EIP-0045: Native STARK Proof Verification Opcode

[a-shannon]

Summary

This EIP proposes a native verifyStark opcode for Ergo, enabling post-quantum STARK proof verification as a first-class L1 primitive.

The opcode verifies proofs for registered verifier profiles rather than arbitrary AIR. Each vmType maps to an immutable consensus profile fixing the field, extension tower, Merkle hash, Fiat-Shamir hash, FRI parameters, proof format, public-input format, and cost table version.

What

• Opcode: verifyStark(proofChunks, publicInputs, imageId, vmType, costParams)
• Cryptographic suite: BabyBear, Ext16, Poseidon1 Merkle commitments with 52-byte digests, Blake2b-256 Fiat-Shamir transcript
• Verifier profiles: vmType registry for audited STARK/zkVM profiles, not generic user-supplied AIR
• Transcript binding: profile hash, vmType, imageId, publicInputs, and cost parameters are domain-separated before challenge generation
• eUTXO safety: public-input binding guidance so contracts bind proofs to the current transaction context
• AOT safety: O(1) pre-execution cost calculation with fail-fast bounds checks
• Conformance: required Known Answer Tests for field encoding, Poseidon1, Fiat-Shamir, serialization, malformed proof rejection, and AOT costing

Network Parameter Proposal

This EIP proposes increasing maxTransactionSize from 96 KB to 256 KB.

With Poseidon1 Merkle commitments using 52-byte digests:

• Minimal AIR / D=16: approximately 97.9 KB proof before transaction framing. It exceeds the current 96 KB transaction limit once overhead is included, but fits under 256 KB.
• Full zkVM / D=27: approximately 317 KB proof. It does not fit in a single 256 KB transaction and requires zero-conf chaining, recursion/aggregation, reduced trace width, or a future proof-carrier strategy.

Security Model

• FRI / Fiat-Shamir: Q=35 and blowup B=2048 target >=128-bit post-quantum soundness under the standard QROM modeling assumption for Blake2b-256.
• Merkle binding: Poseidon1 Merkle commitments use 13 BabyBear capacity elements, giving approximately 134-bit quantum collision resistance under BHT-style collision attacks.
• Hash separation: Poseidon1 is used for Merkle commitments; Blake2b-256 is used for Fiat-Shamir transcript generation.
• Scope control: bridge protocols, source-chain commitment formats, proof transport boxes, and standalone Poseidon1 hashing are explicitly left to companion standards.

Companion Material

• Reference implementation PR: feat(EIP-0045): Native STARK Proof Verifier (VerifyStark) - Draft sigmastate-interpreter#1116
• Cryptographic rationale included in this PR
• ErgoScript usage examples included in the EIP

Feedback is especially welcome on the verifier profile registry, transcript domain separation, AOT cost model, and activation path.

[a-shannon]

Reference implementation PR: ergoplatform/sigmastate-interpreter#1116

Current test coverage: 159 tests across 3 suites:

• 114 standalone STARK verifier engine tests (field axioms, tower algebra, Poseidon1, Merkle, FRI, Fiat-Shamir, DEEP-ALI)
• 26 Known Answer Tests (hardcoded regression guards for BabyBear, Ext16, Poseidon1)
• 15 integration tests (OpCode slot, serialization roundtrip, AOT costing boundaries, DoS protection)
• 4 base integration tests (P2P roundtrip, cost charge, negative params)