ZK-Rollups: Scaling Ethereum with Zero-Knowledge Proofs
ZK-rollups are layer-2 scaling solutions that bundle hundreds of transactions off-chain and generate a single zero-knowledge proof (validity proof) verified on Ethereum. They offer high throughput, low fees, and fast finality without lengthy withdrawal delays.
ZK-Rollups: Scaling Ethereum with Zero-Knowledge Proofs
ZK-rollups are layer-2 scaling solutions that bundle hundreds or thousands of transactions off-chain and generate a single zero-knowledge proof (validity proof) that is verified on the Ethereum mainnet. Unlike optimistic rollups that assume transactions are valid and use fraud proofs, ZK-rollups provide cryptographic proof of correctness, enabling instant finality and faster withdrawals. They offer high throughput (2000+ transactions per second), low fees (fractions of a cent), and maintain Ethereum's security guarantees.
To understand ZK-rollups properly, it helps to be familiar with zk-SNARKs and Ethereum fundamentals.
ZK-rollup architecture overview:
┌─────────────────────────────────────────────────────────────────────────┐
│ ZK-Rollup Architecture │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ Off-Chain (Rollup Sequencer) On-Chain (Ethereum) │
│ │
│ Users submit txs ──→ Batch (1000 txs) │
│ │ │
│ ▼ │
│ Execute + Generate Proof │
│ (zk-SNARK / zk-STARK) │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────┐ │
│ │ Submit to L1: │ │
│ │ • State root (new) │ │
│ │ • Validity proof (ZKP) │ │
│ │ • Public inputs (tx hashes) │ │
│ └──────────────────┬──────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────┐ │
│ │ L1 Verifier │ │
│ │ Contract │ │
│ │ (verifies proof│ │
│ │ updates state)│ │
│ └─────────────────┘ │
│ │
│ Benefits: │
│ • Instant finality (no challenge period) │
│ • Fast withdrawals (minutes vs 7 days for optimistic) │
│ • High throughput (2000+ TPS) │
│ • Ethereum security (inherits L1) │
│ │
└─────────────────────────────────────────────────────────────────────────┘What Are ZK-Rollups?
ZK-rollups are layer-2 scaling solutions that move computation and state storage off-chain while posting compressed transaction data and validity proofs to Ethereum. A rollup operator (sequencer) collects many transactions, executes them off-chain, and generates a zero-knowledge proof (validity proof) that attests to the correctness of state transitions. The proof is verified by a smart contract on Ethereum. Anyone can verify the proof and update the rollup's state root. Funds can be withdrawn directly from the rollup contract without waiting for challenge periods.
- Validity Proofs (zk-SNARK/STARK): Cryptographic proof that batch of transactions is valid. Guarantees correctness, not just assumption. Much faster finality than optimistic rollups.
- Data Availability: Compressed transaction data published on L1 (Ethereum). Anyone can reconstruct state, even if operator disappears.
- State Root: Root hash of rollup's state tree (accounts, balances). Updated on L1 after each batch with proof.
- Sequencer: Node responsible for ordering, batching, and proving transactions. Can be centralized (for speed) or decentralized.
- Immediate Finality: Once proof verified on L1, transactions are final. No waiting period for withdrawals.
Why ZK-Rollups Matter
Ethereum's layer-1 throughput is limited (~15 transactions per second), causing high gas fees during congestion (>$50 per transaction). ZK-rollups scale Ethereum by 100-200x.
- High Throughput (Scalability): 2000-4000 transactions per second (Ethereum L1 is 15 TPS). Each batch (500k gas) processes 1000s of transactions. Constant throughput independent of number of users.
- Low Fees (Affordability): Fraction of a cent per transaction (vs $5-50 on L1). Batching amortizes fixed costs across many users. Only state updates on L1, not each transaction.
- Fast Withdrawals: Minutes to withdraw (vs 7 days for optimistic rollups). No challenge period; proof already verified. Better capital efficiency than optimistic rollups.
- Same Security as Ethereum: Inherits L1 security, not separate consensus. Proof verified on L1; invalid proofs rejected. Data available on L1 for reconstruction.
- Instant Finality: Proof verification on L1 = transactions final. No waiting for fraud proofs, no assumption of honesty.
ZK-Rollup vs Optimistic Rollup comparison:
Aspect ZK-Rollup Optimistic Rollup
─────────────────────────────────────────────────────────────────────────────
Validity Mechanism Validity proof (ZK) Fraud proof (assume valid)
Withdrawal Delay Minutes (immediate) 7 days (challenge period)
Finality Instant (proof verified) Delayed (challenge window)
Gas Cost per TX <0.01 cent (batched) <0.01 cent
Ethereum Alignment Validity proofs trusted Requires honest validators
EVM Compatibility Growing (zkEVM) Full (Geth compatible)
Centralization Risk Proving expensive (prover) Lower hardware requirementsHow ZK-Rollups Work
ZK-rollup lifecycle:
1. User deposits funds to rollup contract on L1
────────────────────────────────────────────────────────────────────────
User sends ETH to rollup contract → Deposit recorded in rollup state
User has balance in rollup (can now transact)
2. User submits transaction to rollup sequencer
────────────────────────────────────────────────────────────────────────
User signs transaction (similar to L1), includes fee
Sequencer collects pending transactions (mempool)
3. Sequencer batches transactions and generates proof
────────────────────────────────────────────────────────────────────────
Sequencer executes batch → updates state (accounts, balances)
Generates proof of correctness (zk-SNARK/STARK)
Computes new state root (Merkle tree)
4. Sequencer submits batch to L1 rollup contract
────────────────────────────────────────────────────────────────────────
Uploads compressed transaction data (data availability)
Submits new state root, proof, and public inputs
5. L1 contract verifies proof and updates state
────────────────────────────────────────────────────────────────────────
Contract checks that proof validates transition
If valid: updates state root, batches applied
6. User withdraws funds (direct from contract)
────────────────────────────────────────────────────────────────────────
User proves ownership of funds (Merkle proof)
Contract verifies proof and sends ETH to userTypes of ZK-Rollups
| Type | Proof System | EVM Compatibility | Examples |
|---|---|---|---|
| ZK-SNARK Rollups | zk-SNARKs (Groth16, PLONK) | Limited (custom circuits) | zkSync Lite, Loopring |
| zk-STARK Rollups | zk-STARKs | Limited (custom VM) | StarkNet, dYdX (perpetuals) | zkEVM Rollups | Various (SNARK/STARK) | Full EVM compatibility | zkSync Era, Polygon zkEVM, Scroll, Linea |
Proof system comparison:
Proof System Proof Size Verification Proving Time Trusted Setup
─────────────────────────────────────────────────────────────────────────────
zk-SNARK (Groth16) ~200B Very fast Seconds Yes (per circuit)
zk-SNARK (PLONK) ~400B Fast Minutes Yes (universal)
zk-STARK ~100-200KB Moderate Tens of minutes No
zkEVM projects:
Project Type Status
─────────────────────────────────────────────────────────────────────────────
zkSync Era SNARK-based Mainnet (EVM-equivalent)
Polygon zkEVM SNARK-based Mainnet (EVM-equivalent)
Scroll SNARK-based Mainnet (EVM-equivalent)
Linea SNARK-based Mainnet (ConsenSys)
StarkNet STARK-based Mainnet (not EVM-compatible, custom VM)ZK-Rollup Economics
Cost structure for ZK-rollups: Fixed cost per batch (L1 verification gas, data availability) + variable cost per transaction. Batching amortizes fixed costs.
Gas cost breakdown:
Batch Submission Cost (~500k gas on L1):
• Calldata (compressed transactions): ~300k gas
• Proof verification: ~150k gas
• Contract overhead: ~50k gas
Total per batch: ~500k gas
If batch contains 1000 transactions:
Cost per transaction = 500k gas / 1000 = 500 gas
Compared to L1 transaction (21000 gas):
Cost reduction = 21000 / 500 = 42x
Dynamic cost:
• Gas price on L1 (e.g., 50 gwei)
• Batch cost: 500k * 50 = 0.025 ETH (~$50)
• Per transaction (1000 tx): $0.05
Economics improve with more transactions per batchZK-Rollups Anti-Patterns
- Centralized Sequencer Risk: Single sequencer can censor transactions or front-run. Mitigation: decentralized sequencer set (e.g., zkSync's pending decentralization). Some projects have emergency exits via L1.
- Not Publishing Data On-Chain: Data must be available on L1 for security (reconstruction). Some rollups use validium (off-chain data) — different tradeoffs (weaker security). Ensure data availability guarantees understood.
- Slow Proving (User Experience): Generating proof for batches takes time (minutes). Users may wait for confirmation. Mitigation: fast provers (parallelization), pre-computation, aggregator ready for next batch.
- Limited EVM Compatibility (zkEVM Challenges): Early rollups supporting only custom languages (not Solidity). Developers must rewrite contracts. Choose zkEVM rollups for general EVM compatibility.
- Withdrawal Front-Running: User withdrawal may be front-run (included before competitor). Mitigation: signatures with inclusion requirements, sequencer must include.
Rollup risk assessment:
Risk Factor Mitigation
─────────────────────────────────────────────────────────────────────────────
Centralized sequencer Decentralization in roadmap, emergency exits
Proof generation delay Fast provers, parallelization
Data availability Publication on L1 (not validium) for rollup
Bridge security Audited contracts, time delays, caps
EVM incompatibility Use zkEVM (EVM-equivalent) rollups
Upgradeability risk Time locks for contract upgradesZK-Rollup Best Practices
- Choose zkEVM for General Applications: For new applications, prefer zkEVM rollups (zkSync Era, Polygon zkEVM, Scroll). They offer Solidity compatibility, developer tooling (Hardhat, Foundry), and portability of existing contracts.
- Use Bridge Aggregators: ZK-rollups have native bridges (ETH, ERC-20). Use aggregators (Relay, Hop, Across) for faster cross-rollup transfers. Understand fees and security.
- Monitor Rollup Status: Check for sequencer liveness, proof verification failures, contract upgrades. Use block explorers (e.g., zkSync Era block explorer, StarkScan).
- Prepare for Withdrawals (L1): Withdrawal must be claimed on L1. Track proof inclusion. Beware of withdrawal delay if contract busy (queued).
- Understand Data Availability Models: Rollup mode: data on L1 (security). validium mode: data off-chain (higher throughput, weaker security). Ensure mode matches application security requirements.
Selection guide by use case:
Requirement Recommended ZK-Rollup
─────────────────────────────────────────────────────────────────────────────
General EVM apps zkSync Era, Polygon zkEVM, Scroll
DeFi (low cost, high volume) zkSync Era, Polygon zkEVM
NFT minting Loopring (immutable X-style)
High-frequency trading dYdX (perpetuals, custom)
Privacy (shielded transactions) Aztec (private, sunset)
Custom ZK circuits StarkNet (Cairo), zkSync (LLVM)
Existing Solidity codebase zkSync Era (EVM-compatible)Frequently Asked Questions
- What is the difference between ZK-rollup and validium?
ZK-rollup publishes transaction data on Ethereum L1 (data availability). Validium keeps data off-chain (on external DA layer). Validium has higher throughput but weaker security (operator could withhold data). Validium can be upgraded to rollup. - Are ZK-rollups decentralized?
Most current ZK-rollups have centralized sequencers (for speed). Decentralization of sequencer planned for all major projects. Users can always withdraw via L1 (emergency exit). Eventually, sequencer set will rotate. - How long does it take to withdraw from a ZK-rollup?
Withdrawals are relatively fast after proof verified (minutes). Optimistic rollups take 7 days (challenge period). ZK-rollup withdrawals: proof generation (minutes) + finality (once L1 confirms). Some projects offer fast exits via liquidity providers. - Can I run my own ZK-rollup node?
You can run a node that tracks rollup state (reads L1 data). But currently you cannot be a sequencer (centralized). Some projects allow permissionless block building in future. - What is zkEVM (zk-EVM)?
zkEVM is a ZK-rollup that is compatible with Ethereum's EVM. Developers can deploy existing Solidity contracts without modification. Different levels of compatibility: bytecode-equivalent (e.g., Scroll), language-equivalent (e.g., zkSync Era). Compatibility reduces developer friction. - What should I learn next after ZK-rollups?
After mastering ZK-rollups, explore zk-SNARKs for validity proofs, Circom for writing circuits, zkEVM internals, optimistic rollups as alternative, and bridging for cross-rollup communication.