Production83,574 CU
Groth16
Pairing · BN254
Single verify. Light Protocol compatible, battle-tested on Solana L1.
One substrate,
many proofs
Proof-system-agnostic on-chain verification for Solana. One API, multiple proving systems, no Groth16 wrapping required.
- No Groth16 wrapping
- Rust · MSRV 1.85
- Apache / MIT
On-chain ZK
On-chain verify
83,574
CU · Groth16 single
Proof valid
Groth16KZG-PLONKHyperPlonkHalo2 KZGFRI-STARKNovaHyperNovaProtoStar
Benchmarks
Production numbers, not promises
Measured on Solana with real compute budgets. Phase-1 and Phase-2 components are frozen at production quality.
0Groth16 CUSingle on-chain verify
0+Library testsAcross 12 crates
0Fuzz targetsIncl. 10 compression harnesses
0%Bandwidth savedGroth16 compression
Coverage
Many families, one interface
Pick a proving system with a single generic parameter. Today Groth16 and PLONK are production-ready; four more families have structural scaffolds in place.
Production258,397 CU
Groth16 Batch
Pairing · BN254 · N=5
Amortized multi-proof verification in a single instruction.
Production968,457 CU
KZG-PLONK
Universal · BN254
Universal SRS, one trusted setup serves every circuit.
Phase-3~505K CU
HyperPlonk
Universal · BN254
Boolean-hypercube sumcheck. Structural scaffold complete.
Phase-3~580K CU
Halo2 KZG
Universal · BN254
PLONKish arithmetization with KZG commitments.
Phase-3~9.4M CU
FRI-STARK
Transparent · Hash-based
Transparent setup, post-quantum security. No pairings.
Phase-3~885K CU
Nova
Folding · IVC
Nova / HyperNova / ProtoStar folding schemes for IVC.
Phase-3 means the structural scaffold is complete and compute-unit budgets are estimated; production hardening and external audit follow.
Coverage
One verifier, every proof family
Most Solana verifiers are locked to a single proof paradigm. Mosaic verifies six families, pairing, universal, transparent and folding, through one API.
Pairing-only
STARK-only
Folding-only
Mosaic
How it works
Swap proofs, not code
The proving system is a type parameter. Change it and your instruction handler, client and tests stay exactly the same.
- 1Add mosaic-core plus the crate for your proving system.
- 2Construct a verifier with a host or Solana backend.
- 3Call verify(vk, proof, inputs), identical bytes on host and chain.
Verify off-chain with the arkworks backend.
use mosaic_core::{ProofSystem, ProofSystemId};
use mosaic_groth16::Groth16Verifier;
let backend = mosaic_core::syscall::host::HostBackend::new();
let verifier = Groth16Verifier::<_, false>::new(&backend);
verifier.verify(&vk_bytes, &proof_bytes, &public_inputs_bytes)?;
Why Mosaic
The verifier layer Solana was missing
One audited substrate that treats proving systems as interchangeable parts, so your program logic never has to care which one you chose.
One unified API
Select a proving system via a generic parameter. Swap Groth16 for PLONK or Nova without touching your program logic.
No Groth16 wrapping
Run PLONK, HyperPlonk, Halo2, STARK and folding schemes natively on Solana L1, no awkward re-proving step.
Compression built in
50% bandwidth savings for Groth16 and 40–42% for PLONK / Nova, with 10 dedicated fuzz harnesses guarding the codecs.
No hand-rolled crypto
Every curve operation is delegated to ark-bn254 or audited Solana syscalls. Mosaic is plumbing, not new cryptography.
Forward-compatible bytes
A LE_INPUTS const generic plus a FormatTag wire enum keep the serialized layout stable as new systems land.
Differentially tested
549+ differential tests and 152+ proptest sessions check on-chain output against an arkworks reference, every run.
Architecture
Built to disappear
Four design rules keep Mosaic deterministic on-chain, rich off-chain, and forward-compatible as new proof systems land.
01
Object-safe ProofSystem trait
A single byte-slice API. The dispatcher monomorphizes each system through an exhaustive match, zero dynamic dispatch on the hot path.
02
Two-layer error model
Deterministic OnChainError for the program, rich DiagnosticError for off-chain tooling. The chain stays cheap; developers stay informed.
03
Syscall abstraction
One SyscallBackend trait bridges arkworks host tests and Solana syscalls, so the same verifier runs in CI and on-chain unchanged.
04
Forward-compatible layout
A LE_INPUTS const generic and FormatTag wire enum version the byte format, so new proof systems extend the wire without breaking it.
Composable
Built like a mosaic
Every proof system is one tile on the same substrate. Compose them, swap them, and they still fit a single surface.
Hover, or tap, to play with the grid.
Start verifying proofs on Solana
Add two crates, pick a proving system, and verify. The same code runs in your tests and on-chain, unchanged.