{
  "type": "option",
  "name": "FRI-based STARKs",
  "slug": "starks",
  "section": {
    "id": "proof-systems",
    "number": "01",
    "title": "Choosing a proof system",
    "url": "https://zkpick.com/proof-systems/"
  },
  "url": "https://zkpick.com/proof-systems/starks/",
  "markdown": "https://zkpick.com/md/proof-systems/starks.md",
  "category": "Transparent hash-based proof system",
  "summary": "FRI-based STARKs: Transparent hash-based proof system. Setup: None. Proof size: Tens to hundreds of KB. On-chain verification: Impractical directly — wrapper is standard. PQ: Plausibly. Recursion: Well-exercised. Maturity: Heavily production. Prover cost profile: Small-field hashing and NTTs; the fastest bulk provers on CPU and GPU, and the basis of most zkVMs. Peak prover memory: Trace-proportional, but small fields keep it low; continuations bound it. Off-chain verifier: Milliseconds to tens of milliseconds — hashing only. Implementations and maintainers: Stone and Stwo (StarkWare), Plonky3 (Polygon Zero lineage; beneath SP1 Turbo, OpenVM, Ziren, Pico), RISC Zero, Miden, ZKsync Airbender (Matter Labs), Winterfell. Where it is measured: ethproofs.org real-time Ethereum block proving; a16z zkvm-benchmarks. Assumption: Hash (collision resistance). Setup: None. Opening size: Polylogarithmic but large in absolute terms. Verifier cost: Polylogarithmic; expensive on-chain. Field constraint: High two-adicity; extension for challenges. Choose it when: High-throughput server-side proving of large computations, especially zkVM execution, where a final wrapper handles settlement.",
  "description": "AIR or PLONKish arithmetisation committed with Reed–Solomon codewords and Merkle trees, with FRI as the low-degree test. No trusted setup, hash-based, plausibly post-quantum. The workhorse of large-scale transparent proving: StarkWare's Stone and Stwo, the Plonky2 and Plonky3 toolkits, RISC Zero, Miden and ZKsync Airbender are all instances of this family, differing mainly in field, hash and lookup argument.",
  "notes": [],
  "sections": [],
  "strengths": [
    "No trusted setup; security reduces to hash collision resistance plus the FRI soundness analysis",
    "Plausibly post-quantum in the proving layer",
    "Small-field arithmetic gives excellent CPU and GPU throughput; Circle STARK constructions extend this to fields that FRI could not otherwise use",
    "Scales well to very large computations"
  ],
  "tradeoffs": [
    "Proofs are tens to hundreds of kilobytes and verifiers are expensive, so a pairing-based wrapper is standard — which reintroduces a trusted setup and removes post-quantum security",
    "Security parameters are a dial, and deployed systems routinely ship 96–100 bits rather than 128",
    "Requires a field with high two-adicity and enough size, or an extension, for challenges",
    "Parameter tuning across rate, queries, grinding and decoding regime is easy to get wrong"
  ],
  "bestFit": "High-throughput server-side proving of large computations, especially zkVM execution, where a final wrapper handles settlement.",
  "maintainers": "Construction by Ben-Sasson, Bentov, Horesh and Riabzev (StarkWare, 2018). Implementations: Stone and Stwo (StarkWare), Plonky2 and Plonky3 (Polygon Zero lineage), RISC Zero, Miden, ZKsync Airbender (Matter Labs), Winterfell",
  "maturity": "Heavily production",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2018/046",
  "facts": [
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-fri-based-starks",
      "name": "FRI-based STARKs",
      "setup": "None",
      "size": "Tens to hundreds of KB",
      "verify": "Impractical directly — wrapper is standard",
      "pq": "Plausibly",
      "recursion": "Well-exercised",
      "maturity": "Heavily production"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-fri-based-starks",
      "name": "FRI-based STARKs",
      "prover": "Small-field hashing and NTTs; the fastest bulk provers on CPU and GPU, and the basis of most zkVMs",
      "memory": "Trace-proportional, but small fields keep it low; continuations bound it",
      "offchain": "Milliseconds to tens of milliseconds — hashing only",
      "impls": "Stone and Stwo (StarkWare), Plonky3 (Polygon Zero lineage; beneath SP1 Turbo, OpenVM, Ziren, Pico), RISC Zero, Miden, ZKsync Airbender (Matter Labs), Winterfell",
      "bench": "ethproofs.org real-time Ethereum block proving; a16z zkvm-benchmarks"
    },
    {
      "table": "Commitment schemes — the layer that decides most of it",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-3-fri",
      "name": "FRI",
      "basis": "Hash (collision resistance)",
      "setup": "None",
      "opening": "Polylogarithmic but large in absolute terms",
      "verifier": "Polylogarithmic; expensive on-chain",
      "field": "High two-adicity; extension for challenges"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Scalable, transparent, and post-quantum secure computational integrity (STARKs)",
      "url": "https://eprint.iacr.org/2018/046",
      "kind": "paper"
    },
    {
      "title": "Circle STARKs — making Mersenne-31 usable for FRI-based systems",
      "url": "https://eprint.iacr.org/2024/278",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/proof-systems/starks/",
  "authors": [
    "MarketComp"
  ]
}