💻 computer science

SNARKChain: Proof-of-Useful-Work Blockchain Consensus with General-Purpose SNARK Marketplace

This paper introduces SNARKChain, a novel Proof-of-Useful-Work consensus protocol that secures the blockchain by integrating client-outsourced SNARK proof generation directly into the mining process, thereby eliminating energy waste while establishing the first decentralized marketplace for SNARK proofs at the consensus layer.

Original authors: Samuel Oleksak, Richard Gazdik, Martin Peresini, Ivan Homoliak

Published 2026-07-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Samuel Oleksak, Richard Gazdik, Martin Peresini, Ivan Homoliak

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the blockchain world as a giant, global digital ledger that everyone trusts, but no single person controls. To keep this ledger safe from bad guys, most blockchains use a system called Proof of Work (PoW). Think of it like a massive, high-tech scavenger hunt where computers race to solve incredibly hard math puzzles. The first one to solve it gets to write the next page in the ledger and earns a reward.

The problem? These puzzles are like burning a library just to keep a fire going. They use a ton of electricity but produce nothing useful outside of the blockchain itself. Some reports suggest that just one famous blockchain (Bitcoin) might be responsible for as much carbon dioxide as the entire country of Greece emits in a year!

Enter SNARKChain, a new idea from a team of researchers at Brno University of Technology. They asked: What if the "useless" puzzles we solve to keep the blockchain safe could actually do something helpful for the real world?

The Big Idea: Solving Puzzles That Matter

The researchers propose a system called Proof of Useful Work (PoUW). Instead of burning energy on random math problems, miners would solve puzzles that generate zk-SNARKs.

To understand zk-SNARKs, imagine a magician who can prove they know a secret password without ever saying the password out loud. These are powerful tools for privacy and security in the digital world, but they are incredibly heavy to create. They require massive computers and lots of time, making them too expensive for regular people to generate on their own.

SNARKChain turns the blockchain into a decentralized marketplace. Here's how the magic happens:

Clients (people who need these magic proofs) post a request on the blockchain.
Miners (the computers keeping the network safe) pick up these requests.
While they are working to secure the blockchain, they generate these useful proofs as a "byproduct."
If a miner solves the puzzle correctly, they get to add a new block to the chain and earn a reward.

This is the first time, according to the authors, that such a marketplace has been built directly into the core security layer of a blockchain.

The Tricky Part: Keeping It Fair

The researchers knew that just swapping one puzzle for another wasn't enough. They had to make sure the system didn't break the golden rules of blockchain security. They had to solve a few specific headaches:

1. The "Stolen Work" Problem
In the old days, if a miner solved a puzzle but didn't win the race to add the block, their work was wasted. In SNARKChain, if a miner generates a proof but loses the lottery to publish the block, that proof is useless to anyone else because it's tied to a specific, unique "integrity parameter" (a digital fingerprint of the current block). This stops bad actors from stealing someone else's hard work and using it for themselves.

2. The "Rich Get Richer" Problem
If the system just rewarded the fastest computer, only the biggest, most expensive mining farms would ever win. The researchers designed a lottery system to fix this.

Imagine a miner generates a proof. Instead of just checking if it's "good enough," the system rolls a digital die.
The bigger and more complex the proof, the higher the chance of winning the lottery.
This means a smaller miner with a weaker computer still has a fair shot at winning, as long as they keep working. The authors ran simulations (computer models) to test this, and the results suggested that the rewards are distributed fairly based on how much work each miner actually does.

3. The "Traffic Jam" Problem
What if everyone tries to solve the same request at the same time? The researchers proposed a "bucketing" system. Think of it like a post office with many different mail slots. Instead of everyone fighting over one slot, requests are sorted into different buckets based on a code. Miners pick a bucket and work only on the requests inside it. This stops miners from stepping on each other's toes and wasting energy. Their simulations showed that using more buckets significantly reduces wasted work.

What the Paper Says (and Doesn't Say)

The authors are very careful about what they claim. They suggest that their system works and demonstrated its security properties through simulations. They did not claim to have built a fully running, live blockchain that has been tested in the real world for years.

They also explicitly rule out some ideas that might seem obvious but don't work:

They reject the idea of "amortization": You can't just batch multiple proofs together to make them easier. The system is designed so that every single proof must be computed from scratch, ensuring no one can cheat by doing less work.
They reject the idea of pre-computing: A miner cannot secretly solve a puzzle today for a block that won't exist until next week. The puzzle changes every second based on the current state of the blockchain, so you have to solve it now.

The Bottom Line

The researchers have designed a system where the energy spent to secure a blockchain isn't wasted. Instead, that energy is used to create valuable cryptographic proofs that help other parts of the internet stay private and secure.

While they have shown through simulations that the math holds up and the system is fair, they acknowledge that real-world deployment is a future step. They have built the blueprint for a blockchain that doesn't just burn energy, but actually does something useful, turning the "useless work" of the past into the "useful work" of the future.

Technical Summary: SNARKChain – Proof-of-Useful-Work Blockchain with General-Purpose SNARK Marketplace

1. Problem Definition

Proof of Work (PoW) remains the most secure permissionless consensus protocol but suffers from significant environmental inefficiency due to its reliance on computationally intensive puzzles that yield no value outside the blockchain (e.g., hash collisions). Proof of Useful Work (PoUW) aims to replace these arbitrary puzzles with tasks that generate real-world value, such as scientific simulations or cryptographic proofs. However, existing PoUW proposals often fail to meet the rigorous security requirements of PoW, specifically regarding freshness (resistance to replay attacks), chain integrity embedding, and miner identity binding.

Simultaneously, the generation of Zero-Knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs) is computationally prohibitive for many users, necessitating outsourcing. While decentralized marketplaces for SNARK generation exist, they typically operate at the application layer or are limited to specialized circuits, failing to integrate proof generation directly into the consensus layer while maintaining general-purpose capabilities.

2. Methodology

The authors propose SNARKChain, a novel consensus protocol where the "useful work" is the generation of client-outsourced SNARK proofs. The system functions as a decentralized marketplace where miners compute proofs to secure the network.

Core Architecture

The network consists of three participant roles:

Clients: Submit coin transactions and "proof transactions" containing arithmetic circuits and parameters to request SNARK generation.
Miners (Full Nodes): Select transactions, generate the required SNARK proofs, and compete to publish blocks. They receive rewards for blocks containing valid proofs.
Circuit Registry Nodes: A staked subnetwork responsible for the decentralized registration of arithmetic circuits, storage of proving/verification keys, and participation in Secure Multi-Party Computation (SMPC) for trusted setup.

Consensus Mechanism: The Lottery and Integrity

To address the specific challenges of PoUW, the protocol introduces a Lottery Mechanism and Integrity Binding:

Lottery-Based Block Selection: Instead of requiring miners to reach a fixed difficulty threshold (which leads to centralization by the most powerful miner), the protocol uses a weighted lottery. Every time a miner generates a new proof for a block, they trigger a lottery check. The probability of winning ( $P_{win}$ ) is proportional to the complexity ( $C_i$ ) of the generated proof relative to the current difficulty target ( $\kappa$ ):
$P_{win}(i) = \frac{C_i}{\kappa}$
This ensures progress-freeness: the probability of winning depends only on the most recently generated proof, not on time already spent mining.
Integrity Parameter ( $\eta$ ): To prevent proof theft and replay attacks, each arithmetic circuit is modified to include a public integrity parameter. This parameter is derived from the hash of the block header being constructed. If a miner fails the lottery, they must recalculate the integrity parameter to include the newly generated proof, creating a cryptographically linked chain of proofs within the block. This ensures that a proof cannot be reused in a different block without invalidating the verification.
Amortization Prevention: To prevent miners from gaining unfair advantages by batching proofs, the system uses a mask parameter (combining the miner's address and circuit usage count) and ensures that changing public inputs (like the integrity parameter) invalidates the entire QAP evaluation in Groth16, requiring full recomputation.
Bucketing: To reduce wasted work caused by transaction overlaps when multiple miners work in parallel, the protocol partitions the transaction space into "buckets" based on transaction hash prefixes. Miners select a bucket, ensuring disjoint transaction sets and minimizing conflicts.

Cryptographic Details

The system utilizes Groth16 SNARKs. The authors selected Groth16 for its constant proof size (128 bytes) and linear proving time relative to the number of constraints. The protocol supports general-purpose circuits (defined in DSLs like ZoKrates or Circom) rather than being limited to a single specialized circuit.

3. Key Contributions

The paper claims the following contributions:

First Consensus-Layer SNARK Marketplace: The proposal represents the first decentralized marketplace for general-purpose zk-SNARK generation that operates directly at the consensus layer, where proof generation is inseparable from block security.
PoUW Protocol Design: A novel approach to offloading resource-intensive SNARK computation onto nodes, satisfying all critical PoW properties (asymmetry, granularity, amortization-freeness, independence, efficiency, unforgeability, freshness, determinism, progress-freeness, and public verifiability).
Handling Private Inputs: The paper proposes a method (detailed in the Appendix) for handling proofs with private parameters via witness obfuscation outsourcing, addressing the limitation of public-only parameters in the initial design.
Security Analysis: A formal analysis and simulation (using Stochastic Time Colored Petri Nets) demonstrating that the protocol maintains fairness and security properties.

4. Results and Evaluation

The authors evaluated the protocol using a Petri net model to test four hypotheses:

H1 (Fairness): Reward distribution is commensurate with mining power. Simulations confirmed that block rewards scale linearly with computational power. However, proof rewards showed a quadratic dependence on power, suggesting that proof rewards should be minimized relative to block rewards to prevent mining pool centralization.
H2 (Independence): The complexity of selected proofs does not unfairly skew rewards. Results indicated that miners with a preference for larger proofs did not gain disproportionate block rewards, though they generated more proofs.
H3 (Centralization vs. Efficiency): Introducing a parameter ( $\psi$ ) to favor longer proof chains reduces wasted work but increases centralization. The trade-off suggests that while efficiency can be improved, it risks compromising the fairness of the network.
H4 (Bucketing): Increasing the number of buckets significantly reduces wasted work caused by transaction overlaps. The simulation showed that a higher number of buckets correlates with lower wasted work percentages.

The analysis confirms that Groth16 offers the necessary linear scaling for proof generation time, making the protocol predictable and scalable.

5. Significance and Claims

The paper positions SNARKChain as a solution to the dual challenges of blockchain energy waste and the high cost of zk-SNARK generation.

Security: Unlike previous PoUW proposals, this system embeds the integrity of the chain and the identity of the miner directly into the puzzle solutions, meeting the strict "freshness" and "unforgeability" requirements of PoW.
Utility: It transforms the "waste" of PoW into valuable cryptographic proofs that can be used for privacy, scalability, and cross-chain interoperability in broader applications.
Novelty: The authors assert that to the best of their knowledge, this is the first system to successfully integrate general-purpose SNARK generation into the consensus layer while satisfying all necessary PoW properties.

The work concludes that while challenges remain (such as the trade-off between wasted work and centralization via the $\psi$ parameter), the proposed protocol offers a viable path toward secure, energy-efficient blockchains that produce useful cryptographic byproducts.