---
title: "Glossary"
description: "Definitions of 16 terms used in ZK engineering: Arithmetisation, Witness, Underconstrained circuit, SRS / CRS, Universal setup, Updatable setup, and more."
type: "glossary"
url: "https://zkpick.com/glossary/"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/glossary.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

- **Arithmetisation** — The translation of a computation into a system of polynomial constraints (R1CS, PLONKish, AIR) that a proof system can operate on.
- **Witness** — The private input plus all intermediate values that satisfy a circuit's constraints. Soundness means no witness exists for a false statement.
- **Underconstrained circuit** — A circuit admitting witnesses that do not correspond to a correct execution. The dominant real-world ZK bug class: the cryptography is sound, the statement being proved is simply the wrong one.
- **SRS / CRS** — Structured (Common) Reference String — public parameters some proof systems require. Produced by a trusted setup; compromise of the setup randomness breaks soundness.
- **Universal setup** — An SRS reusable across every circuit up to a size bound, so a new circuit does not require a new ceremony. Contrast with circuit-specific setup.
- **Updatable setup** — An SRS any party may re-randomise after the fact; it stays secure as long as at least one contributor in its entire history was honest.
- **Toxic waste** — The secret randomness used to generate an SRS. If any single participant's contribution is destroyed, the setup is secure; if all are retained and combined, forged proofs become possible.
- **Powers of tau** — The circuit-independent first phase of a setup ceremony, producing a universal SRS of committed powers of a secret value. Public transcripts exist and are widely reused.
- **Polynomial commitment** — A scheme to commit to a polynomial and later prove evaluations of it. The choice (KZG, FRI, IPA, hash-based) drives proof size, verifier cost, setup need and post-quantum posture more than the surrounding protocol does.
- **Fiat–Shamir** — The transform making an interactive protocol non-interactive by deriving the verifier's challenges from a hash of the transcript. Omitting values from that hash is the 'Frozen Heart' vulnerability class.
- **Recursion / aggregation** — Verifying one proof inside another, to compress many proofs into one or to prove unbounded computation in bounded memory.
- **Folding scheme** — A technique that combines two instances of a relation into one without producing a full proof at each step, amortising the cost of proving repeated computation.
- **Lookup argument** — A protocol proving that values appear in a precomputed table, used to express operations that are expensive as raw arithmetic constraints.
- **zkVM** — A proof system for the execution trace of a general-purpose virtual machine, letting teams prove ordinary programs instead of hand-written circuits, at a cost in prover work.
- **Nullifier** — A deterministic, unlinkable value published to prevent double-spending or replay of a private action. Missing or malleable nullifiers are a recurring protocol-level bug.
- **Soundness error** — The probability a prover can convince a verifier of a false statement. Quoted in bits; conjectured and provable bounds can differ substantially for FRI-based systems.