zk-SNARK Verification and Batch Verification

[arcadiaarb]

In shielded pools (Sapling, Orchard) Zcash uses zk-SNARKs to prove correctness of a transaction without revealing values/addresses.
For example, in Sapling the proof system is based on Groth16 over a bilinear pairing-friendly elliptic curve. The verifier checks an equation of the form
ē(a,b)  =  ē(α,β)⋅∏i=1ne(Ci,Di)e(a,b)=e(α,β)⋅i=1∏n​e(Ci​,Di​)
where ē denotes pairing, a,ba,b are proof elements, the RHS uses public inputs and verification keys etc. (this is simplified). Zebrad’s consensus module must validate each proof.

Because verifying each proof individually is expensive, Zebrad supports batch verification: grouping many proofs/signatures together and verifying them as one unit, amortizing cost.
According to the ZF article:
“Zebra’s verification pipeline … approximately 3× speedup for a full Zcash chain sync.” ZKProof Standards
In pseudo-math: If individual verification cost = CC, then verifying mm items individually costs
m⋅Cm⋅C. With batch,
cost ≈ C+ϵ(m)C+ϵ(m) → much less than m⋅Cm⋅C.

Batch verification uses futures (Rust) and Tower services to collect items into a batch, then execute batch verification, and on failure fall back to individual verification. ZKProof Standards