Circom

Circom allows developers to define circuits using a declarative syntax that describes what constraints must be satisfied rather than how to enforce them. This approach mirrors hardware description languages like Verilog.

• Signals represent wire values in the circuit
• Components encapsulate reusable circuit logic
• Templates define parameterized circuit blueprints
• The compiler automatically generates the Rank-1 Constraint System (R1CS) from high-level descriptions

Example: A simple constraint a * b === c defines a multiplication gate where the product of signals a and b must equal signal c.

Circom separates witness computation from constraint definition, a critical architectural distinction for zero-knowledge proofs. The compiler produces two distinct artifacts:

• Constraint system: Defines the mathematical relationships that must hold
• Witness generator: A WebAssembly or C++ program that computes intermediate signal values given inputs

This separation ensures the prover can efficiently compute the witness without executing the full constraint system during proof generation. The witness represents a valid assignment to all signals that satisfies every constraint in the circuit.

Circom integrates with multiple proving backends through the snarkjs library, supporting the most widely deployed ZK-SNARK protocols:

• Groth16: Produces the smallest proof sizes (~128 bytes) with constant verification time, ideal for on-chain verification where gas costs dominate
• PLONK: Supports universal trusted setups, enabling multiple circuits to share a single setup ceremony
• FFLONK: A variant of PLONK with improved prover performance

The compiler outputs an R1CS file that snarkjs consumes to perform the trusted setup, generate proofs, and verify them. This modular architecture allows developers to switch proving systems without rewriting circuit logic.

Circom provides explicit signal visibility modifiers that enforce privacy boundaries at the language level:

• Private signals: Known only to the prover, never revealed in the proof
• Public signals: Included in the proof output and visible to verifiers
• Input/Output declarations: Explicitly define the circuit's public interface

The compiler enforces that private signals cannot leak into public outputs through constraint violations. This language-level privacy enforcement prevents a common class of bugs where secret data accidentally becomes part of the verifiable proof output, ensuring the zero-knowledge property is maintained by construction.

Circom operates natively over prime fields, specifically the scalar field of the BN254 curve (also known as BN128 or alt_bn128) by default. This design choice has critical implications:

• All arithmetic is modular arithmetic modulo a 254-bit prime
• Operations are optimized for the native field used by Ethereum's precompiled contracts
• Non-native arithmetic for other fields requires explicit bit-decomposition circuits
• The compiler performs constant folding and linear constraint reduction to minimize constraint count

Understanding the field arithmetic is essential for writing efficient circuits, as operations that are cheap in standard programming (like division) require explicit modular inverse computation in the constraint system.

Circom circuits enable users to prove attributes about themselves without revealing the underlying data. A user can prove they are over 18, possess a valid passport, or are a member of a DAO without exposing their birth date, passport number, or wallet address.

• Anonymous credentials: Prove membership in a group using Merkle tree inclusion proofs
• KYC/AML compliance: Satisfy regulatory checks while preserving customer privacy
• Sybil resistance: Prove unique personhood without linking to a real-world identity
• Verifiable credentials: W3C-compliant attestations with ZK-enhanced privacy

Circom is the primary language for building the validity proof circuits that power ZK-Rollups. These circuits prove that thousands of off-chain transactions were executed correctly, allowing the Layer 1 blockchain to verify a single constant-size proof instead of every individual transaction.

• Transaction batching: Prove correct execution of 1000+ transfers in one proof
• Account state transitions: Verify Merkle tree updates for account balances
• Signature verification: Batch-validate ECDSA or EdDSA signatures inside circuits
• EVM equivalence: Implement opcode-level execution traces for zkEVMs

Circom circuits enable on-chain voting systems where ballot secrecy is cryptographically guaranteed while maintaining public verifiability of the final tally. Voters prove their eligibility and that their vote is valid without linking their identity to their choice.

• Quadratic voting: Weight votes by conviction without revealing individual preferences
• MACI (Minimal Anti-Collusion Infrastructure): Prevent bribery and collusion in decentralized governance
• Ranked-choice voting: Encode preference ordering in ZK-friendly formats
• Anonymous DAO proposals: Submit and vote on proposals with privacy guarantees

Circom circuits can encode the forward pass of neural networks, enabling zkML applications where a prover demonstrates that a specific model produced a given output without revealing the model weights or input data. This is critical for privacy-preserving AI services.

• Model integrity: Prove a prediction came from the advertised model architecture
• Private inference: Run ML on encrypted user data with verifiable results
• On-chain AI oracles: Deliver trustless model outputs to smart contracts
• Benchmark circuits: Implement matrix multiplication, ReLU, and softmax in R1CS

Circom powers privacy-preserving reputation systems where users can prove their trustworthiness or creditworthiness without exposing their full transaction history. This enables composable, portable reputation across platforms.

• Credit scoring: Prove credit score exceeds a threshold without revealing the exact number
• Social graph proofs: Demonstrate connection to trusted entities via graph traversal
• Reputation aggregation: Combine scores from multiple sources into a single ZK proof
• Anti-sybil attestations: Prove unique identity across platforms without cross-referencing

Circom circuits enable financial transactions where amounts and counterparties remain hidden while still satisfying regulatory reporting requirements. This balances privacy with the need for auditability in enterprise finance.

• Confidential transfers: Hide sender, receiver, and amount using Pedersen commitments
• Range proofs: Prove a transaction amount falls within acceptable bounds without revealing it
• Tax compliance: Generate aggregate reports without exposing individual transactions
• Solvency proofs: Prove an exchange holds sufficient reserves without revealing wallet addresses