Proving progress
Where the zero-knowledge proving of this exchange actually stands, from the repository rather than from a roadmap.
No proof has been produced
Not a single one, on any machine this repository has been developed on. The guest program type-checks and its outputs are pinned by tests, but no ELF has ever been executed: sp1-sdk does not build on the development platform at all, so there is no toolchain here to run it with. circuits/DECISION.md records the whole of that.
This means §7.6 is not discharged, and the exit gate’s “prover cost within budget” cannot be assessed from anything in this repository.
What is measured instead
SHA-256 compressions per batch — the quantity §7.6’s hot path is made of. Every commitment in the engine is a SHA-256, SP1 has a precompile for it, and “Merkle updates” is the roadmap’s own phrase for what dominates. A hash count is not a cycle count and the conversion is unknown; what it is good for is noticing a change.
Measured 2026-08-21 by pnpm run prove:budget, in batches of at most 128 events so the rows are comparable.
| accounts | events | batches | hashes | hash/batch | hash/event | blob/event | state/batch |
|---|---|---|---|---|---|---|---|
| 8 | 18 | 1 | 893 | 893 | 49 | 130 | 144 |
| 64 | 130 | 2 | 3,714 | 1,857 | 28 | 133 | 6,527 |
| 256 | 514 | 5 | 23,357 | 4,671 | 45 | 168 | 26,662 |
| 1,024 | 2,050 | 17 | 247,712 | 14,571 | 120 | 168 | 106,877 |
hash/batch grows with the account count, not with the batch. That is the O(accounts) cost of the full-state guest, measured rather than asserted: the accounts tree and the exit tree are both rebuilt whole, and the guest input carries the whole prior state.
The ceilings
A ratchet rather than a budget. They were set from the first measurement with headroom so that a regression fails a command instead of being noticed later, and they are not derived from a proving target — there is no measured proving cost to derive one from.
- Hashes per batch at 1,024 accounts
- 14,571 of 20,000
- Data-availability bytes per event
- 168 of 250
The blob figure is the data-availability cost directly rather than a proxy: on a chain with 128 KiB blobs it decides how many events fit in one, which at 168 bytes is roughly 780 events per blob.
What has to be measured first
All three need a Linux or macOS host with sp1up installed. Until they exist, the table above is an instrument and not an answer.
- cycles per event from a real ELF execution, at the sizes in the table
- wall-clock and dollar cost of one proof at Phase 1's throughput floor
- the same for the Succinct network, which is what PROVER_BACKEND=network exists to compare against
The exchange itself
Whether the exchange is up, frozen, or short of reserves is a live question with its own page — exchange status.