ZK / Privacy·EVM · Multi-chain
Noir
Noir is a Rust-like, backend-agnostic DSL for writing zero-knowledge circuits, originally developed by Aztec Labs. Programs compile to ACIR and are proven by a pluggable backend — Barretenberg (BB) by default — producing proofs that can be verified in Solidity, the browser, or other Noir programs via recursion.
- 01writing ZK circuits in a high-level language
- 02Solidity-verified application proofs
- 03browser/client-side proving via WASM
- 04recursive proof composition
- 05Aztec contract development
- curl -L https://raw.githubusercontent.com/noir-lang/noirup/main/install | bash
- noirup
- curl -L https://raw.githubusercontent.com/AztecProtocol/aztec-packages/next/barretenberg/bbup/install | bash
- bbup
- nargo new my_circuit
- pnpm add @noir-lang/noir_js @aztec/bb.js
Use Noir to author ZK circuits in `src/main.nr` and manage them with `nargo`. Run `nargo check` to generate a `Prover.toml` template, then `nargo execute` to produce a witness, and `bb prove -b ./target/<pkg>.json -w ./target/<pkg>.gz -o ./target/proof` to prove with the Barretenberg backend. Generate a Solidity verifier with `bb write_solidity_verifier -k ./target/vk -o ./target/Verifier.sol` and deploy it as the on-chain verifier. For client-side proving in a Next.js app, import `@noir-lang/noir_js` (`Noir`) and `@aztec/bb.js` (`UltraHonkBackend`), feed the compiled circuit JSON, and call `noir.execute(inputs)` then `backend.generateProof(witness)`.
- ⚑Noir and `bb` versions are tightly coupled — always use `bbup` to install the backend version that matches your `nargo --version`, otherwise proving fails with cryptic errors.
- ⚑Browser proving via `bb.js` needs WASM threads + COOP/COEP headers and several hundred MB of memory; mobile Safari often OOMs on non-trivial circuits.
- ⚑On-chain verification gas scales with public inputs and proving system (UltraHonk vs UltraPlonk vs Keccak Honk); benchmark before committing to a backend.
- ⚑The default UltraHonk backend uses no trusted setup, but the older Plonk path requires Aztec's universal CRS — pick the backend deliberately.
- ⚑Recursion has practical depth/aggregation limits; deeply recursive proofs blow up witness size and prover memory.