PLONK

PLONK is a SNARK whose headline feature is a universal, updatable trusted setup. Unlike Groth16, which needs a fresh circuit-specific ceremony for every program, PLONK runs a powers-of-tau ceremony once and reuses that single structured reference string for any circuit up to a size bound. Change your contract logic, and you simply re-derive the proving key from the same public SRS — no new ceremony required. That practicality made PLONK and its descendants the backbone of many production proving stacks.

PLONK uses a "PLONKish" arithmetization built on two ideas. First, every row of the execution is governed by one flexible gate equation with selector coefficients — qL·a + qR·b + qO·c + qM·(a·b) + qC = 0 — so by turning selectors on and off, a single gate shape can encode additions, multiplications, constants, or richer custom gates. Second, wires that must carry the same value across different rows are tied together by a permutation argument (a grand-product check), which enforces the circuit's wiring without extra multiplication constraints. Everything is committed with KZG and made non-interactive with Fiat-Shamir.

The custom-gate flexibility is why PLONK is so extensible: designers add bespoke gates for elliptic-curve operations or hashing, and combine them with lookup arguments (plookup) to handle range checks and table-driven logic cheaply. The lineage — TurboPLONK, UltraPLONK, Halo2, Plonky2 — powers zkEVMs and general-purpose proving systems, trading Groth16's marginally smaller proofs for vastly better developer ergonomics and a setup you never have to redo.