# Lighter

Markdown version of https://ethbeat.org/zk-catalog/lighterprover

## Summary

- Creator: Lighter
- Total Value Secured: $1.16 B (+0.27% compared to seven days ago)
- Trusted setups for Gnark (Plonk):
  - Aztec Ignition, risk green (lowest risk) per the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381): Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.
  - Used in: [Lighter](https://ethbeat.org/layer2s/projects/lighter), [Lighter on Robinhood](https://ethbeat.org/layer2s/projects/lighter-robinhood)
  - Verifiers: 5 not verified
- zkVM: Plonky2 (Plonk), Goldilocks (Field), App-specific circuits (Other)
- Final wrap: Gnark (Plonk), BN254 (curve)

### About

A ZK proving system designed by Lighter for proving their DEX L2 focused on trading perpetuals.

### Links

- Website: https://lighter.xyz
- Docs: https://docs.lighter.xyz
- Repository: https://github.com/elliottech/lighter-prover/tree/main, https://github.com/elliottech

## Value Secured

The interactive TVS chart is shown on [the HTML page](https://ethbeat.org/zk-catalog/lighterprover#tvs).

## Proof System

### Description

Lighter prover is a zk proving system for Lighter L2 based on [Plonky2](https://github.com/0xPolygonZero/plonky2/tree/main) circuits. It verifies the logic for regular state transition of Lighter L2, state transitions in the “desert mode” when L2 is shut down and users exit, as well as one-off state root upgrades, using different sets of circuits. The circuits are proven with a STARK which is wrapped into a Plonk SNARK before settling onchain.

### Proof system

[Plonky2](https://github.com/0xPolygonZero/plonky2) implements a circuit aritmetization based on TurboPlonk over Goldilocks field, but it replaces KZG polynomial commitment scheme with a FRI-based polynomial testing scheme. In this way proving Plonky2 circuits requires no trusted setup, i.e. it is a STARK.

However Lighter wraps these STARK in a [gnark](https://github.com/Consensys/gnark) implementation of Plonk over BN254 curve, which requires a trusted setup.

#### Lighter Circuits

The proof system operates on Lighter STF circuits, desert mode circuits and state root upgrade circuits. All published circuits are available [here](https://github.com/elliottech/lighter-prover/tree/main).

Lighter proof system defines circuits for proving all transactions, including internal, L1 and L2 transactions. The full list of available transactions that define Lighter STF can be seen [here](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/transactions).

Transaction circuits use custom implementations for arithmetic operations ([bigint](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/bigint), [uint](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/uint)), cryptographic primitives ([ecdsa](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/ecdsa) on the Secp256k1 curve, [eddsa](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/eddsa) on the ECgFp5 curve, [keccak](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/keccak), [poseidon_bn128](https://github.com/elliottech/lighter-prover/tree/main/circuit/src/poseidon_bn128)) and other helper circuits.

#### Desert circuits

Lighter also provides [desert exit circuits](https://github.com/elliottech/lighter-prover/tree/main/desertexit) that allow users to permissionlessly exit L2 when it is in the desert mode. Users can use desert circuit to generate a proof of ownership of all their positions locally, which could be submitted on L1 for withdrawing funds.

#### Recursion

Lighter prover implements recursive aggregation of transaction proofs to make the whole pipeline more efficient and parallelizable. First, fixed-size blocks of consecutive transactions are processed and proven by [BlockTx circuit](https://github.com/elliottech/lighter-prover/blob/main/circuit/src/block_tx_constraints.rs), which can be done on separate machines. Next, arbitrary number of BlockTx proofs are aggregated into a single proof by [BlockTxChain circuit](https://github.com/elliottech/lighter-prover/blob/main/circuit/src/block_tx_chain_constraints.rs), which includes continuity checks across all BlockTx proofs.

## Trusted Setups

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Aztec Ignition

- Risk: green (lowest risk)
- Proof systems: Gnark (Plonk)
- Phase 1: 176 participants

Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019.
It included 176 participants and was publicly open for participation.

- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).
- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).
- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).

## Verifier IDs

List of different onchain verifiers for this proving system. Unique ID distinguishes different deployments of the same verifier from different verifiers (e.g. different versions).

### Plonk: Gnark

Consensys implementation of Plonk proving system written in Go.

#### Lighter verifier

Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined.

- Verifier ID: `0x0b4835549c725db37f158fde0f2522a1d1278d0640768f1ee637af9828a5879e`
- Verification: not verified
- Used in: [Lighter](https://ethbeat.org/layer2s/projects/lighter)

**Known deployments**

- [0x329d7d7f7B3F2879991B83E1A53BCe6D7ce63E6f](https://etherscan.io/address/0x329d7d7f7B3F2879991B83E1A53BCe6D7ce63E6f#code) on Ethereum, used in: [Lighter](https://ethbeat.org/layer2s/projects/lighter)

##### Verification steps

The sources for the verifier circuits are not published and thus the verifier cannot be independently regenerated.

#### Lighter Desert verifier

Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined.

- Verifier ID: `0x156f444f62404c056e3126b7bccad049dd99ec0812d5d0ef1abdbbfc0dfec500`
- Verification: not verified
- Used in: [Lighter](https://ethbeat.org/layer2s/projects/lighter)

**Known deployments**

- [0x975210588389526a3A1DeF1628e7A4d7aBdFD121](https://etherscan.io/address/0x975210588389526a3A1DeF1628e7A4d7aBdFD121#code) on Ethereum, used in: [Lighter](https://ethbeat.org/layer2s/projects/lighter)

#### Lighter state root upgrade verifier

Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined. One-time verifier that lets a validator replace the state root outside of regular batch proving, see the proof system description.

- Verifier ID: `0xdb6ffbd7513b7d6ff32acc9006f35d6a929ca0670dcd6d40f3d960b47ef56cca`
- Verification: not verified
- Used in: none

**Known deployments**

- [0xcb7131eDbe3F54FC3101DA943b969fB0CD04ca95](https://etherscan.io/address/0xcb7131eDbe3F54FC3101DA943b969fB0CD04ca95#code) on Ethereum, used in: none

##### Verification steps

The sources for the state root upgrade circuits are not published and thus the verifier cannot be independently regenerated.

#### Lighter on Robinhood verifier

Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined.

- Verifier ID: `0xa29ec4d3bd2bd13606a2504774017527b16f8e107649e09389e817da1ad205a2`
- Verification: not verified
- Used in: [Lighter on Robinhood](https://ethbeat.org/layer2s/projects/lighter-robinhood)

**Known deployments**

- [0x7817a34136c56A6097C7042B3cAAe24b9eEd9fb4](https://robin.etherscan.io/address/0x7817a34136c56A6097C7042B3cAAe24b9eEd9fb4#code) on Robinhood Chain, used in: [Lighter on Robinhood](https://ethbeat.org/layer2s/projects/lighter-robinhood)

#### Lighter on Robinhood Desert verifier

Custom verifier ID: SHA256 hash of all VK_... values from the smart contract, abi packed in the same order they are defined.

- Verifier ID: `0xe519ae1119a83c6ad569daf26ae1d61e9bbdac185aec5fae55c1e0a7c0aa4969`
- Verification: not verified
- Used in: [Lighter on Robinhood](https://ethbeat.org/layer2s/projects/lighter-robinhood)

**Known deployments**

- [0x93c83bdA3A45241729Ce150C1e3677bA7389c0D0](https://robin.etherscan.io/address/0x93c83bdA3A45241729Ce150C1e3677bA7389c0D0#code) on Robinhood Chain, used in: [Lighter on Robinhood](https://ethbeat.org/layer2s/projects/lighter-robinhood)