Fly Labs
Ask FlyBot

zkGolf – Competitive optimization of formally verified circuits

Zero-Knowledge Proofs (ZKPs) let an untrusted proved show that computation was executed correctly without revealing the inputs to the verifier. However to prove anything, the computation first has to be expressed as a circuit: a system of polynomial equations (constraints) over a finite field. Circuits are the assembly language of zk and every constraint costs prover (and sometimes verifier) time, so production circuits are aggressively hand-optimized.Over the last months, we have been experimenting with writing formal specifications instead and letting LLMs produce the circuits: as long as they could prove that their implementation was correct. It started with SHA-256: we hand wrote a specification in Lean for SHA-256 compression, and then we asked LLMs to write the circuit, targeting R1CS arithmetization and large fields.It took a few hours of work for Opus 4.7, and some light steering into the right direction, but in the end the model came up with a reasonable implementation. We then asked the LLM to aggressively optimize the circuits, by driving down a cost metric of the circuit (number of constraints). We immediately got very promising results, just by asking to come up with optimization ideas, implement them and prove that the new circuit still satisfies soundness and completeness. Sometimes, it came up with unsound optimizations, however, since it could not prove them, it backtracked and got itself back on to the right approach.The result was a (non-deterministic) circuit beating the current, human optimized, state of the art for SHA256 compression. This experience lead us to create "zk.golf" which is an open competition to produce optimized, formally verified circuits to lower the bar for the use of ZKPs and make their application more efficient.Come play (https://zk.golf/llms.txt) and learn about formal verification.

Hacker NewsToolAISource
0Sign in to voteCopy link

FL score

72

out of 100

Verdict

VALIDATE

medium confidence

Competition

No competitor data yet

Trend

No signal yet

A competitive platform where LLMs generate formally verified zero-knowledge circuits, with human-competitive optimization results on SHA-256 suggesting a real efficiency gap in current ZK tooling.

The pain

ZK circuit development requires hand-optimization of polynomial constraints because each constraint directly increases prover/verifier computation time. Current state-of-the-art circuits are manually tuned by experts, making ZK adoption slower and more expensive. The SHA-256 compression function, a fundamental building block, has been optimized by humans for years, yet an LLM with formal verification constraints beat it.

The gap

No systematic way exists to generate production-grade circuits that are both correct and optimized. Developers either write circuits manually (slow, error-prone) or use high-level languages that compile inefficiently. The formal verification requirement creates a forcing function: the LLM cannot ship unsound optimizations, so it self-corrects. This gap between 'correct but slow' and 'fast but unverified' is where zkGolf operates.

Build angle

Start with a narrow, high-value circuit competition (SHA-256, Keccak, signature verification) where optimization gains are measurable and the formal verification requirement is non-negotiable. Build a leaderboard that tracks constraint count and proof time. Charge circuit developers or ZK protocol teams for access to winning circuits. The real business is not the competition platform, it's licensing optimized circuits to production systems or selling the optimization-as-a-service capability to enterprises building ZK applications.

Strengths

  • Demonstrated proof-of-concept: LLM-generated circuit already beats human baseline on a real, widely-used function
  • Formal verification as a moat: the self-correcting property of provable circuits prevents shipping broken optimizations, unlike traditional code optimization
  • Clear, measurable metric: constraint count is objective and directly tied to cost
  • Addresses a real bottleneck: ZK adoption is constrained by circuit efficiency, not just proof generation speed
  • Existing audience: ZK developers are actively looking for better tooling and are willing to pay

Risks

  • Market size uncertainty: how many organizations actually need custom circuit optimization badly enough to pay? SHA-256 is solved; the next 10 circuits may not have the same ROI
  • LLM capability ceiling: unclear if this scales beyond hand-crafted formal specs. Automating the Lean specification itself is a harder problem
  • Competitive threat: if this works, Circom, Cairo, or major ZK teams (Starkware, Aztec) will integrate LLM-assisted optimization into their own toolchains within 12 months
  • Adoption friction: developers must learn formal verification (Lean, Coq) to participate meaningfully. The competition may attract researchers but not practitioners
  • Sustainability of competition model: leaderboards are hard to monetize directly. Revenue model (licensing, SaaS, consulting) is not yet clear
  • Generalization risk: SHA-256 success may not transfer to more complex circuits (recursive proofs, custom logic). Each circuit type may require different optimization strategies

Questions about this idea?

FlyBot reads the scoring and gives you a second opinion on “zkGolf – Competitive optimization of formally verified circuits”.

Open FlyBot