---
title: "Bulletproofs"
description: "Bulletproofs: Transparent discrete-log argument. Setup: None. Proof size: Logarithmic; small for ranges."
type: "option"
url: "https://zkpick.com/proof-systems/bulletproofs/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/bulletproofs.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Bulletproofs — *Transparent discrete-log argument*

> Bulletproofs: Transparent discrete-log argument. Setup: None. Proof size: Logarithmic; small for ranges. On-chain verification: Linear in circuit size — not succinct. PQ: No. Recursion: Poor. Maturity: Production for range proofs since 2018. Prover cost profile: Linear MSMs; slow for general circuits. Peak prover memory: Low. Off-chain verifier: Linear in circuit size; batchable. Implementations and maintainers: dalek bulletproofs (Rust), Monero, Bulletproofs+ in several wallets. Where it is measured: Range-proof figures in Monero and dalek benchmarks. Choose it when: Range proofs and small confidential-transaction statements verified by full nodes.

Logarithmic-size zero-knowledge arguments from the inner-product argument, with no trusted setup. Best known for range proofs in confidential transactions; general circuits are supported but not the strength.

**Strengths**

- No trusted setup and only the discrete-log assumption
- Very small proofs for range statements, with cheap aggregation of many range proofs
- Batch verification gives real speedups across many proofs
- Long production track record in confidential-transaction systems

**Tradeoffs**

- Verification is linear in circuit size — no succinct verifier, so unsuitable for on-chain verification of large statements
- Not post-quantum
- General-circuit performance is poor relative to modern SNARKs; the sweet spot is narrow

**Choose it when:** Range proofs and small confidential-transaction statements verified by full nodes.

Maintained by: Bünz, Bootle, Boneh, Poelstra, Wuille and Maxwell (Stanford and Blockstream, 2017). Implementations: dalek bulletproofs (Rust), Monero's Bulletproofs+, several confidential-asset wallets · Maturity: Production since 2018 in its niche · License: n/a (construction) · Source: https://eprint.iacr.org/2017/1066

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-bulletproofs)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| Bulletproofs | None | Logarithmic; small for ranges | Linear in circuit size — not succinct | No | Poor | Production for range proofs since 2018 |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-bulletproofs)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| Bulletproofs | Linear MSMs; slow for general circuits | Low | Linear in circuit size; batchable | dalek bulletproofs (Rust), Monero, Bulletproofs+ in several wallets | Range-proof figures in Monero and dalek benchmarks |