SHA256 is everywhere in crypto, but inside zk circuits it becomes one of the biggest bottlenecks. Most implementations pay a huge cost because SHA256 was never designed to be circuit-friendly. In our latest write-up by @0xrosetteeee, we explore how to make SHA256 significantly cheaper in R1CS. Key ideas: • Spread-based encoding for bitwise ops • Dynamic bit-width optimization • Single-constraint multi-operand additions • LogUp batching and micro-optimizations This design achieves state-of-the-art SHA256 compression in R1CS among existing open-source implementations. This is particularly important for mobile proving environments, where witness size directly impacts memory usage. Full deep dive ↓