What Are Zk-Rollups (Zero-Knowledge Rollups)?

Zk-rollups support increased blockchain scalability by moving computation and state off-chain while storing transaction data in bundled-up batches on-chain.

Blockchains have historically struggled to maintain a high degree of trust-minimization for use cases that require high speed and low cost. Reaching the ultimate goal of bringing the benefits of trust-minimization to billions of people requires blockchains to be able to process orders of magnitude more transactions than they currently can while keeping transaction costs sufficiently low for ordinary users to seamlessly enter the Web3 economy. Blockchain scalability is at the forefront of blockchain research and development, with the goal of making the technology scalable so that smart contracts can form the backbone of major industries, such as finance, insurance, logistics, gaming, and more.

One approach to scaling blockchains involves using rollups, which move computation and state into off-chain networks while storing transaction data on-chain. In this article, we’ll discuss a type of rollup called a zk-rollup, outline how it increases scalability while keeping transaction costs low, and compare zk-rollups to other scaling solutions.

What Are Zk-Rollups?

A zero-knowledge rollup (zk-rollup) is a layer-2 scaling solution that moves computation and state off-chain into off-chain networks while storing transaction data on-chain on a layer-1 network (for example, Ethereum). State changes are computed off-chain and are then proven as valid on-chain using zero-knowledge proofs.

Zk-rollups greatly increase transaction throughput and help reduce transaction costs while inheriting the security of the base-layer (layer-1) network they are connected with for settlement. Instead of posting every single transaction on-chain, zk-rollups only have to periodically post valid batches of transactions from the layer-2 network bundled up to the layer 1, effectively only leveraging the censorship resistance and security of the base layer for transaction settlement. Rollups also commonly use data compression mechanisms to reduce the amount of data posted on the layer 1.

How Do Zk-Rollups Work?

Zk-rollups increase scalability as instead of having to post all transaction data on-chain, they only need to periodically provide valid bundled-up transaction batches that are executed using off-chain computation. These bundles are then “rolled up” into one summary of the state changes that are verified by the base layer using a validity proof that proves the correctness of the changes using a zero-knowledge proof, demonstrating with mathematical certainty that the state changes proposed by the layer 2 are correct and are the result of the execution of the given batch of transactions.

Zk-rollups typically rely on the base layer for data availability, settlement, and censorship resistance. The rollup’s state is maintained by a smart contract deployed on the layer-1 network. When a user submits a transaction on the rollup, it’s usually submitted to a layer-2 operator for inclusion in the next transaction batch. These operators can be a centralized entity called a sequencer that executes transactions, bundles them up in batches, and submits the batch to the layer-1 network. Zk-rollups can also use a proof-of-stake system where the role of executing and bundling transactions is rotated between a set of validators who have deposited funds into a rollup staking contract.

Zk-rollups bundle transactions into batches that are executed off-chain and verified on-chain using a validity proof.

Zk-Rollup vs. Optimistic Rollup

Optimistic rollups are another layer-2 scaling solution with some key differences compared to a zk-rollup. Instead of validity proofs, optimistic rollups use a fraud proof mechanism that allows any user to challenge the outcome of an optimistic rollup execution during a specific time window.

In the case of zk-rollups, the validity of state changes is cryptographically verified. Since optimistic rollups don’t operate with validity proofs, they employ a different approach whereby transactions are assumed to be valid until their correctness is challenged. After an optimistic rollup batch is submitted on the base layer, there’s a time window called a challenge period during which anyone can challenge the outcome of a rollup transaction by computing a fraud proof. If the fraud proof succeeds, the rollup protocol executes the transaction again and updates the rollup’s state. If optimistic rollup state transitions aren’t challenged by the time the challenge period elapses, the batch of transactions is deemed valid and accepted on the layer 1.

Using a fraud proof mechanism with a challenge period also means that withdrawing funds from an optimistic rollup to the layer 1 using a native bridge involves a waiting period (typically seven days) from when the funds are submitted for withdrawal to when they are made available on the base chain. However, to avoid the diminished user experience of a lengthy waiting period, optimistic rollups can employ liquidity providers that enable users to withdraw quicker by paying a small premium as a withdrawal fee. Optimistic rollups can also leverage various economic incentives and game-theoretic mechanisms for avoiding network spam as a result of false fraud proofs.

Due to the complexity and nascency of zero-knowledge proofs, optimistic rollups have had a head start in terms of adoption due to the relative simplicity of the technology and the slightly lower chance of implementation bugs. However, the proponents of zk-rollups consider them a more optimal long-term solution for scalability due to the usage of cryptographically verifiable validity proofs.