Skip to main content

Quick Start

This guide runs the core ZeroStyl workflow end to end:

  1. Debug — check a witness against the circuit constraints
  2. Prove — generate a halo2 proof from the witness
  3. Verify — verify the proof against the circuit's public inputs

The example uses the state_mask circuit, which proves that a hidden collateral_ratio lies in a required range and that a hidden_balance exceeds a threshold, while committing to the secret values with a Poseidon hash — without revealing any of them.

The commands below use the binary names directly (see Installation). From a fresh clone you can equivalently prefix them with cargo run --bin <name> --.

Step 1 — Inspect the circuit​

See what witness the circuit expects and a template you can fill in:

zerostyl-prove info state_mask
Circuit: state_mask v1.0.0
  Default k:         10
  Public inputs:     2
  Private witnesses: 5

Witness fields:
  - [private] state_value       : u64   Secret value committed via Poseidon hash.
  - [private] nonce             : fp    Commitment randomness (Poseidon input)
  - [private] collateral_ratio  : u64   Must lie in [150, 300].
  - [private] hidden_balance    : u64   Must be strictly greater than `threshold`.
  - [public ] threshold         : u64   Public minimum balance.

Create state_mask.json with a valid witness (collateral_ratio in range, hidden_balance above threshold):

state_mask.json
{
  "state_value":      "42",
  "nonce":            "7",
  "collateral_ratio": "200",
  "hidden_balance":   "5000",
  "threshold":        "1000"
}

Step 2 — Debug the witness​

Before proving, run the MockProver to confirm the witness satisfies every constraint. This is instant — no keygen, no proof — so it is the fastest way to catch a bad witness.

zerostyl-debug debug --circuit state_mask --witnesses state_mask.json
=== Debug Report: state_mask ===

Circuit: state_mask  k=10

Result: ALL CONSTRAINTS SATISFIED

If a constraint fails, the report names the failing region (for example range check 16 bits), so you can locate the problem in your witness. See the Debug a failing witness tutorial for a worked failure.

Step 3 — Generate a proof​

zerostyl-prove generate --circuit state_mask \
  --witnesses state_mask.json --output proof.bin
ZeroStyl Prover — circuit: state_mask  k: 10
  Proof: 2720 bytes  →  proof.bin
  Public inputs  →  public_inputs.json
Done.

This writes the proof (proof.bin) and the derived public inputs (public_inputs.json, 32-byte little-endian field representations). The first run generates the KZG parameters for k=10 and caches them under .zerostyl_cache/, so later runs are faster.

Step 4 — Verify the proof​

zerostyl-prove verify --circuit state_mask \
  --proof proof.bin --inputs public_inputs.json
ZeroStyl Verifier — circuit: state_mask  k: 10
  Proof is VALID
Done.

That is the full off-chain loop. The zerostyl-verifier crate implements the same halo2-KZG verification for the Arbitrum Stylus runtime; whether it fits a given chain's on-chain size budget is reported by zerostyl-orbit and discussed in Verifier Integration.

What's next?​