The MoonMath Manual to zk-SNARKs

The MoonMath Manual to zk-SNARKs explains how a zero-knowledge proof system is built from arithmetic a reader can check by hand, and continuity is the best reason to read it. Its route runs from modular arithmetic through groups, finite fields, elliptic curves and pairings to a worked Groth16 proof. Once formal statements appear, one toy statement, knowing three factors of a public number in the field with thirteen elements, carries through constraint systems and quadratic arithmetic programs into that final proof, so each new representation arrives with a visible reason to exist.

Least Authority released version 1.1.7 on 11 May 2026 and is named in the manual as the initial creator of a community project open to contributions, while a preface by Mirco Richter traces the material back to his lectures. Its authors call it a constant work in progress offering an informal minimum of theory, and it reads that way, as an example-driven teaching text whose parameters are deliberately insecure.

The arithmetic chapters train the habit everything later depends on, re-deriving each familiar operation inside the number system in use. In the integers modulo 6, the elements with multiplicative inverses are 1 and 5. Because 5 times 5 leaves remainder 1, the expression 4/5 means 4 times 5, which reduces to 2. Division becomes the question of whether an inverse exists, which coprimality answers and the extended Euclidean algorithm computes. Every nonzero element of a prime field has an inverse, and the extension fields built later keep that property, while division by zero stays undefined in all of them.

That habit carries over to elliptic curves through BLS6_6, which is defined by y^2 = x^3 + 6 over the field with 43 elements and has 39 points, few enough to tabulate. Its subgroup of order 13 becomes G1, with scalars taken from F13. The second pairing group also has order 13 but sits on the same curve over a degree-six extension of F43, so its coordinates leave the base field, and following the later protocol requires keeping that extension apart from both the base field and the scalar field. Because the groups are so small, the book's public logarithm tables turn each pairing comparison into exponent arithmetic modulo 13, and a check that pairs 6 with 5 against 8 with 7 succeeds because both products reduce to 4. Anyone consulting those tables can recover the exponent behind an encoded group element, so the toy lacks the discrete-logarithm hardness that real deployments depend on, and the authors call the smallest such curve the most insecure. What the reader gains in exchange is a view of what a pairing equation compares.

The running example takes over in the chapters on statements, which separate what the verifier sees from what the prover keeps. Its public instance equals the product of three private witnesses in F13, and because every element of F13 has some factor triple, the example carries none of the hardness of factoring large integers. A rank-1 constraint allows one multiplication, so the product is flattened into w1 * w2 = w4 and w4 * w3 = I, with the auxiliary witness w4 fixing the intermediate value. Choosing which values are public falls to the application, and a public instance stays public along with everything that follows logically from it. Many different constraint systems can also define the same language.

The circuit-compiler chapter gives programmers the warning they most need. A field variable intended as a boolean behaves as one in the proof once a constraint such as x * (1-x) = 0 forces it to equal 0 or 1, and the AND and OR gadgets are correct under that assumption alone. What a valid proof certifies is the encoded constraint system, so a declared type or a developer's intention that never became a constraint offers no protection, and an underconstrained circuit can prove the wrong relation with a proof that verifies. Through its PAPER pseudo-language and Circom examples, the book connects this discipline to ordinary bounded programs.

Quadratic arithmetic programs fold all of the constraints into one divisibility test. Placing the two constraints at the points 5 and 7 of F13, the manual interpolates a polynomial for each variable column and combines them into a polynomial P that vanishes at a constraint point when that constraint holds. Satisfying every constraint then means that P is divisible by the target polynomial T with roots 5 and 7, which over F13 is x^2 + x + 9. For the instance 11 with witnesses 2, 3 and 4 and auxiliary value 6, P equals T and the quotient is 1, whereas changing the auxiliary value to 8 makes P equal 8x^2 + 6 and leaves the remainder 5x + 12. This divisibility test is a representation step with no zero-knowledge or succinctness guarantee of its own. Those properties come from the complete Groth16 protocol, which evaluates the polynomials at a secret point inside the groups built earlier and depends on fresh blinding and a properly conducted setup.

The Groth16 chapters then show where trust sits. A setup samples secret scalars and publishes their encodings as the common reference string, and the book picks memorable toy values on the condition that real deployments sample them at random. The prover adds two fresh blinding scalars and outputs three group elements, two in G1 and one in G2, so proof size stays fixed while the verifier's work grows linearly with the number of public inputs. Whoever keeps the setup secrets can produce an accepted proof without any witness, and the manual carries out such a simulated forgery and checks its pairing equation. A publicly verifiable multi-party setup removes reliance on a single party, since the trapdoor stays unrecoverable as long as at least one participant properly destroys their contribution. Soundness therefore rests on that setup history and on properly sized parameters together with assumptions about bilinear groups, while zero knowledge comes from the blinding.

Beyond Groth16, which the manual works through in full, other proof systems, including those that need no trusted setup, get no comparable treatment, so the book prepares a reader to study them without covering them. Unresolved cross-references and some typos remain in the text, which is neither a deployment recipe nor a guide to current tooling, so readers should check computations as the exercises invite, using Sage where the book suggests it.

Choose this manual if your question is how a zk-SNARK works from the arithmetic up and you are comfortable with basic programming and high-school integer arithmetic. The book teaches its own mathematical foundations and assumes no graduate background in proofs. Its exercises do a large share of the teaching, and readers who work them by hand learn to look for missing constraints in a circuit and to ask who held the secrets of a setup. Least Authority distributes the official v1.1.7 release PDF under the Creative Commons BY-NC-ND 4.0 license, which allows noncommercial sharing of the unaltered work with attribution.