Proofs and Provers

What is proven

For every block, a prover produces a zero-knowledge proof that the block's transactions, applied to the previous state, produce the claimed new state — and that every transaction followed the rules: signatures valid, fills at best-of-book, margin checks passed, funding computed correctly, liquidations only where the rule allowed, cancelled orders not filled.

The proof is small and quick to verify, however many transactions the block contains. The settlement contract verifies it once; if it does not verify, the block is rejected.

Who proves

Anyone. A prover is a program that reads committed blocks from the chain, rebuilds the state, and produces proofs. It needs nothing from the sequencer — there is no connection between the two — so the right to check the exchange's history is not something the operator grants or can revoke. Provers accrue a share of the exchange's yield for the work.

How it scales

Provers cut each block into segments and prove them in parallel; segment proofs are aggregated two at a time into a single proof for the block, which is then wrapped into the form the settlement chain verifies. Blocks are proven out of order and in parallel, so throughput grows with the number of provers rather than being capped by any one of them.

The stack

The proof system is a small-field, FRI-based stack. Two design choices make it fast:

• Per-type circuits. Transactions are proven by circuits shaped to their type. A cancel does not pay for the work of a match; a light transaction (an order, a transfer, an oracle update) proves in a fraction of the cost of a heavy one (a match or a liquidation).
• Native recursion. Proofs verify proofs cheaply, which is what lets thousands of transactions across many blocks fold down into the one proof the settlement contract checks — and lets segments be proven wide, out of order, by a whole fleet.

Signature checking, the most expensive part of a signed transaction, is batched into a dedicated proof rather than paid per transaction. The result is on the order of one prover-second per transaction for a realistic trade mix — the throughput headroom behind the exchange's speed.