{
  "type": "option",
  "name": "Avoid the setup entirely: transparent proof systems",
  "slug": "transparent-proof-systems",
  "section": {
    "id": "ceremony",
    "number": "04",
    "title": "Running or reusing a trusted setup",
    "url": "https://zkpick.com/ceremony/"
  },
  "url": "https://zkpick.com/ceremony/transparent-proof-systems/",
  "markdown": "https://zkpick.com/md/ceremony/transparent-proof-systems.md",
  "category": "Avoidance strategy",
  "summary": "Avoid the setup entirely: transparent proof systems: Avoidance strategy. Choose a proof system with a public-coin setup so there is no trapdoor to protect: FRI/STARK-based systems, Bulletproofs, Halo2 with IPA, and hash- or Pedersen-based multilinear commitments. Maturity: Production-used at scale. Maintained by: See the transparent families in §01: StarkWare, Polygon, RISC Zero, Succinct, Zcash and others ship transparent provers. Choose it when: Systems verifying off-chain, or on a chain tolerant of larger proofs, and any team for whom parameter lifecycle risk outweighs proof size.",
  "description": "Choose a proof system with a public-coin setup so there is no trapdoor to protect: FRI/STARK-based systems, Bulletproofs, Halo2 with IPA, and hash- or Pedersen-based multilinear commitments. This is the option most teams should evaluate first, because it removes the workstream rather than managing it.",
  "notes": [],
  "sections": [],
  "strengths": [
    "Eliminates the entire class of ceremony risks, including the ones that have actually caused losses",
    "No parameter lifecycle burden when circuits change, and no artefact-persistence obligation",
    "Plausibly post-quantum for hash-based variants, unlike pairing-based SRS systems"
  ],
  "tradeoffs": [
    "Larger proofs and higher verification cost: no transparent scheme in deployment matches a pairing-based SNARK's proof size and verifier cost, and the gap is what pays for the missing trapdoor",
    "On-chain verification cost often forces a final wrap in Groth16 or PLONK — which reinstates a trusted setup for the wrapper circuit",
    "Public parameters must still be generated from auditable nothing-up-my-sleeve seeds; 'transparent' is not 'no parameters'"
  ],
  "bestFit": "Systems verifying off-chain, or on a chain tolerant of larger proofs, and any team for whom parameter lifecycle risk outweighs proof size.",
  "maintainers": "See the transparent families in §01: StarkWare, Polygon, RISC Zero, Succinct, Zcash and others ship transparent provers",
  "maturity": "Production-used at scale",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2025/064",
  "facts": [],
  "relatedFailureModes": [
    {
      "name": "Forgetting that a universal SRS is updatable by you",
      "url": "https://zkpick.com/ceremony/failure-modes/forgetting-that-a-universal-srs-is-updatable-by-you/"
    },
    {
      "name": "Circuit changes after the ceremony",
      "url": "https://zkpick.com/ceremony/failure-modes/circuit-changes-after-the-ceremony/"
    }
  ],
  "sources": [
    {
      "title": "SoK: Trusted setups for powers-of-tau strings (Wang, Cohney, Bonneau; FC 2025)",
      "url": "https://eprint.iacr.org/2025/064",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/ceremony/transparent-proof-systems/",
  "authors": [
    "MarketComp"
  ]
}