Soundness review

The harness checks that a verifier accepts valid proofs and rejects tampered ones. Those tests catch many mistakes, but passing them does not prove a verifier is sound: a gap can survive every fixture. So every entry also carries a review status, which says how much its correctness claim has been checked.

Review statuses

• reviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps.Reviewed: an independent soundness review of the exact artifact shipped here (these bytes) found no gaps. An independent soundness review of the exact artifact found no gaps. The review checks that a written soundness argument exists, that every value the accept decision depends on has an owner (computed on-chain, a verifying-key constant, committed before its challenge, or fixed by an exact equation), and that the code enforces what the argument assumes. 38 entries are reviewed today.
• unreviewed: the author’s claim only, with no open finding. Passing the harness tests is not a soundness proof.Unreviewed: the author’s claim only, with no open finding. Passing the harness tests is not a soundness proof. The author's claim only, with no open finding against it. These entries rank on the leaderboard and can hold crowns and the frontier (3 today).
• withdrawn: the author withdrew the claim, a finding applies, or it is held pending review.Withdrawn: the author withdrew the claim, a finding applies, or it is held pending review. The author withdrew the claim, a confirmed finding applies, or the maintainer holds the entry until an open question is resolved. Withdrawn entries leave the leaderboard, the crowns and the frontier, and the benchmark normally drops them from its feed. Their last rows are kept, frozen, in a collapsed list under the leaderboard and below, so the record is not rewritten (16 today).
• archived: a superseded legacy entry, kept as history only; not ranked.Archived: a superseded legacy entry, kept as history only; not ranked. A superseded legacy entry, kept as history only. Like a withdrawn entry it never ranks, holds a crown or sets the frontier, but its row stays in the feed, the score history and a collapsed list under the leaderboard (6 today).

Three labels mark entries that are not ranked submissions and make no soundness claim of their own:

• baseline: a third-party reference verifier, measured for comparison; not ranked as a submission.Baseline: a third-party reference verifier, measured for comparison; not ranked as a submission. A third-party reference verifier (nChain, sCrypt), measured for comparison (2 today).
• component: a partial pairing or vk_x component (a sub-step of a verifier), not a full verifier; not soundness-reviewed on its own.Component: a partial pairing or vk_x component (a sub-step of a verifier), not a full verifier; not soundness-reviewed on its own. A partial pairing or vk_x component, a sub-step of a verifier shown under research milestones (10 today).
• demo: a harness self-test, not a Groth16 verifier.Demo: a harness self-test, not a Groth16 verifier. The harness self-test, not a Groth16 verifier (1 today).

Holding an entry while a question is open is the conservative default: a missing argument or a value without an owner is enough, and no counterexample is needed.

The October 2026 withdrawals

In October 2026 a mathematical review of several submitted constructions found gaps: values that the accept decision used but nothing pinned down, and in the densless family a pairing core with no soundness argument. The author, kallisti, confirmed the findings and withdrew the correctness claims for their own revisions at the reviewed commits, in groth16_cashscript #28, groth16_cashscript #32 and zk-verifier-bench #49.

That withdrawal covers kallisti’s revisions only. Other entries share the same mechanisms, so the maintainer mapped the findings onto them or held them for review. Toorik’s pairfold5-densless ships the same Miller-step and terminal bytes as the withdrawn densless constructions, and the author’s withdrawal explicitly leaves that baseline out. Toorik’s pairfold5 ships the same genesis that the pevalfuse finding flags. The densless-msm and densless-msm-spec builds reuse the withdrawn densless executors. Pairfold7, the BLS12-381 residue-large build and the BLS12-381 vk_x covenant chain are held until an open question about each is resolved. The two BLS12-381 singletons were held too (they lacked point-validation checks); the checks were added and the rebuilt singletons were independently reviewed. The maintainer’s own BN254 singletons had a related gap (a point addition that dropped a term when its right operand was the identity). They have been fixed, rebuilt with coordinate range checks, and independently reviewed.

This is how the process is meant to work. Gaps were found, the author withdrew their claims, the maintainer applied the findings to the rest of the board, and the frontier moved back to entries with no open finding. Corrected successors can return as new entries once they qualify on their own. They don’t restore the withdrawn revisions.

The reviewed entries are groth16-singleton-genpow (BN254, 4,613 B), groth16-singleton-genpow (BLS12-381, 5,965 B), groth16-singleton-opcode-optimized (BLS12-381, 5,999 B), groth16-singleton-opcode-optimized (BN254, 6,237 B), groth16-singleton (BLS12-381, 7,510 B), groth16-singleton (BN254, 8,206 B), groth16-singleton-minop-rolled (BLS12-381, 8,712 B), groth16-singleton-rolled-residue-mulc (BN254, 9,116 B), groth16-singleton-rolled-residue (BN254, 9,776 B), groth16-sound-si-gls-dproj (BN254, 16,571 B, bch-spec), groth16-sound-si-gls-dproj (BLS12-381, 18,892 B, bch-spec), groth16-sound-si-gls-single (BN254, 21,915 B, bch-spec), groth16-sound-si-gls-single (BLS12-381, 26,484 B, bch-spec), groth16-sound-native (BN254, 27,624 B), groth16-sound-native (BLS12-381, 34,229 B), groth16-singleton-minop (BN254, 58,073 B), groth16-intratx-residue-large (BN254, 58,460 B, bch-spec), groth16-singleton-minop (BLS12-381, 58,841 B), groth16-intratx-fs-coordinator-head (BLS12-381, 60,285 B), groth16-intratx-fs-coordinator-head-fields (BLS12-381, 60,308 B), groth16-intratx-fs-first-tail (BLS12-381, 62,252 B), groth16-intratx-fs-regular-initializer (BLS12-381, 62,328 B), groth16-intratx-fs-middle-pair (BLS12-381, 63,866 B), groth16-intratx-fs-carrier-pair (BLS12-381, 64,159 B), groth16-intratx-fs-regular-triples (BLS12-381, 64,532 B), groth16-intratx-fs-regular-pairs-packed (BLS12-381, 64,689 B), groth16-intratx-fs-regular-pairs (BLS12-381, 64,783 B), groth16-intratx-fs-fused-regular (BLS12-381, 65,160 B), groth16-singleton-fs-spec-zero (BLS12-381, 65,218 B, bch-spec), groth16-intratx-fs-fused-final (BLS12-381, 65,326 B), groth16-intratx-fs-compact (BLS12-381, 65,696 B), groth16-singleton-fs-spec-shared (BLS12-381, 73,536 B, bch-spec), groth16-intratx-fs (BLS12-381, 79,948 B), groth16-intratx-residue (BN254, 86,974 B), groth16-chunked-covenant-residue (BN254, 93,819 B), groth16-singleton-fs-spec (BLS12-381, 97,955 B, bch-spec), groth16-singleton-fs (BLS12-381, 103,861 B) and groth16-chunked-covenant-residue (BLS12-381, 211,202 B).

Withdrawn entries

Each entry, with who withdrew or held it and the reason recorded in the benchmark. The benchmark removed most of these entries from its registry, so their rows here (marked frozen) are taken from the last measurement, in the export at 9218e32; bch-groth16-bls12381-grouped-residue was removed later, its row is from the export at ca18086. Older measurements stay in the historical export.

• vkx-chunked-covenant (kallisti, BLS12-381, 23,700 B). Maintainer hold: Held (F3 class): each covenant step pins only commitment + category, not its successor locking. (frozen row)
• groth16-intratx-pairfold5-densless (Toorik, BN254, 33,179 B). Maintainer mapping: F6: same millerEvent and terminal bytes as the withdrawn densless constructions; no soundness argument. (frozen row)
• groth16-intratx-pairfold5-densless-msm-spec (mr-zwets, BN254, 33,875 B). Maintainer mapping: F6: same densless executors and terminal; no soundness argument. (frozen row)
• groth16-intratx-pairfold5-densless-msm-slim (kallisti, BN254, 35,143 B). Author withdrawal: F6: ships the withdrawn densless-msm-slim head; no soundness argument. (frozen row)
• groth16-intratx-pairfold5-densless-msm (mr-zwets, BN254, 35,861 B). Maintainer mapping: F6: densless executors and terminal; no soundness argument. (frozen row)
• groth16-intratx-pairfold5-pevalfuse (kallisti, BN254, 36,836 B). Author withdrawal: F9: the auxiliary relation does not establish the public MSM. (frozen row)
• groth16-intratx-pairfold5 (Toorik, BN254, 44,968 B). Maintainer mapping: F9: genesis byte-identical to the withdrawn pevalfuse genesis; the public MSM is not established. (frozen row)
• groth16-intratx-pairfold7 (Toorik, BN254, 54,483 B). Maintainer hold: Held (F9 class): public-statement binding not established; the harness red-team already fails it. (frozen row)
• pairing-intratx (kallisti, BN254, 107,243 B). Maintainer hold: Held partial connected Miller component: raw carrier byte ownership is not proved; no standalone full-verifier claim is asserted. (frozen row)
• groth16-intratx-residue-large (mr-zwets, BLS12-381, 161,660 B). Maintainer hold: Held (F1 pattern): chunks are generated without enforceExactInputLength (prefix-only forward checks). (frozen row)
• groth16-intratx-residue (kallisti, BLS12-381, 193,309 B). Author withdrawal: F1 (BLS24): no GLV-carrier / terminal-state byte owner. (frozen row)
• groth16-grouped-residue (mr-zwets, BLS12-381, 202,594 B). Review finding: Owner gap (review 2026-10-27): the tx2/tx3 group roots take their incoming state from tx.inputs[0].nftCommitment but check only capability 0x01 and sibling exclusion, with no pinned token category, so that state is unowned. Fix route: pin the category and hold minting in a covenant. (frozen row)
• groth16-grouped-residue (kallisti, BN254, 225,877 B). Author withdrawal: F1 (grouped26): no carrier / terminal-state byte owner. (frozen row)
• groth16-intratx (kallisti, BN254, 234,022 B). Author withdrawal: F1 (BN42): the final vk_x chunk reads in1 without an exact-length gate. (frozen row)
• groth16-grouped (kallisti, BN254, 234,301 B). Author withdrawal: F1 (grouped42): in0/in1 are trailing limbs without an exact-length gate. (frozen row)
• groth16-intratx-authenticated-p2s (bastiancarmy, BN254, 330,742 B). Author withdrawal (kallisti, of their revision): F1 (authenticated42): no byte-owner gates on state/table bytes. (frozen row)

Archived entries

Legacy large chains, superseded by the reviewed sound verifiers. They stay in the feed and the score history, but are not ranked and were not reviewed:

• groth16-chunked (kallisti, BN254, 239,773 B)
• groth16-intratx (kallisti, BLS12-381, 345,471 B)
• groth16-grouped (kallisti, BLS12-381, 345,791 B)
• groth16-chunked (kallisti, BLS12-381, 357,241 B)
• groth16-chunked-covenant (Toorik, BN254, 473,475 B)
• groth16-chunked-covenant (Toorik, BLS12-381, 635,295 B)