---
title: "Avoid the setup entirely: transparent proof systems"
description: "Avoid the setup entirely: transparent proof systems: Avoidance strategy. Choose a proof system with a public-coin setup so there is no trapdoor to protect…"
type: "option"
url: "https://zkpick.com/ceremony/transparent-proof-systems/"
section: "04 Running or reusing a trusted setup"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/ceremony/transparent-proof-systems.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Avoid the setup entirely: transparent proof systems — *Avoidance strategy*

> Avoid the setup entirely: transparent proof systems: Avoidance strategy. Choose a proof system with a public-coin setup so there is no trapdoor to protect: FRI/STARK-based systems, Bulletproofs, Halo2 with IPA, and hash- or Pedersen-based multilinear commitments. Maturity: Production-used at scale. Maintained by: See the transparent families in §01: StarkWare, Polygon, RISC Zero, Succinct, Zcash and others ship transparent provers. Choose it when: Systems verifying off-chain, or on a chain tolerant of larger proofs, and any team for whom parameter lifecycle risk outweighs proof size.

Choose a proof system with a public-coin setup so there is no trapdoor to protect: FRI/STARK-based systems, Bulletproofs, Halo2 with IPA, and hash- or Pedersen-based multilinear commitments. This is the option most teams should evaluate first, because it removes the workstream rather than managing it.

**Strengths**

- Eliminates the entire class of ceremony risks, including the ones that have actually caused losses
- No parameter lifecycle burden when circuits change, and no artefact-persistence obligation
- Plausibly post-quantum for hash-based variants, unlike pairing-based SRS systems

**Tradeoffs**

- Larger proofs and higher verification cost: no transparent scheme in deployment matches a pairing-based SNARK's proof size and verifier cost, and the gap is what pays for the missing trapdoor
- On-chain verification cost often forces a final wrap in Groth16 or PLONK — which reinstates a trusted setup for the wrapper circuit
- Public parameters must still be generated from auditable nothing-up-my-sleeve seeds; 'transparent' is not 'no parameters'

**Choose it when:** Systems verifying off-chain, or on a chain tolerant of larger proofs, and any team for whom parameter lifecycle risk outweighs proof size.

Maintained by: See the transparent families in §01: StarkWare, Polygon, RISC Zero, Succinct, Zcash and others ship transparent provers · Maturity: Production-used at scale · License: Varies by implementation · Source: https://eprint.iacr.org/2025/064