waxwing on Nostr: For anyone interested: these proofs are actually STARKs ; they are proved recursively ...

For anyone interested: these proofs are actually STARKs ; they are proved recursively by the sequencer. any final withdrawal proof by the user does what Risc-0 calls 'shrink-wrap', in which you make a groth16 (so, SNARK) proof that the STARK proof validates. That's why the on-bitcoin verification is O(1). The STARK proof is also O(1) because it's a recursive proof: it says "this proof is valid, plus this other one new chunk is valid'.