{
  "type": "option",
  "name": "Nova, SuperNova and HyperNova",
  "slug": "nova-folding",
  "section": {
    "id": "proof-systems",
    "number": "01",
    "title": "Choosing a proof system",
    "url": "https://zkpick.com/proof-systems/"
  },
  "url": "https://zkpick.com/proof-systems/nova-folding/",
  "markdown": "https://zkpick.com/md/proof-systems/nova-folding.md",
  "category": "Folding schemes / IVC",
  "summary": "Nova, SuperNova and HyperNova: Folding schemes / IVC. Setup: None in the folding layer. Proof size: Accumulator, not a proof — needs final compression. On-chain verification: Via the compressing SNARK only. PQ: No. Recursion: This is the whole point. Maturity: Research to early production. Prover cost profile: Two MSMs per step — the cheapest incremental step known. Peak prover memory: Bounded by one step plus the accumulator. Off-chain verifier: Only after final compression. Implementations and maintainers: Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer). Where it is measured: Repository benchmarks only; no neutral suite. Choose it when: Long, repetitive computations and memory-constrained provers, where the final compression step happens once.",
  "description": "Folding reduces checking two instances of a relation to checking one, so each step of a long computation costs a couple of multi-scalar multiplications rather than an in-circuit SNARK verification. Variants add non-uniform steps and generalised constraint systems.",
  "notes": [],
  "sections": [],
  "strengths": [
    "The lowest known per-step recursion overhead for long, near-uniform computations",
    "Memory-friendly: proving is incremental, so peak memory tracks one step rather than the whole trace",
    "No trusted setup in the folding layer itself",
    "Non-uniform variants avoid paying for the union of all instructions at every step"
  ],
  "tradeoffs": [
    "Folding produces an accumulator, not a succinct proof — a final compressing SNARK is still required, and its cost is often omitted from benchmarks",
    "Not post-quantum: security rests on discrete log in the commitment scheme",
    "Real soundness pitfalls have been published in cycle-of-curves constructions — this is subtle territory",
    "Implementation maturity trails the pairing-based and FRI families"
  ],
  "bestFit": "Long, repetitive computations and memory-constrained provers, where the final compression step happens once.",
  "maintainers": "Nova by Kothapalli, Setty and Tzialla (Microsoft Research, 2021); SuperNova and HyperNova from the same lineage. Implementations: Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer)",
  "maturity": "Research to early production",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2021/370",
  "facts": [
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-nova-folding-schemes",
      "name": "Nova / folding schemes",
      "setup": "None in the folding layer",
      "size": "Accumulator, not a proof — needs final compression",
      "verify": "Via the compressing SNARK only",
      "pq": "No",
      "recursion": "This is the whole point",
      "maturity": "Research to early production"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-nova-folding-schemes",
      "name": "Nova / folding schemes",
      "prover": "Two MSMs per step — the cheapest incremental step known",
      "memory": "Bounded by one step plus the accumulator",
      "offchain": "Only after final compression",
      "impls": "Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer)",
      "bench": "Repository benchmarks only; no neutral suite"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Nova — recursive zero-knowledge arguments from folding schemes",
      "url": "https://eprint.iacr.org/2021/370",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/proof-systems/nova-folding/",
  "authors": [
    "MarketComp"
  ]
}