I feel like off-chain ZK applications are really undervaluing the potential of just using STARKs, including for privacy-demanding use cases.

These days a STARK is < 100 kB, for off-chain use cases that amount of  bandwidth is utterly trivial compared to the client-side prover time savings that come from using STARKs.

When debugging a ZKP verifier, make sure to keep checking not just that the proof verifies on valid inputs, but also that the proof verification returns an error on invalid inputs (or with nonsensical tweaks to the verification mechanism).

Artem

@artemko88