Generate optimized on-chain verifiers for Halo2 proofs in Plinth or Aiken.
Measured costs for both Plinth and Aiken verifiers across representative circuits. Percentages are relative to Cardano's execution limits.
| Circuit | Script size Plinth |
Script size Aiken |
CPU usage Plinth |
CPU usage Aiken |
Mem usage Plinth |
Mem usage Aiken |
|---|---|---|---|---|---|---|
| Simple mul | 6,699 (40.9%) | 6,610 (40.3%) | 5.8B (58%) | 5.3B (53%) | 9.0M (64.3%) | 5.6M (40.0%) |
| Lookup table | 11,508 (70.2%) | 10,453 (63.8%) | 9.2B (92%) | 8.4B (84%) | 13.0M (92.9%) | 7.5M (53.6%) |
| ATMS (50 of 90) | 12,295 (75.0%) | 11,634 (71.0%) | 10.1B (101%) | 9.7B (97%) | 11.9M (85.0%) | 7.9M (56.4%) |
| ATMS (228 of 408) | 12,293 (75.0%) | 11,630 (71.0%) | 10.0B (100%) | 9.7B (97%) | 11.8M (84.3%) | 7.8M (55.7%) |
| ATMS (50/90) + Lookup | 14,557 (88.9%) | 13,498 (82.4%) | 12.0B (120%) | 11.4B (114%) | 14.7M (105.0%) | 9.0M (64.3%) |
| Schnorr signatures | 20,474 (125.0%) | 18,910 (115.4%) | 13.0B (130%) | 12.4B (124%) | 15.7M (112.1%) | 10.2M (72.9%) |
Script size % relative to the 16 KB script limit. ■ Within limits ■ Near limit (>60%) ■ Exceeds limit. Benchmark numbers are approximate — proof generation randomness can cause slight variation.
Upcoming improvements: CIP-109 (built-in modular inversion) and CIP-133 (built-in multi-scalar multiplication) are expected to significantly reduce on-chain costs for all circuits.
The Cost Estimator only needs Rust. The Verifier Generator additionally requires the Plinth (Haskell + Nix) or Aiken toolchain.
Cost Estimator — Rust only
# Clone the repository git clone https://github.com/input-output-hk/\ plutus-halo2-verifier-gen cd plutus-halo2-verifier-gen # Run a circuit example cargo run --example simple_mul
Aiken Verifier
# After running a Rust example
cd aiken-verifier/aiken_halo2
aiken check
aiken build
Plinth Verifier
# Enter Nix dev shell
nix develop github:input-output-hk/devx#ghc96-iog
cd plinth-verifier
cabal build -j all
cabal test all
More circuit examples
cargo run --example atms # ATMS threshold multisignaturecargo run --example atms_with_lookups # ATMS + lookup argumentcargo run --example lookup_table # Lookup argument circuitRUST_LOG=debug cargo run --example simple_mul # With detailed logging