---
title: "FRI-based STARKs"
description: "FRI-based STARKs: Transparent hash-based proof system. Setup: None. Proof size: Tens to hundreds of KB."
type: "option"
url: "https://zkpick.com/proof-systems/starks/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/starks.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# FRI-based STARKs — *Transparent hash-based proof system*

> FRI-based STARKs: Transparent hash-based proof system. Setup: None. Proof size: Tens to hundreds of KB. On-chain verification: Impractical directly — wrapper is standard. PQ: Plausibly. Recursion: Well-exercised. Maturity: Heavily production. Prover cost profile: Small-field hashing and NTTs; the fastest bulk provers on CPU and GPU, and the basis of most zkVMs. Peak prover memory: Trace-proportional, but small fields keep it low; continuations bound it. Off-chain verifier: Milliseconds to tens of milliseconds — hashing only. Implementations and maintainers: Stone and Stwo (StarkWare), Plonky3 (Polygon Zero lineage; beneath SP1 Turbo, OpenVM, Ziren, Pico), RISC Zero, Miden, ZKsync Airbender (Matter Labs), Winterfell. Where it is measured: ethproofs.org real-time Ethereum block proving; a16z zkvm-benchmarks. Assumption: Hash (collision resistance). Setup: None. Opening size: Polylogarithmic but large in absolute terms. Verifier cost: Polylogarithmic; expensive on-chain. Field constraint: High two-adicity; extension for challenges. Choose it when: High-throughput server-side proving of large computations, especially zkVM execution, where a final wrapper handles settlement.

AIR or PLONKish arithmetisation committed with Reed–Solomon codewords and Merkle trees, with FRI as the low-degree test. No trusted setup, hash-based, plausibly post-quantum. The workhorse of large-scale transparent proving: StarkWare's Stone and Stwo, the Plonky2 and Plonky3 toolkits, RISC Zero, Miden and ZKsync Airbender are all instances of this family, differing mainly in field, hash and lookup argument.

**Strengths**

- No trusted setup; security reduces to hash collision resistance plus the FRI soundness analysis
- Plausibly post-quantum in the proving layer
- Small-field arithmetic gives excellent CPU and GPU throughput; Circle STARK constructions extend this to fields that FRI could not otherwise use
- Scales well to very large computations

**Tradeoffs**

- Proofs are tens to hundreds of kilobytes and verifiers are expensive, so a pairing-based wrapper is standard — which reintroduces a trusted setup and removes post-quantum security
- Security parameters are a dial, and deployed systems routinely ship 96–100 bits rather than 128
- Requires a field with high two-adicity and enough size, or an extension, for challenges
- Parameter tuning across rate, queries, grinding and decoding regime is easy to get wrong

**Choose it when:** High-throughput server-side proving of large computations, especially zkVM execution, where a final wrapper handles settlement.

Maintained by: Construction by Ben-Sasson, Bentov, Horesh and Riabzev (StarkWare, 2018). Implementations: Stone and Stwo (StarkWare), Plonky2 and Plonky3 (Polygon Zero lineage), RISC Zero, Miden, ZKsync Airbender (Matter Labs), Winterfell · Maturity: Heavily production · License: n/a (construction) · Source: https://eprint.iacr.org/2018/046

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-fri-based-starks)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| FRI-based STARKs | None | Tens to hundreds of KB | Impractical directly — wrapper is standard | Plausibly | Well-exercised | Heavily production |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-fri-based-starks)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| FRI-based STARKs | Small-field hashing and NTTs; the fastest bulk provers on CPU and GPU, and the basis of most zkVMs | Trace-proportional, but small fields keep it low; continuations bound it | Milliseconds to tens of milliseconds — hashing only | Stone and Stwo (StarkWare), Plonky3 (Polygon Zero lineage; beneath SP1 Turbo, OpenVM, Ziren, Pico), RISC Zero, Miden, ZKsync Airbender (Matter Labs), Winterfell | ethproofs.org real-time Ethereum block proving; a16z zkvm-benchmarks |

**In the commitment schemes — the layer that decides most of it** (https://zkpick.com/proof-systems/#proof-systems-matrix-3-fri)

| Scheme | Assumption | Setup | Opening size | Verifier cost | Field constraint |
| --- | --- | --- | --- | --- | --- |
| FRI | Hash (collision resistance) | None | Polylogarithmic but large in absolute terms | Polylogarithmic; expensive on-chain | High two-adicity; extension for challenges |