Constraint Analysis

Circuit constraint counts measured with nargo 1.0.0-beta.18 and bb 3.0.0-nightly.20260102.

Main Circuits

Circuit
ACIR Opcodes
Gates

receiving_key

409

60,820

shielded_transfer

9,507

115,254

shielded_withdrawal

8,435

107,358

shielded_swap

15,694

138,410

Library Exported Functions

Function
ACIR Opcodes
Gates

derive_keys

480

60,945

derive_receiving_key

411

60,737

derive_viewing_key

242

42,539

commit_note

8

3,025

encrypt_note

1

63

try_decrypt_note

179

4,362

note_nullifier

4

131

Benchmark Circuits

Individual operation costs for reference:

Operation
ACIR Opcodes
Gates

ecdsa_verify

162

42,084

keccak256 (136 bytes)

2,629

47,647

keccak256 (272 bytes)

4,087

68,892

keccak256 (408 bytes)

5,545

90,135

fixed_base_scalar_mul

11

3,417

multi_scalar_mul

11

3,576

poseidon2_hash

3

130

note_commitment

8

3,025

note_encryption

131

4,810

note_nullifier

4

131

merkle_verify

21,329

63,193

recursive_verify

1

722,797

Cost Breakdown

The dominant costs in the shielded transfer circuit (~115K gates):

  1. ECDSA signature verification: ~42K gates (36%)

  2. Keccak256 hashing (for RLP + address): ~48K gates (42%)

  3. 6x Merkle membership proofs: Variable (uses LeanIMT, depth-dependent)

  4. Poseidon2 operations: ~10K gates (note commitments, nullifiers, encryption)

  5. Note encryption: ~5K gates per encrypted note

The swap circuit is larger (~138K gates) due to the bigger transaction data buffer (324 vs 68 bytes) requiring additional Keccak256 operations.

Running Analysis

Last updated