Performance
4.82 milliseconds against 3.7 to 49 seconds.
The same claim, the same algorithm, one desktop CPU, and the current release of every system compared.
fib(10,000) mod 7919
Every system, the same algorithm, one machine.
Fast doubling throughout: fourteen rounds rather than ten thousand steps. The zkVM guests run a hand-written doubling routine. zkFOL is handed the naive two-call recurrence and its compiler rewrites that into the doubling form itself.
| System | Prove | Verify | Proof | Prover memory |
|---|---|---|---|---|
| zkFOL | 4.82 ms | 1.4 ms | 49.8 KB | under 10 MB |
| RISC Zero, composite | 3.69 s | 11.8 ms | 209.6 KB | 312 MB |
| RISC Zero, succinct | 14.73 s | 12.4 ms | 223.3 KB | 1.39 GB |
| SP1, core | 13.32 s | 74.3 ms | 2.78 MB | 9.39 GB |
| SP1, compressed | 49.24 s | 32.9 ms | 1.27 MB | 17.00 GB |
AMD Ryzen 7 5700X, eight cores, Linux, CPU proving only, one prover at a time. zkFOL 0.4.0, RISC Zero 3.0.5, SP1 6.3.1. Every cell is the median of three runs.
Sudoku
16 milliseconds, and not a single square revealed.
The two sides are proving different things here, and the difference matters more than the timings do. The comparators take a finished grid, publish it, and prove that the published grid is valid. zkFOL proves that a grid exists satisfying the clues, and publishes none of it.
| System | What is proved | Prove | Verify | Prover memory |
|---|---|---|---|---|
| zkFOL | a solution exists, nothing disclosed | 15.95 ms | 3.38 ms | ~25 MB |
| RISC Zero, composite | this published grid is valid | 7.252 s | 12.46 ms | 606 MB |
| RISC Zero, succinct | this published grid is valid | 18.040 s | 12.44 ms | 1.43 GB |
| SP1, core | this published grid is valid | 13.687 s | 75.92 ms | 9.57 GB |
| SP1, compressed | this published grid is valid | 50.329 s | 33.21 ms | 16.80 GB |
zkFOL makes the stronger of the two claims and reaches it roughly 450 times faster than the quickest comparator. Replace the grid with a balance sheet, a set of positions or a counterparty exposure, and the property is identical.
The floor
A bounds check costs 1.53 milliseconds.
Prove that a committed value lies between 10 and 100. There is nothing to compute, so this is the price of a proof at all, and it is the atomic unit of nearly every risk check in finance: collateral above a threshold, a position inside a limit, an age, a balance, an exposure.
The zkVM columns barely move from the table above. RISC Zero charges the same 32,768 cycles here as it does for fast doubling, because the work never leaves the floor its own machine sets. That floor is the gap.
| System | Prove | Verify | Proof | Prover memory |
|---|---|---|---|---|
| zkFOL | 1.53 ms | 0.54 ms | 28.0 KB | ~3 MB |
| RISC Zero, composite | 3.70 s | 11.5 ms | 209.6 KB | 311 MB |
| RISC Zero, succinct | 14.68 s | 12.3 ms | 223.2 KB | 1.39 GB |
| SP1, core | 13.23 s | 78.2 ms | 2.78 MB | 9.36 GB |
| SP1, compressed | 49.20 s | 32.6 ms | 1.27 MB | 17.01 GB |
Prove time, zkVM over zkFOL: 2,420×, 9,600×, 8,650× and 32,200×. Prover memory: 100×, 460×, 3,100× and 5,700×.
Each system's own route
The exact 2,090-digit integer, in 8.36 milliseconds.
Here the zkVMs run the published benchmark program unchanged, in their headline proof mode, and zkFOL runs Fibonacci the way a user would actually write it. The second row proves the exact integer with no modular reduction anywhere, which is a strictly harder claim than the one every other row makes, and it is the fastest row on the page.
| System | What is proved | Prove | Verify | Proof |
|---|---|---|---|---|
| zkFOL, exact integer | exact fib(10,000) | 8.36 ms | 3.1 ms | 664 KB |
| RISC Zero, succinct | fib(10,000) mod 7919 | 40.67 s | 12.5 ms | 223.3 KB |
| SP1, compressed | fib(10,000) mod 7919 | 50.39 s | 35.2 ms | 1.27 MB |
The compiler is what makes that row possible. Handed the same recurrence written as a plain loop, zkFOL proves it in 1.06 s; rewritten to doubling, 8.36 ms. That rewrite is the default route a user gets.
Hardware
One desktop CPU, start to finish.
No accelerator, no cluster, no specialist machine. Producing and verifying proofs for your own transactions sits inside the envelope published on this page, which means no proving farms, no rented trust and no queue. That was the promise of this industry before it got complicated.
Full methodology, the guest programs each system was given, how memory was measured, and the commands to reproduce every cell, are in the documentation.