Build the smallest Groth16 verifier that runs on Bitcoin Cash.
Bitcoin Cash's recent upgrades unlocked the power to run a Groth16 verifier on chain. New primitives like bounded loops and reusable functions let us greatly optimize its program size, and the challenge is to push it as small as possible.i
What this measures
How it works →The same Groth16 verifier shows up as two very different numbers. On BN254, as one input it is just 4.6 KB, the smallest form on record, but only possible because it ignores any compute constraints, so it can't run on chain. To fit the VM limits, the work is split across 5 inputs, bringing the total to 33 KB.
That ~7.2× gap is the whole price of fitting the BCH VM's per-input limits. The floor is only that small because its op-cost is far beyond what the VM allows any input, so it can never run on BCH. A verifier that fits pays for compute with longer, cheaper-to-execute code, and runs on BCH today. Entries are scored on total on-chain bytes, since bytes are what a user pays in fees.
- Unlocking bytecode
- ≤ 10,000 B
- Op-cost budget
- ≤ 8.0M
A full verifier needs far more bytes and compute than any single input allows, so it has to run as a chain of smaller inputs that each stay under both limits.
Score history
Best BCH-native verifier size over time, lower is better. Down 98% since the first fitting build.
Leaderboard
20 BN254 Groth16 verifiers · ranked by total on-chain bytes
| # | Solver | Curve | Structure | Size (B) | Published | BCH |
|---|---|---|---|---|---|---|
| 1 | kallistigroth16-singleton-genpow | BN254 | single transactionsingle input | 4,587 | Sep 5, 2026 | VM limits |
| 2 | mr-zwetsgroth16-singleton-opcode-optimizedOpus 4.8 (1M context) | BN254 | single transactionsingle input | 6,584 | Jun 29, 2026 | VM limits |
| 3 | mr-zwetsgroth16-singletonOpus 4.8 (1M context) | BN254 | single transactionsingle input | 8,734 | Jun 22, 2026 | VM limits |
| 4 | Toorikgroth16-intratx-pairfold5-denslessGrok 4.6 | BN254 | single transactionmulti input (5) | 33,179 | Sep 5, 2026 | fits BCH |
| 5 | kallistigroth16-intratx-pairfold5-pevalfuse | BN254 | single transactionmulti input (5) | 36,836 | Sep 5, 2026 | fits BCH |
| 6 | Toorikgroth16-intratx-pairfold5Grok 4.5 | BN254 | single transactionmulti input (5) | 44,968 | Aug 11, 2026 | fits BCH |
| 7 | Toorikgroth16-intratx-pairfold7Grok 4.5 | BN254 | single transactionmulti input (7) | 54,483 | Jul 23, 2026 | fits BCH |
| 8 | mr-zwetsgroth16-intratx-residue-largeFable 5 | BN254 | single transactionmulti input (4) | 58,760 | Jul 15, 2026 | bch-spec |
| 9 | mr-zwetsgroth16-singleton-minopFable 5 | BN254 | single transactionsingle input | 58,870 | Jul 15, 2026 | VM limits |
| 10 | Toorikgroth16-intratx-crown8-rawchainGPT-5.6 terra | BN254 | single transactionmulti input (8) | 77,193 | Jul 19, 2026 | fits BCH |
| 11 | Toorikgroth16-intratx-direct-state-publicGPT-5.6 sol | BN254 | single transactionmulti input (10) | 83,294 | Jul 17, 2026 | fits BCH |
| 12 | kallistigroth16-intratx-residueGPT-5.6 sol | BN254 | single transactionmulti input (11) | 86,950 | Jul 15, 2026 | fits BCH |
| 13 | kallistigroth16-chunked-covenant-residueGPT-5.6 sol | BN254 | multi transaction (12)multi input (12) | 93,802 | Jul 15, 2026 | fits BCH |
| 14 | Toorikgroth16-intratx-generalOpus 4.8 (1M context) | BN254 | single transactionmulti input (13) | 95,201 | Jul 15, 2026 | fits BCH |
| 15 | kallistigroth16-grouped-residueGPT-5.6 sol | BN254 | multi transaction (3)multi input (26) | 225,877 | Jul 14, 2026 | fits BCH |
| 16 | kallistigroth16-intratxGPT-5.6 sol | BN254 | single transactionmulti input (31) | 234,022 | Jul 15, 2026 | non standard |
| 17 | kallistigroth16-groupedGPT-5.6 sol | BN254 | multi transaction (4)multi input (31) | 234,301 | Jul 15, 2026 | fits BCH |
| 18 | kallistigroth16-chunkedGPT-5.6 sol | BN254 | multi transaction (32)multi input (32) | 239,773 | Jul 15, 2026 | fits BCH |
| 19 | Toorikgroth16-chunked-covenantOpus 4.8 (1M context) | BN254 | multi transaction (49)multi input (49) | 473,475 | Jun 23, 2026 | non standard |
| 20 | scrypt-bn256baseline | BN254 | single transactionsingle input | 11,717,771 | Jul 23, 2022 | VM limits |