Key Terms

ELI5 ZK-Rollups

• Ethereum has limited capacity and high demand, making transaction fees very expensive, with basic token swaps frequently costing more than $100 during periods of high activity.
• ZK-Rollups essentially take this activity away from the congested mainnet by verifying transactions all off-chain with a cryptographic proof and then confirming this proof on L1.
• ‘ZK-Rollup’ is generally a misnomer as transaction data must be posted to L1 in order for it to be properly verified. The correct term for most ‘ZK-Rollups’ is Validity Rollups e.g. StarkNet, zkSync.
• ZK-Rollups are inherently difficult to make compatible with Ethereum. However, Ethereum-compatible validity rollups are in advanced development, notably zkSync 2.0, Scroll, and Polygon Hermez. Other rollups like StarkEx and StarkNet use Cairo - a language optimized for validity proofs.
  • ZK-Rollup's challenges with Ethereum compatibility is a short/medium-term disadvantage compared to Optimistic Rollups which are already EVM compatible or equivalent. Projects working on zkEVMs claim to have made far faster progress than previously anticipated. It remains to be seen how these will perform when launched.

At a high level, ZK-Rollups can be broken down into three characteristics:

1. Transaction computation and sequencing occur in an off-chain environment on L2.
   • ZK-Rollups batch a large number of off-chain transactions and generate a cryptographic proof regarding their validity.
   • These proofs can be STARKs (StarkEx, StarkNet), or SNARKs (ZK-Sync, Aztec Network).
2. Transactions are then sent to L1.
   • These validity proofs are then posted to the Ethereum mainnet (L1).
3. There is a rollup smart contract on L1 that verifies the proof.

   • This crucially means that rollup transactions inherit the underlying security and decentralization of L1.

     Rollups essentially move computation data storage off-chain, while retaining L1 security by posting the transaction data and a mathematical proof of its off-chain computation on L1 where it can be validated. It is currently mathematically impossible to include fraudulent validity proofs meaning that ZK-Rollups can rely on the mathematical integrity of the proofs.

ZK-Rollups take a ‘guilty until proven innocent’ approach whereby transactions are validated before being posted to L1. This differentiates them from Optimistic Rollups which take an ‘innocent until proven guilty’ approach to transaction validation.

Key actors in a ZK-Rollup include

• Prover: Conducts mathematical validity proof to attest to the integrity of transactions.
• Sequencer: Block producer, arranges transactions in a block.
• Verifier: A smart contract on L1 that verifies the proof. This leverages the security and decentralization of L1.

The prover and sequencer are different roles but can be conducted by the same entity. In order to achieve censorship resistance in ZK-Rollups, these roles will need to be decentralized. This may work by having various provers/sequencers on standby and/or having a random rotation.

What is the core thesis on ZK-Rollups?

Ethereum L1 is plagued with scalability issues as its decentralized consensus mechanism makes it slow and expensive. ZK-Rollups (or validity rollups) have long been heralded as the most exciting development in Ethereum scaling. Overall, many people share the view with Vitalik Buterin that Optimistic Rollups will be more prevalent in the short term because of their easy EVM compatibility/equivalence and lesser technological complexity, while ZK-Rollups are expected to prevail in the medium-to-long-term as the technology matures.

• ZK-Rollups are designed to leverage both mathematical integrity and the security and decentralization of Ethereum in scaling blockchains.
• ZK-Rollups batch a large number of L2 transactions that were executed off-chain, generate a validity proof regarding the transactions and submit this validity proof as one transaction onto Ethereum.

Rollups are an exciting solution to blockchain scaling as they can leverage the underlying security of the underlying blockchain (with Ethereum L1 widely considered the most secure and decentralized). Transactions are computed off-chain (on L1) with various ways to massively scale e.g. validiums and volitions for specific applications. The ability to leverage the security of Ethereum while benefiting from the scale that rollups can offer make them a powerful value proposition.

It is worth emphasizing again that because StarkEx, StarkNet, and zkSync do not actually use zero-knowledge technology, they do not implement any privacy by default.

Since ZK-Rollups do not depend on network participants to challenge transactions, withdrawals from L2 to L1 can occur as soon as the validity proof is confirmed on L1. However, generating these proofs is complex and at present is currently done by a single operator. A key challenge and objective for ZK-Rollups will be decentralizing proving in the future. This does not necessarily mean that there would be a BFT-like consensus. ZK-Rollups likely operate best with centralized block production and verification, with Vitalik stating that block production will likely be centralized, while confirmation decentralized. However, to be satisfactorily decentralized and censorship-resistant, it should be easy for anyone to participate as a sequencer and prover should any sequencer(s)/provers stop working/get censored.

OR vs ZKR Cheat Sheet

The following cheat sheet is provided to contextualize ZK-Rollups in the L2 space. Check out our report on Optimistic Rollups here.

SNARKs vs STARKs

SNARKs

SNARKs are the most widely used validity proof in ZK-Rollups. The first paper on SNARKs was co-authored by Starkware co-founder Alessandro Chiesa in 2012.

Advantages

• SNARKs are the most tested validity proof - with the most developer libraries, projects and published code. As a result, there is far greater support for developers using SNARKs rather than STARKs.

• Another benefit is that SNARKs use far less gas than STARKs, making them more cost-efficient for users. The size of the SNARK proof is less than STARK proofs - requiring less on-chain storage.

Disadvantages

• SNARKs rely on elliptic curves for their security which are vulnerable to quantum computing. Furthermore, they require an initial trusted setup.

STARKs

STARKs are a cryptographic proof used by StarkWare and were co-invented by StarkWare co-founders Eli Ben-Sasson and Michael Riabzev.

Advantages

• STARKs remove this requirement of a trusted configuration that is needed with SNARKs, removing the risk of those parties compromising the entire system. Instead, STARKs use publicly verifiable randomness to create trustlessly verifiable computation systems (Source: Ethhub)
• STARKs are more scalable than SNARKs regarding computational size and speed.
• It is currently understood that STARKs are quantum-resistant, whereas SNARKs are vulnerable to quantum computing attacks.

Disadvantages

• STARKs are less tested in practice than SNARKs
• STARKs do have larger proof sizes than SNARKs and therefore require more time to verify and typically cost ~10x more gas.

Having a universal trusted setup reduces trust assumptions as a greater number of community participants participate with greater scrutiny around the setup ceremony. zkSync used a universal trusted setup. Source: Ethworks

Transaction Data Storage Architecture

What Is Validium?

Transaction data can be stored on-chain and off-chain, which is a core trade-off between security (on-chain) and scalability (off-chain). ZK-Rollups save transaction data as calldata on-chain, whereas solutions storing it off-chain are called Validium.

A key risk of Validiums is that attackers (be it malicious actors or governments) can potentially freeze accounts and/or halt block production by making data unavailable. A potential incentive to do this would be to receive a ransom from the affected party. This is why Validiums are generally better suited to high-volume activities like gaming rather than high-value activities like DeFi.

There are several different variations of Validium:

Data Availability Committee

• A group of trusted entities maintains the off-chain data.
• Example: StarkEx validium.
  • StarkEx requires only one committee member to be available and honest to post data. In order for the data to be lost, all committee members would need to misbehave.
  • Examples include Immutable X (NFT-centric L2), Sorare (fantasy football game), and DeversiFi (decentralized crypto exchange).

Proof of Stake Guardians Guardians stake the native token and provide data availability attestations. If there are any errors in these attestations, their stake is slashed. It is likely that this form will be used in the future as ZK-Rollups introduce native tokens to reward ‘guardians’.

• Example: zkSync has announced plans to do this.

Data Availability Layer This uses a separate data availability layer blockchain. A benefit of moving DA to a dedicated DA layer is a lower threshold to become a node, which should help make the data availability layer more scalable and take on the security of the chain providing the DA for the given rollups. These can be seen as more decentralized than the current DA setups for validiums which are more trusted/closed off but they also introduce their own trust assumptions.

• Example: Polygon Avail, Celestia

Validiums unlock exponential scaling with ZK-Rollups. This is because the cost basis is:

1. Proof costs (fixed)
2. Data costs (scale linearly)

Therefore, in a validium where data is stored off-chain at a very low cost, the more transactions there are, the cheaper it is per transaction (up to a currently unknown limit).

Hybrid solutions that allow for a choice between on-chain and off-chain storage on a transaction basis are called Volition.

Volition As stated above, Volitions are hybrid solutions, that enable users/protocols to choose between on-chain (ZK-Rollup) and off-chain storage (Validium) on a per-transaction basis.

Volition Example:

zkSync 2.0 will operate as a volition whereby:

ZK-Rollup

    - This will comprise the protocols and the contracts

Validium

    - Users will interact with the validium (zkPorter). They can opt to have their transactions included in the ZK-Rollup if they would prefer greater security (at greater expense).
    - As explained above, zkSync’s validium will use proof of stake guardians. This is riskier and less secure than ZK-Rollup (with mathematical assumptions) but would require more than ⅔ of validators to launch a successful ransom attack. If zkSync reaches a large scale, this would be extremely difficult and unlikely. 

Data Storage On Ethereum Scaling Solutions

Source

ZK-Rollup Ecosystems Landscape

There are several projects working on more generalistic ZK-Rollup solutions at the moment, with the most prominent players listed below. Other big players like Loopring, which are also building on ZK technology but envision more of a closed ecosystem for their product, are omitted from this list (although they announced that they collaborate with the Ethereum Foundation on a zkEVM).

Scaling

EIP-4488

EIP-4488 (if implemented) is expected to reduce gas costs by approximately 5x. This is designed to improve the capacity of L1 for rollup transactions. However, EIP-4488 is not without controversy and it is unclear as of now if it will be implemented. This is because the blockchain growth would accelerate, making it more expensive to run a node. EIP-4444 removes this history after a year and should help, but the long time frame (1 year) will reduce the impact of this compared to EIP-4844 whereby this period will be approximately 1 month. Note the potentially confusing similar names of the EIPs.

EIP-4844 - Proto-danksharding

Vitalik submitted a proposal to reduce transaction costs for rollups - EIP-4488. This is expected to reduce costs for rollups by up to 10-100x from the current state. EIP-4844 introduces ‘data blobs’ which are a transaction type whereby transactions are no longer posted as call data, but as ‘data blobs’ which are removed after approximately 1 month. The Ethereum Foundation has taken the position that 1-month is a satisfactory timeframe for this data to be downloaded so it can be made available when required.

Note that given that most of the transaction cost in optimistic rollups is from posting the call data to L1, EIP-4844 will deliver far greater cost savings to ORs vs ZKRs.

Danksharding

Danksharding is Ethereum’s endgame of achieving a unified settlement and data availability layer. Ethereum’s original scaling plan was to shard the chain. Danksharding moves away from this - and is not actually sharding per se. In fact, the only element of sharding is that validators do not need to download all the data - instead they sample pieces of the data. This greatly reduces the bandwidth burden on validators and ensures a large and decentralized validator set remains possible.

Danksharding includes many of the elements that will be introduced by protodanksharding, with key additions of data availability sampling and proposer-builder separation.

Layer 3/Fractal Scaling

The Starkware ecosystem has started to shift the narrative beyond L2 scaling to L3 scaling. L3 is to L2 what L2 is to L1. The proposed L3 would be an application-specific layer built atop L2 (Starknet). This means that StarkEx, which currently operates as an L2 solution, will be ported to L3. This opens up enormous scalability potential for the Starkware ecosystem.

The following diagram shows how L3 would operate in practice, with all layers inheriting the security of L1, directly (L2), and indirectly (L3+).

Source: Starkware

At a high level:

1. Transactions processed on L3
2. Proofs of batches sent to L2
3. Proofs are verified on L2
4. Multiple proofs are rolled into a single proof that is submitted to Ethereum L1

L3 seeks to enable:

• Increased developer control of their technology stack, optimizing for their specific application.

This includes

• Customized data availability
• More deterministic cost and performance
• Faster deployment of new features
• Hyper-scalability by leveraging the multiplicative effect of recursive proving.
  • E.g. if each layer results in a 100x reduction from the previous layer.
    • L2 (100x reduction) x L3 (100x reduction) = 10,000x reduction from L1.
• Privacy
• Easier interoperability between L2 ←-> L3 vs L1 ←-> L2.
  • On/off ramping is highly expensive between L2-L1. The massive cost reduction of L2 makes L3-L2 interoperability far easier and cheaper.
  • Starkware argues that the latency of moving assets between L2-L3 is longer than applications on the same L2, however, the cost and throughput is still comparable.
• L3-L3 interoperability improves for the same reasons discussed above.
• Starkware proposes that L3 could be used as a ‘Canary Network’ - similar to the Polkadot-Kusama model. This would be an interesting development and could even foster greater innovation in the Ethereum ecosystem.

Source: Starkware

The diagram above illustrates the envisioned rollup-centric hyper-scalable Ethereum ecosystem. As demonstrated above, the hypothetical L3s are application-specific, whereby they can have greater freedom in optimizing their application than building on a more generalized system in L2.

Issues

One thing that should be noted is that L3 is obviously a layer further away from L1 than L2. The additional risks of this added layer of separation are yet to be properly determined. Risks include smart contract risk, censorship risk, runtime risk, and more.

Interestingly, StarkEx will move from L2 to L3, as well as certain instances of StarkNet. This is an exciting prospect, however, it should be noted that it is currently theoretical and has not yet been implemented in practice. That will be the true test of whether or not it will operate as intended. As of now, it is unclear what scaling limit there is for this technology, meaning there could be some unintended consequences of pursuing an aggressive L2-L3 strategy.

Privacy

Some ZK-Rollups like Aztec Network incorporate privacy by default - enabling private transactions. Privacy is often seen as a key issue with blockchains - whereby everyone can see everything. However, privacy is not guaranteed even on Aztec, and by withdrawing to the same L1 address to which you deposited, one can start to reduce privacy for other participants. Aztec is developing fully private smart contracts and is one of the most advanced actual zero-knowledge rollups. A privacy-focused bridge is also currently in development.

Starkware and zkSync, on the other hand, do not offer zero-knowledge products and therefore lack privacy-preserving transactions by default. That said, privacy protocols may be deployed atop these infrastructures due to the high levels of computation such applications generally require and the scaling possibilities enabled by ZK-Rollups.

The lack of privacy by default is arguably a positive feature. Privacy-preserving applications such as Tornado Cash have attracted negative attention from many regulators as they have been used for laundering stolen funds. A privacy-first protocol could suffer in a regulatory environment that bans untraceable funds from entering the system. However, there is interesting potential for privacy-preserving applications that are General Data Protection Regulation (GDPR) compliant for example.

Top Market Participants and Protocols

StarkNet

StarkNet is a permissionless decentralized ZK-Rollup that supports sophisticated smart-contract applications and operates as an L2 network over Ethereum. As an L2, it allows dApps to scale without having to compromise on Ethereum’s composability and security.

StarkNet uses the Cairo programming language and is also in the process of being deployed with full functionality. StarkNet Alpha has already launched and is currently live on mainnet. Additionally, the ecosystem has been flourishing with numerous protocols and applications building atop it. Check out the comprehensive list of projects building on StarkNet here.

Ecosystem

The number of projects and the quality of some of the projects is a bullish indicator for StarkNet.

DeFi

ZigZag Exchange (Website/Twitter) ZigZag Exchange is an order-book based DEX launching on both zkSync and StarkNet.

JediSwap (Website/Twitter) Jediswap is a fully permissionless and composable AMM on Starknet. The protocol is built by the same team behind Mesh Finance.

zkLend (Website/Twitter) zkLend is a lending and borrowing protocol built on StarkNet. The protocol offers a dual solution: a permissioned and compliance-focused solution for institutional clients and a permissionless service for regular DeFi users.

Notable DeFi protocols that have announced intentions to launch on StarkNet include:

• MakerDAO
• Aave

NFTs/GameFi

PlayOasis (Website/Twitter) PlayOasis is an NFT marketplace powered by StarkNet.

Loot Realms (Website/Twitter) Loot Realms is a massively multiplayer on-chain game of economics and chivalry.

Wallets

Argent X (Website/Twitter) Argent X is the primary StarkNet wallet to interact with DApps and tokens. What makes Argent different from most wallets is the ability for users to pick a “guardian” that can recover a wallet in the event they lose access to their seed phrase.

Braavos (Website/Twitter) Braavos is another key wallet for StarkNet.

Bridges

In order to bridge from Ethereum Mainnet to StarkNet, users will need to have their Metamask and Argent wallet ready. Visit the official StarkGate bridge here.

Starknet’s native bridge called ‘ StarkGate’ has been live since May 9th 2022 and has a TVL of 260 ETH (~$520k) at the time of writing. Starkgate Alpha is live on Mainnet and currently supports only ETH with a hard cap total bridge limit of 260 ETH that routinely gets lifted.

To reduce risks involved in using an Alpha version, the bridge will limit the amount of ETH, in addition to limiting the maximum amount of ETH per transaction too. There will be plans to gradually ease the limitations and lift them completely as confidence grows. Additional tokens like WBTC, USDC, USDT, and DAI will be supported in the near future too.

Check out the StarkGate Bridge on Nansen here.

StarkEx

StarkEx leverages STARK technology and is a deployable self-custodial tool for high-performance dApps. It can be considered as an L2 scalability engine that enables an application to scale significantly and improve transaction speeds

All dApps that use StarkEx have an off-chain component that executes transactions and holds the state of the off-chain system, while periodically sending updates to the on-chain component. This on-chain component ensures that state transactions are valid.

Examples of projects using StarkEx:

• dYdX (perpetual contracts trading)
• DeversiFi (trading)
• Immutable X (gaming and NFTs)
• Sorare (NFT sports game)

zkSync

zkSync is an L2 scaling solution on Ethereum powered by ZK-Rollup technology. zkSync 2.0 is EVM compatible and the public Testnet went live in February 2022. Being EVM compatible is a potential advantage as it should make it relatively easy for Ethereum developers to build applications on zkSync. Ethereum has by far the largest number of active developers in crypto.

Source: Electric Capital

In return, this will allow protocols to deploy seamlessly onto zkSync 2.0 much easier. There are dozens of projects building on zkSync and a comprehensive list can be viewed here. If zkSync can establish itself as a reliable zkEVM it could build a very strong ecosystem.

Ecosystem

DeFi

DeFi Large-caps The following DeFi protocols have stated intent to deploy on zkSync:

• Curve
• Yearn
• 1inch
• Alchemix

ZigZag Exchange (Website/Twitter) ZigZag Exchange is an orderbook-based DEX that aims to provide the CEX like experience with deep liquidity and minimal fees and slippage. The protocol also has a bridge that allows for easy fund transfers from Ethereum mainnet. An upcoming NFT marketplace is also in the works.

SyncSwap (Website/Twitter) SyncSwap is an AMM dex built on zkSync 2.0. The protocol is currently in testnet.

Notable DeFi protocols that will be launching on zkSync 2.0:

• Yearn Finance
• Frax
• Alchemix
• 1inch Network
• Olympus DAO

NFTs/GameFi

tofuNFT (Website/Twitter) tofuNFT is a multi-chain NFT marketplace focused on GameFi and collectables.

Tevaera (Website/Twitter) Tevaera is a gamified metaverse where players can build, monetize, and govern digital islands, trade utility NFTs, and participate in fun arcade mini-games.

Wallets Since zkSync 2.0 will be EVM compatible, most users will be able to use familiar Ethereum wallets like Metamask, Argent, Numio, 1inch Wallet, Mykey, and imToken to sign transactions and manage their assets.

Bridging With the zkSync airdrop confirmed, using the official bridge will likely be a prerequisite or potentially directly qualify for the airdrop. Users can deposit through the official bridge here.

The other 3 bridges currently live are ZigZag Exchange, Orbiter Finance and LayerSwap. Other bridges like Celer, Connext, DAI Wormhole, Composable, Hop Exchange, LayerZero, PolyNetwork, deBridge and Nomad are also in the works and will be going live soon.

Crypto Exchange/Fiat On and Off Ramps For users who prefer using a CEX, major exchanges like Crypto.com, Bybit, Huobi, Blockchain.com, OKEx and Ripio are integrating direct deposit and withdrawal capabilities with zkSync.

And for those who want to purchase crypto directly on zkSync with a debit/credit card, Banxa, Ramp Network, UTORG, and Moonpay will provide that ability. They will however charge a 3-5% fee so unless you don’t have funds on-chain, bridging will be a far cheaper option.

Loopring

Loopring is an application-specific L2 ZK-Rollup protocol built for securely scaling exchanges and payments. What makes Loopring unique from other competing L2 scaling rollups is that they do not actively seek to have other protocols or dApps built on top of them. They are focused on developing in-house product offerings such as their own DEX and wallet. However, in March 2022, Loopring announced a partnership with Gamestop to launch their NFT Marketplace built atop Loopring L2. The partnership has onboarded new users and resulted in a surge in the record-high number of wallets joining the network can be seen.

Loopring Exchange Loopring exchange is a non-custodial AMM and orderbook-based exchange.

Loopring Wallet (website) Loopring wallet is a self-custodial wallet with a social recovery and ‘guardians’ feature. With the ‘guardians’ feature, users can rest assured that their funds will be recoverable if at least half of the guardians approve the recovery. The wallet is also mobile-compatible.

Trust/Security assumptions

Mathematical Assumptions ZK-Rollups assume the mathematical integrity of the validity proofs/ZK-proofs. While all current evidence suggests that they are highly secure, the technology is relatively untested, especially with STARKs. Therefore, this is a key security assumption with very serious consequences if proven incorrect.

Centralization ZK-Rollups currently have centralized validity proof generation and transaction sequencing. This is done to bootstrap the network and enable its smooth development. The intention is to decentralize as soon as possible - however, this needs to be done carefully. That said, it is difficult to know how this ‘decentralized’ future looks. Vitalik argues persuasively that block production in rollups will be centralized. It will be crucial for rollups to become censorship resistant while maintaining centralized proving. This will likely entail having a sufficient global network to seamlessly take over proving/sequencing in the event of censorship/provers going down.

SNARK Trusted Setup SNARKs (as used by zkSync) have an initial trusted setup whereby a small group of developers has asymmetric knowledge of the initial trusted state. This poses some centralization risk. Note that the STARKs used by Starkware avoid this issue - there is no backdoor for developers.

Code Assumptions A general assumption is that the code behind ZK-Rollups is watertight. However, it is a relatively new and untested technology and there could be security bugs that place funds at risk. This is a major concern for all rollups.

What Would Cause ZK-Rollups to Fail?

• Failures in the aforementioned security and trust assumptions would result in ZK-Rollups failing.
• A failure to decentralize could also result in ZK-Rollups failing. This needs to occur at the sequencer and prover level. Interestingly, dYdX recently announced that they will be moving from StarkEx to set up a Tendermint chain on Cosmos. The rationale for doing so is that L2s are currently centralized, and a standalone and customizable Cosmos blockchain was best suited to optimizing their product and scaling it beyond what is currently possible on StarkEx.
• Beyond that, alternatives e.g. app-chains or alternative L1s will make redundant ZK-Rollups if they receive far greater developer and user adoption. However, it is unclear now that an objectively better alternative will exist when (or if) ZK-rollup technology matures.
• Furthermore, if languages such as Cairo do not get sufficiently adopted, and the EVM wanes in importance, this could limit the adoption of ZK-Rollups (at least in their current form), where other ecosystems like Polkadot and Cosmos enable virtual machines that are optimized for their specific use case.
  • In effect, app-specific ZK-Rollups must be relatively easy to construct. This may hinge on wider adoption of ZK-Rollup computing languages or the ability to create app-specific rollups with common computing languages.

What Would Cause ZK Rollups to Succeed?

• ZK-Rollups are widely regarded as one of the most exciting scaling solutions in crypto. They are a relatively nascent technology, and the deployment of high-value applications will be crucial.
• ZK-Rollups are potentially superior scaling solutions to alternative L1 blockchains due to the enormous scalability they can provide with volitions and recursive proving. It is crucial that ZK-Rollups decentralize relatively quickly to become censorship resistant. This may be achieved by enabling various reserve sequencers/provers to take over in the event that the sequencer/prover goes down/is forcibly taken down.
• In addition, the adoption of ZK-specific languages like Cairo will be important to the development of the ecosystem. Languages like this are optimized for validity proofs and therefore potentially better suited to building applications rather than forcing the EVM upon them - which has various design tradeoffs and wasn’t designed with ZK-Rollups in mind.
• On the flip side, EVM-equivalent ZK-Rollups will be important for adoption (at least in the short-term or as long as EVM dominance holds), with projects such as Scroll claiming to solve this.