Chain-state proof · connecting…

Bitcoin consensus, proven with Core's own code. Verify one small proof.

Hazync runs Bitcoin Core's own unmodified consensus code inside a zero-knowledge VM, script by script, signature by signature, and folds it into a single succinct proof. Not a reimplementation. The exact code the network already trusts.

The difference

Everyone else reimplements consensus. We don't.

Every prior effort expresses Bitcoin's rules in a circuit language, and inherits one question forever: does the reimplementation match Core in every edge case? Low-S, the SIGHASH_SINGLE bug, MINIMALIF, the exact sigop accounting, taproot's annex, the CVE-2012-2459 merkle malleability, miss one and the proof attests the wrong thing.

Hazync compiles Bitcoin Core v28's real interpreter.cpp, SignatureHash, and libsecp256k1 to RISC-V and proves those, two narrow portability shims, zero consensus-logic changes. Bitcoin has no separate spec: Core is the reference.

How it works

Validate once. Prove it. Verify forever.

The whole point is the separation, validate ≠ prove ≠ verify. Proving is expensive and done by a few; verifying is cheap and done by everyone.

01 · witness

The real block

A block plus an inclusion proof for every coin it spends.

header · txs · Utreexo proofs
from any archive node
02 · prove

Run real Core code

The guest executes Bitcoin Core's own consensus code and emits a STARK.

VerifyScript · SignatureHash
libsecp256k1 · UTXO transition
03 · fold

Compose the chain

Each block proof folds into the running chain proof, genesis to tip.

recursion · log-depth
parallel range-fold
04 · verify

Check one proof

Every node verifies a single receipt, no re-execution, no peers.

milliseconds
every node, cheap
The fold · genesis → tip

Prove a block's transactions with real Core code, then fold it onto the running chain proof, genesis to tip. The single proof grows one block at a time; blocks prove independently, so the party splits the work by height.

Anatomy of a proof
tip_hashthe chain's head
utxo_rootUtreexo commitment
cum_worktotal proof-of-work
heightblocks proven

A verified receipt commits exactly this ChainState, and nothing else can produce it. Checked in milliseconds; SNARK-wrappable to a few hundred bytes, to verify anywhere.

Live · Proof Party

Claim a block. Prove it. Put your name on Bitcoin’s history.

Every proof is verified by the coordinator, nobody can fake it, chained onto the genesis-anchored frontier, and credited to you on an open, signed ledger. Take a single block or a range, prove it on your GPU, and submit.

Board temporarily unavailable — reconnecting to the coordinator. Numbers will reappear once it responds.
Proof frontier,
◂ genesis · 0, tip
Timeline · genesis → tip,
frontier (verified + chained from genesis) proven ahead (out of order) in progress open

Choose a block to prove

◂ genesistip ▸
Claim · block ,
# claim it, prove on your GPU, submit, signed with your key, in one command
$ hazync run , 
the coordinator verifies your signature + the STARK receipt, then credits it to you

Leaderboard

signed ledger
Every contribution is signed by the prover's key and recorded in an open ledger, verifiable, and no chain spam. = signature checked.

Recently verified

live

What it proves

Every consensus rule, on real mainnet blocks.

Enforced with real Core code, each demonstrated on actual mainnet data.

Script validity, all types & per-height flagsinterpreter.cpp
ECDSA + Schnorr signatures, real sighashlibsecp256k1
CheckTransaction + no inflation (Σin ≥ Σout, subsidy)tx_check.cpp
Proof-of-work + difficulty retargetarith_uint256
Merkle root incl. CVE-2012-2459 mutationmerkle.cpp
Block weight ≤ 4M · sigop cost ≤ 80kBIP141
Witness commitment · BIP34 · BIP30soft forks
Coinbase maturity · absolute + relative locktime (BIP68, real MTP)time rules
time-too-old (block time > median of prev 11)header
UTXO transition , inclusion, delete, insertUtreexo

Proven on real data

Real STARK receipts, real mainnet blocks.

Not execute-mode traces, cryptographic proofs a verifier can check, generated on GPU.

Block 170

The first Bitcoin transaction

Satoshi → Hal. Full consensus validity, end-to-end, as a verified STARK receipt.

~9.4s a comparable block on one L40S
Block 741000

SegWit + Taproot, at scale

A modern block with key-path and script-path taproot spends, proven whole.

670 inputs·394 UTXO leaves
Genesis → 550

A folded chain proof

Every block linked into one recursive proof; parallel range-fold verified.

tip 75a5ad37…·555 leaves
Block 958250

A real 90-day time-lock

A live Taproot CSV spend, validated with real median-time-past, matching mainnet.

coin 90.2d old·VALID, as accepted

What a proof can't cover

By design, not omission.

The interesting objections live at the trust boundary. Stated up front, a proof is only as honest as its edges.

, The 2-hour future-time limitDepends on a node's wall-clock, not the chain. Not a provable rule, deliberately excluded. (The chain-side time-too-old half is enforced.)
, Data availabilityThe proof attests validity given the block's transactions; they're bound to the header, but the proof is not the data.
, The anchorGenesis is unconditional; any later checkpoint is a documented trust input.
, Cryptographic assumptionsRISC0/STARK soundness, SHA-256, secp256k1, and the recursion self-reference, hardened and argued in writing.

Self-audited, adversarially, eight rounds

Every finding fixed, validated, and negative-tested.

Eight rounds of hostile self-review, each one attacking the fixes from the round before, until a round turned up nothing. The serious ones assumed a prover who can mine: downgrading a block's height to switch every soft-fork off and mint a 50 BTC subsidy, and inflating the fee on a multi-input transaction toward 21M BTC. Both are closed, alongside the segmented-proof binding, the recursion image-id, and the coordinator's cross-range seam. Every fix ships with a negative test that rejects the bad case, and a replayable suite runs them all. The full list, round by round, is in SECURITY.md.

honest [A,B,C]cacd895c…a0f3f5e6merkle_ok
malleated [A,B,C,C]cacd895c…a0f3f5e6REJECTED · mutated

CVE-2012-2459, identical merkle root, caught and rejected on the mutation flag.

Run it

Check a proof yourself, no build, no GPU.

Every proof on the board is public and reproducible. Grab the prebuilt verifier, it's the canonical guest, the same code that made the proofs, download any proven block, and check it against real Bitcoin Core consensus. Any Linux x86-64 box, no GPU, no toolchain.

bash · verify a proof
# 1 · get the prebuilt verifier (no build)
$ curl -L -o host https://github.com/bitcoin-ghost/hazync/releases/latest/download/hazync-host-x86_64-linux-gnu
$ chmod +x host

# 2 · download a proof by block number and verify it
$ curl https://bitcoinghost.org/hazync/api/proof/1 -o proof.bin
$ ./host verify-any proof.bin        # → RANGE-OK

# 3 · confirm the binary IS the canonical guest — the id you're verifying against
#     (reproducible byte-for-byte via reproduce/Dockerfile)
$ ./host method-id
36a0415d5763ed62e71c44915d36caa34ae840cfd1051587bce1de27be0dd7f5

Want to prove blocks? Grab the CUDA prover binary (NVIDIA GPU + CUDA 12.6) and join the Proof Party; full steps in CONTRIBUTING. Building from source or reproducing the image id is in the repository; the tagged release is v0.7.2.

Beyond one node

One proof, useful to everyone.

The proof is not tied to any single node. Because it attests real Bitcoin Core consensus, anyone can verify it and anyone can build on it. Every proof the party produces is public, so the whole ecosystem leans on the same work instead of repeating it.

Light clients and wallets

A phone can confirm the chain is fully valid without downloading it or trusting a server. Full-node security in your pocket.

Trustless bridges

A contract on another chain can check a Bitcoin proof and trust Bitcoin's state directly. No federation, no multisig, no watchtowers.

Layer 2 and rollups

An L2 can anchor to Bitcoin and prove settlement with one succinct receipt instead of running a full node of its own.

Any node, any client

Not only this one. Any Bitcoin implementation can verify a proof instead of re-executing history, and sync in seconds.

Prove a block once. Everyone who needs to trust it can check the proof in milliseconds, for good.

Bitcoin Ghost · planned

Full-node security. None of the spam.

Bitcoin Ghost will run hazed nodes. Once a block's validity proof exists and it's past the re-org window, its raw data can be dropped. You keep the proof and the UTXO commitment, and you are still fully validated. Because the proof already checked every consensus rule, your node trusts the proof, not the bytes.

Full consensus security

Every rule, scripts, signatures, no-inflation, PoW, the lot, was proven. No trust in peers, no assumevalid.

No forced data retention

Inscriptions, images, arbitrary payloads never have to touch your disk. A hazed node keeps the proof and the UTXO set, not the megabytes of witness spam.

Full usage preserved

The data stays available from archive nodes for anyone who wants it. Storing and serving it becomes a choice, not a requirement for full-node security.

The proof is the state

The chain proof plus the UTXO root is the exact valid state. You don't need the history to know it's correct, so you don't have to carry it.

You decide what your node stores. The proof decides what it validates. For the first time, those are two separate questions.

Bitcoin Ghost · planned

Verify one proof. Skip re-executing history.

Bitcoin Ghost nodes will sync from a single proof. A new node today re-executes ~16 years of blocks, hundreds of gigabytes, hours to days, every byte of inscription spam included. With a Hazync + hazed archive, it fetches headers, verifies one chain-tip proof, and validates only the short unproven tail.

Today · full IBD
~600 GB downloaded · hours to days · every script re-run · all spam stored
With Hazync
one proof verified in seconds + a bounded tail · UTXO accumulator only · spam optional

Same full-consensus security as replaying the chain yourself, because the proof is that replay, done once and checked by everyone. The tail you validate live is only as long as the proving lag.

How to help

The method is built. Now it needs eyes and compute.

A research prototype, demonstrated end-to-end on real data, not yet externally audited. That's exactly why the code is open: real Core code invites real scrutiny.

01 · review

Try to make it lie

The valuable finding is a case where a Hazync proof says valid for something Core rejects. SECURITY.md maps the soft spots, the accumulator, the recursion binding, the metadata plumbing. Reproduce in ~25 min.

02 · compute

Prove a slice of history

Genesis→tip is GPU-hours the parallel backfill is built to absorb, thousands of independent block proofs, folded log-depth. Pick a block on the Proof Party board and put your name on it. A community effort to prove Bitcoin's whole history, once.