Off-chain proof.
One on-chain check.
Warren proves a rule over a dataset off-chain, chunk by chunk, in parallel. Every chunk proof folds into one. Soroban checks that single proof on-chain. The result is trusted because the math was checked, not because anyone was.
Three steps, one proof
The dataset never touches the chain. Only the root does.
Prove in parallel
Each chunk of the dataset gets its own proof, off-chain, across cores. nargo and bb generate an UltraHonk proof per chunk against your rule.
Fold into one
Chunk proofs fold pairwise up a binary tree. Every level recursively verifies its two children and outputs a single proof. N chunks become one root.
Verify once, on-chain
Soroban checks the root proof. An ed25519 signature controls who may submit; the proof controls whether the batch is correct.
The economics of one proof
97.8% of a transaction.
Once.
That is the instruction budget one aggregate proof spends on Soroban, measured, and it does not grow with the batch. Sixteen items or a thousand and twenty-four, the on-chain check costs the same. Verifying each proof separately would need its own transaction, every time.
Aggregation time as a multiple of chunk-proving time, measured on a 20-core box, chunk_size=8. Aggregation runs off-chain and asynchronously, so this ratio never reaches the chain — it costs wall-clock minutes on the prover's own hardware, not transaction budget. bash bench/reproduce.sh
Three commands
Write your rule, then test, bench, and prove it. No proving harness to hand-roll.
$ warren test --input data.json
# runs your rule at native speed, no proving. reports which item failed which check.
$ warren bench --input data.json
# measures circuit size and proving time before you commit to a shape.
$ warren prove --input data.json --submit --batch-id 1 \
--contract C... --network testnet
# chunks the dataset, proves every chunk in parallel, folds the tree, submits the root.Get it
Three crates, dependency order doesn't matter to you, only to cargo.