{
  "type": "option",
  "name": "PLONK and the PLONKish family",
  "slug": "plonk",
  "section": {
    "id": "proof-systems",
    "number": "01",
    "title": "Choosing a proof system",
    "url": "https://zkpick.com/proof-systems/"
  },
  "url": "https://zkpick.com/proof-systems/plonk/",
  "markdown": "https://zkpick.com/md/proof-systems/plonk.md",
  "category": "Pairing-based SNARK, universal SRS",
  "summary": "PLONK and the PLONKish family: Pairing-based SNARK, universal SRS. Setup: Universal, updatable. Proof size: Sub-kilobyte. On-chain verification: Practical; above Groth16. PQ: No. Recursion: Well-exercised. Maturity: Production; most common deployed family. Prover cost profile: 256-bit-field FFTs dominate; custom gates and lookups trade prover work for constraint count. Peak prover memory: SRS and witness polynomials resident; comparable to Groth16 at equal size. Off-chain verifier: Milliseconds. Implementations and maintainers: Barretenberg / UltraHonk (Aztec), gnark (Consensys), plonky2 (Polygon Zero lineage), Kimchi (o1Labs), Halo2 forks. Where it is measured: Vendor-published only; no neutral cross-implementation suite. Choose it when: General-purpose circuits where churn is expected and a per-circuit ceremony would be painful, and where on-chain verification is required but need not be absolutely minimal.",
  "description": "A permutation-argument-based universal SNARK over a custom-gate arithmetisation — selector columns, copy constraints, optional lookup columns. One SRS serves all circuits up to a size bound. The most frequently occurring family among deployed on-chain verifiers.",
  "notes": [],
  "sections": [],
  "strengths": [
    "Universal, updatable SRS — one ceremony, many circuits, no per-circuit phase two",
    "Flexible arithmetisation: custom gates and lookups express non-arithmetic operations efficiently",
    "Verifier cost close to Groth16 and still practical on-chain",
    "Very large ecosystem with many independent implementations"
  ],
  "tradeoffs": [
    "Larger proofs and higher gas than Groth16",
    "Not post-quantum",
    "Prover requires large-field FFTs, the main bottleneck at scale",
    "Arithmetisation flexibility is also a footgun — custom gates and lookup tables are a common source of underconstrained circuits",
    "'PLONK' names a family, not one artefact: two implementations may share little"
  ],
  "bestFit": "General-purpose circuits where churn is expected and a per-circuit ceremony would be painful, and where on-chain verification is required but need not be absolutely minimal.",
  "maintainers": "Construction by Gabizon, Williamson and Ciobotaru (Aztec, 2019). Implementations: Barretenberg / UltraHonk (Aztec), gnark (Consensys), plonky2 (Polygon Zero lineage), Kimchi (o1Labs), Halo2 forks",
  "maturity": "Production; most common deployed family",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2019/953",
  "facts": [
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-plonk-family",
      "name": "PLONK family",
      "setup": "Universal, updatable",
      "size": "Sub-kilobyte",
      "verify": "Practical; above Groth16",
      "pq": "No",
      "recursion": "Well-exercised",
      "maturity": "Production; most common deployed family"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-plonk-family",
      "name": "PLONK family",
      "prover": "256-bit-field FFTs dominate; custom gates and lookups trade prover work for constraint count",
      "memory": "SRS and witness polynomials resident; comparable to Groth16 at equal size",
      "offchain": "Milliseconds",
      "impls": "Barretenberg / UltraHonk (Aztec), gnark (Consensys), plonky2 (Polygon Zero lineage), Kimchi (o1Labs), Halo2 forks",
      "bench": "Vendor-published only; no neutral cross-implementation suite"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "PLONK — permutations over Lagrange bases for oecumenical noninteractive arguments",
      "url": "https://eprint.iacr.org/2019/953",
      "kind": "paper"
    },
    {
      "title": "fflonk — a fast-Fourier inspired verifier efficient variant of PLONK",
      "url": "https://eprint.iacr.org/2021/1167",
      "kind": "paper"
    },
    {
      "title": "HyperPlonk — PLONK with linear-time prover and high-degree custom gates",
      "url": "https://eprint.iacr.org/2022/1355",
      "kind": "paper"
    },
    {
      "title": "Plonky3 — polynomial IOP toolkit over small fields",
      "url": "https://github.com/Plonky3/Plonky3",
      "kind": "project"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/proof-systems/plonk/",
  "authors": [
    "MarketComp"
  ]
}