Zero-Knowledge Rollups: How ZK Scaling Works
ZK rollups execute transactions off-chain and prove them correct on Ethereum with validity proofs. We explain the technology, compare it with optimistic rollups and follow the research.
zkSync Era Custom zkVM Cuts Proving Time to Seconds, Adds Bytecode Compilation Step
zkSync Era implements a custom zero-knowledge virtual machine (zkVM) that diverges from the Ethereum Virtual Machine (EVM) bytecode format. Matter Labs selects this design to reduce proving time and lower…
Latest in this topic
What is a zero-knowledge rollup?
A rollup bundles many transactions, executes them outside the base chain and posts the result back to a Layer 1. In a zero-knowledge (ZK) rollup, every batch comes with a validity proof – a short cryptographic proof that the new state was computed correctly. A verifier contract on the Layer 1 checks the proof, so it does not need to re-execute the transactions or wait for anyone to challenge them.
ZK rollups vs optimistic rollups
| ZK rollup | Optimistic rollup | |
|---|---|---|
| How correctness is guaranteed | Validity proof for every batch | Fraud proofs during a challenge window |
| Native withdrawal to L1 | After the proof is verified | After the challenge window, typically about seven days |
| Main cost | Generating proofs | Posting data and running fraud-proof systems |
| Examples | zkSync, Starknet, Scroll, Linea | Arbitrum, Optimism, Base |
Third-party bridges can make optimistic withdrawals faster, but they add their own trust assumptions.
The building blocks
- Sequencer – orders transactions and produces batches. Most rollups still run a single sequencer.
- Prover – generates the validity proof. Proving is computationally expensive, which is why prover performance and hardware are a key area of competition.
- Verifier contract – checks proofs on Ethereum and updates the rollup’s state.
- Data availability – transaction data must be published so anyone can reconstruct the state. Since Ethereum’s Dencun upgrade in March 2024, rollups can post this data as cheaper “blobs”.
SNARKs, STARKs and zkVMs
ZK rollups use different proof systems. SNARKs produce very small proofs that are cheap to verify; some require a trusted setup. STARKs avoid a trusted setup and rely on hash functions, but their proofs are larger. Many teams now build general-purpose zkVMs that can prove arbitrary programs, so developers do not need to write custom circuits.
Open problems we follow
- Decentralising sequencers and shared sequencing across rollups.
- MEV and transaction ordering on Layer 2.
- Proving costs, latency and decentralised prover networks.
- Interoperability and bridges between rollups.
How to check a rollup’s maturity
Not every network that calls itself a rollup offers the same guarantees. Useful questions are: can users withdraw to Ethereum if the sequencer stops working; is there a delay before upgrades take effect; is the proof system live for all transactions; and is data posted to Ethereum or to an external data-availability layer? Projects that post data elsewhere are often called validiums and have different security properties.
Risks to keep in mind
A ZK rollup is only as secure as its proof system, circuits and upgrade process. Bugs in circuits can be hard to detect, and many rollups can still be upgraded by a small multisig without a delay. Independent trackers such as L2BEAT classify rollups by these risks – check them before moving large amounts.
Frequently asked questions
Are ZK rollups more secure than optimistic rollups?
They rely on different assumptions. ZK rollups depend on the correctness of their proof system and circuits; optimistic rollups depend on at least one honest party submitting a fraud proof in time. Both also depend on how upgrades and sequencers are controlled.
Why are ZK rollup withdrawals faster?
Because each batch is proven valid before it is accepted on Layer 1, there is no challenge period to wait for once the proof has been verified.
What is a zkVM?
A zkVM is a virtual machine whose execution can be proven with zero-knowledge proofs, letting developers prove general programs instead of writing custom circuits.
This page is for educational purposes only and is not financial, investment or tax advice. Crypto assets are volatile and you can lose all of the money you invest.
