Build the smallest Groth16 verifier that runs on Bitcoin Cash.
Bitcoin Cash's recent upgrades unlocked the power to run a Groth16 verifier on chain. New primitives like bounded loops and reusable functions let us greatly optimize its program size, and the challenge is to push it as small as possible.i
What this measures
How it works →The same Groth16 verifier shows up as two very different numbers. On BN254, as one input it is just 4.7 KB, the smallest form on record, but only possible because it ignores any compute constraints, so it can't run on chain. To fit the VM limits, the work is split across 11 inputs, bringing the total to 91 KB.
That ~20× gap isn't the real overhead, since the floor doesn't account for compute usage, which the VM has to constrain. The chunking overhead itself is ~1.5×: the same split measured against the op-cost-optimized single input (59 KB), so both sides carry comparable compute. Entries are scored on total on-chain bytes, since bytes are what a user pays in fees.
- Unlocking bytecode
- ≤ 10,000 B
- Op-cost budget
- ≤ 8.0M
A full verifier needs far more bytes and compute than any single input allows, so it has to run as a chain of smaller inputs that each stay under both limits.
Score history
Best BCH-native verifier size over time, lower is better. Down 95% since the first fitting build.
Leaderboard
14 BN254 Groth16 verifiers · ranked by total on-chain bytes
| # | Solver | Curve | Structure | Size (B) | Published | BCH |
|---|---|---|---|---|---|---|
| 1 | Toorikgroth16-singleton-genpowOpus 4.8 (1M context) | BN254 | single transactionsingle input | 4,651 | Jul 4, 2026 | VM limits |
| 2 | mr-zwetsgroth16-singleton-opcode-optimizedOpus 4.8 (1M context) | BN254 | single transactionsingle input | 6,673 | Jun 29, 2026 | VM limits |
| 3 | mr-zwetsgroth16-singletonOpus 4.8 (1M context) | BN254 | single transactionsingle input | 8,874 | Jun 22, 2026 | VM limits |
| 4 | mr-zwetsgroth16-singleton-minopFable 5 | BN254 | single transactionsingle input | 59,093 | Jul 15, 2026 | VM limits |
| 5 | mr-zwetsgroth16-intratx-residue-largeFable 5 | BN254 | single transactionmulti input (2) | 82,291 | Jul 15, 2026 | bch-spec |
| 6 | kallistigroth16-intratx-residueGPT-5.6 sol | BN254 | single transactionmulti input (11) | 90,949 | Jul 15, 2026 | fits BCH |
| 7 | Toorikgroth16-intratx-generalOpus 4.8 (1M context) | BN254 | single transactionmulti input (13) | 95,201 | Jul 15, 2026 | fits BCH |
| 8 | kallistigroth16-chunked-covenant-residueGPT-5.6 sol | BN254 | multi transaction (14)multi input (14) | 106,754 | Jul 15, 2026 | fits BCH |
| 9 | kallistigroth16-grouped-residueGPT-5.6 sol | BN254 | multi transaction (3)multi input (26) | 225,877 | Jul 14, 2026 | fits BCH |
| 10 | kallistigroth16-intratxGPT-5.6 sol | BN254 | single transactionmulti input (42) | 330,364 | Jul 15, 2026 | non standard |
| 11 | kallistigroth16-groupedGPT-5.6 sol | BN254 | multi transaction (5)multi input (42) | 330,628 | Jul 15, 2026 | fits BCH |
| 12 | kallistigroth16-chunkedGPT-5.6 sol | BN254 | multi transaction (43)multi input (43) | 337,403 | Jul 15, 2026 | fits BCH |
| 13 | Toorikgroth16-chunked-covenantOpus 4.8 (1M context) | BN254 | multi transaction (49)multi input (49) | 473,475 | Jun 23, 2026 | non standard |
| 14 | scrypt-bn256baseline | BN254 | single transactionsingle input | 11,717,771 | Jul 23, 2022 | VM limits |