← → Print all
04 — Trusted setup · Ceremony approach

Avoid the setup entirely: transparent proof systems

Avoidance strategy

In one paragraph

Avoid the setup entirely: transparent proof systems: Avoidance strategy. Choose a proof system with a public-coin setup so there is no trapdoor to protect: FRI/STARK-based systems, Bulletproofs, Halo2 with IPA, and hash- or Pedersen-based multilinear commitments. Maturity: Production-used at scale. Maintained by: See the transparent families in §01: StarkWare, Polygon, RISC Zero, Succinct, Zcash and others ship transparent provers. Choose it when: Systems verifying off-chain, or on a chain tolerant of larger proofs, and any team for whom parameter lifecycle risk outweighs proof size.

By MarketComp Updated v1.3 About the authors Changelog

What it is

Choose a proof system with a public-coin setup so there is no trapdoor to protect: FRI/STARK-based systems, Bulletproofs, Halo2 with IPA, and hash- or Pedersen-based multilinear commitments. This is the option most teams should evaluate first, because it removes the workstream rather than managing it.

Strengths and tradeoffs

Strengths
  • Eliminates the entire class of ceremony risks, including the ones that have actually caused losses
  • No parameter lifecycle burden when circuits change, and no artefact-persistence obligation
  • Plausibly post-quantum for hash-based variants, unlike pairing-based SRS systems
Tradeoffs
  • Larger proofs and higher verification cost: no transparent scheme in deployment matches a pairing-based SNARK's proof size and verifier cost, and the gap is what pays for the missing trapdoor
  • On-chain verification cost often forces a final wrap in Groth16 or PLONK — which reinstates a trusted setup for the wrapper circuit
  • Public parameters must still be generated from auditable nothing-up-my-sleeve seeds; 'transparent' is not 'no parameters'

Choose it whenSystems verifying off-chain, or on a chain tolerant of larger proofs, and any team for whom parameter lifecycle risk outweighs proof size.

Failure modes that involve it
Maintained implementations

See the transparent families in §01: StarkWare, Polygon, RISC Zero, Succinct, Zcash and others ship transparent provers

Maturity: Production-used at scale · License: Varies by implementation · eprint.iacr.org ↗

How to decide
Other ceremony approaches in §04
snarkjs (powersoftau + zkey)gnark mpcsetupCoordinated phase-2 ceremony platformsSequencer-mediated large public ceremonyCoordinatorless and on-chain ceremonies

Sources cited on this page · 1

  1. SoK: Trusted setups for powers-of-tau strings (Wang, Cohney, Bonneau; FC 2025)paper

All 42 sources for §04 are listed on the section page →

Cite this page 
MarketComp (2026). Avoid the setup entirely: transparent proof systems. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/ceremony/transparent-proof-systems/
@misc{zkfieldmanual-avoid-the-setup-entirely-transparent-pro,
  title        = {Avoid the setup entirely: transparent proof systems — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/ceremony/transparent-proof-systems/}},
  note         = {Accessed: YYYY-MM-DD}
}