Prover

The prover is a LinethLineth (Formerly the Linea Stack) The open-source ZK-rollup stack, codebase, and technical protocol that's the foundation of Linea Mainnet. Operators can deploy this stack to launch their own Ethereum-compatible L2 or L3 networks. module that turns execution traces into zk-SNARKszk-SNARK (Zero-Knowledge Succinct Non-interactive Argument of Knowledge) A type of ZK proof where the prover and verifier don't have to interact. With zk-SNARKs, you can verify 1 transaction or 1 billion transactions in the same amount of time.. These zk-SNARKs enable the finalization layerFinalization layer The blockchain where a Lineth deployment submits proofs and state commitments for verification and hard finality. If the finalization layer is Ethereum (an L1), the deployment is an L2. If the finalization layer is Linea (an L2), the deployment is an L3. to accept a Lineth state transition without re-executing any transactions.

Proof generation is computationally intensive, so deployments run the prover as one or more dedicated instances rather than inside the execution client.

How it works

The coordinator drives the prover. It writes each proof request, along with the conflated traces produced by the tracer, to the directories the prover watches, and collects the finished proof from the same place.

The prover produces three kinds of proofs:

• Execution proofs show that the transactions in a batch executed correctly.
• Compression proofs show that a blob's compressed data expands to the batches it stands for.
• Aggregation proofs combine the proofs for several blobs into the single proof submitted at finalization.

Each proof is built in two stages:

1. Corset expands the trace data into the full constraint system, the arithmetization the prover proves against.
2. The proving system reduces that expanded data to an inner proof, then wraps it with the gnark library into an outer proof: the zk-SNARK that a verifier contract on the finalization layer can check cheaply.

Because the proof accompanies the data it proves, anyone can confirm that a state transition is correct by checking the proof onchain, instead of trusting the operator or re-executing the transactions themselves.

See also

• See Circuit building and Circuit execution and runtime for how Corset and gnark each work in detail.
• See Module limits for the trace line limits that keep batches provable, and Trusted setup for the reference strings the proving system relies on.
• See RISC-V proving architecture for the planned evolution toward guest-program-based proof generation.
• Configure prover behavior using the Prover options.
• See the prover source code in the lineth-monorepo.