The number reached me at 3:47 a.m. the way most numbers do — unannounced, stripped of context, and already dressed for a headline. Starknet's Stwo prover had brought its peak memory footprint down to 2.1 GiB. Read that again, slowly, because the claim underneath it is genuinely wild: STARK proofs, the cryptographic heavyweights that once demanded a rack of servers and a small prayer, now fitting inside the RAM of a mid-range Android phone.
I watched fortunes bloom and wither in real-time across eleven years of this industry, and I've learned the same lesson every cycle: the most quotable figure in a technical announcement is almost never the most important one. So before the timeline turns 2.1 GiB into a slogan, let's do the thing the press release didn't. Let's read the number against everything it refuses to say.
Because the first thing missing is a baseline. No "down from 6 GiB." No proof-generation time. No proof size. One dimension of a three-dimensional problem, handed to a market that rewards velocity over verification. Speed is survival, but empathy is the signal — and the empathetic thing to do right now is slow down for the readers who might otherwise buy a story they don't fully understand.
Context: What Stwo Actually Is
Starknet is a ZK-Rollup: a Layer 2 that executes transactions off-chain, then proves to Ethereum that the execution was correct. That proof is the entire product. Strip it away and you have a fast database with extra steps. Keep it, and you have cryptographic compression — an entire block's worth of state transitions folded into something Ethereum can verify in milliseconds.
Historically, Starknet's proving engine was Stone. Stwo is its successor, and the technical choices inside it matter far more than the marketing draped over it. Stwo is built on Circle STARKs and the M31 field, a small prime field roughly 31 bits wide. That width is the engineering insight worth understanding: the narrower the field, the fewer machine words each arithmetic operation consumes, and the less memory the prover must hold in flight at any single instant. This isn't a branding flourish. It's the mechanical reason a figure like 2.1 GiB is even conceivable in the first place.
There's a second, quieter reason STARKs matter here, and it's the one that gets buried under performance talk. Unlike SNARKs, STARKs require no trusted setup — no ceremonial multi-party computation where one surviving participant could, in theory, forge proofs forever. STARKs are transparent by construction and lean toward post-quantum resistance. For a system that wants to settle everything from payments to identity, that property isn't academic. It's the difference between a proof you have to trust and a proof you can check. Code was the law, and I was its restless guardian — but a law you can't audit is just an opinion with better PR.
None of this is new territory for StarkWare. The team has been one of the founding academic houses of STARK theory since 2018, and its engineering claims carry a higher prior than the average protocol's roadmap slide. I've audited enough circuits to feel the difference between a team improvising and a team executing. Stwo reads like execution.
And yet the framing needs one more layer. Starknet's competitive position has never been decided by its prover. It's been decided by users, liquidity, and whether developers choose Cairo over Solidity — a language bet that has cost the ecosystem as much mindshare as it has bought in performance. In a bear market, that's the ledger that matters. A cheaper prover is a tool; adoption is the outcome. The two are related, but the relationship is neither automatic nor fast, and anyone who tells you otherwise is selling the tool and the outcome as the same product.
There's also the question of what "2.1 GiB" is measured against. Peak memory during proving is highly sensitive to the circuit being proven, the batch size, the hardware, and the compiler flags. A number without its test conditions is a number without a warranty. I've seen the same prover report wildly different footprints across two machines because one had a different cache hierarchy. So when a figure arrives with no methodology attached, the honest response isn't disbelief — it's suspension of judgment until the conditions show up.
Now to the part that actually matters.
Core: What 2.1 GiB Unlocks — And What It Doesn't
Peak memory is the high-water mark of everything a prover holds simultaneously while constructing a proof. Drag it down to 2.1 GiB and you've crossed a threshold: the prover now runs inside the working set of consumer hardware. A laptop. A phone. That threshold is the whole story, and it points somewhere specific — client-side proving.
Here's the distinction the headline blurs, the one I'd tattoo on every ZK news item if the industry would let me: "proving on a phone" is not "Starknet's blocks are proven by phones." Starknet's main chain will keep leaning on dedicated provers and prover markets — machines built to chew through full-block proofs where throughput and cost, not memory, are the binding constraints. What fits on a phone is something much smaller and, in my view, far more interesting: a single private transfer, an on-chain identity attestation, a light-client state check. Local proof generation, where the sensitive data never leaves the device.
That is where the privacy argument lives. When I verify my own state locally and submit only a proof, I stop broadcasting my balance, my counterparties, my history to every node that indexes the chain. I stop trusting a third-party prover not to peek. Transparency is a virtue in code and a liability in life, and client-side proving is one of the few places where the two finally stop fighting.
This is why the announcement matters even in a bear market where nobody wants another infrastructure brag. Client-side proving is the missing primitive for privacy-preserving DeFi, decentralized identity, and genuinely light clients. It opens a category of application that has been theoretically possible and practically absurd for years.
It also matters for the small builders — the indie devs and the artists. The on-chain creator economy was gutted the moment the big marketplaces decided royalties were optional, and I've never forgiven the ecosystem for pretending that was a technical inevitability rather than a business decision. Client-side proving is one of the few remaining corners where a solo builder can offer something a giant can't cheaply clone: a hard guarantee that your data never leaves your device. That's a moat made of cryptography instead of lawyers.
Now the missing two-thirds of the benchmark.
Proof generation is governed by three constraints: memory, time, and proof size. The Stwo announcement hands you exactly one — and, not coincidentally, the one that photographs best. A phone with 2.1 GiB of headroom is useless if a single proof takes four minutes to generate, or if the resulting proof is too large to verify cheaply on-chain. I've run circuit benchmarks where memory fell by half and wall-clock time went up, because the optimization traded space for compute. Space is cheap on a server. Space is the bottleneck on a phone. But time is the bottleneck on a human being. A prover that saves memory by spending minutes is a prover nobody uses.
Stability isn't a number you publish. It's a number you survive — under load, on real hardware, against adversarial inputs. Until StarkWare publishes end-to-end benchmarks — time, size, and a clean before-and-after against Stone — 2.1 GiB is a capability demonstration, not a product claim. That's not cynicism. That's the standard I'd want applied to my own work, and the standard this industry keeps skipping because the market doesn't reward patience.
Circle STARKs also carry a second-order benefit that rarely makes headlines: they make recursion and aggregation friendlier. When proofs are cheap to fold together, the cost of verifying a large batch collapses, and that's where real throughput gains live. Memory is the headline; recursion is the compounding interest. If Stwo delivers on the aggregation side, the phone-proving story will turn out to have been the appetizer, not the meal.
Zoom out, and Stwo lands in a proving arms race that moves fast enough to embarrass quarterly roadmaps. zkSync runs Boojum. Polygon pushes its zkEVM aggregation strategy. The zkVM camp — SP1, RISC Zero, Jolt — iterates on a timescale measured in weeks. Memory is one axis of competition. Time, proof size, developer ergonomics, and verification cost are the others, and a lead on one axis can evaporate before the blog post cools. The honest question isn't "is 2.1 GiB impressive?" It's "is 2.1 GiB impressive enough, fast enough, against everyone else running the same race?" I'd want the full leaderboard, not the single headline.
There's a downstream consequence worth naming, even if the evidence is thin. If proof generation migrates from centralized prover services onto user devices, the business model of the prover market shifts underneath its own feet. Cloud provers sell access to hardware that's expensive to run and hard to trust. A world where the user proves locally doesn't eliminate that market — full-block proving still needs muscle — but it does shrink the surface area where a third party can charge rent for something you could do yourself. That's a quiet structural threat to a quiet structural business.
Contrarian: The Value Capture Gap Nobody Wants to Draw
Here's the angle the ecosystem press won't draw, because it's inconvenient for everyone holding the token: a cheaper prover does not automatically make a token more valuable.
Follow the chain. Stwo lowers the cost of producing proofs. Lower proof cost lowers Starknet's operating overhead. But overhead reduction only reaches STRK holders if the fee mechanism routes value back — if fees are denominated in STRK, burned, or used for buybacks. If the savings instead accrue to the prover market, to hardware vendors, or simply to the foundation's runway, then a brilliant engineering milestone and a token holder's portfolio are two different objects that happen to share a logo. That's the value capture gap, and it's the most under-reported story in every "major breakthrough" cycle.
I've watched this movie before. During DeFi Summer, I flagged liquidity mining APYs for what they were — a project subsidizing its own TVL number, a vanity metric propped up by emissions. Stop the incentives and the real users vanish, leaving a ghost town with a governance forum and a chart that only goes one direction. The same pattern operates here in slow motion: technical progress gets narrated as token progress, and the distance between the two is exactly where retail gets quietly diluted. In a bear market, the central question isn't "which chain is fastest." It's "which protocol is bleeding, and who's actually paying for the blood."
There's a funding question underneath this too, and it's one I care about. Infrastructure like Stwo should be sustained by mechanisms that reward delivered results, not committee relationships. I've argued for years that the only public-goods funding that scales is the kind that pays retroactively for measured impact — everything else is a grant committee with a favorites list and a budget. If Starknet's ecosystem can't route the value of its own breakthroughs back to the people who build and use them, the breakthroughs become someone else's free lunch. The technology will be fine. The economics may not.
And there's a second contrarian edge. "Phone proving" is a narrative about capability, not adoption. It answers "can this be done?" It doesn't answer "who is doing it, how fast, and how cheap?" Until a real dApp ships a real feature a real user touches, this is a vision wearing a metric's clothing. The marketing choice is telling, too: the headline says "phones," not "cost" or "throughput." Phones travel. Cost doesn't. That's a PR decision, and PR decisions reveal where the emphasis was engineered.
None of this makes the work wrong. It makes the framing incomplete — and incomplete framing is what a bear market punishes hardest, because there's no rising tide left to hide the gap between narrative and delivery.
Takeaway: What to Watch, Not What to Believe
Watch for the official technical write-up with the numbers that were left out — proof time, proof size, and a clean before-and-after against Stone. That document, not the headline, will decide whether Stwo is a genuine step change or a well-chosen screenshot.
Watch for mainnet adoption. If Starknet's own chain switches to Stwo in production, the claim graduates from demo to infrastructure. If it stays in the lab, you'll understand why the announcement led with memory.
And watch the client-side proving category — privacy DeFi, on-chain identity, light clients — because that's where a 2.1 GiB prover could actually change what people are able to build. Whether that value flows to users, to developers, or to a token that never quite captures it is the question the next six months will answer.
The number is real. The dream is real. The gap between them is where the work — and the risk — still lives.