PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   Universal means reusable, not optional

   The reference string does not encode one circuit. You can prove a new program without a new ceremony. You cannot skip the ceremony entirely. That is the difference from a STARK.

2. Claim 02 · Paper model

   Permutations wire the gates

   The paper checks that a value leaving one gate is the value entering another by a permutation argument. Custom gates then express the actual program. The wiring is part of what an auditor has to read.

3. Claim 03 · Paper model

   Updates need an honest participant

   An updatable string lets a later party randomise the trapdoor. Soundness returns if at least one updater was honest and destroyed their contribution. An update theatre with no honest party is still a trapdoor.

4. Claim 04 · Paper model

   Variants are not the same paper

   TurboPLONK and UltraPLONK add gates and lookups. A rollup that says PLONK may mean a variant with a different verifier. Ask for the circuit and the variant.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 Universal means reusable, not optional

   Observation

   What the study says

   The reference string does not encode one circuit. You can prove a new program without a new ceremony. You cannot skip the ceremony entirely. That is the difference from a STARK.

   Model

   What has to hold

   The polynomial commitment's setup assumption holds, and at least one setup contributor was honest if the string is updatable.

   Falsifier

   What would retire it

   Is the reference string universal, and which variant is implemented?

2. 02 Permutations wire the gates

   Observation

   What the study says

   The paper checks that a value leaving one gate is the value entering another by a permutation argument. Custom gates then express the actual program. The wiring is part of what an auditor has to read.

   Model

   What has to hold

   Custom gates used by a variant are specified. Unspecified gates are a different language.

   Falsifier

   What would retire it

   How big is the proof relative to a Groth16 proof of the same program?

3. 03 Updates need an honest participant

   Observation

   What the study says

   An updatable string lets a later party randomise the trapdoor. Soundness returns if at least one updater was honest and destroyed their contribution. An update theatre with no honest party is still a trapdoor.

   Model

   What has to hold

   The polynomial commitment's setup assumption holds, and at least one setup contributor was honest if the string is updatable.

   Falsifier

   What would retire it

   Is the reference string universal, and which variant is implemented?

4. 04 Variants are not the same paper

   Observation

   What the study says

   TurboPLONK and UltraPLONK add gates and lookups. A rollup that says PLONK may mean a variant with a different verifier. Ask for the circuit and the variant.

   Model

   What has to hold

   Custom gates used by a variant are specified. Unspecified gates are a different language.

   Falsifier

   What would retire it

   Is the reference string universal, and which variant is implemented?

03 Sequence

One action, as an operating tape

1. 01A one-time setup produces a universal string. Later parties may update it.
2. 02The team encodes their program as gates and a wiring permutation.
3. 03The prover commits to the witness polynomials and produces an evaluation proof against the universal string.
4. 04The verifier checks the permutation and the gate constraints.
5. 05A changed program changes the prover's circuit description. It does not, by itself, require a new string.

04 Load-bearing

The argument, and where a pitch drops it

1. The ceremony stopped blocking iteration

   The cut

   Groth16 made every circuit edit a social event. PLONK's adoption in rollups is largely about being able to patch a virtual machine without reassembling the planet. The trust did not leave. It concentrated in one string.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A universal string does not audit the circuit. A wrong circuit is honestly proved.

2. Updatability is a process claim

   The cut

   The math says an honest update suffices. A real system has to show that an honest update happened and that the verifier key everyone uses is the one that update produced.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A later client, parameter or reward formula is a different object from this paragraph.

05 Register

What has to be true

• Adversary · Not re-measured

  The polynomial commitment's setup assumption holds, and at least one setup contributor was honest if the string is updatable.

• Cryptography · Not re-measured

  The Fiat-Shamir transcript binds the proof to this circuit and this public input.

• Cryptography · Not re-measured

  The verifier checks the wiring, not only a proof blob handed to a contract.

• Model · Not re-measured

  Custom gates used by a variant are specified. Unspecified gates are a different language.

06 Divergence

What happened after the paper

PLONK-family proofs became the default for many zk-rollups and zkEVMs because one setup could survive circuit changes. STARKs competed by refusing the setup and paying in proof size. A 2026 system that says PLONK should be pinned to a variant, a circuit hash, and a setup transcript. The 2019 paper is the permutation argument, not that transcript.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1Is the reference string universal, and which variant is implemented?
2. Kill test 2Who updated the string, and is the verifier key the updated one?
3. Kill test 3What is the circuit hash users are supposed to be proving?
4. Kill test 4How big is the proof relative to a Groth16 proof of the same program?
5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

Universal setup

A structured string that is not tied to one circuit, so later programs can reuse it.

Permutation argument

The check that wires carry the same value between gates, which is how the circuit is held together.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

11 Related

The next papers, as theses

• Groth16 · 2016

  On the Size of Pairing-based Non-interactive Arguments

  A pairing-based argument in three group elements. The proofs are tiny and cheap to verify. Each circuit needs its own setup, and a leaked setup can forge proofs.

• StarkWare · 2018

  Scalable, transparent, and post-quantum secure computational integrity

  The STARK paper: proofs of computational integrity that are succinct, do not need a trusted setup, and are argued to resist quantum attackers on the underlying hashes. StarkWare's later systems, including StarkEx and Starknet, are built on this proof system. They are not identical to it.

• Halo · 2019

  Halo: Recursive Proof Composition without a Trusted Setup

  Recursion for inner-product arguments, without a structured setup. A proof can attest that another proof was checked. That is how a chain can fold a long history into one object. Halo 2 is a later system.