Nova excels at fast, incremental proof recursion by leveraging a folding scheme for R1CS constraints. This approach avoids the overhead of repeated SNARK verifications within the circuit, enabling linear-time recursion. For example, in benchmarks for proving SHA256 chains, Nova demonstrated recursion overheads of mere milliseconds per step, making it ideal for high-throughput state updates in applications like rollup provers or on-chain gaming.
LABS
Comparisons
Nova vs PLONK: Recursive Proofs
A technical comparison of Nova's folding scheme and PLONK's universal SNARK for recursive proofs, analyzing trade-offs in performance, cost, and developer experience for ZK rollup and Layer 2 architects.
Chainscore © 2026
introduction
THE ANALYSIS
Introduction: The Race for Efficient Recursion
A technical breakdown of Nova's incremental computation versus PLONK's universal circuit approach for recursive proof systems.
PLONK takes a different, more general approach by using a universal and updatable trusted setup to verify arbitrary circuits within a single SNARK. This strategy provides immense flexibility for complex, heterogeneous proof composition but introduces higher per-proof computational costs. The trade-off is generality for raw speed; PLONK-based systems like those used by zkEVMs (e.g., Scroll, Polygon zkEVM) can recursively verify entire block executions but with longer proving times measured in minutes.
The key trade-off: If your priority is ultra-low-latency recursion for homogeneous computations (like a verifiable state machine), choose Nova. If you prioritize flexibility to recursively verify diverse, complex logic within a single proof, choose a PLONK-based system. The decision hinges on whether you need specialized speed or general-purpose composability.
tldr-summary
NOVA VS PLONK
TL;DR: Core Differentiators
Key strengths and trade-offs for recursive proof systems at a glance.
01
NOVA: Unmatched Recursion Speed
Folding Scheme Efficiency: Nova uses a unique folding scheme to incrementally combine proofs, avoiding the overhead of full verification at each step. This results in ~10x faster recursion for long-running computations like proving state transitions in a zkVM. This matters for high-throughput L2s and on-chain gaming where proving latency is critical.
~10x
Faster Recursion
02
NOVA: Simpler, Non-Universal Setup
No Trusted Setup per Circuit: Nova's folding scheme relies on a single, circuit-agnostic Structured Reference String (SRS). This eliminates the need for a new trusted setup for each new program, simplifying deployment. This matters for rapid protocol iteration and teams wanting to avoid the ceremony overhead of PLONK.
03
PLONK: Battle-Tested & Universal
Industry Standard Verification: PLONK's verifier is a single, fixed circuit that can verify proofs for any program up to a bounded size. This universal setup (one-time ceremony) is now highly decentralized (e.g., Perpetual Powers of Tau). This matters for interoperability and mainnet deployments where security audits and tooling (Circom, halo2) are mature.
1000+
Audited Projects
04
PLONK: Superior Final Proof Compression
Optimal On-Chain Footprint: After recursive aggregation, a PLONK-based stack (e.g., using SnarkPack or a final Groth16 wrapper) can produce a single, constant-sized SNARK (~1 KB) for the entire computation. This matters for Ethereum L1 settlement where calldata costs dominate and final proof size is the ultimate bottleneck.
~1 KB
Final Proof Size
RECURSIVE PROOF SYSTEMS
Feature Comparison: Nova vs PLONK
Direct comparison of key technical metrics and design trade-offs for recursive proof systems.
| Metric | Nova (IVC) | PLONK (Universal) |
|---|---|---|
Primary Design Goal | Incrementally Verifiable Computation (IVC) | Universal, flexible circuit proving |
Recursion Overhead per Step | ~10ms (folding scheme) | ~2-5 seconds (full SNARK verification) |
Prover Memory for N Steps | O(1) (constant) | O(N) (linear) |
Trusted Setup Required | true (per circuit) | |
Succinct Final Proof | false (requires final SNARK wrap) | |
Primary Use Case | High-frequency state updates (e.g., rollups) | General-purpose ZK applications (e.g., zkEVMs) |
Notable Implementations | Lurk, RISC Zero, Jolt | Aztec, zkSync, Polygon zkEVM |
PERFORMANCE & COST BENCHMARKS
Nova vs PLONK: Recursive Proofs
Direct comparison of key technical metrics for recursive proof systems used in ZK-rollups and validity proofs.
| Metric | Nova (SNARK) | PLONK (SNARK) |
|---|---|---|
Proof Generation Time (1 iteration) | < 100 ms | ~2-5 seconds |
Recursive Overhead per Step | Constant (~10 ms) | Logarithmic (O(log n)) |
Primary Use Case | Incremental Computation (IVC) | General Circuit Verification |
Succinct Proof Size | ~1 KB | ~400-600 bytes |
Trusted Setup Required | ||
Major Adoption | RISC Zero, Lasso | Aztec, zkSync, Polygon zkEVM |
pros-cons-a
PROS AND CONS
Nova vs PLONK: Recursive Proofs
Key strengths and trade-offs for recursive proof systems at a glance. Choose based on your protocol's primary constraint: speed or flexibility.
01
Nova Pro: Unmatched Recursive Speed
Folding scheme efficiency: Nova's incremental computation (IVC) avoids repeated verification of the entire proof. This results in ~10x faster recursion than PLONK-based approaches for long-running computations like zkVM state transitions. This matters for high-throughput L2s like Scroll or applications needing real-time proof updates.
02
Nova Pro: Minimal On-Chain Footprint
Constant-size recursive verifier: The final recursive proof and verification key size remain constant, regardless of iteration count. This leads to lower gas costs for on-chain settlement (e.g., on Ethereum). This matters for protocols like Brevis coProcessors that frequently commit proofs to L1, where gas is the primary cost driver.
03
PLONK Pro: Universal Circuit Support
Single trusted setup for all circuits: PLONK's universal SNARK (e.g., via Aztec's barretenberg) allows one ceremony to support any circuit up to a fixed size. This enables rapid prototyping and upgrades without new trusted setups. This matters for evolving protocols like Polygon zkEVM that need to frequently update their circuit logic.
04
PLONK Pro: Rich Tooling & Ecosystem
Mature developer frameworks: PLONK is integrated into widely-used toolchains like Circom, halo2, and Noir. This provides extensive libraries, debugging tools, and auditor familiarity. This matters for teams prioritizing developer velocity and security, such as those building private DeFi with Aztec.
05
Nova Con: Specialized Circuit Design
Requires R1CS structure: Nova's folding scheme works natively with Rank-1 Constraint Systems (R1CS), which can be less intuitive for certain operations compared to PLONK's custom gates. This may increase initial development overhead for complex business logic. This is a trade-off for its speed advantage.
06
PLONK Con: Heavier Recursive Overhead
Verification cost scales with recursion: Each recursive step in a PLONK-based stack (e.g., using a SNARK verifier inside a circuit) adds significant proving time and size. This leads to diminishing returns for deep recursion, making it less ideal for applications like continuous proof aggregation in a zkRollup sequencer.
pros-cons-b
PROS AND CONS
Nova vs PLONK: Recursive Proofs
Key strengths and trade-offs at a glance for two leading recursive proof systems.
01
Nova's Core Strength
Incremental Verifiable Computation (IVC): Nova uses folding schemes to aggregate proofs iteratively, avoiding the need for a trusted setup. This makes it exceptionally efficient for long-running computations like proving state transitions in a blockchain or a zkVM.
02
Nova's Trade-off
Limited Proof Expressiveness: Nova's current implementations are optimized for a specific class of computations (e.g., R1CS). For complex, custom logic requiring high-degree constraints, you may need to wrap it in a less efficient circuit or use a different proving system as a final layer.
03
PLONK's Core Strength
Universal & Updatable Trusted Setup: PLONK's universal setup (e.g., Perpetual Powers of Tau) supports any circuit up to a bounded size. This flexibility is critical for protocols like zkSync Era and Aztec that deploy many diverse, complex smart contracts.
04
PLONK's Trade-off
Higher Per-Step Overhead for Recursion: While PLONK can be made recursive, each recursive step involves verifying a PLONK proof inside a circuit, which is computationally heavy. This makes deep, fast recursion more expensive than Nova's native folding approach.
CHOOSE YOUR PRIORITY
Decision Framework: When to Choose Which
Nova for Scalability\nVerdict: The premier choice for high-throughput, low-cost recursive applications.\nStrengths: Nova's folding scheme enables incremental verification, making it exceptionally efficient for long-running computations like state updates or proving blockchain history. It achieves O(1) recursion overhead, meaning proof size and verification time remain constant regardless of recursion depth. This is critical for building zk-rollups or zkVMs where you need to prove the execution of thousands of transactions.\nKey Metric: Ideal for applications requiring millions of state updates with minimal on-chain verification cost.\n\n### PLONK for Scalability\nVerdict: A robust, general-purpose alternative, but recursion is a secondary optimization.\nStrengths: PLONK's universal trusted setup and efficient polynomial commitments make it a versatile foundation. Recursion is achieved through proof composition (e.g., using cycles of curves like BN254 and Grumpkin), which adds complexity and overhead. While capable, its recursion is less native and more computationally intensive per step than Nova's folding.\nKey Metric: Best when you need a single proof system for both standalone and occasional recursive proofs, leveraging its extensive tooling (e.g., halo2 libraries).
verdict
THE ANALYSIS
Verdict: Strategic Recommendations
Choosing between Nova and PLONK for recursive proofs is a decision between specialized performance and universal flexibility.
Nova excels at high-throughput, incremental computation because it leverages folding schemes to avoid expensive SNARK verifications at each step. For example, in a recursive proving benchmark for a zkVM, Nova demonstrated the ability to generate proofs for 10,000 steps in under 2 seconds, significantly outperforming traditional SNARK recursion for long-running computations. Its design is optimal for stateful applications like on-chain games or zk-rollups that require continuous proving of incremental state updates.
PLONK takes a different approach by providing a universal, circuit-agnostic proof system. This results in greater flexibility for complex, one-off proofs but at the cost of higher per-proof overhead. PLONK's widespread adoption in ecosystems like Ethereum (via circuits for zkEVMs) and its support by major tooling (e.g., Circom, halo2) make it the de facto standard for applications requiring interoperability and proof composability across diverse, custom logic.
The key trade-off: If your priority is sheer proving speed and low cost for sequential, repetitive logic (e.g., a zkVM, a verifiable map-reduce), choose Nova. Its folding paradigm minimizes recursive overhead. If you prioritize flexibility, ecosystem support, and proving arbitrary, non-linear circuits (e.g., a custom DEX circuit, a privacy-preserving identity proof), choose PLONK. Its universal setup and robust toolchain are better suited for heterogeneous, standalone applications.
ENQUIRY
Build the
future.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall