Understanding ZK-Rollups: How Do They Bring a Paradigm Shift to the Crypto Ecosystem?

Written by: Cati

Edited by: Nan Feng

The scalability trilemma exists in all blockchain networks. The greater the difficulty of achieving scalability on a blockchain L1 (mainnet), the higher the minimum hardware requirements for running a full node on that network. When running a full node becomes less feasible, the blockchain network becomes more centralized.

It is evident that Ethereum has long prioritized the security and decentralization of L1 over scalability. However, as Ethereum shifts to a Rollup-centric roadmap, it is leveraging its L1 foundational layer (especially its vast full node network) to provide robust data availability instead of L1 scalability, while maintaining the network's security and decentralization.

*Above: The blockchain's *trilemma*, image source: *Vitalik Buterin*

The intention behind Ethereum's shift to this roadmap is that most of the transaction execution (including DeFi, NFTs, and other activities) on the Ethereum blockchain today will move to Rollups rather than being executed on Ethereum L1. This contrasts with the approach of many L1 chains in the industry that focus on speed and security (rather than decentralization).

However, this "trilemma" does not apply to Rollups: Rollups inherit the security of the Ethereum L1 mainnet, and because Ethereum L1 handles the difficult parts, Rollups can focus on being the best execution layer.

You may have heard of Optimism and Arbitrum, both of which are Rollup networks based on Optimistic Rollups technology; another type of Rollup network is based on ZK-Rollups technology, and there are already some ZK-Rollups-based networks live (such as the current Loopring and zkSync 1.0).

However, ***no ZK-Rollup network currently provides general-purpose EVM compatibility (i.e., ***zkEVM), but with networks like zkSync 2.0, Scroll, and StarkNet making rapid progress, *this situation will not last long*.

So, why is this important? When Ethereum transforms from a "monolithic blockchain" to a modular system, this will change the competitive dynamics of blockchains. As Polynya pointed out in its article, other L1 smart contract blockchains will no longer compete directly with Ethereum but will compete with Rollups.

I believe that with the emergence of general-purpose ZK-Rollups networks compatible with EVM, this will not only render Optimistic Rollups somewhat outdated but will also make all other L1 smart contract blockchains obsolete.

In fact, through the implementation of these competitive Rollups and their focus on enhancing execution efficiency, Rollups will iterate rapidly to achieve the best version. Since they are likely to undergo rapid changes, I will not attempt to describe specific ZK-Rollups solutions in this article; instead, I will emphasize the capabilities and possibilities of ZK-Rollups in the Ethereum world after the merging of the new and old chains and the implementation of sharding.

1. Security

The security guarantees of Rollups enable some interesting dynamics.

Escape Hatches

If your funds are on the Polygon PoS (Ethereum sidechain) *or the Solana blockchain, and that network goes offline for several hours, you are powerless to access your trapped funds during that time. Unlike using these "sidechains" or other L1 smart contract chains, contracts on Rollups chains based on the Ethereum L1 mainnet *include "escape hatches."*

This allows users to withdraw funds from the Rollups network back to the Ethereum L1 mainnet even if the Rollup network is offline. In a Rollups chain, you can always manually submit transactions to the Rollup contract on the Ethereum mainnet as needed, including withdrawing funds from Rollups back to the Ethereum mainnet.

Ideally, withdrawing funds from Rollup to L1 should be a "comfortable" process. Image source: Google

Centralized Sequencers & Provers (and why they are not so scary)

I mentioned in the introduction that this article will discuss the "best advantages" offered by Rollups, and before anyone is disappointed, I need to clarify an obvious fact: the ideal scenario is for Rollups to achieve fully decentralized sequencers and provers.

However, this was not the initial situation: most Rollups had varying degrees of centralization at launch and gradually achieved decentralization. That said, it is worth emphasizing that Rollups chains with centralized sequencers are still more secure than centralized L1 chains.

When you use a Rollup network with a centralized sequencer or prover, you are only compromising on trust and censorship resistance, not on security. The operators of Rollups sequencers cannot steal your funds; you can always withdraw your funds back to the Ethereum mainnet. In fact, you primarily rely on the activity of the central sequencer.

We have all heard jokes about blockchains being "data center chains." With ZK-Rollups, you can actually have a data center composed of ultra-high-spec machines dedicated to performing proof work, which poses no risk to the network.

Decentralized Sequencers & Provers

Fortunately, because Rollups developers can trigger escape hatches when needed and cannot steal funds, they can experiment with various solutions without worrying about catastrophic consequences. There is considerable room for designing decentralized sequencers and provers.

In its final form, I expect the sequencing and proving work of Rollups networks to be open to the public and provide different forms of economic incentives (tokens, staking, penalties, etc.) to ensure people act correctly. More importantly, we will have distributed Rollups networks that include various businesses, Rollup developers, and enthusiasts running provers.

2. Data Availability

Data availability refers to the data that each Ethereum node needs to maintain. On-chain data storage is highly valuable due to its immutability, but the data capacity on the Ethereum chain is limited, and maintaining this data consumes significant resources; therefore, storing data on-chain is not cheap!

However, once Ethereum implements data sharding and transitions to a modular system, Rollups will gain a substantial amount of data capacity, and this capacity will only increase over time* (as Ethereum will increase from an initial 64 shard chains to 1024 shard chains)*. A large number of full nodes and validators means that Ethereum will have the highest capacity for data availability.

Ethereum Data Sharding

Sharding is a multi-phase upgrade that Ethereum will implement. Shards will act as load balancers for the network's data storage needs, allowing Rollup execution layers to achieve significant scalability improvements. Importantly, this also avoids placing excessive demands on Ethereum network full nodes, allowing the network to remain decentralized.

Initially, 64 data shards (i.e., "shard chains") will be implemented on Ethereum; eventually, there will be 1024 data shards. Data shards will not be responsible for processing transactions or smart contracts but will provide additional data capacity for Rollups.

*Illustration of Ethereum sharding, image source: *Hsiao-Wei Wang*

We know that Rollups periodically publish single state root updates to the Ethereum mainnet in compressed form by batching transactions, which contain the results of many different transactions that occurred at the Rollup layer.

Since Rollups must publish these state roots to the mainnet, the Gas fees that Rollups need to pay are also subject to fluctuations in the demand for mainnet block space, and this cost is typically passed on to the users of Rollups (which we will explain in detail below). Once Ethereum sharding is live, the capacity of the mainnet will increase nearly 20 times, allowing operations on Rollups to be cheap and fast!

Volitions

Volitions are a hybrid scaling solution that allows users to choose between "ZK-Rollup mode" and "Validium mode." Similar to ZK-Rollups solutions, Volitions also require submitting state roots and proofs to the Ethereum mainnet.

However, the difference is that Volitions allow users to make choices regarding data availability: if users want or need to use on-chain data availability, they can choose the zk-Rollup mode of Volition; if they prefer off-chain data availability, they can choose the Validium mode. This trade-off is only available in the ZK-Rollup space; it is not possible in the Optimistic Rollups space.

An example of a Volition solution is zkSync 2.0:

Above: The Volition solution that zkSync 2.0 will implement. Image source: Matter Labs

The Validium mode of zkSync is called zkPorter. In this solution, data availability is protected by zkPorter validators. The Matter Labs team claims that zkPorter will achieve a throughput of 20,000 TPS and a 100-fold reduction in Gas costs.

It is worth noting that the ultimate transaction throughput limit on zk-Rollups is actually constrained by the computational and storage capabilities of its provers. I believe that, in the long run, 20,000 TPS may actually be an overestimation.

3. Transaction Costs & Throughput

Currently, transaction costs on Rollups are already quite low, but not low enough. Fortunately, there are more optimizations that will lead to significant reductions in Gas costs. Additionally, many technologies will be deployed to increase the transaction throughput of Rollups.

The Army of Rollups

Given the lightweight nature of Rollups on the mainnet, it is likely that hundreds of Rollups networks will run in parallel in the future, each supporting hundreds of thousands of users, all with their own massive transaction throughput, all supported and protected by Ethereum.

When a Rollup becomes saturated (for example, due to its sequencer being overwhelmed), it will be easy to jump to another Rollup and start transacting. If needed, you can also fork a Rollup and deploy a copy of that Rollup.

Amortization of Validity Proofs

Amortization of validity proofs refers to the Gas costs that each batch of transactions on ZK-Rollups must pay when submitting state root updates to Ethereum L1 being distributed among all transactions included in that batch.

In this article, I will provide an example to quickly understand the concept of amortization. Please remember that for simplicity, this example is mathematically inaccurate. The formula I provide is only for explanatory purposes; in reality, the breakdown of Rollups transaction costs is not that simple. Here is the imagined scenario:

• Suppose the cost for a Rollup network to update a state root on Ethereum L1 is 5,000,000 Gas;
• Similar to the mainnet, Rollup users also need to pay a Gas fee when initiating transactions;
• Thus, the cost formula for each transaction is x = 5000000/y, where x represents the Gas fee for each transaction, and y represents the number of transactions included in a given Rollup transaction batch.

From this, we can deduce:

• If the transaction batch contains 200 transactions, then the cost per transaction is 25,000 Gas;
• If the transaction batch contains 100,000 transactions, then the cost per transaction is 50 Gas, which is basically negligible.

As we can see, as more users submit more transactions in a batch, the amortized transaction costs become lower. This is in stark contrast to the situation on monolithic blockchains (like the current Ethereum): on monolithic blockchains, the demand for block space increases with the number of active users in the network, and due to the scarcity of block space, this leads to skyrocketing Gas prices.

An example of amortization is that StarkEx provides a mechanism called SHARP (Shared Prover), which distributes costs across all StarkEx deployments.

Volitions

Most of the relevant information about Volitions has already been mentioned above. Nevertheless, this solution is still related to Rollup throughput, so it is worth mentioning Volitions again. A quick recap:

• Volitions give developers and users the ability to use off-chain data availability in Validium mode;
• While the security of this off-chain data availability is not as strong as on-chain data availability, it can lead to significant reductions in transaction costs;
• In addition to reducing transaction costs, off-chain data availability also unlocks a large amount of additional transaction throughput.

4. Privacy

It is well-known that privacy is not an inherent attribute of the Ethereum public chain. By default, ZK-Rollups solutions also do not possess privacy. The "ZK" (zero knowledge) in ZK-Rollups refers to computations occurring off-chain.

Then, the legitimacy is verified on the L1 main chain using zero-knowledge proofs, which does not mean "your transaction activities are hidden from prying eyes." However, it is not that bad: there is currently a lot of work being done to implement permissionless privacy in ZK-Rollups.

Recursive Proofs

Vitalik discussed some key differences between Optimistic Rollups and ZK-Rollups in his article "An Incomplete Guide to Rollups," one of which is how these two Rollup solutions handle privacy issues.

Vitalik specifically mentioned "recursive proofs." Recursive proofs refer to the act of verifying one proof (proof) within another proof, such as verifying one SNARK proof within another SNARK proof. This is a convenient compression technique that can improve efficiency and reduce privacy protection costs.

For example, the Aztec team is working on research related to ZK-ZK-rollup (i.e., ZK²-rollup), which utilizes their innovative PLONK proof and Turbo-PLONK to provide transaction privacy.

It is important to note that Optimistic Rollups cannot achieve this innovation because they cannot safely allow internal SNARK verification outside of the Rollup; data must be published on-chain. This does not mean that Optimistic Rollups cannot benefit from zero-knowledge proofs, but they will always be lower in efficiency and cost-effectiveness.

At the time of writing, zkSync and Mina Protocol have already adopted PLONKs. Over time, we can expect more innovations regarding recursive proofs (including innovations from other protocols like Groth16, Marlin, Fractal, Halo2, etc.) to bring cheaper and more powerful privacy to all ZK-Rollups.

Above: Turbo-PLONK polynomial logic unit, image source: Zero Knowledge Summit.

5. Flexibility

ZK-Rollups enjoy the freedom to innovate in many ways without facing the catastrophic failure risks that other L1 chains do. A key principle of Ethereum's Rollup-centric roadmap is that the free market is seeking all the best ways to build Rollups, rather than allowing a small group of core developers to assume what that way should be.

Since developing and deploying a Rollup network is a permissionless endeavor, we will see many Rollups using different approaches competing for users, including different styles of governance, token economics, liquidity incentive mechanisms, different trade-offs on the decentralization spectrum, varying ideological expressions, and even choosing different VM (virtual machine) environments (such as LLVM, custom VMs, etc.).

However, not everything mentioned in this section is unique to ZK-Rollups. Although Optimistic Rollups lack some features offered by ZK-Rollups, they also possess considerable flexibility. However, other L1 smart contract chains cannot iterate on any of these features as quickly as Rollups can. Remember: now is the time for Rollups to compete against other L1 smart contract platforms.

If an L1 chain tries to iterate quickly, sacrificing proper testing and security measures, it poses a high risk to users. At any time, all funds on an L1 network are a kind of "bounty," and if the L1 chain fails, the losses can be catastrophic.

Downtime will also impact any scalability execution environment (such as Rollups, state channels, etc.) on that L1. It makes sense for L1 networks to prioritize security and decentralization.

In the worst-case scenario, when a Rollup crashes, manual intervention will be required until the issue is resolved. It would be similar to interacting with a smart contract on Etherscan.

Rollups developers and dApp developers may provide "emergency" portals that allow users to quickly and easily perform manual operations on Rollups when needed. Fortunately, these rapid iterations are likely to be addressed early on, and I believe the relevant development work will receive adequate attention.

6. A Wealth of New Applications

By outsourcing computation* (i.e., executing computations at the L2 layer)*, a wealth of new on-chain applications that are currently unfeasible on the Ethereum main chain or any other smart contract platform becomes possible. This new paradigm also allows us to build advanced versions of any existing on-chain products.

Application-Specific ZK-Rollups

While this article primarily focuses on the benefits of general-purpose computing ZK-Rollups, there is much to discuss regarding the impact of application-specific ZK-Rollups.

*

#### dYdX Exchange

Powered by the L2 scalability engine StarkEx, dYdX is a decentralized exchange that supports perpetual contract trading, margin trading, and spot trading, while also enabling asset lending. Since dYdX was deployed on the L2 network, the liquidity generated by the ETH-USD trading pair on the exchange has been comparable to that of the FTX exchange.

Although this liquidity may have flowed in to participate in the platform's DYDX token reward program, I believe that dYdX or some other ZK-Rollup native DEX (decentralized exchange) will one day surpass all perpetual contract exchanges in terms of trading volume and liquidity.

Above: Comparison of dYdX's ETH liquidity to FTX, data as of September 26, 2021. Source: Hsaka

In terms of UX (user experience), you only need an Ethereum wallet and some ETH to log in and start trading on dYdX. Unlike typical centralized exchanges, there is no need for KYC, nor is there a requirement to store your personal information with a third party; of course, the DEX is non-custodial.

You do need to transfer funds to the Rollup to use this DEX, but you can control your funds and withdraw them back to the Ethereum mainnet when needed. Some users of dYdX have reported that it feels as responsive as using a centralized exchange.

Some blockchains have already attracted the attention of high-frequency trading crowds. Assuming that high-frequency trading firms are rational, profit-driven entities, I believe that over time, this activity will mainly reside on ZK-Rollups.

*

#### Immutable X

Another rapidly gaining attention example is Immutable X, which is a Volition solution (also powered by StarkEx) that provides significant scalability benefits specifically for the minting and trading of NFTs (non-fungible tokens).

Recently, TikTok chose the Immutable X platform for their TikTok Top Moments NFTs. The Immutable X platform allows users to mint NFTs at extremely low fees or even for free, without incurring Gas costs of $100 or even $1,000. The platform stated:

"Immutable X offers gas-free and instant transactions: for any marketplace, game, and decentralized application (dApps), Immutable X provides gas-free transactions (minting, trading, profiting, and collecting NFTs are all gas-free), instant NFT trading (up to over 9,000 transactions per second), driving scalability without requiring user custody."

Did you see them say up to over 9,000 transactions per second?

Other Concepts

Volitions will bring new ways to achieve the mission of Web3.0. For example, blockchain-native social networks will benefit immensely from off-chain data availability. Jack Dorsey (founder of Twitter) has talked about his plans to turn Twitter into an open-source distributed system*, where Twitter is merely a client on top of a "Twitter" protocol. Volitions (more specifically, Validiums) could play a key role in that implementation.

Similarly, I can envision a revival of an open-source Vine* (the now-defunct short video app)* where user-submitted short videos (6 seconds or shorter) are minted as NFTs. TikTok and its "Top Moments" NFT program are somewhat similar to this idea, but TikTok is ultimately a closed-source entity, and a little breakthrough for it is never a bad thing.

7. How Will This Competition Evolve?

ZK-Rollups bring a lot to the table, and Ethereum will soon allow ZK-Rollups to perform at their best. But what about other competitive L1 chains? What will happen to these L1 chains that are surpassed by ZK-Rollups in every aspect? This is a good question, but there will inevitably be many complex answers. I have some thoughts on their fate.

Ethereum's Pragmatic Black Hole

In the past year, we have seen many "cheap and fast" EVM-compatible chains spring up like mushrooms. We have also seen some blockchains claiming to "overcome the blockchain trilemma" at the base layer that abandon the idea of continuing to scale through layering (but in reality, they sacrifice decentralization for speed and security).

It is clear that general-purpose computing ZK-Rollups will be more secure, decentralized, adaptable, flexible, and lightweight than any other L1 smart contract chain. These facts are significant; each independently operating L1 chain will bear unnecessary security costs and risks, making it a "subpar product."

In my view, the pragmatic future for these blockchains is to abandon their redundant consensus mechanisms and data availability and become a ZK-Rollup or Volition. They should absorb Ethereum's top-tier security, data availability, and settlement guarantees.

By "outsourcing" consensus and security to Ethereum, these chains will be able to focus more on execution. In a future world where Ethereum implements sharding and Rollups dominate, this will keep these chains relevant. Otherwise, their security costs will become burdensome and difficult to keep up with. Over time, this will become an increasingly clear reality.

Above: Ethereum (left) & other L1 execution layers (right), around 2023. Image source: NASA/CXC/M.WEISS

In other words, abandoning their redundant consensus mechanisms and security costs to become a Rollup based on Ethereum does not mean their tokens will disappear. On the contrary, they can give their tokens new uses to fit their sequencer and prover incentive mechanisms or provide on-chain liquidity incentives. These chains do not need to sacrifice their identity; they just need to shed their dangerous burdens. The impact of this will be positive for them.

Reality

If one thinks that the architects, venture capitalists, and users of these L1 chains will quickly accept this reality, that would be self-deception. The memes they generate have a strong influence, and they are not without pride, with many VCs dreaming of continuing to sell tokens to retail investors.

History tells us that the demise of a blockchain network is never a quick process. You can see thousands of empty blocks on today's Ethereum Classic, indicating a lack of adoption. Many other blockchain networks are similar. They persist, persist, until one day they vanish.

Time

Even if these L1 chains choose the most pragmatic way to become a Rollup network, it will require extensive research, preparation, and caution to achieve such a significant change. Any L1 chain taking this route will need a long time. Perhaps contrary to intuition, my instinct is that Solana will be one of the first blockchains to take this route.

8. Disclaimer

The future of ZK-Rollups may seem like a magical technical solution, but there are some things you need to keep in mind.

General Overview

Here is a non-exhaustive list:

• Depending on the implementation of different Rollups, centralized sequencers may have advantages in executing MEV* (Miner Extractable Value)*.
• Depending on how the data availability committee of Validiums in Volitions is implemented, the validators of the data committee may maliciously freeze or refuse to update the state of Validiums. However, this situation does not apply to the ZK-Rollups mode in Volitions.
• The emergence of many Rollups means more liquidity venues, whether for token trading or NFT trading. Although ZK-Rollups allow for quick transfers between Rollup and mainnet, and even between Rollup and Rollup, the fragmentation of liquidity may cause early turbulence. Fortunately, solutions aimed at addressing this issue, such as dAMM (an automated market maker protocol that supports sharing liquidity across different L2 networks), are being developed.

Running a Rollup prover consumes computation, so we should find ways to reduce potential kW/h consumption while making provers more efficient.

• It is important to note that the proof work on Rollups is not a consumption game like PoW mining; it does not become more difficult over time. Therefore, the energy usage of Rollups validators is unlikely to approach the energy usage of Ethereum during the PoW era.

That said, aside from MEV (Miner Extractable Value), I expect the market to relatively quickly provide solutions for most issues. Unfortunately, MEV is a tricky problem that cannot be solved by any magical solution or protocol, but various methods to minimize and democratize MEV will help reduce its impact.

Optimistic Rollups

While I do not believe Optimistic Rollups have long-term viability, they are still the best EVM-compatible scalability solution for Ethereum at present. General-purpose computing EVM-compatible ZK-Rollups have not yet emerged and will take some time to realize all the benefits of the solutions discussed in this article.

Optimism recently announced an exciting change to its execution environment that will greatly benefit users and developers. Arbitrum will soon welcome the Nitro upgrade, which will enhance the network's EVM compatibility and provide faster speeds for its users.

Interestingly, an increasing number of new and existing DeFi applications are being deployed on these Rollups networks. These two L2 networks have already attracted billions of dollars in liquidity. Bridging from Ethereum L1 to Optimism or Arbitrum networks takes just a few minutes!

• You can bridge to Optimism via this link:
  <span>https://gateway.optimism.io/welcome</span>
• Or bridge to Arbitrum via this link:
  <span>https://bridge.arbitrum.io/</span>

I recommend verifying the validity of each link before interacting with either of these networks. You can reconfirm through the links published in the profiles of Optimism and Arbitrum's official Twitter accounts.

As of the time of writing, Optimism has a whitelist for smart contracts that can be deployed on it, but regular users can freely use any smart contract application on the whitelist. I expect this whitelist will be lifted soon. Arbitrum does not have a whitelist, allowing users and developers to freely trade and deploy their applications.

It is important to remember that using the bridges of these two networks to withdraw funds back to the Ethereum mainnet requires waiting about 7 days (this is how Optimistic Rollups handle fraud issues).

Of course, there are third-party service bridges that allow you to swap back and forth between Rollup and mainnet, but these bridges will charge fees. You need to do your own research and carefully check slippage and rates before using any bridge.

9. Conclusion

We are on the brink of a massive paradigm shift that will forever change the cryptocurrency ecosystem. ZK-Rollups will scale Ethereum, and they do it best. This paradigm shift is so powerful that it clearly marks the beginning of the end for every other L1 smart contract chain—even the Ethereum we know today.

There are many different claims regarding scalability. Thousands of hours of research, implementation, successes, and failures have been dedicated to finding the right way to create this well-known bright bulb (i.e., ZK-Rollups)—and of course, this work is far from over. The road ahead is winding, but the destination has never been clearer than it is now.

I hope this article helps shape your mindset as you think about the future of this industry. I am incredibly excited about what is to come.