I recently worked on a rust wrapper of the reference implementation for Falcon signature scheme. Also a rank-1 constraint system (R1CS) implementation of Falcon which shows falcon’s signature can be verified with some 80k r1cs constraints. The main ingredient is an almost linear time NTT based multiplication circuit that performs ring multiplications with 15k constraints.