recursive proofs

Recursive proofs are proofs about proofs. Instead of only proving "this computation was correct," a recursive proof can prove "I verified another valid proof." That self-referential trick unlocks two superpowers: aggregation (combine thousands of separate proofs into one small proof that attests to all of them) and incrementally verifiable computation, or IVC (prove a long-running process step by step, where each step's proof also vouches for all prior steps, so the final proof certifies the entire history in constant size).

The technical obstacle is that verifying a proof is itself a computation, and to prove you ran the verifier you must express the verifier as a circuit — but the verifier does arithmetic over one field while the proof lives over another, creating a field mismatch. The classic fix is a cycle of elliptic curves (such as the Pasta curves Pallas and Vesta, or the older MNT4/MNT6 pair), where each curve's scalar field is the other's base field, so two proof systems can verify each other in a loop. A newer approach, folding schemes like Nova, sidesteps full in-circuit verification by cheaply "folding" two instances into one and deferring the heavy proof to the very end, making each recursive step far cheaper.

Recursion is what lets ZK rollups scale economically. Provers generate many small proofs for batches of transactions in parallel, then recursively aggregate them into a single proof that the on-chain verifier checks just once — amortizing verification cost across enormous workloads. It also enables proof "wrapping," where a large transparent STARK is proven correct inside a small SNARK so that only the compact SNARK ever touches the chain.