MIST.cash paper makes recursive Groth16 proofs 38% cheaper

The MIST.cash team announced that recursive Groth16 proofs are now ~38% cheaper to prove, after their paper "Pairing Proofs and Polynomial Ring Toolkit" by Shrameet Shantz was accepted at CHES 2027 (TCHES). The announcement was amplified by the Ethereum account on X on October 26.

The polynomial-ring approach verifies a BN254 or BLS12-381 Groth16 proof inside a BN254 circuit with a single generic verifier circuit for both curves. It takes roughly 38% (BN254) and 31% (BLS12-381) fewer R1CS constraints than gnark's own pairing — at the cost of two extra verifier pairings.

• Open-source implementation (polyring) is unaudited and intended for research/testnet use only
• ~34–44% less witness solve time than gnark's pairing, per the team's benchmarks