> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/a16z/jolt/llms.txt
> Use this file to discover all available pages before exploring further.

# How Jolt Works

> High-level explanation of how Jolt zkVM proves RISC-V program execution

## Overview

Jolt is a zkVM (zero-knowledge virtual machine) for RISC-V that efficiently proves and verifies program execution. Unlike traditional zkVMs that use complex arithmetic circuits, Jolt leverages a fundamentally different approach: **lookup arguments**.

## Core Innovation: Just One Lookup Table

The name "Jolt" stands for **Just One Lookup Table**. This reflects the system's core innovation: proving CPU instruction execution by decomposing each operation into lookups against precomputed tables, rather than expressing everything as arithmetic constraints.

### Why Lookups?

Traditional zkVMs represent CPU instructions (like multiplication, bitwise operations, etc.) as large arithmetic circuits. This is inefficient because:

* Circuits for complex operations require many constraints
* Proof size and verification time grow with circuit complexity
* Adding new instructions requires designing new circuits

Jolt's lookup-based approach offers several advantages:

* **Simplicity**: Instructions decompose into table lookups rather than complex circuits
* **Speed**: Lookups are proven using efficient sumcheck protocols
* **Extensibility**: New instructions can be added by defining new lookup tables

## The Lookup Singularity: Lasso

Jolt builds on [Lasso](https://eprint.iacr.org/2023/1216), a breakthrough protocol for proving lookups in large tables. Lasso enables:

* **Sublinear proof size**: Proofs are much smaller than the lookup table itself
* **Fast proving**: The prover time scales with the number of lookups, not table size
* **Batch efficiency**: Multiple lookups can be proven together

This "lookup singularity" makes it practical to prove millions of instruction executions efficiently.

## Memory Checking: Twist and Shout

Beyond instruction execution, a zkVM must also prove correct memory and register behavior. Jolt uses [Twist and Shout](https://eprint.iacr.org/2025/105), a state-of-the-art memory checking protocol that:

* Proves all memory reads return previously written values
* Uses one-hot addressing for efficient encoding
* Supports incremental updates for register state
* Achieves 6x speedup over previous approaches

## Architecture Components

### RISC-V Support

Jolt currently supports the RV64IMAC instruction set:

* **RV64I**: 64-bit Base Integer Instruction Set
* **M Extension**: Integer Multiplication and Division
* **A Extension**: Atomic Operations
* **C Extension**: Compressed Instructions

This covers the core instructions needed for most general-purpose programs.

### Tracer (Emulator)

The **tracer** is a RISC-V emulator that:

* Executes the guest program (compiled as a RISC-V ELF binary)
* Records every instruction cycle with full CPU state
* Captures all memory and register accesses
* Produces an execution trace as input to the prover

The trace contains a `Cycle` struct for each instruction, recording the program counter, instruction opcode, register values, and memory operations.

### Cryptographic Primitives

Jolt combines several cryptographic building blocks:

* **Sumcheck protocol**: Interactive proof protocol reduced to non-interactive via Fiat-Shamir
* **Multilinear polynomial commitments**: Using [Dory](https://eprint.iacr.org/2020/1274) for transparent setup
* **BlindFold**: Zero-knowledge layer that hides witness values (optional)

### Polynomial Representation

All trace data is encoded as **multilinear polynomials** over the BN254 scalar field. Jolt uses specialized polynomial types:

* `DensePolynomial`: Full field elements for standard data
* `CompactPolynomial`: Small integers (u8-i128) promoted to field elements on-demand
* `RaPolynomial`: Lazy materialization for read-after addresses
* `SharedRaPolynomials`: Memory-efficient sharing of equality tables

## Standard vs Zero-Knowledge Mode

Jolt can operate in two modes:

### Standard Mode

* Proves correctness of execution
* Reveals sumcheck round polynomial coefficients
* Faster proving with smaller proofs
* Use case: Public computation verification

### Zero-Knowledge Mode (BlindFold)

* Proves correctness **without revealing** intermediate witness values
* Uses Pedersen commitments for sumcheck rounds
* Encodes verifier checks into R1CS proved via Nova folding
* Use case: Private computation with hidden inputs/execution

The mode is controlled via the `zk` feature flag at compile time.

## Performance Characteristics

### Proof Generation

Prover time is dominated by:

1. **Sumcheck inner loops**: Polynomial binding and evaluation
2. **Commitment generation**: Dory polynomial commitments
3. **Memory checking**: RAM and register read-write verification

### Proof Size

Proof size scales with:

* Number of sumcheck rounds (logarithmic in trace length)
* Number of committed polynomials
* Polynomial commitment openings

Typical proofs are a few hundred kilobytes for programs with millions of cycles.

### Verification

Verification is fast (milliseconds) because:

* Verifier only processes sumcheck challenges
* Polynomial commitments use succinct verification
* No need to re-execute the program

## Key Papers

Jolt is based on cutting-edge research:

* [Jolt: SNARKs for Virtual Machines via Lookups](https://eprint.iacr.org/2023/1217) - Core Jolt paper
* [Unlocking the lookup singularity with Lasso](https://eprint.iacr.org/2023/1216) - Lookup arguments
* [Twist and Shout](https://eprint.iacr.org/2025/105) - Fast memory checking
* [Proofs, Arguments, and Zero-Knowledge](https://people.cs.georgetown.edu/jthaler/ProofsArgsAndZK.pdf) - Background textbook