← → Print all
01 — Proof system · Proof system

Nova, SuperNova and HyperNova

Folding schemes / IVC

In one paragraph

Nova, SuperNova and HyperNova: Folding schemes / IVC. Setup: None in the folding layer. Proof size: Accumulator, not a proof — needs final compression. On-chain verification: Via the compressing SNARK only. PQ: No. Recursion: This is the whole point. Maturity: Research to early production. Prover cost profile: Two MSMs per step — the cheapest incremental step known. Peak prover memory: Bounded by one step plus the accumulator. Off-chain verifier: Only after final compression. Implementations and maintainers: Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer). Where it is measured: Repository benchmarks only; no neutral suite. Choose it when: Long, repetitive computations and memory-constrained provers, where the final compression step happens once.

By MarketComp Updated v1.3 About the authors Changelog
Setup
None in the folding layer
Proof size
Accumulator, not a proof — needs final compression
On-chain verification
Via the compressing SNARK only
PQ
No
Recursion
This is the whole point
Maturity
Research to early production
Selection matrix · as Nova / folding schemes · see the row in context
Prover cost profile
Two MSMs per step — the cheapest incremental step known
Peak prover memory
Bounded by one step plus the accumulator
Off-chain verifier
Only after final compression
Implementations and maintainers
Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer)
Where it is measured
Repository benchmarks only; no neutral suite
Prover profile · as Nova / folding schemes · see the row in context

What it is

Folding reduces checking two instances of a relation to checking one, so each step of a long computation costs a couple of multi-scalar multiplications rather than an in-circuit SNARK verification. Variants add non-uniform steps and generalised constraint systems.

Strengths and tradeoffs

Strengths
  • The lowest known per-step recursion overhead for long, near-uniform computations
  • Memory-friendly: proving is incremental, so peak memory tracks one step rather than the whole trace
  • No trusted setup in the folding layer itself
  • Non-uniform variants avoid paying for the union of all instructions at every step
Tradeoffs
  • Folding produces an accumulator, not a succinct proof — a final compressing SNARK is still required, and its cost is often omitted from benchmarks
  • Not post-quantum: security rests on discrete log in the commitment scheme
  • Real soundness pitfalls have been published in cycle-of-curves constructions — this is subtle territory
  • Implementation maturity trails the pairing-based and FRI families

Choose it whenLong, repetitive computations and memory-constrained provers, where the final compression step happens once.

Maintained implementations

Nova by Kothapalli, Setty and Tzialla (Microsoft Research, 2021); SuperNova and HyperNova from the same lineage. Implementations: Nova (Microsoft Research), Sonobe (Ethereum Foundation lineage), arecibo (Argument Computer)

Maturity: Research to early production · License: n/a (construction) · eprint.iacr.org ↗

How to decide
Other proof systems in §01
Groth16PLONK and the PLONKish familyFRI-based STARKsHalo2 with IPA, and Halo2 with KZGBinius and binary-field systemsSTIR and WHIRGKR-based systemsSpartanBulletproofsLookup arguments: Plookup, LogUp, cq, Lasso/Shout/Twist

Sources cited on this page · 1

  1. Nova — recursive zero-knowledge arguments from folding schemespaper

All 40 sources for §01 are listed on the section page →

Cite this page 
MarketComp (2026). Nova, SuperNova and HyperNova. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/proof-systems/nova-folding/
@misc{zkfieldmanual-nova-supernova-and-hypernova,
  title        = {Nova, SuperNova and HyperNova — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/proof-systems/nova-folding/}},
  note         = {Accessed: YYYY-MM-DD}
}