If you want more cryptocurrency analysis, including full-length research reports, trading signals, and social media sentiment analysis, use the code "Publish0x" when subscribing to CryptoEQ.io to make your first month of CryptoEQ just $10! Or simply click the button above!

Overview

Rollups, as a whole, batch together large amounts of off-chain transactions, compress them into a single block, and submit the data and a proof to the Ethereum L1. ZKRs batch together thousands of off-chain transactions, actually do the computation (as opposed to Optimistic rollups), and then post the batch to the Mainnet as a “validity proof.” Because zero-knowledge rollups (ZKRs) don't assume all transactions are valid, validity proofs must be sent with every batch to prove the validity of transactions cryptographically. The validity proof is a cryptographic proof called a “SNARK” or STARK.

In general, a ZK-proof is a cryptographic proof that allows someone to publicly verify that they possess specific, correct information without revealing the contents of the information. As a result, Zero-Knowledge cryptographic proofs reduce the necessary computing resources for validating the block by reducing the amount of data held in a transaction. This is because the nodes no longer need to re-execute every transaction to determine its validity. 

Zero Knowledge rollups explained graphically. Source: @eli5_defi\Twitter

While validity proofs are complex and expensive (relative to Optimistic fraud proofs), verification by the L1 is simple, making them—even still—cheaper than a regular L1 transaction. However, due to the complex computation involved in the validity proofs, special-purpose hardware may be needed to run a node, creating a centralizing effect on the L2. Worry not, though! Even though the ZKR chain may be quite centralized compared to Mainnet Ethereum, L2 transactions are ultimately verified and finalized by the L1. This gives L2 transactions the same security guarantees as L1 transactions. 

This is one of the key benefits of using a rollup rather than some other L2 or alt-L1. While rollup technology can be technical, at its core, it’s simply a smart contract on Mainnet Ethereum. Rollups connect with Ethereum via this smart contract. They’re “trust-minimized bridges” because the smart contract on the L1 acts as a light client receiving block headers and validating by fraud/validity proofs. Ethereum has access to a rollup's data and conducts its on-chain fraud and validity proofs. This proof process is why rollups can have as little as one node but still maintain the same trust assumptions as the Ethereum base layer. 

Rollups don't require validators; they use the thousands on Ethereum L1. Additionally, rollups that share a settlement layer can build trust-minimized bridges between them because their state transitions can be easily verified through the settlement layer via full nodes.

Because of this approach by ZK-rollups, users can be assured that:

• Rollup operators can’t alter the state and/or steal user funds
• User funds are always available/retrievable from the ZKR smart contract
• Noone is needed to monitor transactions/blocks to prevent fraud constantly

ZK-Rollups

Entities

In today’s rollup world, the L2 teams building rollups (zkSync, Starkware, Arbitrum, Optimism, etc.) still play a critical, centralizing role in the L2 process. At a high level, there are three entities involved in a rollup transaction: the user on the rollup, the rollup operator, and the Ethereum L1. The rollup operator between the user and Mainnet has tremendous responsibility and some power.

Understanding rollup economics from first principles

Within this framework, there are also three crucial actors in the collection, execution, and finalization of a ZKR block: sequencers, provers, and validators. Sequencers are a small set of nodes that run this specialized hardware, receive, order, and compute the transactions. Typically, they aren’t very transparent and/or auditable and are run by the L2 team. Provers are the nodes, also generally run by the L2 team, that generate the validity proof. Sequencers and provers can generally be lumped together in rollups’ early days. Validators are a much larger set of L1 nodes that verify the validity of the ZK-proofs submitted by the provers. This group serves to hold the provers accountable and ensure censorship resistance. 

To describe the process in further detail: 

1. A highly-compressed batch of L2 transactions is combined with the current state root (sequencers)

2. The combination is sent to an off-chain prover 

3. The prover computes the transactions, generating a validity proof of the results 

4. The prover sends the validity proof to on-chain validators (Ethereum L1 nodes)

5. The validators confirm the validity proof

6. The smart contract on Ethereum's L1 that maintains the state of the rollup is updated to the new state

Trade-offs in Rollup Solutions. Source: Kyber Network

Limitations

ZK-rollups are (theoretically) faster and more efficient than Optimistic rollups (ORs), but they suffer from friction and compatibility issues with the Ethereum L1 versus ORs. The main reason for this: ZKRs face computational difficulties when composing smart contracts over ZK circuits. Validity proofs are mathematically complex and data-heavy, adding some upfront complexity compared to ORs that don’t use validity proofs. Currently, for ZKRs, time to finality is constrained by the ZK prover and how quickly it can generate the transaction proofs. The  ZK proving process is relatively slow compared to other steps in the process, and under times of heavy congestion, the prover may struggle to keep up and serve as the bottleneck. However, it’s also highly parallelizable, which promises excellent improvements in the future. 

Additionally, provers are the bottleneck (so to speak) in the data availability requirements for rollups. This is because, while validators don’t need access to all the transaction data (just the proof), provers do. They need all of the data to generate the validity proof initially. Also, if the provers in the system ever went down, new provers would need access to all data to come online and resume operations. Making all of the data available on the Mainnet lets anyone reconstruct the state, even if the sequencers or provers disappear.

Despite rollups providing superior security guarantees to many alternative scaling solutions, the risk of a smart contract bug persists. Rollups are still relatively new and pushing the EVM design's boundaries. New code always runs the risk of having errors/bugs.

Consequently, many rollup operators maintain upgrade keys, meaning they can change the code. In many cases, there’s a multi-sig with an upgrade threshold time, whereas, in others, the team can arbitrarily alter the code. Rollup teams hold on to this centralizing power to strike a balance between safety and trust minimization. If a catastrophic bug is uncovered in their nascent implementation, the upgrade keys can be used to fix the bug. For a rollup to be genuinely secure and decentralized, the protocol must mature and the upgrade keys removed.

Risk Framework in Ethereum Smart Contract Rollups. Source: Delphi Digital

The other disadvantage innate to early ZKRs is the reduced compatibility with the Ethereum Virtual Machine (EVM). Optimistic rollups sacrifice some scalability for increased compatibility with the EVM, even reaching EVM equivalence. This is exceptionally critical as composability is paramount in the Ethereum ecosystem and enables developers to deploy code and projects on the secondary chains easily.

Comparing Optimistic to Zero Knowledge Rollups Source: LuozhoZhang\Twitter

Moreover, most ZK-rollups are often incompatible with EVM due to their inherent complexity, making them a challenge to work with and design general-purpose apps to be built atop them. This complexity has led many teams, such as Scroll, Polygon, and zkSync, to work towards a zkEVM.

zkEVM in General

A zkEVM enables every smart contract/piece of code to be easily deployed and executed on Ethereum's base layer with minimal code changes. Creating a ZK-enabled EVM that’s entirely compatible with Ethereum's EVM offers the best of both worlds: orders of magnitude more scalability with all of the network effects and users that come with Ethereum's EVM dapp ecosystem. However, there are degrees to which a zkVM can be compatible with the EVM. This equivalency is similar to EVM-compatible and EVM-equivalence in the Optimistic rollup space.

zkEVM difficulty and development scale. Source: LuozhuZhang\Twitter

1) The first (bottom) level is "language-level," aka EVM-compatible. This is the current approach by projects, such as zkSync or Starkware, that involves translating an EVM-friendly language, such as Solidity or Yul, into a ZK-friendly language, such as Zinc and Cairo. Once translated, the code runs on its virtual machine (VM), entirely distinct from Ethereum's EVM. 

The benefit of this technique is that developers can create a ZK-friendly VM without being constrained by the EVM's inherent limitations. However, the downside is the native languages don’t support many EVM opcodes, creating friction in the development process. This limitation typically results in developers needing to learn these new, zkVM-specific languages, further separating L2 development from L1.

2) ​​The second level is "bytecode-level," aka EVM-equivalent. This level is where Polygon Hermez 2.0 and zkSync 2.0 sit. It has full compatibility at the EVM-opcode level and compatibility at the Solidity language level, making it a true "zkEVM." As a zkEVM, all Ethereum development tools and dApps may be moved to L2, essentially unchanged. 

Scaling solutions compatibility comparison. Source: Scroll

3) The consensus level is the third and final level of zkEVM. In addition to the language- and bytecode levels, it generates proofs for state roots on Ethereum and is equivalent to Ethereum’s EVM, achieving consensus-level compatibility.  

zkSync

zkSync v1

zkSync is an Ethereum ZK-rollup by Matter Labs founded in 2018 by Alex Gluchowski. In June 2020, Matter Labs released zkSync v1.0 on the Ethereum Mainnet, where users can deposit ETH onto the network and send payments between other zkSync accounts for much lower transaction fees. It’s a standard L2 ZK-rollup scaling solution because a smart contract holds all funds on Ethereum Mainnet, computation and storage are performed off-chain, and every batched/rollup block generates a Zero-Knowledge Proof, which is verified by L1. 

However, because zkSync uses SNARKs (PLONKs specifically and discussed more below), it’s slower than its STARK counterpart used by Starkware and relies on a trusted setup at genesis. That means the entirety of the zkSync ecosystem is dependent upon a trusted ceremony conducted in 2019. The good news is that the system is 100% secure if even one participant is honest.

The ceremony included 200+ well-known and public crypto figures, including Matter Labs, Vitalik Buterin, Ethereum Foundation, Consensys, Argent, and many others. The trusted setup and future zkSync v1 protocol are secure if at least one participant is honest. Therefore, it’s likely this trusted setup isn’t an issue and wasn’t compromised.  Additionally, zkSync is unable to move or steal user funds.

zkSync 2.0

To learn more about the new zkEVM from zkSync, click here or the image below!