From Nova to Magnetar: Three Years of Research with Srinath Setty

Srinath Setty traced roughly three years of research after his 2023 discussion of NOVA through SuperNOVA, HyperNOVA, lattice-based folding schemes Neo and SuperNeo, and finally Magnetar. A recurring tool is sum-check: Spartan uses it to prove statements in R1CS, and folding can be understood as stopping Spartan partway through and folding its intermediate results. Setty said each project addressed gaps in prior work, but there was no single recipe for finding or solving them.

Lasso factored out Spartan’s lookup argument for sparse-polynomial evaluation and made very large structured tables practical without materializing them; Jolt’s tables can contain 2^128 entries or more. Setty said that capability was crucial to Jolt, while Twist and Shout, introduced in early 2025, improve on Lasso’s lookup argument. Neo and SuperNeo investigate lattice-based versions of HyperNova, including folding directly over a finite field instead of a ring. Setty said these schemes can be implemented today, but their concrete performance still needs investigation, and he has not seen a full-scale lattice-based folding ZKVM. Lattice-based Jolt takes a different approach, combining Jolt’s polynomial IOP with a lattice-based polynomial commitment scheme as a monolithic SNARK.

Setty distinguished elliptic-curve, lattice-based, “hash and more,” and hash-only ZKVMs. Elliptic-curve systems are not post-quantum secure; lattice systems are post-quantum but rely on lattice assumptions. “Hash and more” designs combine hash-based commitments with other components or assumptions, such as elliptic curves for memory checking. Setty knew of only one hash-only candidate, LeanVM, which targets the Lean ISA rather than general-purpose applications. Magnetar is intended to fill that gap: it proves virtual-machine executions, including RISC-V, using standard hashes such as SHA2 and SHA3, without conjectures about error-correcting codes.

Magnetar is a monolithic SNARK that currently proves an execution in one shot, without recursion or zero knowledge. Its components are Spartan as a polynomial IOP over binary fields, Twist-and-Shout for memory checking, and Ligurito as its polynomial commitment scheme; standard hashes are used for witness commitments and Fiat–Shamir. Setty called Poseidon’s structure a potential weak point as cryptanalysis increases. He cited Ethereum Foundation concerns, its Poseidon bounties, and its recent decision not to use Poseidon in its lean VM. For RISC-V instructions, Magnetar applies one universal R1CS circuit to multiple witness vectors in SIMD form, rather than using instruction-specific lookup tables and a permutation argument. Setty said this circuit approach is more efficient over binary fields, while lookup tables are more optimal in prime-field elliptic-curve and lattice settings.

Magnetar also runs two circuits over the same witness: a binary circuit supporting XOR and AND, and an extension-field circuit using 128-bit values. R1CS linear combinations help reduce witness size by avoiding commitments to intermediate values. Setty attributed efficiency in part to exploiting repeated processor-execution structure through SIMD R1CS and to Spartan and Twist-and-Shout committing only to necessary data while leaving some data virtual. A binary-field Spartan implementation first came within a factor of two of Flock’s performance; later implementation optimizations matched it without protocol changes or new algorithmic innovation. The paper reports 7.2–8.7 million RV64I cycles per second on a laptop, with an optimized version reaching 12 million. Setty said Magnetar is more than an order of magnitude faster than many “hash and more” schemes, though its current proofs are about 600 kilobytes; parameter tuning could reduce them to 250–300 kilobytes without significantly changing prover cost.

Setty said Magnetar could reduce the effort needed to build applications such as Vega, a fully implemented client-side proof system for MDL digital-identity credentials, though it may be slower than a hand-tuned solution. Vega uses Spartan and folding, achieves zero knowledge through blind folding, and relies on elliptic-curve assumptions; Longfellow instead uses GKR plus Ligero. Magnetar’s RV64 target can express lattice-signature and elliptic-curve-signature verification, but proving cost matters. Adding recursion could potentially use repeated proof generation or folding, while adding zero knowledge could enable privacy applications. Client-side use would also require controlling prover memory; Setty suggested an application of about one million RASC-5 cycles may be feasible with further engineering. He considers formal verification the gold standard for complex-system correctness, but Magnetar has not yet been formally verified.