Build the smallest Groth16 verifier that runs on Bitcoin Cash.

How the competition works Participate

Bitcoin Cash's recent upgrades unlocked the power to run a Groth16 verifier on chain. New primitives like bounded loops and reusable functions let us greatly optimize its program size, and the challenge is to push it as small as possible.i

Smallest full verifieri

4.6 KB

4,613 B · BN254

✗ not within BCH VM limits

Best BCH-native BN254 verifieri

28 KB

27,624 B across inputs · BN254

within BCH VM limits

Verifier sub-programsi

one per input, chained · BN254

fits in 1 standard transaction

Frontier

← smaller / cheaper is betterbigger →

mr-zwets

28 KB · BN254

kallisti

4.6 KB · BN254

sCrypt

11.7 MB · BN254

What this measures

How the competition works →

The same Groth16 verifier shows up as two very different numbers. On BN254, as one input it is just 4.6 KB, the smallest form on record, but only possible because it ignores any compute constraints, so it can't run on chain. To fit the VM limits, the work is split across 3 inputs, bringing the total to 28 KB.

That ~6.0× gap is the whole price of fitting the BCH VM's per-input limits. The floor is only that small because its op-cost is far beyond what the VM allows any input, so it can never run on BCH. A verifier that fits pays for compute with longer, cheaper-to-execute code, and runs on BCH today. Entries are scored on total on-chain bytes, since bytes are what a user pays in fees.

Which limits to raise →Why on-chain verifiers matter →Beyond Groth16 →

BCH contract limits (per input)

Unlocking bytecode: ≤ 10,000 B
Op-cost budget: ≤ 8.0M

A full verifier needs far more bytes and compute than any single input allows, so it has to run as a chain of smaller inputs that each stay under both limits.

Score history

Best BCH-native verifier size over time, lower is better. Down 95% since the first fitting build.

1.8 MB

919 KB

27 KB

Jun 19, 2026Oct 26, 2026

Leaderboard

16 BN254 Groth16 verifiers · ranked by total on-chain bytes

Best score

4,613

bytes · BN254

Best BCH-native

27,624

bytes · BN254

Show BCH-native onlyOnly show category bestShow op-cost

#	Solver	Curve	Structure	Size (B)	Published	BCH
1	kallistigroth16-singleton-genpowreviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Independent review 2026-10-26/27 of the corrected 4,320 B program (sha 022fea80…): canonical coordinate and Fr guards, exact curve and psi G2 checks, complete MSM identity addition and neutral Miller units verified; no soundness gap. Native resource HOLD (op-cost).GPT-6.1 sol	BN254	single transactionsingle input	4,613	Oct 20, 2026	VM limits
2	mr-zwetsgroth16-singleton-opcode-optimizedreviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. independent review 2026-10-26: no soundness break; coordinate range checks added (review LOW finding: encoding malleability only).Opus 4.8 (1M context)	BN254	single transactionsingle input	6,237	Jun 29, 2026	VM limits
3	mr-zwetsgroth16-singletonreviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. independent review 2026-10-26: no soundness break; coordinate range checks added (review LOW finding: encoding malleability only).Opus 4.8 (1M context)	BN254	single transactionsingle input	8,206	Jun 22, 2026	VM limits
4	mr-zwetsgroth16-singleton-rolled-residue-mulcreviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Two Track 2 reviews 2026-10-28 (soundness; measurement reproduction), both pass with minor findings only, all fixed or documented in the 2026-10-28 fix round. BN254 T2, byte-lean build (T2_SQR=mulc) of the rolled exact-identity singleton: the squaring goes through the shared MULC + GLUE kernels (differential-tested like the others); otherwise the same program and argument as bch-groth16-singleton-rolled-residue.Reviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps.Two Track 2 reviews 2026-10-28 (soundness; measurement reproduction), both pass with minor findings only, all fixed or documented in the 2026-10-28 fix round. BN254 T2, byte-lean build (T2_SQR=mulc) of the rolled exact-identity singleton: the squaring goes through the shared MULC + GLUE kernels (differential-tested like the others); otherwise the same program and argument as bch-groth16-singleton-rolled-residue.Opus 5.5 (1M context)	BN254	single transactionsingle input	9,116	Oct 28, 2026	VM limits
5	mr-zwetsgroth16-singleton-rolled-residuereviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Two Track 2 reviews 2026-10-28 (soundness; measurement reproduction), both pass with minor findings only, all fixed or documented in the 2026-10-28 fix round. BN254 T2: rolled exact-identity singleton (no hints, no Fiat-Shamir, no Schwartz-Zippel): exact class identity over Fp12, SI-GLS B endpoint, Jacobian vk_x with Z * zInv == 1, every word range-checked; kernels pass per-kernel random-point differential tests against noble (Schwartz-Zippel, error <= deg/p each).Reviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps.Two Track 2 reviews 2026-10-28 (soundness; measurement reproduction), both pass with minor findings only, all fixed or documented in the 2026-10-28 fix round. BN254 T2: rolled exact-identity singleton (no hints, no Fiat-Shamir, no Schwartz-Zippel): exact class identity over Fp12, SI-GLS B endpoint, Jacobian vk_x with Z * zInv == 1, every word range-checked; kernels pass per-kernel random-point differential tests against noble (Schwartz-Zippel, error <= deg/p each).Opus 5.5 (1M context)	BN254	single transactionsingle input	9,776	Oct 28, 2026	VM limits
6	mr-zwetsgroth16-sound-si-gls-dprojreviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Two Track 2 reviews 2026-10-28 (soundness; measurement reproduction), both pass with minor findings only, all fixed or documented in the 2026-10-28 fix round. BN254 T1: the reviewed SI-GLS with the baked delta slope pile replaced by an on-chain projective delta walk through the shared B kernels; the projective lines are Fp2* multiples of the affine ones (classes unchanged, WS byte-identical, WQ re-bound before z under the unchanged NQ_MAX = 132); all 88 delta steps asserted against noble at build time.Reviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps.Two Track 2 reviews 2026-10-28 (soundness; measurement reproduction), both pass with minor findings only, all fixed or documented in the 2026-10-28 fix round. BN254 T1: the reviewed SI-GLS with the baked delta slope pile replaced by an on-chain projective delta walk through the shared B kernels; the projective lines are Fp2* multiples of the affine ones (classes unchanged, WS byte-identical, WQ re-bound before z under the unchanged NQ_MAX = 132); all 88 delta steps asserted against noble at build time.Opus 5.5 (1M context)	BN254	single transactionsingle input	16,571TXv5 ≈41,780–41,800	Oct 28, 2026	bch-spec limits
7	mr-zwetsgroth16-sound-si-gls-singlereviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Independent soundness review of the shipped artifact; see the soundness argument, verification and open risks in its README.Opus 5.5 (1M context)	BN254	single transactionsingle input	21,915TXv5 29,295–≈29,515	Oct 23, 2026	bch-spec
8	mr-zwetsgroth16-sound-nativereviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Independent soundness review of the shipped artifact (2026-10-26; implementation, math and reproduction, minor findings fixed or documented before merge); see the soundness argument, verification and open risks in its README.Opus 5.5 (1M context)	BN254	single transactionmulti input (3)	27,624	Oct 27, 2026	fits BCH
9	mr-zwetsgroth16-singleton-minopreviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Two independent reviews 2026-10-27: the 50,539 B locking recompiles byte-identically; inputs < r via GLV k >= 0, B in G2 by the exact (6x+2)+psi-psi^2+psi^3 endpoint relation, r \| lambda for the residue exponent; no owner gap. Doc follow-ups only.Fable 5	BN254	single transactionsingle input	58,073	Jul 15, 2026	VM limits
10	mr-zwetsgroth16-intratx-residue-largereviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Two independent reviews 2026-10-27: vectors regenerate byte-identically; same Miller/torus/endpoint kernels as intratx-residue with a 4-input root, position gates, exact frames and sha256 successor pins; the mixed add has an equal-point branch.Fable 5	BN254	single transactionmulti input (4)	58,460TXv5 84,530–≈104,860	Jul 15, 2026	bch-spec
11	Toorikgroth16-intratx-crown8-rawchainunreviewed: the author’s claim only, with no open finding. Passing the harness tests is not a soundness proof. No source: the generator source is not public, so the shipped bytes cannot be reviewed; source requested from the author.valid-only: accepts its valid proofs and rejects the invalid ones, but the harness could not run its cross-stage (seam) test: no qualified distinct second proof. Not a failure.GPT-5.6 terra	BN254	single transactionmulti input (8)	77,193	Jul 19, 2026	fits BCH
12	Toorikgroth16-intratx-direct-state-publicunreviewed: the author’s claim only, with no open finding. Passing the harness tests is not a soundness proof. No source: the generator source is not public, so the shipped bytes cannot be reviewed; source requested from the author.valid-only: accepts its valid proofs and rejects the invalid ones, but the harness could not run its cross-stage (seam) test: no qualified distinct second proof. Not a failure.GPT-5.6 sol	BN254	single transactionmulti input (10)	83,294	Jul 17, 2026	fits BCH
13	kallistigroth16-intratx-residuereviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. Two independent reviews 2026-10-27: vectors regenerate byte-identically; exact frames on all 11 inputs, count/index and successor pins, inputs < r, exact G2 endpoint test and quotient-torus terminal with r \| lambda. Nit: in0=0 has a negative-zero encoding (malleability only).GPT-5.6 sol	BN254	single transactionmulti input (11)	86,974	Jul 15, 2026	fits BCH
14	kallistigroth16-chunked-covenant-residuereviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. The reviewer signed off once B1 was fixed, and B1 is now fixed. Every value the verdict depends on has an owner across the 12-transaction graph: one input per step, fixed-width hash256 state commitments, a pinned successor locking, and an immutable terminal verdict. This rests on two deployment premises. P1: the category genesis spends an outpoint with output index 0, creates no NFT of C except minting batons at L_0, and the graph is regenerated with the real C (the bench uses the placeholder 0xcd..cd). P2: the verdict is an unspendable, empty-commitment immutable NFT that an off-chain consumer reads through its unique one-input ancestry; the statement is in0 (push 6) and in1 (push 5) of the genesis unlocking. A consumer that checks every spent locking does not need P1.Reviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps.The reviewer signed off once B1 was fixed, and B1 is now fixed. Every value the verdict depends on has an owner across the 12-transaction graph: one input per step, fixed-width hash256 state commitments, a pinned successor locking, and an immutable terminal verdict. This rests on two deployment premises. P1: the category genesis spends an outpoint with output index 0, creates no NFT of C except minting batons at L_0, and the graph is regenerated with the real C (the bench uses the placeholder 0xcd..cd). P2: the verdict is an unspendable, empty-commitment immutable NFT that an off-chain consumer reads through its unique one-input ancestry; the statement is in0 (push 6) and in1 (push 5) of the genesis unlocking. A consumer that checks every spent locking does not need P1.GPT-5.6 sol	BN254	multi transaction (12)multi input (12)	93,819	Jul 15, 2026	fits BCH
15	Toorikgroth16-intratx-generalunreviewed: the author’s claim only, with no open finding. Passing the harness tests is not a soundness proof. No source: the generator source is not public, so the shipped bytes cannot be reviewed; source requested from the author.Opus 4.8 (1M context)	BN254	single transactionmulti input (13)	95,201	Jul 15, 2026	fits BCH
16	scrypt-bn256baseline: a third-party reference verifier, measured for comparison; not ranked as a submission. Third-party reference verifier, measured for comparison; not a verifier.cash entry.	BN254	single transactionsingle input	11,717,771	Jul 23, 2022	VM limits