Introducing Pangolin: A padding-aware commitment scheme based on Basefold. Instead of materializing repeated padding rows after encoding, Pangolin uses a simple observation: Back-padding in the trace becomes front-padding in the encoded matrix. So the commit path can hash the padding row once and reuse its digest. Same commitment semantics — less prover work: ✅ Store the padding row once ✅ Fewer encoded rows to hash/read ✅ Less prover data and memory traffic ✅ GPU-friendly: less global-memory bandwidth pressure The 5th post in the zkDTVM series: openlabs-intl.antdigital.com…

While writing Khatam, I wasn’t even thinking about publication, I just wanted to prove that BaseFold is practical. Since then, BaseFold has become foundational to fast SNARKs, e.g. it's currently used by @SuccinctLabs , and @aztecnetwork; it's a core building block of WHIR.

We identified this size issue for multilinears while finalizing the BaseFold manuscript back in 2023. Since then, it has taken on a life of it’s own, even given a name “mutual correlated agreement” (coined in WHIR) & becoming a topic of focus in the 1m prize by @ethereumfndn

Very cool! Also the point about it being nicer for WHIR/Basefold is very valid

justice for the other polynomial commitments that didn’t make the “top 3” Bulletproof-style PCs → no trusted setup, logarithmic proofs via inner-product arguments, but slower verification Dory → improves IPA-style commitments for multivariate polynomials, better for recursion batching DARK / DEW → commitments from unknown-order groups (RSA-style), transparent succinct, but impractical today Hyrax / Ligero / Aurora → early transparent PCs, code-based, no setup but large proofs (pre-FRI lineage) Brakedown → linear-time prover, extremely fast proving, trades off with larger proofs Orion → refines Brakedown/FRI ideas with better proof size composition Virgo / Spartan PCs → sumcheck multilinear commitments, avoids heavy FFTs, good for general computation Gemini → multilinear commitments enabling modern SNARKs to move beyond univariate polynomials HyperPlonk → rethinks PLONK using multilinear PCs (hypercube instead of FFT domain) ProtoStar / Nova-style folding PCs → compress multiple proofs into one, unlock efficient recursion BaseFold / modern FRI variants → faster STARK-style commitments with better prover efficiency Lattice-based PCs (emerging) → post-quantum direction, still early but important long-term

📚: ia.cr/2026/391 While hash-based SNARKs have had an explosion of progress recently (Brakedown, BaseFold, STIR, Blaze, WHIR, Tensorswitch, Bolt, Lightning…) most of them are *not* zero-knowledge, and the cost of adding ZK is at least a 2x on most metrics of interest.

Thank you so much for the incredible work I always think of Irreducible as the team making the best long-term ZK engineering. (Binary fields, multi-linear IOP's, testing out linear codes, techniques like BaseFold, etc) The work and inspiration will absolutely live on

No that’s double Johnson which is not so good. 1.5 Johnson is from the paper Deep-FRI and then adapted to Basefold/multilinear setting in eprint.iacr.org/2024/1843 and also eprint.iacr.org/2024/1810

Great blog by @VitalikButerin exploring how to efficiently prove Poseidon hashes using GKR. Love the shoutout to multilinear polynomial commitment schemes like Basefold for added efficiency (it’s true, I can affirm 💯) vitalik.eth.limo/general/202…

Vitalik发布GKR教程文章：支撑超快ZK证明的“批×层”协议 Vitalik Buterin最新撰文，详解GKR（Goldreich–Kahan–Rothblum）协议被用于加速ZK证明，适配“批量×多层”计算结构，显著减少中间层承诺，仅对输入与输出做承诺。文章以Poseidon2哈希为例， 详解以sumcheck为核心的递归证明流程，并给出优化（Gruen’s trick、线性批处理、部分轮仅立方首元素），在多项式承诺场景下可结合BaseFold或FRI。作者称实际开销低于传统STARK约100倍理论值，单数字级开销可期，并提醒Fiat–Shamir挑战需防电路内可预测性风险。

Thanks for highlighting the update. To clarify, WHIR has been proven sound in the unique decoding regime by the authors of the paper. However, in the list-decoding regime, their security analysis relied on a conjectured strengthening of the correlated agreement, called "mutual correlated agreement" therein. While mutual CA can be in fact proven (will make a note public soon), the soundness analysis in my update goes a different path, and uses the same techniques that helped already in my analysis of Basefold: Collinearity of folding proximates, the raw proxy of correlated agreement.

[Proximity proofs] 1/11 Recently @UHaboeck updated "Basefold in the List Decoding Regime" paper where the WHIR round by round soundness is detailed. Let's break down the soundness of a WHIR round, step-by-step. 🧵

Added a revision on the previous soundness analysis of Basefold in the list decoding regime. This one now clarifies round-by-round soundness, and adds a separate analysis of WHIR in the list decoding regime, using the same techniques as for the other Basefold-like protocols. eprint.iacr.org/2024/1571

(4/11) WHIR's core logic combines two powerful ideas: 1. Recursive Folding (from STIR) to shrink the problem in each round. 2. Lightweight Sumchecks (from BaseFold) to efficiently verify algebraic correctness. This combination makes the protocol highly efficient.

This is a major step forward, bridging IPA with sumcheck opens up cleaner, more modular proof system designs. Excited to see how this shapes the next generation of transparent folding protocols. Props to @rel_zeta_tech & @liameagen for pushing the boundaries on BaseFold FRI integration. More of this, please.

Check out the new work from @rel_zeta_tech & @liameagen that explores the IPA sumcheck connection. It connects BaseFold/FRI with IPA in a clean way and introduces a more efficient approach to transparent accumulation and folding schemes.

I said it before, and it doesn't hurt to do it again: such an inspiring idea, group-valued basefold!

Check out recent work eprint.iacr.org/2025/1325 with @rel_zeta_tech exploring the (known but imo under appreciated) IPA sumcheck connection. Allows connecting BaseFold/FRI with IPA in a neat way and an efficient decider for transparent accumulation & folding schemes

A few words on recent paper with @liameagen. A drawback of IPAs is the linear time verification. This was partially mitigated in Halo by deferring this linear time verifier op via accumulation. We give a minor improvement of this accumulation over Halo/BCMS. More interestingly, we improve the final verifier complexity from linear to polylog by using Basefold (and consequently, FRI) - but for a polynomial over a group rather than field. eprint.iacr.org/2025/1325