EIP-0045: Native STARK Proof Verification — Draft

[a-shannon]

Summary

This EIP proposes adding a native VerifyStark opcode to ErgoScript for on-chain STARK proof verification. It enables zero-knowledge virtual machine execution proofs (RISC Zero, SP1, Valida) to be verified as a first-class L1 consensus operation.

Why?

ErgoScript's existing opcodes cannot express STARK verification within a single block's JIT budget. A native opcode amortizes the cryptographic cost into a single, auditable, consensus-enforced operation.

Key Design Points

• 5-child AST node: proofChunks, publicInputs, imageId, vmType, costParams
• OpCode slot 73 (byte 0xB9) from the reserved 73-80 gap — the opcode space beyond slot 143 is completely saturated (0xFF limit)
• AOT Preemptive Costing: charges BASE + Q*PER_QUERY + Q*D*PER_MERKLE from O(1) scalars BEFORE loading byte arrays — instant DoS rejection
• Pure Scala verifier engine (org.ergo.stark): BabyBear field, Ext16 Karatsuba tower, Poseidon1 sponge, Radix-8 FRI, batch Merkle, DEEP-ALI
• 128-bit+ security: Q=35, D=16 yields 132-bit FRI + 155-bit DEEP-ALI soundness
• Soft-fork compatible: invalid proofs return false, never throw to user ErgoScript

Reference Implementation

• sigmastate-interpreter PR: feat(EIP-0045): Native STARK Proof Verifier (VerifyStark) - Draft sigmastate-interpreter#1116
• 1001 tests verified (120 standalone + 877 regression + 4 integration)

Status

Draft — seeking feedback on opcode slot choice, AOT cost model, and package placement.
cc @kushti @aslesarenko

[a-shannon]

Closing in favor of #103 which contains the same EIP-0045 specification and was already shared publicly. All future updates will be pushed to #103.