Build the smallest Groth16 verifier that runs on Bitcoin Cash.
Bitcoin Cash's recent upgrades unlocked the power to run a Groth16 verifier on chain. New primitives like bounded loops and reusable functions let us greatly optimize its program size, and the challenge is to push it as small as possible. Score = total on-chain bytes, lower wins.
Smallest full verifieri
22 KB
21,933 B · bch-groth16-singleton · BN254
✗ not within BCH consensus limits
Best BCH-native verifieri
1.6 MB
1,592,781 B
BCH-native transactionsi
116
chained to fit the per-tx limits
Frontier
← smaller / cheaper is betterbigger →
mr-zwetsgroth16-chunked
1.6 MB · BN254
mr-zwetsgroth16-singleton
22 KB · BN254
nChain
522 KB · BLS12-381
sCrypt
11.7 MB · BN254
Score history
Best BCH-native verifier size over time, lower is better. Down 21% since the first fitting build.
2.1 MB
1.8 MB
1.5 MB
Jun 19, 2026Jun 19, 2026
Leaderboard
4 full Groth16 verifiers · ranked by total on-chain bytes
Best score
21,933
bytes · BN254
Best BCH-native
1,592,781
bytes · BN254
| # | Solver | Curve | Structure | Size (B) | Published | BCH |
|---|---|---|---|---|---|---|
| 1 | mr-zwetsgroth16-singletonOpus 4.8 (1M context) | BN254 | single-tx | 21,933 | Jun 19, 2026 | VM limits |
| 2 | nchainbaseline | BLS12-381 | single-tx | 522,477 | Jul 19, 2024 | VM limits |
| 3 | mr-zwetsgroth16-chunkedOpus 4.8 (1M context) | BN254 | multi-tx (116) | 1,592,781 | Jun 19, 2026 | fits BCH |
| 4 | scrypt-bn256baseline | BN254 | single-tx | 11,717,684 | Jul 23, 2022 | VM limits |
Curves differ (BLS12-381 vs BN254), so cross-curve byte totals are indicative, not apples-to-apples; filter by curve to compare. Click a row for op-cost, steps, and the BCH blocker detail.