The progress made by @SuccinctLabs and @RiscZero toward real-time proving has been super impressive. QT-ing not to be critical but because I think these questions are really interesting (and I would like to see RTP hit Ethereum!). 1. Proving all historical Ethereum blocks within 12s is not sufficient to cover worst-case prover time. This is important because there are possible pathological ("prover-killer") blocks where proving cost >> gas cost (proving cost is a measure of latency or $). The first step is proving all historical blocks within 12s. But this isn't enough. We need to work to identify pathological cases that haven't shown up on Ethereum yet. Not sure what the cost schedule is for SP1, but something like an entire block full of extcodehash could be expensive in latency terms. 2. Formal Verification also needs to cover the compiler 😱 @argumentxyz had a good article about the frequency at which compiler bugs are found ( tl;dr there's a specific class of "mis-optimization bugs" that could potentially be exploitable in zkVMs to create soundness issues. These bugs are found fairly frequently. @drakefjustin has argued that we can get around this with many zkVM implementations. But that doesn't work if those zkVMs share the same compiler toolchain and are vulnerable to the same bugs. 3. At-home proving is not needed I think that I agree that at-home proving isn't necessary. We already rely on extra-protocol actors like builders to construct blocks. The guarantee that we want is that *someone* is always available to generate proofs. Deferring RTP for the WW3 scenario where all provers go offline seems like overkill. Maybe in this scenario, Ethereum could default back to a mode where the gas limit decreases and blocks are re-executed rather verified with ZKPs. 4. 100x-ing the gas limit could create issues Parallelized proving definitely helps, but timing is so tight that we need to consider witness generation (not parallelizable in many zkVMs) and recursion. Recursion overhead should scale logarithmically, but if the gas limit increases by 100x, proving times could exceed block times. Bonus - I'd argue that it's really important for Ethereum to reduce block times and time to finality, in order to help users onboard to L2s, bridge from CEXs, etc. This increases the latency demands on proving. It would be suboptimal if we're unable to move to 1s block times because the lower bound on worst-case RTP latency is 10s.
Uma Roy
Uma Roy22 мая 2025 г.
Yesterday's real-time proving announcement is a huge milestone, and @VitalikButerin brings up some good points about further work that will be required. BUT I think we're closer on all these points than people might realize... 1. Worst case real-time proving can be solved with simple changes to Ethereum's gas schedule: Today, ~94% of blocks can be proven in < 12 seconds, 99% of blocks can be proven in < 13 seconds. For the remaining outliers, simple adjustments to Ethereum's gas schedule should suffice (currently the bn254, bls12-381 precompiles are underpriced relative to their proving costs). Also the EIP limiting the maximum gas usage of a single transaction will help ensure there are no DDOS vectors (since we prove subblocks of transactions in parallel to achieve our low latency). 2. Formal Verification for SP1 is already underway: Conveniently, we've had 2 announcements in the past week about formal verification for SP1, working with @NethermindEth and @VeridiseInc! We have a clear line of sight to formally verifying all of our core AIRs over the next few months. 3. At-home proving is not needed with decentralized prover networks: Right now RTP requires ~160 GPUs, which is very small for any data-center but maybe slightly large for an at-home setup. However, with the upcoming launches of decentralized prover networks, I'm not sure we need to aim for proving at home. The network will economically incentivize that there's always provers online ready to real-time prove. 4. Parallelized proving of subblocks means 100x-ing the gas limit is no problem for latency: I'm all for 100x-ing the gas limit and this will be no problem for us. Our real-time proving implementation uses a subblock approach, where we take a block and break it into smaller subblocks of a few transactions. These subblocks are proven in parallel, and then aggregated into 1 proof at the end. Even if the gas limit increases by 100x, we can still parallelize proving of the subblocks (there are just more of them), meaning the latency won't be impacted. Believe in something real. Believe in real-time proving.
9,27K