A powers-of-tau ceremony whose contract accepts a string of $2^{15}$ elements without reading more than four of them — and can still be shown, later, exactly which one was wrong.
1Visa Research · 2Georgia Institute of Technology · 3IMDEA Software Institute · 4Max Planck Institute for Security and Privacy
In three numbers
A powers-of-tau string is the trusted setup underneath KZG commitments, Danksharding and most efficient zk-SNARKs. It stays secure as long as one contributor threw their randomness away, so you want a crowd. On Ethereum every extra degree costs gas — so the ceremonies that exist are small.
To throw out an ill-formed string of any length, the contract opens four Merkle leaves and runs two pairing equalities. It never verifies the other $n-4$.
$16\times$ the $2^{11}$ where prior on-chain work last fits under the 30M block gas limit. Enough for ProtoDanksharding, which targets $2^{12}$ to $2^{15}$.
One aggregated proof of three group elements covers $m$ contributors — flat in $m$, whether $m$ is 10 or 140,000.
The problem
The public parameters are a string of powers of one secret scalar:
Anyone who learns $\tau$ can forge proofs in every system built on the string. The fix is a ceremony: contributor $i$ re-randomises it with a secret $r_i$, and the trapdoor becomes $r\cdot\tau$ — safe as long as at least one participant destroyed their $r_i$ and none of them is zero.
Running this on a blockchain gets you four properties for free: consensus on the final string, validity of each contribution, data availability of the history, and censorship resistance. Nikolaenko et al. built the first such ceremony — but their contract proactively verifies every update, and that check is linear in the degree and made of scalar multiplications and pairings, the most expensive things the EVM does. At $2^{12}$ a single contribution already costs more gas than an entire block holds.
Lite-PoT makes the contract optimistic. It verifies only that a contributor knows their own randomness (Check #1) and that the result is non-degenerate (Check #3). Well-formedness — Check #2, the expensive one — is simply assumed. Everything below follows from what it takes to disprove that assumption cheaply, afterwards.
Interactive 1 · Algorithms 4 and 5, equation (1)
Here is a string as the protocol sees it — each cell holds the exponent it is supposed to have. Click any cell to corrupt it to an unrelated $\delta$, then run the check and watch which cells anybody actually has to open.
The contract keeps only the root $\mathsf{com}_{\pp}$. A fraud proof opens the highlighted leaves and supplies the sibling hashes along their paths.
The strip is an illustration at $n=14$, $k=2$ so the tree fits on screen; the paper's strings run to $2^{15}$. Cells show exponents, not curve points. Every number in the readouts is for the measured size selected in the gas section, never for the 16-cell toy. The walk that locates the first bad index is $O(n+k)$ and runs off-chain — that is the cost plotted in the off-chain timings below; only the openings and the two pairing equalities touch the chain. For a fault in $\mathbb{G}_2$ the walk and the contract use different anchors — Algorithm 5 compares $Q_j$ against $P_{j-1}$, while Algorithm 4's FraudVerify compares it against $P_1$ and $Q_{j-1}$, which is why the equation changes between the walk and the ruling. Both are valid: each anchors on an element already known to be correct.
Interactive 2 · Algorithm 4, Disprove and RecvFraud
Optimism has a sting. An adversary can plant an ill-formed $\pp_i$, immediately cover it with a well-formed one so nobody investigates, let honest people build on top for weeks, then challenge its own $\pp_i$ and erase every honest contribution that followed.
The defence is not a policy bolted on top — it is the shape of the challenge procedure. Disprove walks the chain backwards from the tip and stops at the first well-formed contribution it meets. Whatever it collected before stopping is a contiguous ill-formed tail, and that is all RecvFraud will cut. Click a block to flip it, then run.
DisproveAn ill-formed $\pp_i$ with a well-formed $\pp_j$ behind it is never removed, and that is deliberate: the trapdoor is safe as long as one honest contributor destroyed their randomness, so the mechanism only ever needs to strip a bad tail — never to delete history. Giving up the latter is exactly what kills the rollback attack. The payoff is off-chain: a contributor verifies the latest $\pp$ and nothing else.
Interactive 3 · Section 3.2 and Algorithm 1
Check #1 — proving you know the randomness you mixed in — still has to happen once per contributor. Prior work verifies each one on-chain. Here every contributor folds their proof into the running one and leaves, and an untrusted operator relays it. Add contributors and watch what grows and what does not.
The proof is $(\presig, \cursig, \curvk)$ — three group elements, whatever $m$ is. The paper's stated on-chain cost for verifying it is 137,000 gas: two pairings plus four scalar multiplications at Table 3's prices. Algorithm 1 is shown exactly as the paper writes it; since Ethereum has no native $\mathbb{G}_2$ operations, which four scalar multiplications a deployed contract actually performs is not derivable from the paper, so no per-line gas is claimed here. For scale: the paper estimates prior per-contributor checks at more than 10,000 gas each, so Ethereum's KZG Ceremony of 140,000 contributors would need over 1.4 billion gas — more than $46\times$ a full block.
Interactive 4 · Sections 3.2.2 and 3.2.3
The aggregate above is BLS-shaped, and BLS-shaped things get rogue-keyed. You play the attacker. Both attacks work by making a key you do not control vanish out of a sum — but they happen in different places, and the fix that stops one is useless against the other.
Interactive 5 · Table 4 and Figure 3 of the paper
The measured result. Pick a string size — this also sets the size quoted in the readouts above. Bars are log-scale, and the dashed rule is Ethereum's 30M block gas limit; anything past it cannot be executed at all.
Only the six sizes actually benchmarked are offered; the control snaps to them and nothing is interpolated. Gas figures are Table 4's. USD figures are Table 4's own, computed at an Ethereum price of 1,630 USD and a gas price of 2 gwei on 14 April 2025 — the camera-ready's rates. The PDF linked above prices the same gas at 3,080 USD per ETH and 24 gwei (2,774 USD becomes 62,904 USD). The gas is identical in both.
Table 5 of the paper
$m$ is the number of contributors; $n$ and $k$ are the degrees in $\mathbb{G}_1$ and $\mathbb{G}_2$; $c$ is the number of untrusted operators, with $c \ll m$. Fault tolerance of $m-1$ is what makes a ceremony "the more the merrier" — one honest participant suffices.
| Construction | Censorship resistant | Fault tolerance | Communication model | On-chain cost |
|---|---|---|---|---|
| MPC-based PoT | No | $m-1$ | Round-robin + broadcast | N/A |
| PoT in async | No | $m/3$ | Asynchronous | N/A |
| PoT to the People (Nikolaenko et al.) | Yes | $m-1$ | Round-robin + blockchain | $O(km)$ pairings + $O(m(n+k))$ ECMult |
| Lite-PoT | Yes | $m-1$ | Round-robin + blockchain | $O(c)$ pairings + $O(c(n+k))$ calldata/hashing |
The number of contributors is fixed in advance in the MPC and asynchronous designs; it can keep growing in the two blockchain designs. Security of the aggregation scheme is proved in the algebraic group model.
Measured results
Red cells exceed Ethereum's 30M block gas limit. USD at 1,630 USD per ETH and 2 gwei, 14 April 2025.
| Name | Operation | Gas cost |
|---|---|---|
ECADD | $A + B$ for $A, B \in \mathbb{G}_1$ | 150 |
ECMult | $\alpha A$ for $\alpha \in \mathbb{Z}_p$, $A \in \mathbb{G}_1$ | 6,000 |
ECPAIR | $\sum_{i=1}^{k} e(A_i, B_i) = 0$ | $34{,}000 \cdot k + 45{,}000$ |
CALLDATA | $k$ non-zero bytes | $16 \cdot k$ |
Keccak256 | $k$ 32-byte words | $30 + 6 \cdot k$ |
| Construction | Update cost | Fraud-proof verification cost |
|---|---|---|
| Nikolaenko et al. | ${\approx}2n$ ECMULT + $4k-2$ ECPAIR | — |
| Lite-PoT | ${\approx}(n+k)$ CALLDATA + $2(n+k)$ Keccak | ${\approx}\log_2(n+k)$ CALLDATA + $\log_2(n+k)$ Keccak |
ECMULT and ECPAIR are more than $10\times$ costlier than CALLDATA and Keccak. Aggregation is not counted in this comparison.
This is the cost of the $O(n+k)$ walk in the first interactive. Because Lite-PoT verifies off-chain rather than inside the sequential EVM, the additions inside Check #2 can run in parallel.
Desktop with a 2.6 GHz 6-core Intel Core i7 and 80 GB RAM. BN254 (EIP-197), Keccak256, off-chain components in Rust, contract in Solidity, deployed on Ganache. The paper reports the speed-up as $\approx 6\times$; the measured per-size values run from $5.52\times$ to $6.21\times$.
Provenance
Several quantities are stated inconsistently across the source material, and the PDF linked from this page is an earlier version of the paper than the one the numbers come from. This page does not reconcile any of it; it shows what each source says and which one is used where.
if e(P₁, G₂) = e(G₁, Q₁) then Outputs (1,1,1) — reporting the string ill-formed when the two groups agree. Its $\mathbb{G}_2$ loop likewise tests for equality, while its $\mathbb{G}_1$ loop tests for inequality. Section 3.1's prose says the opposite: "If this equality does not hold, the contract accepts the fraud-proof." Both the arXiv version and the camera-ready carry the same algorithm text. The first interactive animates the prose semantics — a mismatch means ill-formed — because that is the direction the rest of the paper depends on, including the correctness argument for equation (1).Code availability. The paper contains no data-availability or artifact statement, and links no repository: the off-chain components are described as implemented in Rust and the contract in Solidity, deployed on Ganache, but no source is published with the paper. No code link is offered here because there is none to offer.
The linked PDF is arXiv:2503.04549v1, de-anonymised, carrying gas figures identical to the camera-ready's; only its USD column differs (November 2024 rates) and its affiliations are listed more briefly. The authors and affiliations at the top of this page are the camera-ready's.
Cite
@inproceedings{ng-litepot-2025,
author = {Ng, Lucien K. L. and Moreno-Sanchez, Pedro and Minaei, Mohsen and
Chatzigiannis, Panagiotis and Bhat, Adithya and Le, Duc V.},
title = {Lite-PoT: Practical Powers-of-Tau Setup Ceremony},
booktitle = {Proceedings of the 2025 ACM SIGSAC Conference on Computer and
Communications Security (CCS '25)},
year = {2025},
address = {Taipei, Taiwan},
publisher = {Association for Computing Machinery},
isbn = {979-8-4007-1525-9},
doi = {10.1145/3719027.3765182}
}
Page numbers are omitted because the source does not state them. Published under CC BY.