R1CS (Rank-1 Constraint System)
R1CS is the arithmetic format that Leo programs compile into before zero-knowledge proofs can be generated. Every operation in a Leo program (additions, multiplications, comparisons, hash calls) gets decomposed into constraints, each taking the form A * B = C over a finite field. The "rank-1" means each constraint has exactly one multiplication of two linear combinations.
The R1CS size directly determines proof generation time and memory usage. A simple token transfer might produce a few thousand constraints. A complex program with loops, nested conditionals, and cryptographic operations can produce millions. This is why Leo requires compile-time-known loop bounds and fixed-size data structures: they keep the R1CS size predictable.
After compilation to R1CS, the Varuna proving system generates a succinct proof. Verification takes milliseconds regardless of how large the original R1CS was. Expensive proving, cheap verification. That asymmetry is what makes zero-knowledge systems practical.