---
title: "Nova, SuperNova and HyperNova"
description: "Nova, SuperNova and HyperNova: Folding schemes / IVC. Setup: None in the folding layer. Proof size: Accumulator, not a proof — needs final compression."
type: "option"
url: "https://zkpick.com/proof-systems/nova-folding/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/nova-folding.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Nova, SuperNova and HyperNova — *Folding schemes / IVC*

> Nova, SuperNova and HyperNova: Folding schemes / IVC. Setup: None in the folding layer. Proof size: Accumulator, not a proof — needs final compression. On-chain verification: Via the compressing SNARK only. PQ: No. Recursion: This is the whole point. Maturity: Research to early production. Prover cost profile: Two MSMs per step — the cheapest incremental step known. Peak prover memory: Bounded by one step plus the accumulator. Off-chain verifier: Only after final compression. Implementations and maintainers: Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer). Where it is measured: Repository benchmarks only; no neutral suite. Choose it when: Long, repetitive computations and memory-constrained provers, where the final compression step happens once.

Folding reduces checking two instances of a relation to checking one, so each step of a long computation costs a couple of multi-scalar multiplications rather than an in-circuit SNARK verification. Variants add non-uniform steps and generalised constraint systems.

**Strengths**

- The lowest known per-step recursion overhead for long, near-uniform computations
- Memory-friendly: proving is incremental, so peak memory tracks one step rather than the whole trace
- No trusted setup in the folding layer itself
- Non-uniform variants avoid paying for the union of all instructions at every step

**Tradeoffs**

- Folding produces an accumulator, not a succinct proof — a final compressing SNARK is still required, and its cost is often omitted from benchmarks
- Not post-quantum: security rests on discrete log in the commitment scheme
- Real soundness pitfalls have been published in cycle-of-curves constructions — this is subtle territory
- Implementation maturity trails the pairing-based and FRI families

**Choose it when:** Long, repetitive computations and memory-constrained provers, where the final compression step happens once.

Maintained by: Nova by Kothapalli, Setty and Tzialla (Microsoft Research, 2021); SuperNova and HyperNova from the same lineage. Implementations: Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer) · Maturity: Research to early production · License: n/a (construction) · Source: https://eprint.iacr.org/2021/370

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-nova-folding-schemes)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| Nova / folding schemes | None in the folding layer | Accumulator, not a proof — needs final compression | Via the compressing SNARK only | No | This is the whole point | Research to early production |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-nova-folding-schemes)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| Nova / folding schemes | Two MSMs per step — the cheapest incremental step known | Bounded by one step plus the accumulator | Only after final compression | Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer) | Repository benchmarks only; no neutral suite |