← → Print all
01 — Proof system · Proof system

Bulletproofs

Transparent discrete-log argument

In one paragraph

Bulletproofs: Transparent discrete-log argument. Setup: None. Proof size: Logarithmic; small for ranges. On-chain verification: Linear in circuit size — not succinct. PQ: No. Recursion: Poor. Maturity: Production for range proofs since 2018. Prover cost profile: Linear MSMs; slow for general circuits. Peak prover memory: Low. Off-chain verifier: Linear in circuit size; batchable. Implementations and maintainers: dalek bulletproofs (Rust), Monero, Bulletproofs+ in several wallets. Where it is measured: Range-proof figures in Monero and dalek benchmarks. Choose it when: Range proofs and small confidential-transaction statements verified by full nodes.

By MarketComp Updated v1.3 About the authors Changelog
Setup
None
Proof size
Logarithmic; small for ranges
On-chain verification
Linear in circuit size — not succinct
PQ
No
Recursion
Poor
Maturity
Production for range proofs since 2018
Selection matrix · as Bulletproofs · see the row in context
Prover cost profile
Linear MSMs; slow for general circuits
Peak prover memory
Low
Off-chain verifier
Linear in circuit size; batchable
Implementations and maintainers
dalek bulletproofs (Rust), Monero, Bulletproofs+ in several wallets
Where it is measured
Range-proof figures in Monero and dalek benchmarks
Prover profile · as Bulletproofs · see the row in context

What it is

Logarithmic-size zero-knowledge arguments from the inner-product argument, with no trusted setup. Best known for range proofs in confidential transactions; general circuits are supported but not the strength.

Strengths and tradeoffs

Strengths
  • No trusted setup and only the discrete-log assumption
  • Very small proofs for range statements, with cheap aggregation of many range proofs
  • Batch verification gives real speedups across many proofs
  • Long production track record in confidential-transaction systems
Tradeoffs
  • Verification is linear in circuit size — no succinct verifier, so unsuitable for on-chain verification of large statements
  • Not post-quantum
  • General-circuit performance is poor relative to modern SNARKs; the sweet spot is narrow

Choose it whenRange proofs and small confidential-transaction statements verified by full nodes.

Direct answers that mention it
Maintained implementations

Bünz, Bootle, Boneh, Poelstra, Wuille and Maxwell (Stanford and Blockstream, 2017). Implementations: dalek bulletproofs (Rust), Monero's Bulletproofs+, several confidential-asset wallets

Maturity: Production since 2018 in its niche · License: n/a (construction) · eprint.iacr.org ↗

How to decide
Other proof systems in §01
Groth16PLONK and the PLONKish familyFRI-based STARKsHalo2 with IPA, and Halo2 with KZGNova, SuperNova and HyperNovaBinius and binary-field systemsSTIR and WHIRGKR-based systemsSpartanLookup arguments: Plookup, LogUp, cq, Lasso/Shout/Twist

Sources cited on this page · 1

  1. Bulletproofs — short proofs for confidential transactions and morepaper

All 40 sources for §01 are listed on the section page →

Cite this page 
MarketComp (2026). Bulletproofs. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/proof-systems/bulletproofs/
@misc{zkfieldmanual-bulletproofs,
  title        = {Bulletproofs — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/proof-systems/bulletproofs/}},
  note         = {Accessed: YYYY-MM-DD}
}