{
  "type": "option",
  "name": "Bulletproofs",
  "slug": "bulletproofs",
  "section": {
    "id": "proof-systems",
    "number": "01",
    "title": "Choosing a proof system",
    "url": "https://zkpick.com/proof-systems/"
  },
  "url": "https://zkpick.com/proof-systems/bulletproofs/",
  "markdown": "https://zkpick.com/md/proof-systems/bulletproofs.md",
  "category": "Transparent discrete-log argument",
  "summary": "Bulletproofs: Transparent discrete-log argument. Setup: None. Proof size: Logarithmic; small for ranges. On-chain verification: Linear in circuit size — not succinct. PQ: No. Recursion: Poor. Maturity: Production for range proofs since 2018. Prover cost profile: Linear MSMs; slow for general circuits. Peak prover memory: Low. Off-chain verifier: Linear in circuit size; batchable. Implementations and maintainers: dalek bulletproofs (Rust), Monero, Bulletproofs+ in several wallets. Where it is measured: Range-proof figures in Monero and dalek benchmarks. Choose it when: Range proofs and small confidential-transaction statements verified by full nodes.",
  "description": "Logarithmic-size zero-knowledge arguments from the inner-product argument, with no trusted setup. Best known for range proofs in confidential transactions; general circuits are supported but not the strength.",
  "notes": [],
  "sections": [],
  "strengths": [
    "No trusted setup and only the discrete-log assumption",
    "Very small proofs for range statements, with cheap aggregation of many range proofs",
    "Batch verification gives real speedups across many proofs",
    "Long production track record in confidential-transaction systems"
  ],
  "tradeoffs": [
    "Verification is linear in circuit size — no succinct verifier, so unsuitable for on-chain verification of large statements",
    "Not post-quantum",
    "General-circuit performance is poor relative to modern SNARKs; the sweet spot is narrow"
  ],
  "bestFit": "Range proofs and small confidential-transaction statements verified by full nodes.",
  "maintainers": "Bünz, Bootle, Boneh, Poelstra, Wuille and Maxwell (Stanford and Blockstream, 2017). Implementations: dalek bulletproofs (Rust), Monero's Bulletproofs+, several confidential-asset wallets",
  "maturity": "Production since 2018 in its niche",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2017/1066",
  "facts": [
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-bulletproofs",
      "name": "Bulletproofs",
      "setup": "None",
      "size": "Logarithmic; small for ranges",
      "verify": "Linear in circuit size — not succinct",
      "pq": "No",
      "recursion": "Poor",
      "maturity": "Production for range proofs since 2018"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-bulletproofs",
      "name": "Bulletproofs",
      "prover": "Linear MSMs; slow for general circuits",
      "memory": "Low",
      "offchain": "Linear in circuit size; batchable",
      "impls": "dalek bulletproofs (Rust), Monero, Bulletproofs+ in several wallets",
      "bench": "Range-proof figures in Monero and dalek benchmarks"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Bulletproofs — short proofs for confidential transactions and more",
      "url": "https://eprint.iacr.org/2017/1066",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/proof-systems/bulletproofs/",
  "authors": [
    "MarketComp"
  ]
}