Cost Estimator — Plutus Halo2 Verifier

CLI Binaries

Three CLI binaries give you different views of verifier execution cost from circuit parameters alone — no full circuit instantiation required.

ℹ

Estimates are lower bounds — assumes minimal column rotations (prev, current, next) and table numbers. Chip flags are the most precise input; additional circuit config flags trade precision for flexibility.

Full cost estimate — native chip

# Full breakdown: scalar/point ops, pairings,
# MSM sizes, proof and VK byte sizes
cargo run --bin estimate -- \
  --nb-public-inputs 3 \
  --native

Proof size — Poseidon + JubJub circuit

cargo run --bin proof_size -- \
  --nb-public-inputs 5 \
  --committed-instances \
  --poseidon --jubjub

VK size — BLS12-381 circuit with committed inputs

cargo run --bin vk_size -- \
  --nb-public-inputs 1 \
  --committed-instances \
  --bls12-381

Proof inputs

--nb-public-inputs / --pi	Number of public inputs (required)
--committed-instances / --ci	Whether the circuit has committed inputs

Chips (combine as needed)

--native	Arith chip (arithmetic + parallel_add gates)
--automaton	Regular expression parsing (automaton) chip
--base64	Base64 decoding chip
--sha256	SHA256 hash chip
--sha512	SHA512 hash chip
--poseidon	Poseidon hash chip
--jubjub	JubJub Edwards curve chip
--hash-to-curve	Poseidon hash-to-JubJub-curve chip
--curve25519	Curve25519 field/curve chip
--secp256k1	Secp256k1 curve chip
--secp256r1	Secp256r1 curve chip
--bls12-381	BLS12-381 curve chip

Circuit config (default 0)

--nb-advice	Number of advice columns
--nb-fixed	Number of extra fixed columns
--nb-selectors	Number of extra selectors
--nb-evaluations	Number of column evaluations
--nb-lookups	Number of lookup arguments
--degree	Circuit degree
--nr-pow2	Scalar decomposition lookup columns

Three binaries, three levels of detail:

`estimate`

Full breakdown — scalar/point operation counts, pairings, MSM sizes, proof byte size, VK byte size. Percentage of Cardano execution limits.

`proof_size`

Proof size in bytes, derived from column layout and commitment scheme. Fast single-number answer.

`vk_size`

Verification key size in bytes. Useful for on-chain storage budget planning independently of proof size.

Supported Chips

Each chip encapsulates a set of gates, advice columns, and lookup tables. Combine chips to build the circuit that matches your use case.

--native Arith

Standard PLONK arithmetic gate + parallel_add gate. The baseline for any custom computation.

--automaton Automaton

Regular expression parsing via a fixed lookup-table automaton. Used for structural validation of committed byte strings.

--base64 Base64

Base64 decoding chip. Used to decode base64-encoded data inside the circuit.

--sha256 SHA256

Bitwise SHA256 hash chip. Used for hashing where SHA256 is required by the target protocol.

--sha512 SHA512

Bitwise SHA512 hash chip. Larger word size than SHA256, used where the protocol calls for it.

--poseidon Poseidon Hash

ZK-friendly Poseidon permutation over the BLS12-381 scalar field. Used in commitments and Merkle trees.

--jubjub JubJub

Edwards curve arithmetic chip for the JubJub curve (embedded in BLS12-381). Efficient scalar multiplication.

--hash-to-curve Hash-to-Curve

Maps an arbitrary message to a JubJub curve point via Poseidon hash. Required for BLS-style signature schemes.

--curve25519 Curve25519

Field and curve arithmetic chip for Curve25519. Supports Ed25519/X25519-style signature and key-exchange circuits.

--secp256k1 Secp256k1

Bitcoin/Ethereum elliptic curve. Supports ECDSA verification and threshold multisignature (ATMS) circuits.

--secp256r1 Secp256r1

NIST P-256 elliptic curve. Supports ECDSA verification circuits such as WebAuthn and TLS.

--bls12-381 BLS12-381

Primary commitment curve. BLS signatures, G1 MSM, and KZG verification are all built on BLS12-381.