FRI-based STARKs
Transparent hash-based proof system
FRI-based STARKs: Transparent hash-based proof system. Setup: None. Proof size: Tens to hundreds of KB. On-chain verification: Impractical directly — wrapper is standard. PQ: Plausibly. Recursion: Well-exercised. Maturity: Heavily production. Prover cost profile: Small-field hashing and NTTs; the fastest bulk provers on CPU and GPU, and the basis of most zkVMs. Peak prover memory: Trace-proportional, but small fields keep it low; continuations bound it. Off-chain verifier: Milliseconds to tens of milliseconds — hashing only. Implementations and maintainers: Stone and Stwo (StarkWare), Plonky3 (Polygon Zero lineage; beneath SP1 Turbo, OpenVM, Ziren, Pico), RISC Zero, Miden, ZKsync Airbender (Matter Labs), Winterfell. Where it is measured: ethproofs.org real-time Ethereum block proving; a16z zkvm-benchmarks. Assumption: Hash (collision resistance). Setup: None. Opening size: Polylogarithmic but large in absolute terms. Verifier cost: Polylogarithmic; expensive on-chain. Field constraint: High two-adicity; extension for challenges. Choose it when: High-throughput server-side proving of large computations, especially zkVM execution, where a final wrapper handles settlement.
What it is
AIR or PLONKish arithmetisation committed with Reed–Solomon codewords and Merkle trees, with FRI as the low-degree test. No trusted setup, hash-based, plausibly post-quantum. The workhorse of large-scale transparent proving: StarkWare's Stone and Stwo, the Plonky2 and Plonky3 toolkits, RISC Zero, Miden and ZKsync Airbender are all instances of this family, differing mainly in field, hash and lookup argument.
Strengths and tradeoffs
- No trusted setup; security reduces to hash collision resistance plus the FRI soundness analysis
- Plausibly post-quantum in the proving layer
- Small-field arithmetic gives excellent CPU and GPU throughput; Circle STARK constructions extend this to fields that FRI could not otherwise use
- Scales well to very large computations
- Proofs are tens to hundreds of kilobytes and verifiers are expensive, so a pairing-based wrapper is standard — which reintroduces a trusted setup and removes post-quantum security
- Security parameters are a dial, and deployed systems routinely ship 96–100 bits rather than 128
- Requires a field with high two-adicity and enough size, or an extension, for challenges
- Parameter tuning across rate, queries, grinding and decoding regime is easy to get wrong
Choose it whenHigh-throughput server-side proving of large computations, especially zkVM execution, where a final wrapper handles settlement.
Related pages
Sources cited on this page · 2
All 40 sources for §01 are listed on the section page →
Cite this page
MarketComp (2026). FRI-based STARKs. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/proof-systems/starks/
@misc{zkfieldmanual-fri-based-starks,
title = {FRI-based STARKs — The ZK Field Manual},
author = {MarketComp},
year = {2026},
version = {1.3},
howpublished = {\url{https://zkpick.com/proof-systems/starks/}},
note = {Accessed: YYYY-MM-DD}
}