Nova256 sub-proofs
Nova
Relaxed-R1CS folding · the foundational scheme
Avg fold
12.0ms / proof
Final proof
26.4 KB
Verify cost
$0.019USD
Reduction
99.14%vs naïve
▼ saves $4.59Sublogarithmic verifier, IVC since 2022.
SXTNT · folding ZKon SolanaNova · SuperNova · HyperNova
FEW STARS.WHOLE POSITION.
A folding ZK coprocessor for Solana. Fold a thousand sub-proofs into a single relaxed-R1CS accumulator and verify it on-chain in milliseconds. Few stars, whole position — for the on-chain era.
Sub-proofs folded
1,024
single accumulator
Verify time
~12ms
on Solana mainnet
Cost reduction
99.7%
vs separate proofs
CA7PYfwCU7u6JUN4pXKGQtsrkCed5KCjShyPq6hVgpump
19th c. sextant · foldedscroll · measure further
Method · IVC over relaxed-R1CS
How does the sextant fold?
Nova's folding scheme is not a SNARK. It is the cheaper, recursive step that the SNARK closes at the end — like the sextant taking many sights and reading one position.
Step 01
Many sub-proofs in
Each computation step — an ML inference, a DEX trade attestation, an oracle update — produces its own relaxed-R1CS instance.
Step 02
Fold pairwise
Nova's folding scheme combines two instances into one with constant cost. No final SNARK at every step; the verifier walks an accumulator.
Step 03
Single accumulator
The retained instance grows sublinearly. Two thousand sub-proofs collapse into a fixed-size accumulator the verifier reads in one pass.
Step 04
Verify on Solana
A succinct final SNARK lands on-chain. The Anchor verifier program reads a few kilobytes and finishes in milliseconds for the equivalent of one Solana transaction.
Three folding instruments · same precision
Pick your scheme
Three folding schemes, one accumulator. Each tuned for a different shape of computation. Numbers below are measured against 256 sub-proofs.
SuperNova256 sub-proofs
SuperNova
Non-uniform IVC · multi-circuit aware
Avg fold
8.5ms / proof
Final proof
30.1 KB
Verify cost
$0.019USD
Reduction
99.02%vs naïve
▼ saves $4.59Switches circuits per step, saves columns.
HyperNova256 sub-proofs
HyperNova
CCS over Plonkish · highest compression
Avg fold
6.2ms / proof
Final proof
33.9 KB
Verify cost
$0.019USD
Reduction
98.90%vs naïve
▼ saves $4.59Customizable constraints, smallest accumulator.
Live preview · simulated locally
Drag the dial.
Fold what you measure.
Pull the slider toward 1,024 sub-proofs and watch the accumulator stay bounded. The verifier cost flattens long before the work does — that is the whole point of recursive folding.
256
Scheme
Baseline (separate proofs)
3.07 MB
Folded (NOVA)
26.4 KB
Reduction
99.14%
saves $4.59
Verify cost
$0.019
vs $4.61
Avg fold
12.0 ms
per sub-proof
Steps
17
accumulator updates
Compression ratio
Plot a course
Where the sextant points
SXTNT is not a circuit — it is the recursive layer. Use it wherever the proof you need is many small proofs glued together.
MLHYPERNOVA
Verifiable ML inference
Each token of a transformer call is a tiny sub-proof. Fold the conversation, settle the final claim on-chain. No re-running the model.
2,048 folds · 1 settlement
BRIDGESUPERNOVA
Cross-chain aggregation
Light-client headers from ten chains over a thousand blocks each. SXTNT folds them into a single accumulator a Solana program reads in one slot.
10,000 headers · 1 verify
ORACLENOVA
On-chain price oracle
Every price update is a sub-proof of an off-chain attestation. Fold the day, post one proof — Solana programs trust the entire stream.
8,400 ticks · 1 commit
ROLLUPNOVA
Score & reputation rollup
Game outcomes, on-chain credit events, attestations — fold thousands of contributions per account and settle a verifiable score periodically.
1,200 events · 1 proof
INFRAHYPERNOVA
Trustless message bridge
Source-chain state transitions fold into one recursive instance. Destination chains verify millions of messages in a constant-size proof.
1,000,000 msgs · 1 root