Understanding the Ultrahonk Verifier

In this post, we share a mathematical writeup of the UltraHonk verifier that follows the functionality of the original verifier code. Last year we ported the UltraHonk verifier from Aztec's Solidity implementation to Sway for the Fuel blockchain. You can find our implementation here. This was the fourth ZKP verifier we implemented in Sway, after Groth16, Plonk, and Fflonk. Of the four, UltraHonk was the most challenging: unlike the others, there was no writeup or documentation to follow beyond the code itself. That gap is the reason for this post.

The structure of this writeup is inspired by the original Plonk paper, especially Section 8.3, which presents the protocol step by step. When we implemented the Plonk verifier, the paper and its reference implementations were an extremely practical guide. Our goal here is to provide a similarly useful resource for UltraHonk, focusing specifically on the verifier.

Both the implementation and this writeup follow version 0.87.0 of Barretenberg, the default backend for zkDSL Noir at the time. This work was part of a broader effort to make Noir programs verifiable on the Fuel blockchain by creating an UltraHonk verifier template in Sway. To support that effort, we created a fork of Barretenberg aligned with nargo version 0.87. For readers who want to follow the verifier in detail and map the mathematics back to the implementation, the full writeup is embedded below.