Fflonk (Fast PLONK with folded polynomial openings) is an optimization of the PLONK proof system introduced by Jordi Baylina and the Polygon zkEVM team, with formal analysis in a 2023 paper. The core innovation: instead of opening multiple KZG polynomial commitments separately (each requiring one pairing), Fflonk folds multiple polynomial evaluations into a single combined commitment that can be verified with fewer pairings. This reduces on-chain PLONK verification from approximately 3-4 pairings to 2 pairings, saving approximately 30% of the verification gas cost. Polygon zkEVM uses Fflonk as the final aggregation layer: sub-proofs from each batch are recursively aggregated into a single Fflonk proof that settles on Ethereum mainnet. The practical result: Polygon zkEVM achieves approximately 200,000-250,000 gas per L1 settlement proof — competitive with Groth16’s 200,000 gas while retaining PLONK’s universal setup flexibility. Fflonk represents the engineering optimization mindset of the Polygon zkEVM team, targeting gas cost as the primary production metric.
The Folding Optimization
Standard PLONK verification:
- Open n polynomial commitments → n pairing operations
- Each Ethereum pairing: ~100,000 gas
- PLONK: 3+ pairings → 300,000+ gas
Fflonk folding:
- Combine multiple polynomial evaluations: f_combined(x) = f₁(x) + r·f₂(x) + r²·f₃(x) + …
- Commit to combined polynomial once
- Open combined polynomial at single point → 2 pairings total
- Gas reduction: ~30% vs. standard PLONK
Soundness preservation: The folding uses random linear combinations — if any individual polynomial is malformed, the combined polynomial evaluation fails with overwhelming probability (by Schwartz-Zippel lemma).
Polygon zkEVM Architecture
Fflonk sits at the top of Polygon zkEVM’s proving stack:
“`
Transaction batch
↓
Polynomial Identity Language (PIL) arithmetization
↓
Sub-proofs per execution component (EVM state, Keccak, memory)
↓
Recursive proof aggregation
↓
Single Fflonk proof
↓
Ethereum L1 verification (~200K gas)
“`
Comparison to Other zkEVM Verifiers
| System | Proof System | L1 Verify Gas | Setup |
|---|---|---|---|
| Polygon zkEVM | Fflonk | ~200K | Universal |
| zkSync Era | Boojum (PLONK-based) | ~400K | Universal |
| Scroll | Halo2 | ~600K | None |
| StarkNet | STARK | ~5M | None |
PIL: Polynomial Identity Language
Polygon zkEVM’s custom arithmetization language that generates the sub-circuits Fflonk aggregates:
- PIL defines polynomial constraints for each EVM component
- Separate PIL modules: EVM main, memory, storage, Keccak, elliptic curve operations
- Compiled to PLONK-compatible format → aggregated via Fflonk
Related Terms
Sources
- “Fflonk: A Fast-Verification zkSNARK” — Gabizon, Baylina (2023). The formal academic paper for Fflonk — introducing the folded polynomial commitment scheme, proving soundness and completeness, and demonstrating 35% gas reduction vs. standard PLONK.G, …, [fₙ(τ)]G and evaluation points z₁, …, zₙ, define combined polynomial F(X) = Σᵢ rⁱ fᵢ(X) / (X – zᵢ) for random challenge r; the combined quotient polynomial W(X) = sum over all openings; commit to W → verify entire batch of openings with 2 pairings; soundness reduction: if any individual opening is incorrect, combined polynomial malformed → Schwartz-Zippel ensures failure detected; gas model: standard PLONK needs 3 pairings (proving key, public inputs, proof elements) → Fflonk reduces to 2 core pairings → EVM gas: 3 × 100K → 2 × 100K = ~100K gas savings per proof; benchmark comparison: standard PLONK verifier: 300,000 gas; Fflonk verifier: 200,000 gas; Groth16 verifier: 200,000 gas; Fflonk achieves Groth16-level verification efficiency with universal SRS (no per-circuit trust ceremony); tradeoff: Fflonk proof is slightly larger than PLONK (~550 bytes vs. 500 bytes) due to additional commitment for combined polynomial; proving time: approximately same as PLONK; primary application: Polygon zkEVM’s final aggregation layer where gas cost is the primary constraint.]
- “Polygon zkEVM Architecture: Proving the EVM with Polynomial Identity Language” — Polygon (2023). Technical documentation of Polygon zkEVM’s complete proving stack — covering PIL arithmetization, sub-proof generation per EVM component, recursive aggregation, and Fflonk L1 settlement.
- “KZG Polynomial Commitments: The Core of PLONK and Fflonk” — Dankrad Feist / Ethereum Research (2022). Detailed explanation of KZG polynomial commitments — the cryptographic primitive underlying PLONK and Fflonk, and their broader use in Ethereum’s EIP-4844 blob commitments.G (scalar multiplication of generator G by f evaluated at the secret s from ceremony); opening at point z: reveal y = f(z) and proof π = [(f(s) – f(z))/(s – z)]G (quotient polynomial evaluation); verification: e([f(s)]G – [f(z)]G, G) = e(π, [s]G – [z]G); check passes because of pairing bilinearity; batch opening optimization: to open m polynomials at m points: (1) generate random challenge r; (2) compute combined evaluation h(x) = Σ rⁱ fᵢ(x); (3) single proof for combined polynomial; (4) 2 pairings for batch check (this is exactly Fflonk); EIP-4844 application: blobs use KZG commitments to commit to 4096 field elements (blob data); proof of correctness: validators can check any element value via KZG opening; distributed reconstruction: nodes store partial blob data and proofs can verify any subset; KZG limitations: trusted setup required (toxic waste risk); pairing-based (quantum-vulnerable); proof size: O(1) — constant regardless of polynomial degree; comparison: IPA alternative (Halo2) has O(log n) proof size and O(log n) verify but no trusted setup; practical recommendation: KZG for maximum efficiency with accepted trusted setup; IPA for maximum trustlessness.]
- “Recursive Proof Aggregation in Production zkRollups” — Polygon Zero / Plonky2 Team (2022). Technical examination of recursive proof systems used in production zkRollups — comparing Polygon’s Fflonk-based aggregation, StarkWare’s SHARP recursive STARK, and Polygon Zero’s Plonky2 recursive PLONK.
- “Gas Market Analysis: zkRollup Settlement Costs and Batch Economics” — L2Beat / Dune Analytics (2023). Data analysis of actual L1 settlement gas costs for production zkRollups — measuring cost-per-transaction amortized across batch sizes and comparing Fflonk-based Polygon zkEVM to other ZK L2s.