KoinlyticsA zero-knowledge proof lets you prove a statement is true without revealing anything else. "I know a preimage of this hash." "I executed these 10,000 transactions correctly." "I am over 18." All without leaking the inputs. Two families dominate crypto: SNARKs and STARKs.
Common ground
Both convert a computation into an arithmetic circuit, then produce a small proof that a verifier can check quickly. The magic is that the verifier's work is constant (or near-constant) regardless of how big the computation was. A proof of 10 million transactions is not much bigger than a proof of 100.
SNARKs
Succinct Non-interactive ARguments of Knowledge. Very small proofs (a few hundred bytes) and fast verification. The trade-off: most SNARK schemes (Groth16, PLONK, KZG-based) require a trusted setup: a one-time ceremony where secret randomness must be destroyed. If anyone kept it, they can forge proofs forever.
- Groth16. Smallest proofs, per-circuit trusted setup.
- PLONK / Marlin. One universal setup for many circuits.
- Halo2 / Nova. No trusted setup, larger proofs.
STARKs
Scalable Transparent ARguments of Knowledge. No trusted setup (transparent). Larger proofs (tens of KB). Post-quantum safe because they rely only on hash functions, not elliptic curves. Slower verification than SNARKs but scales better with computation size.
Where they show up
- zkSync, Polygon zkEVM, Scroll, Linea. SNARK-based (each with its own recipe).
- StarkNet, Starknet-based L3s. STARK-based.
- Aztec, Aleo, Ironfish, Zcash. Privacy-focused ZK, mostly SNARK.
The proving cost problem
Generating a proof is expensive: hardware-heavy, GPU-preferred, dedicated hardware in some cases. Verification is cheap; production is not. Prover markets (Succinct, RISC0, Cysic) are emerging to auction proving jobs. As hardware improves, ZK becomes economical for smaller and smaller computations.
What to take away
SNARKs are what most zk L2s use today because the smaller proof size fits well with Ethereum blob economics. STARKs are what you use when you cannot afford any trusted-setup assumption and want quantum safety. In three years, expect the industry to converge on scheme designs that mix both.