ZK Rollup
A Layer 2 scaling solution that uses zero-knowledge proofs to verify off-chain computation, enabling instant finality withdrawals.
Key Takeaways
- ZK rollups execute transactions off-chain and post a cryptographic validity proof to the base layer, inheriting full L1 security without re-executing every transaction on-chain.
- Unlike optimistic rollups, ZK rollups require no 7-day challenge period: once the proof verifies, the batch is final, enabling near-instant withdrawals back to the base layer.
- Major implementations include zkSync Era, StarkNet, Scroll, and Linea, each using different zero-knowledge proof systems to balance proving cost, speed, and EVM compatibility.
What Is a ZK Rollup?
A ZK rollup (zero-knowledge rollup) is a Layer 2 scaling solution that processes transactions off-chain in batches, generates a succinct cryptographic proof that the entire batch was computed correctly, and submits that proof to the base layer for verification. The base layer smart contract checks the proof (a computation far cheaper than replaying every transaction) and accepts the resulting state update.
The "zero-knowledge" in the name refers to the underlying proof system: zero-knowledge proofs allow one party (the prover) to convince another (the verifier) that a statement is true without revealing any information beyond the statement's validity. In a ZK rollup context, the proof attests that all state transitions in the batch followed the protocol rules, without requiring the verifier to see every individual transaction.
ZK rollups were first proposed for Ethereum but the concept applies to any base layer. Recent projects like Citrea have brought ZK rollup technology to Bitcoin, using BitVM for trust-minimized proof verification without requiring a protocol change.
How It Works
A ZK rollup operates through a cycle of three phases: execution, proving, and verification.
- A sequencer collects user transactions, orders them, and executes them off-chain against the current state. This produces a new state root and compressed transaction data.
- A prover takes the execution trace and generates a validity proof: a compact cryptographic attestation that every state transition in the batch was correctly computed. This is the most computationally expensive step.
- The rollup posts two things to the base layer: the compressed transaction data (for data availability) and the validity proof. A verifier contract on L1 checks the proof and, if valid, accepts the new state root.
Verification on-chain is extremely cheap compared to execution. A single proof can attest to thousands of transactions, yet verifying that proof costs a fixed amount of gas regardless of batch size. This asymmetry is the source of ZK rollups' scaling power.
Proof Systems: SNARKs vs STARKs
ZK rollups use one of two families of proof systems, each with distinct tradeoffs:
| Property | ZK-SNARK | ZK-STARK |
|---|---|---|
| Proof size | Small (~400 bytes for PLONK variants) | Larger (tens of kilobytes) |
| Trusted setup | Required (except Halo2) | Not required (transparent) |
| Quantum resistance | No (elliptic curve based) | Yes (hash based) |
| L1 verification cost | Lower (smaller proofs) | Higher (larger proofs) |
In practice, many implementations use a hybrid approach: generate STARKs for their transparency and quantum resistance, then wrap the STARK inside a final SNARK for cheaper on-chain verification. StarkNet and Polygon zkEVM both use this pattern.
EVM Compatibility Spectrum
Not all ZK rollups handle Ethereum Virtual Machine compatibility the same way. Vitalik Buterin proposed a classification from Type 1 (fully Ethereum-equivalent) to Type 4 (compiles high-level languages to a ZK-friendly VM):
- Type 1: identical to Ethereum at the consensus level. Taiko targets this, using Ethereum L1 validators for sequencing.
- Type 2: EVM-equivalent at the bytecode level but with minor differences in gas costs or precompiles. Scroll and Linea target this level.
- Type 3: almost EVM-equivalent, with some opcodes modified for easier proving.
- Type 4: compiles Solidity or other languages to a custom VM optimized for ZK proving. zkSync Era uses this approach with its own compiler and EraVM.
Higher type numbers typically enable faster proving at the cost of compatibility. Applications may need modifications to deploy on Type 3-4 rollups, while Type 1-2 rollups can run existing Ethereum contracts with minimal or no changes.
Major Implementations
zkSync Era
Developed by Matter Labs, zkSync Era uses a Boojum proof system (PLONK arithmetization with FRI commitments) and a custom EraVM rather than running the EVM directly. It compiles Solidity via its own compiler. As of mid-2026, zkSync Era holds approximately $4.1 billion in TVL, making it the largest ZK rollup by value locked.
StarkNet
Built by StarkWare, StarkNet uses native STARKs with a custom Cairo VM. Developers write in the Cairo programming language rather than Solidity. StarkNet generates STARK proofs, then wraps them in a SNARK for cheaper Ethereum L1 verification. StarkWare is also developing Bitcoin settlement capabilities.
Scroll
Scroll targets Type 2 EVM equivalence using a Halo2-based proof system with KZG polynomial commitments. It achieves bytecode-level compatibility, meaning existing Ethereum smart contracts can deploy without modification. Scroll holds approximately $2.1 billion in TVL.
Linea
Developed by ConsenSys (the team behind MetaMask and Infura), Linea uses a gnark-based SNARK proof system and targets Type 2 EVM equivalence. With roughly $3.4 billion in TVL, Linea benefits from deep integration with the ConsenSys ecosystem.
Proving Costs and Performance
Proof generation is the dominant cost in ZK rollup operations, accounting for 60-70% of total rollup fees. However, proving costs have dropped dramatically:
- Per-transaction proving costs are now under $0.01 for high-volume chains, with end-user fees in the single-digit cents for simple transfers.
- Proving times have collapsed from hours (2022) to minutes (2024) to seconds (2025-2026). Succinct's SP1 Hypercube achieves 10.3-second average proving times for full Ethereum blocks on a cluster of 200 GPUs.
- Specialized hardware from companies like Cysic targets 2-second proof generation with custom ASICs, offering 50x energy efficiency over general-purpose GPUs.
The industry trend is clear: as proving becomes cheaper and faster, the gap between ZK rollup and optimistic rollup user experience narrows. Recursive proof composition, where a proof verifies other proofs, enables further aggregation and cost reduction.
ZK Rollups on Bitcoin
Bitcoin's limited scripting language cannot natively verify zero-knowledge proofs, but several projects are working around this constraint. For a broader view of Bitcoin scaling approaches, see our Bitcoin Layer 2 scaling landscape analysis.
- Citrea launched its mainnet in January 2026 as the first production ZK rollup on Bitcoin. It uses a zkEVM to batch transactions off-chain and inscribes validity proofs on the Bitcoin base layer, with a BitVM-powered bridge for trust-minimized BTC bridging.
- StarkWare is developing Bitcoin settlement for StarkNet, aiming to be the first L2 settling on both Ethereum and Bitcoin. A BitVM-powered bridge is expected in 2026.
- Alpen Labs (Strata) raised $8.5 million and launched a public testnet in 2025 with a BTC-backed stablecoin built on Liquity protocol.
The key challenge is that Bitcoin verification through BitVM uses an optimistic challenge-response model rather than native cryptographic verification. A hypothetical OP_ZKPVERIFY opcode has been proposed but not implemented. For now, ZK rollups on Bitcoin inherit weaker trust assumptions than their Ethereum counterparts, where on-chain verification is cryptographically direct.
ZK Rollups vs Optimistic Rollups
Both rollup types execute transactions off-chain and post data to L1, but they differ fundamentally in how correctness is guaranteed:
| Dimension | ZK Rollup | Optimistic Rollup |
|---|---|---|
| Correctness | Validity proof (mathematical) | Fraud proof (economic) |
| Withdrawal time | Hours (after proof generation) | 7 days (challenge period) |
| Finality | Immediate once proof verifies | After challenge window closes |
| Computational overhead | High (proof generation) | Low (only re-execute if challenged) |
| EVM compatibility | Varies (Type 1-4 spectrum) | Native |
| Security assumption | Cryptographic (proof cannot be forged) | At least one honest watcher must exist |
| Current L2 TVL share | ~20% | ~80% |
Optimistic rollups currently dominate by TVL largely due to their head start and native EVM compatibility. However, ZK rollups are closing the gap as proving technology matures and EVM equivalence improves. Ethereum co-founder Vitalik Buterin has stated that ZK rollups are likely to outperform optimistic rollups once the underlying technology catches up.
Use Cases
- High-throughput DeFi: ZK rollups enable decentralized exchanges and lending protocols to process thousands of transactions per second while inheriting L1 security guarantees. The instant finality eliminates the need for fast bridge workarounds common with optimistic rollups.
- Low-cost payments: transaction fees in the single-digit cents make ZK rollups viable for stablecoin payment rails and everyday transfers that would be prohibitively expensive on L1.
- Privacy-preserving applications: the zero-knowledge property can be leveraged to build applications where transaction details remain private while correctness is still publicly verifiable.
- Cross-chain settlement: projects like StarkNet aim to settle on multiple base layers (Ethereum and Bitcoin), using ZK proofs as a universal correctness mechanism across chains.
Why It Matters
ZK rollups represent a fundamental shift in how blockchains scale: rather than trusting validators or waiting for challenge periods, correctness is proven mathematically. This distinction matters for any application where withdrawal speed, capital efficiency, or verifiable computation is critical.
For Bitcoin's ecosystem, ZK rollups open the possibility of expressive smart contract execution without modifying Bitcoin's consensus rules. Projects building on Bitcoin, including Spark and other Layer 2 solutions, operate within this broader scaling landscape where ZK technology is increasingly relevant. As proving costs continue to fall and hardware acceleration matures, ZK rollups are positioned to become the dominant rollup architecture.
Risks and Considerations
Prover Centralization
Generating ZK proofs requires significant computational resources: GPU clusters or specialized ASIC hardware. Most ZK rollups currently rely on a single centralized prover operated by the development team. If the prover goes offline, the rollup cannot produce new batches. Several projects have roadmaps for decentralized prover networks, but as of 2026, most remain centralized.
Sequencer Risk
Like optimistic rollups, most ZK rollups use a centralized sequencer to order transactions. This introduces censorship risk and single-point-of-failure concerns. Taiko is a notable exception, using Ethereum L1 validators for sequencing (a "based rollup" design).
Complexity and Audit Surface
ZK proof circuits are extremely complex and difficult to audit. A bug in the circuit could allow invalid state transitions to pass verification, potentially draining all rollup funds. The proving systems themselves (PLONK, Halo2, STARKs) are relatively new cryptographic constructions with less battle-testing than traditional cryptography.
Upgrade and Trust Assumptions
Many ZK rollups retain admin keys that can upgrade the verifier contract, which means the security ultimately depends on the integrity of the team controlling those keys, not just the mathematics of the proof system. Users should verify the governance and upgrade mechanisms of any rollup they deposit funds into.
This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.