Every circuit you write here compiles, proves, and gets verified by a real contract — no toy examples that stop at the whiteboard.
You have read how zero-knowledge proofs work and you still cannot write one. The gap is the toolchain. Circom is the language most production privacy systems are actually written in — Tornado Cash, Semaphore, Polygon’s rollup circuits — and it asks you to think in constraints rather than instructions. This course closes that gap by making you build: you start with a two-line multiplier and end with an anonymous ballot circuit whose proofs a Solidity contract accepts on-chain. Along the way you write the pieces by hand — signals and constraints that compile down to a rank-1 constraint system (R1CS), the witness (the full set of intermediate values your prover computes), and the one-time trusted setup ceremony that produces the proving and verification keys. You pull Poseidon, Num2Bits and EdDSA out of circomlib, wrestle secp256k1 into limbs that fit a field it was never designed for, hunt under-constrained signals with circomspect and Picus, and read real audit findings from circuits that shipped with bugs. Five capstones; three to finish.
Built by Lakshya
We grant free access case-by-case — students, career-switchers, builders on a tight budget. Sign in to send us a note.
Sign in to applyFinished the tasks? Take the prompt to your AI and get tested on it. We copy the prompt and open the app — just paste it in.
The standard library already has the hashes, comparators and bit decomposers you need — and its versions cost far fewer constraints.
Build the group-membership circuit behind Semaphore, plus the nullifier trick that catches a second vote without unmasking the voter.
Checking a signature inside a proof is easy on the curve the proof system likes and brutally expensive on the one Ethereum uses.
Picking the wrong hash can multiply your prover time by a hundred; here you measure the real cost of each before you commit.
Bitcoin and Ethereum keys live on a curve your proof system cannot represent, so you split each number into limbs and pay for the carries.
A failing circuit gives you a line number and nothing else; these are the tools that turn that into an actual diagnosis.
Study the circuit bugs that let attackers forge proofs in shipped systems, then run the same audit checklist over your own work.
Generate the verifier contract, encode your public signals correctly, and get the transaction cost down to something users will pay.
Circom has hard limits; port one of your own circuits to another proof system, benchmark both, and decide with numbers instead of vibes.
Complete all modules, then submit the required number of capstone projects. Each must earn a passing rating from an admin reviewer.
Build a Circom circuit that proves membership in a 2^20-leaf Merkle tree using Poseidon hashing. Submit: the .circom file, snarkjs-generated proof + verification key, and a test harness showing 10 successful inclusion proofs and 10 rejected invalid paths. Bonus: generate a Solidity verifier and produce one on-chain verification transaction.
Implement a Semaphore-style circuit: prove 'I am in this group AND my vote on topic X is Y' without revealing identity. Uses Merkle membership + nullifier derivation to prevent double-signalling. Submit: circuit, proof, nullifier computation, and a demo showing that the same identity signalling twice is detectable but anonymous.
Verify EdDSA signatures over Baby Jubjub inside a Circom circuit. Submit: circuit (should reuse circomlib's eddsa), 5 valid signatures that verify, 5 forged signatures that fail witness-gen or SNARK verification. Include constraint count (~4000) and prover time.
Build a voting circuit: voter proves group membership + casts a binary ballot + derives a nullifier. Off-chain: a tallier collects (proof, vote, nullifier) tuples and publishes a batched tally. Submit: circuit, 100 simulated votes, double-vote detection showing one voter's two proofs share a nullifier, and a final tally transcript.
Design and ship a Circom circuit for a problem YOU find interesting — zk-age-verification, zk-KYC, zk-ML inference, zk-sudoku, zk-SMT proofs. Submit: circuit source, a short README explaining the statement + threat model + why you chose Circom over Halo2 / Noir, the full snarkjs artefact bundle, and at least one valid + one invalid witness.
The standard circuit library. Read the five most common templates before Module 2.