Constraint Analysis

Circuit constraint counts measured with nargo 1.0.0-beta.18 and bb 3.0.0-nightly.20260102.

Main Circuits

Circuit	ACIR Opcodes	Gates
receiving_key	409	60,820
shielded_transfer	9,507	115,254
shielded_withdrawal	8,435	107,358
shielded_swap	15,694	138,410

Library Exported Functions

Function	ACIR Opcodes	Gates
derive_keys	480	60,945
derive_receiving_key	411	60,737
derive_viewing_key	242	42,539
commit_note	8	3,025
encrypt_note	1	63
try_decrypt_note	179	4,362
note_nullifier	4	131

Benchmark Circuits

Individual operation costs for reference:

Operation	ACIR Opcodes	Gates
ecdsa_verify	162	42,084
keccak256 (136 bytes)	2,629	47,647
keccak256 (272 bytes)	4,087	68,892
keccak256 (408 bytes)	5,545	90,135
fixed_base_scalar_mul	11	3,417
multi_scalar_mul	11	3,576
poseidon2_hash	3	130
note_commitment	8	3,025
note_encryption	131	4,810
note_nullifier	4	131
merkle_verify	21,329	63,193
recursive_verify	1	722,797

Cost Breakdown

The dominant costs in the shielded transfer circuit (~115K gates):

1. ECDSA signature verification: ~42K gates (36%)

2. Keccak256 hashing (for RLP + address): ~48K gates (42%)

3. 6x Merkle membership proofs: Variable (uses LeanIMT, depth-dependent)

4. Poseidon2 operations: ~10K gates (note commitments, nullifiers, encryption)

5. Note encryption: ~5K gates per encrypted note

The swap circuit is larger (~138K gates) due to the bigger transaction data buffer (324 vs 68 bytes) requiring additional Keccak256 operations.

Running Analysis

cd circuits

# Compile and count constraints
./analyze.sh

# Include proving time benchmarks (slower)
./analyze.sh --prove