Halo2 Verifier PLUTUS · CARDANO
IOHK Research · Apache 2.0

Halo2 Proof Verification
on Cardano

Generate optimized on-chain verifiers for Halo2 proofs in Plinth or Aiken — and predict their execution costs before writing a single line of contract code.

Plutus Verifier Cost Estimator View on GitHub
⚠
Research / Proof-of-Concept This repository is intended to evaluate the feasibility of verifying Halo2 proofs in Plutus smart contracts. It has not been thoroughly tested or audited and is not intended for production use.
Overview

Two tools, one pipeline

From circuit definition to on-chain verifier — with cost prediction at every step.

⚙️

Verifier Generator

Extracts a Halo2 circuit's constraint structure and verification key, then emits a circuit-specific verifier for either Plinth or Aiken — tailored to the exact columns, gates, and lookups of your circuit.
KZG commitments, BLS12-381 operations, and MSMs are handled natively in both backends.

📊

Cost Estimator

Predicts verifier execution cost — proof size, VK size, verifier op counts — from circuit parameters alone, directly in the browser or through the CLI.

Verifier Generator — Workflow
1

Define circuit

Write your Halo2 circuit in Rust using midnight-zk-stdlib

2

Generate keys

Generate proving & verifying keys via KZG commitment scheme

3

Extract structure

Extract circuit constraints, columns, and VK constants

4

Generate verifier

Emit optimized Plinth or Aiken verifier code

5

Deploy on Cardano

Integrate into your smart contract and go on-chain

Cost Estimator — Workflow
1

Select chips

Pick the circuit building blocks your circuit uses (ECC, hash, lookups…)

2

Tune parameters

Set rows, columns, lookup tables, and polynomial degree

3

Get instant estimate

Proof size, VK size, and verifier op counts computed in the browser — no toolchain needed