The Kaspa ZK SDK turns OpZkPrecompile from a raw stack interface into a staged script-building workflow for RISC Zero proofs. Rusty-kaspa PR #953 added native Rust and WebAssembly helpers that construct P2SH locking and spending scripts for Groth16 or Succinct receipts, while keeping proof generation and application design off-chain.

Key takeaways

• Rusty-kaspa PR #953 added a dedicated kaspa-txscript-zk-sdk crate and exposed it through the Wasm SDK.
• The final public API exports ZkScriptBuilder, staged R0 builder types, proof-preparation helpers and verifier-fragment helpers.
• The workflow separates a redeem script that locks a UTXO from a signature script that supplies the proof when spending.
• KIP-16 assigns tag 0x20 to Groth16 and 0x21 to RISC0-Succinct verification.
• The SDK reduces stack-layout mistakes; it does not generate a correct program, audit a circuit or make every proof system safe.
• Developers should start on a devnet, pin exact versions and test both valid and deliberately invalid receipts.

What problem does the Kaspa ZK SDK solve?

KIP-16 defines OpZkPrecompile as a generic script opcode that dispatches to a supported verifier using a tag and a proof-system-specific stack layout. That interface is flexible, but raw script construction demands detailed knowledge of byte encoding, argument order, the program image, public journal data, proof material and P2SH spending rules.

PR #953 describes the practical problem as a knowledge barrier for UTXO-based ZK systems. A caller cannot safely “just invoke” the opcode. The locking script must commit to the expected verification conditions, while the later spending script must place the correct witness elements on the stack in exactly the form the verifier expects.

The SDK wraps ScriptBuilder and exposes higher-level operations. Its goal is not to hide the UTXO model; it is to encode the required sequence so application teams do not repeatedly hand-roll consensus-sensitive boilerplate.

How does the commit-and-finalize workflow work?

The pull request documents a typestate progression: an unbounded builder commits to either a Groth16 or Succinct verification configuration, becomes bounded to that choice, and then finalizes with a compatible proof. The final result contains a redeem script and a signature script.

Conceptually, the flow is:

1. Create a ZkScriptBuilder for the RISC Zero family with covenant-capable engine flags.
2. Commit to Groth16 using the expected program image, or to Succinct using its image ID, control ID and supported hash-function identifier.
3. Drain or hash the redeem script into a pay-to-script-hash address.
4. Fund that P2SH address with a normal signed transaction.
5. Produce the program receipt and public journal off-chain.
6. Finalize or push the prepared proof witness into the spending signature script.
7. Build a version-1 redemption transaction with an appropriate compute budget.
8. Submit it to a compatible node and handle rejection as a normal validation result.

This is a commit/reveal pattern in the P2SH sense: the first transaction locks value to a hash of the redeem script; the spending transaction reveals the script and the proof witness needed to satisfy it. The PR includes native and JavaScript examples for both the staged builder and lower-level “split” helpers.

What are the Groth16 and Succinct paths?

The Groth16 path is compact. KIP-16 describes tag 0x20 as an Arkworks Groth16 verifier on BN254. Its proof and verifying material attest to public inputs or the RISC Zero execution claim. The proposal also states an explicit limitation: Groth16 on this curve is not quantum-safe.

The RISC0-Succinct path uses tag 0x21 and verifies a STARK-based succinct receipt. KIP-16 describes this option as offering post-quantum security properties at the cost of a larger witness. The SDK handles receipt-derived components such as the claim, control index, control digests and seal, while the application supplies the program image and journal relationship required by its design.

Both paths must bind the proof to the intended computation. A proof that some valid program ran is not enough if the contract expected a particular image and particular public output. The SDK’s fixed-journal and dynamic-journal variants let developers choose whether a journal value is committed into the redeem script or supplied later, but that choice changes the covenant’s semantics and must be reviewed deliberately.

Which API surface did PR #953 add?

The final crate exports ZkScriptBuilder, UnboundedR0Script, bounded Groth16 and Succinct builder types, fixed-journal variants and FinalizedR0Script. It also exports lower-level helpers with names such as append_r0_groth16_verifier, append_r0_succinct_verifier, prepare_r0_groth16_proof, prepare_r0_succinct_witness, push_r0_groth16_proof and push_r0_succinct_witness.

Wasm bindings expose the same general capability for JavaScript integrations. PR #953 merged 58 commits, changed 59 files, added 3,217 lines and removed 540. Sixteen checks passed before merge on June 23, 2026. Those numbers indicate a substantial implementation, examples and dependency work—not a tiny convenience wrapper.

Because this surface was new and actively reviewed, developers should consult the exact repository revision they build. Names in early PR discussion can differ from the merged exports. Pinning a release or commit prevents documentation from drifting away from the binary used in a transaction pipeline.

How should a developer test an OpZkPrecompile application?

Start with deterministic fixtures: a known program image, a fixed journal, one valid receipt and multiple invalid variants. Change one property at a time—the image ID, journal byte, proof byte, verifier tag or control data—and require every mutated case to fail.

Then test transaction behavior. Confirm the P2SH address is derived from the intended redeem script, the funding output is found, the signature script is push-only where required, transaction version is 1, and compute budget is high enough without being arbitrary. Run the examples against a controlled devnet before handling real value.

Record the rusty-kaspa revision, SDK version, RISC Zero dependency versions and hashes of the program and fixtures. A Kaspa covenant binding can help index the programmable UTXO lineage, but an indexer still needs the correct application rules to interpret the state.

For production infrastructure, align the SDK with the node and RPC versions described in the rusty-kaspa v2.0.1 maintenance overview. Test serialization through every boundary, not only the builder’s return value.

What this SDK does not prove

The SDK does not generate a ZK proof by itself. The application still defines and executes the guest program, produces a supported receipt, chooses public outputs and manages proving infrastructure.

It does not audit the guest program, proof-system dependencies or surrounding contract. KIP-16 explicitly notes that node verification inherits security dependencies from external cryptographic libraries. Version pinning, review, monitoring and migration planning remain necessary.

It also does not provide privacy automatically. Public journal data, UTXO flows and surrounding transactions may reveal information even when a proof hides the private computation. Privacy is a property of the complete protocol, not the word “zero-knowledge” in one opcode.

Frequently asked questions

Does OpZkPrecompile execute the off-chain program on Kaspa?

No. It verifies a supported proof about the computation. The expensive computation and proof generation occur off-chain; the Kaspa script evaluates the verifier result under its defined inputs.

Why use P2SH for the SDK flow?

P2SH lets the locking output commit to the redeem script’s hash. The spending transaction later supplies the proof witness and redeem script required for verification.

Should developers prefer Groth16 or Succinct?

There is no universal answer. They differ in proof size, verification characteristics and security assumptions. Developers should follow KIP-16, current SDK support and their own reviewed threat model.

Source and verification note

This guide is based on kaspanet/rusty-kaspa PR #953, merged June 23, 2026, including its PR description, final exports and example files. Opcode tags, proof-system descriptions and security caveats were checked against KIP-16. API names can change after publication; the repository revision used by an application remains the authoritative implementation reference.