in Bangkok was about terminology for rollups, by @KelvinFichter. It gave me several new insights, though in the beginning I was quite confused. But after watching the video a couple of times, it all sank in. I'll explain it in my own words.

The ZKM team began our journey in Thailand by establishing a strong presence at @invisiblgarden, an @Ethereum and ZK-focused developer hub in Chiang Mai. They delivered a series of talks and workshops to showcase ZKM’s technology and its potential applications to the local community.

This month has been packed with significant events, groundbreaking research, and impactful collaborations. From hosting our own sessions at the House of ZK Virtual Conference and releasing major research pieces, to making big strides at ETHGlobal San Francisco, we have plenty of highlights to share.

在本期中，我们很自豪地分享9月份的亮点，九月份见证了重大进展，包括我们最新的基准报告、研究文章和关键合作活动的发布。

在这项工作中，我们开始在a16z先前工作的基础上发布一个通用而公平的zkVM基准测试框架，比较ZKM（zkMIPs）与其他zkVM项目（例如RISC Zero（R0）和SP1）之间的时间和能源成本。

什么构成交易证明？

为了完成跨链资产转移，目前可用的大多数解决方案都基于桥梁，即一个独立的中间实体，通常信任该实体在交易的某个时期持有这些资产。这种信任假设是不可取的，因为它提供了很大的攻击机会。在这篇文章中，我将解释，假设存在 zkRollup，人们无需额外的信任假设（例如桥梁）即可实现跨链资产转移。

比特币从投机资产向全球占主导地位的金融体系的过渡已接近转折点。事态发展

本月取得了许多进展和战略合作，这些合作继续影响着我们的技术，因此，我们为您带来了第二版《八月通讯》。要了解第一版，请参阅 zkm.io/blog/hello-world-八月时事通讯。

贡献者专区是一个旨在扩大 ZKM 社区的声音和专业知识的平台，邀请专家和发烧友分享他们的见解，加深对 ZK 技术及其应用的集体理解。贡献者专区的主要目标是创建一个充满活力的社区，让成员积极参与知识的共享和创造。该举措旨在：

ZKM 引领着 ZK 技术的发展，开发了一套创新工具和教育资源，以实现 ZK 与区块链的无缝集成。本文全面概述了我们正在进行的举措，展示了我们工作的广度，展望了未来。

STARK（可扩展的透明知识论证）是埃利·本·萨森及其同事在2018年推出的一种证明系统，与传统的SNARK系统相比，它具有更好的可扩展性和透明度。STARK 的工作原理是将复杂的计算转换为算术电路，然后将其表示为多项式评估问题。为了在计算过程中隐藏中间结果，使用了多项式承诺，同时允许验证者对这些结果进行采样和检查。通过应用低度扩展，将复杂的计算简化为验证低度多项式，然后使用高效的交互式证明协议 FRI 来检查多项式是否为低度多项式。该技术在实现隐私保护和可验证计算方面具有广泛的应用。

什么是 House of ZK？在这里，我们全面解释 “零知识之乡” 🔶

欢迎来到 Pulse Check Bytesize，这是我们常规的 Pulse Check 行业新闻计划的微型版本，它是零知识领域最新发展、见解和分析的可信来源。Pulse Check专注于领先的研究论文和重大项目更新，而 “Bytesize” 则以简洁的格式将行业领导者在社交媒体和播客上的有影响力的讨论整理成简洁的格式，提供重要的更新和热门话题摘要。

House of ZK在纽约市的区块链科学会议上举办了 “ZK日”。该活动由围绕ZK最新创新的技术研讨会和辩论组成，由ZKM和Aleo共同主办，由IC3、斯坦福CBR和伯克利RDI共同组织。杰罗恩·范·德格拉夫、卢卡斯·弗拉加和亚历克斯·普鲁登等知名专家分享了他们对纠缠汇总、zkMips架构和BitcoinL2 zkVM支持的原生安全等话题的见解，之后以热闹的欢乐时光结束，这是经过一天的密集讨论后社交和放松身心的绝佳机会。

继我们在ethCC期间在布鲁塞尔举办的活动取得巨大成功之后，House of ZK在纽约市区块链科学会议期间举办了 “ZK日”。该活动由ZKM和Aleo共同主办，由IC3、斯坦福大学CBR和伯克利RDI共同组织，事实证明是研究人员和行业领导者共同讨论ZK技术最新进展的非凡聚会。

来到《ZK之屋——脉冲检查》，这是零知识领地域最新发展、见解和分析的可信来源。本报告的每一个版本都探讨了该行业的前进和关键讨论，提供评论和分析，特别关注杰出的研究论文文和zkVM，以及基于 zk的L1、L2和跨链的讨论。

在我们庆祝加入 ZKM 一周年之际，我为我们从不起眼的起步到迅速被公认为ZK领域的先驱力量的旅程感到非常自豪。我们致力于转变区块链互操作性并将零知识技术无缝集成到日常区块链应用程序中，这推动了远远超出我们最初预期的创新和合作。我很自豪能够介绍这份时事通讯的前言，其中记录了我们的关键里程碑和社区成就——每一个关键步骤都使我们更接近我们的核心使命，即让大众能够使用最先进的 ZK 技术。‍

House of ZK活动恰逢2024年7月11日在布鲁塞尔举行的ETHCC周，该活动被证明是致力于探索和推进基于ZK技术的区块链开发人员、学者和行业领导者的中心枢纽。为期一天的活动包括教育主题演讲、引人入胜的小组讨论和深入的讨论，重点讨论了ZK在区块链中的巨大潜力和多样化应用。

zkGM，欢迎收看 6 月版的 ZKM 时事通讯 ☀️。

继ZKM Research最近发布最新的zkMIPs论文之后，我们希望解决社区提出的关键问题。在这里，我们将进行广泛的问答，深入了解该论文的更新及其意义。

ZKM 很高兴地宣布推出其独家 Proving Service，为开发人员提供访问高性能服务器的权限，这些服务器能够有效地处理生成零知识证明的密集计算需求。该服务专门针对ZKMIPs进行了优化，ZKMIPS是ZKM的专业zkVM软件，旨在促进将ZKP功能集成到各种应用程序中。

在这里，我们宣布发表ZKM Research的最新论文：“zkMIPS：高级规范”。对先前版本的重大更新纠正了原始文档与 zkMIPS 代码库当前状态之间的差异，为帮助 ZKM 开发者社区的贡献提供了更准确的信息基础。

我们很高兴地宣布，在 Proygon Ventures、Crypto.com、Amber Group、Leland Ventures、Waterdrip Capital、DFG、jSquare、捐赠资本和梅蒂斯基金会 🔥 的支持下，于 2023 年 11 月成功完成了 500 万美元的 Pre-A 轮融资

正如安德鲁·陈（a16z）在《冷启动问题》一书中定义的那样，网络效应描述了当产品随着使用者越来越多而变得更有价值时会发生什么。作为一个核心基础设施项目的创始人，该项目正在构建一个通用 zkVM 来统一区块链间的流动性，如何为较低层基础设施项目实现网络效果是我整天都在思考的问题。

从历史上看，最大的技术和企业努力是由目标驱动的，其目标不仅限于利润最大化的直接目标。埃隆·马斯克经营的公司就是一个很好的例子。以SpaceX使人类成为多行星物种的终极使命或特斯拉的目标为例，

ZKM 正在使用 Entangled Rollups 来构建量子网络，以实现普遍结算。

你好 Q2！我们的团队对新季度开始感到非常兴奋，而且我们每天都在变得更强大。我们在 2023 年 7 月首次推出后发展缓慢，但在 2024 年第一季度，我们的社区成员激增至近 50,000 人。我们希望通过这份时事通讯向我们的社区和合作伙伴表达我们的感激和赞赏，他们在这段旅程中发挥了如此重要的作用。

TL; DR：zkMIPS 通过五个步骤证明了 MIPS 程序的正确执行：它（1）将程序分成几个段，（2）将每个段的指令分成四个模块表，（3）独立证明来自每个模块表的指令，（4）证明每个段的指令包含在其一个表中，以及（5）递归地证明段序列与程序执行相匹配。第 3 步以 STARK 形式编写，步骤 4 是以 STARK 编写的 LogUp 证明，步骤 5 以 PLONK 证明的形式编写。所有证明步骤均使用 Plonky2 库实现。或者，可以生成最终的 Groth16 证明来验证程序在链上的执行。

我们最近推出了一种名为 Entangled Rollup 的新型信任最小化多链互操作性基础设施。‍ 在这项工作中，我们利用我们最先进的递归 zkVM (zkMIPs)，在 zkRollUps 的标准安全假设下审慎地纠缠底层原语，从而实现互操作性协议。‍ Entangled Rollup 协议是去信任的，是解决流动性分散问题向前迈出的一步，此外还简化了作为多链世界主要采用障碍的用户和开发者体验。‍

可以肯定地说，2024 年 2 月是真正让 ZKM 登上地图的月份！经过数月的紧张准备和相对隐身的热心积累，我们透露了在 House of ZK 创世前发布的几项令人垂涎的新进展，它点亮了 ETHDenver！

我们很高兴地宣布推出我们的零知识虚拟机 (zkVM) Alpha 测试网。

我们非常高兴能够推出 “德尔福：共享密码假设评估”，这是一项由耶罗恩·范德格拉夫和阿珍·伦斯特拉开发的高级研究计划。

一月份是紧张准备的一个月——我们不仅即将推出期待已久的测试网，而且丹佛分校也即将到来，我们的 “House of ZK” 黑客之家正准备成为一个非常特别的项目。

我们欣喜若狂地迎接2024年即将到来的新年。ZKM 在 2023 年结束时对我们的社区深表感激和赞赏——没有你们，我们不可能有如此成功的一年！

ZKM 很高兴重启我们的每月 Hello World 时事通讯！我们了解与社区保持联系的重要性，还有什么比重新发布我们的时事通讯更好的方式呢？ZKM 团队一直在幕后辛勤工作，为你带来一份时事通讯，它不仅能提供信息，还能让人眼花缭乱。

11 月伊始于 ZKM 的激动人心的事态发展——我们启动了早期贡献者计划 (ECP) 的第 2 组：社区进化

零知识（ZK）已成为 Web3 世界中一个新的、非常受欢迎的流行语——但它到底意味着什么？ZKM 提供的教育中心是你解开 ZK 错综复杂之处的第一站。ZKM 团队将在您的 ZK 学习之旅的每一步中为您提供帮助。

在 ZKM，我们的使命是通过将隐私、安全和效率放在首位，彻底改变数字世界。随着我们的早期贡献者计划（ECP）第二阶段：社区演进的推出，我们在实现这一目标方面向前迈出了一大步。该计划在培养具有前瞻性思维的开发人员社区方面发挥了重要作用，他们积极参与塑造开源零知识技术的未来。在这篇文章中，我们很高兴向大家介绍我们的ECP在这个新阶段为我们不断壮大的社区带来的新功能和机会。

区块链科学会议（SBC 2023）每年在斯坦福大学举行。当地的ZKM团队出席了会议，与会团队的首席研究顾问杰罗恩·范德格拉夫分享了他的经验，并发表了他对活动和研讨会的见解并发表了评论：

8 月标志着我们构建通用用途 zkVM 的又一个月。让我们回过头来看看 ZKM 发生的所有事情。Hack to the Future 直播