Glossary OS

Plain meaning

Start with the shortest useful explanation before going deeper.

Groth16 is a highly efficient zk-SNARK proving system introduced by Jens Groth in 2016 that produces constant-size proofs (128 bytes: two G1 points and one G2 point on a pairing-friendly elliptic curve) with constant-time verification regardless of circuit complexity, making it the preferred proof system for on-chain verification where calldata and compute costs are constrained. Light Protocol uses Groth16 proofs over the BN254 curve (known as alt_bn128 in Ethereum tooling) to verify compressed account state transitions on Solana, leveraging the native alt_bn128 pairing and point-addition syscalls added to the SVM to keep verification within the per-transaction compute unit limit. The trade-off is that Groth16 requires a trusted setup ceremony per circuit, producing a structured reference string (SRS) whose security relies on participants honestly discarding their toxic waste.

Mental model

Use the quick analogy first so the term is easier to reason about when you meet it in code, docs, or prompts.

Think of it as a building block that connects one definition to the larger Solana system around it.

Technical context

Place the term inside its Solana layer so the definition is easier to reason about.

Compressed state, proofs, and scale-oriented storage patterns.

Why builders care

Turn the term from vocabulary into something operational for product and engineering work.

This term unlocks adjacent concepts quickly, so it works best when you treat it as a junction instead of an isolated definition.

AI handoff

Use this compact block when you want to give an agent or assistant grounded context without dumping the entire page.

Groth16 (groth16)
Category: ZK Compression
Definition: Groth16 is a highly efficient zk-SNARK proving system introduced by Jens Groth in 2016 that produces constant-size proofs (128 bytes: two G1 points and one G2 point on a pairing-friendly elliptic curve) with constant-time verification regardless of circuit complexity, making it the preferred proof system for on-chain verification where calldata and compute costs are constrained. Light Protocol uses Groth16 proofs over the BN254 curve (known as alt_bn128 in Ethereum tooling) to verify compressed account state transitions on Solana, leveraging the native alt_bn128 pairing and point-addition syscalls added to the SVM to keep verification within the per-transaction compute unit limit. The trade-off is that Groth16 requires a trusted setup ceremony per circuit, producing a structured reference string (SRS) whose security relies on participants honestly discarding their toxic waste.
Related: Zero-Knowledge Proofs (ZKP), SNARK (Succinct Non-interactive Argument of Knowledge)

Glossary Copilot

Ask grounded Solana questions without leaving the glossary.

Use glossary context, relationships, mental models, and builder paths to get structured answers instead of generic chat output.

Open full Copilot workspace

Question

Explain this code

Optional: paste Anchor, Solana, or Rust code so the Copilot can map primitives back to glossary terms.

Ask a glossary-grounded question

The Copilot will answer using the current term, related concepts, mental models, and the surrounding glossary graph.

Concept graph

See the term as part of a network, not a dead-end definition.

These branches show which concepts this term touches directly and what sits one layer beyond them.

Branch

Zero-Knowledge Proofs (ZKP)

A zero-knowledge proof is a cryptographic protocol by which a prover convinces a verifier that a statement is true — for example, that a state transition is valid — without revealing any information beyond the truth of the statement itself, satisfying the properties of completeness, soundness, and zero-knowledge. In Solana's ecosystem, ZKPs are used by ZK Compression (via Groth16 SNARKs) to prove correct state transitions for compressed accounts without storing full account state on-chain, and by the Token-2022 Confidential Transfers extension (via ElGamal encryption and range proofs) to prove token balances are non-negative without revealing the actual amounts. Solana's BPF VM exposes the alt_bn128 elliptic curve syscall to make on-chain Groth16 proof verification computationally feasible within the 1.4M compute unit budget.

PLONK

Open term

Branch

SNARK (Succinct Non-interactive Argument of Knowledge)

A SNARK is a class of zero-knowledge proof system characterized by succinctness (proofs are short — typically hundreds of bytes — regardless of the computation's complexity), non-interactivity (the prover sends a single message without back-and-forth with the verifier), and the argument-of-knowledge property (a prover who produces a valid proof must know the witness, i.e., the secret inputs to the computation). zk-SNARKs such as Groth16 and PLONK are the cryptographic core of ZK Compression on Solana, enabling off-chain provers to compress complex state transition validity into a proof that a Solana validator can verify on-chain cheaply using the alt_bn128 syscall over the BN254 elliptic curve. Most current Solana zk-SNARK deployments rely on trusted setups, though newer transparent variants like STARKs eliminate this requirement at the cost of larger proof sizes.

Open term

Next concepts to explore

Keep the learning chain moving instead of stopping at one definition.

These are the next concepts worth opening if you want this term to make more sense inside a real Solana workflow.

ZK Compression

Zero-Knowledge Proofs (ZKP)

A zero-knowledge proof is a cryptographic protocol by which a prover convinces a verifier that a statement is true — for example, that a state transition is valid — without revealing any information beyond the truth of the statement itself, satisfying the properties of completeness, soundness, and zero-knowledge. In Solana's ecosystem, ZKPs are used by ZK Compression (via Groth16 SNARKs) to prove correct state transitions for compressed accounts without storing full account state on-chain, and by the Token-2022 Confidential Transfers extension (via ElGamal encryption and range proofs) to prove token balances are non-negative without revealing the actual amounts. Solana's BPF VM exposes the alt_bn128 elliptic curve syscall to make on-chain Groth16 proof verification computationally feasible within the 1.4M compute unit budget.

Open term

ZK Compression

SNARK (Succinct Non-interactive Argument of Knowledge)

A SNARK is a class of zero-knowledge proof system characterized by succinctness (proofs are short — typically hundreds of bytes — regardless of the computation's complexity), non-interactivity (the prover sends a single message without back-and-forth with the verifier), and the argument-of-knowledge property (a prover who produces a valid proof must know the witness, i.e., the secret inputs to the computation). zk-SNARKs such as Groth16 and PLONK are the cryptographic core of ZK Compression on Solana, enabling off-chain provers to compress complex state transition validity into a proof that a Solana validator can verify on-chain cheaply using the alt_bn128 syscall over the BN254 elliptic curve. Most current Solana zk-SNARK deployments rely on trusted setups, though newer transparent variants like STARKs eliminate this requirement at the cost of larger proof sizes.

Open term

ZK Compression

Light Protocol

Light Protocol is the open-source infrastructure layer that implements ZK Compression on Solana, consisting of a set of on-chain programs (the Light System Program, Compressed Token Program, and Account Compression Program), an off-chain prover network that generates Groth16 proofs for state transitions, the Photon indexer that reconstructs compressed account state from Solana ledger data, and the Forester service that manages Merkle tree maintenance tasks like nullifier queue processing. Light Protocol enables developers to build general-purpose compressed accounts, compressed SPL tokens, and compressed PDAs that are 100–1,000x cheaper than their standard counterparts while inheriting Solana's full security, atomicity, and composability guarantees. The protocol is permissionlessly deployable and integrates with existing Solana tooling via a drop-in SDK that mirrors familiar account and token patterns.

Open term

ZK Compression

Forester

Forester is the permissionless keeper service in Light Protocol's architecture responsible for performing routine Merkle tree maintenance operations that must be triggered by an external party rather than automatically on-chain, including nullifier queue processing (finalizing spent compressed account hashes to prevent double-spends), address queue processing (registering new compressed account addresses), and rolling epoch-based tree updates. Without an active Forester, nullifier queues can fill up and block new state transitions in a compressed tree, so Light Protocol incentivizes Forester operators through protocol fees collected during these maintenance operations. Forester nodes are run permissionlessly by anyone against a Solana RPC and monitor on-chain queue accounts, submitting crank transactions when queues require processing.

Open term

Related terms

Follow the concepts that give this term its actual context.

Glossary entries become useful when they are connected. These links are the shortest path to adjacent ideas.

ZK Compressionzk-proofs

Zero-Knowledge Proofs (ZKP)

A zero-knowledge proof is a cryptographic protocol by which a prover convinces a verifier that a statement is true — for example, that a state transition is valid — without revealing any information beyond the truth of the statement itself, satisfying the properties of completeness, soundness, and zero-knowledge. In Solana's ecosystem, ZKPs are used by ZK Compression (via Groth16 SNARKs) to prove correct state transitions for compressed accounts without storing full account state on-chain, and by the Token-2022 Confidential Transfers extension (via ElGamal encryption and range proofs) to prove token balances are non-negative without revealing the actual amounts. Solana's BPF VM exposes the alt_bn128 elliptic curve syscall to make on-chain Groth16 proof verification computationally feasible within the 1.4M compute unit budget.

Open term

ZK Compressionsnark

SNARK (Succinct Non-interactive Argument of Knowledge)

A SNARK is a class of zero-knowledge proof system characterized by succinctness (proofs are short — typically hundreds of bytes — regardless of the computation's complexity), non-interactivity (the prover sends a single message without back-and-forth with the verifier), and the argument-of-knowledge property (a prover who produces a valid proof must know the witness, i.e., the secret inputs to the computation). zk-SNARKs such as Groth16 and PLONK are the cryptographic core of ZK Compression on Solana, enabling off-chain provers to compress complex state transition validity into a proof that a Solana validator can verify on-chain cheaply using the alt_bn128 syscall over the BN254 elliptic curve. Most current Solana zk-SNARK deployments rely on trusted setups, though newer transparent variants like STARKs eliminate this requirement at the cost of larger proof sizes.

Open term

Stay in the same layer and keep building context.

These entries live beside the current term and help the page feel like part of a larger knowledge graph instead of a dead end.

ZK Compression

State Compression

State Compression is Solana's technique for storing the cryptographic fingerprint (root hash) of a Merkle tree on-chain while keeping the actual leaf data off-chain in the Solana ledger's account data logs, reducing the cost of storing large datasets by orders of magnitude. A compressed NFT collection of 1 million items costs roughly 50 SOL to mint versus ~12,000 SOL with standard SPL accounts, because only a single Concurrent Merkle Tree account occupies on-chain storage. Any data change requires updating the root hash and supplying a Merkle proof to the on-chain program, which verifies inclusion without reading the full dataset.

Open term

ZK Compression

ZK Compression, pioneered by Light Protocol, extends Solana's state compression model beyond NFTs to general-purpose compressed accounts by using zero-knowledge proofs (specifically Groth16 SNARKs verified via the alt_bn128 syscall) to prove the validity of state transitions without storing full account state on-chain. Compressed accounts live in on-chain Merkle trees but their data is reconstructed from the Solana ledger by indexers like Photon, enabling developers to build applications that use thousands of accounts at a fraction of the normal rent cost — often 1,000x to 5,000x cheaper than regular accounts. The protocol introduces compressed tokens, compressed PDAs, and a system of nullifiers to prevent double-spends while maintaining Solana's throughput.

Open term

ZK Compression

Compressed Account

A compressed account is a Solana account whose state is stored as a leaf in an on-chain Concurrent Merkle Tree rather than as a dedicated on-chain account, making it 100–1,000x cheaper to create and maintain because no rent-exempt lamport balance is required per account. Compressed accounts are identified by a hash of their data and position in the tree; to interact with one, a client must supply a Merkle proof (or rely on the canopy) showing the leaf is part of the current tree root, which the on-chain program verifies before processing the state change. Light Protocol's compressed account model supports arbitrary data, discriminators, and owner programs, making it a general-purpose replacement for expensive on-chain accounts in high-volume use cases.

Open term

ZK Compression

Concurrent Merkle Tree

A Concurrent Merkle Tree (CMT) is a specialized on-chain Solana data structure that allows multiple state updates to the same Merkle tree within a single block without conflicting, by recording a changelog buffer of recent root transitions that validators use to reconcile parallel proof submissions. A CMT is parameterized by its maximum depth (max_depth, determining tree capacity of 2^max_depth leaves), max_buffer_size (number of concurrent changes the changelog can track, directly controlling how many operations per slot the tree can safely absorb), and an optional canopy_depth. The SPL Account Compression program manages CMTs, and they are the foundational storage primitive for both Metaplex compressed NFTs and Light Protocol compressed accounts.

Open term