Running a Prover

Every block the sequencer commits has to be proven correct before its balances become final. Producing those proofs is permissionless: a prover reads committed blocks straight from the chain, rebuilds the state, and produces the proof. It needs nothing from the sequencer — there is no connection between the two — so no one grants or revokes the right to prove. Provers accrue 20% of the exchange's yield for the work (see Where the Yield Comes From).

What a prover does

A prover is a follower. On a loop, it:

1. Reads a committed block's data from the settlement contract.
2. Replays the block to rebuild the resulting state — the same replay anyone can run to audit the exchange.
3. Proves it: the block is cut into segments (light and heavy transaction runs) proven in parallel, aggregated two at a time, and folded across a range of blocks into a single succinct proof.
4. Settles: it submits proveBlocks(first, last, proof) to the settlement contract, which verifies the proof and advances the proven frontier.

Because proveBlocks takes no prover identity, any prover's proof for a range is as good as any other's — the fastest one to a range settles it, and the rest move on. See Proofs and Provers.

What it runs

Two processes:

• zk-prover (Rust) — the proving daemon. It speaks JSON lines and does the cryptography: segment, aggregation, range and wrapper proofs over the Goldilocks/FRI stack.
• proverd (Go) — the follower. It watches the chain, feeds blocks to zk-prover, and submits settlements.

Build and run, from the repository root:

# Build the proving daemon (Rust nightly)
cd zk && cargo +nightly build --release -p zk-circuits --bin zk-prover

# Run the follower against your prover config
go run ./cmd/proverd -config proverd.json

The proverd.json names the chain, the settlement contract, the STRATO key that pays for settlement transactions, and the zk-prover binary. The operator runbook in the repository covers the full configuration, the one-time verifying-key export, and how several provers share the wrap stage.

What it takes

Proving is CPU-bound. On a current laptop the whole pipeline costs on the order of one prover-second per transaction for a realistic trade mix, so a fleet's throughput grows with the number of cores you point at it. The proving daemon has an optional GPU path. None of the parameters are secret — the circuits, the verifying keys and the proof format are all public, which is what lets an independent prover produce a proof the contract will accept.