Zero-knowledge rollups (commonly abbreviated as ZK-rollups) are a class of Layer 2 scaling solutions that increase the transaction throughput of blockchain networks. They execute transactions off the main blockchain, then submit a compact cryptographic proof of their validity back to the base layer for settlement. First gaining serious attention in the Ethereum ecosystem around 2018, ZK-rollups have since become one of the most actively developed areas of blockchain infrastructure.
The term "zero-knowledge" refers to a property of the cryptographic proofs used: the verifier receives mathematical certainty that a set of transactions is valid without learning the specifics of those transactions. In practice, most deployed ZK-rollup systems prioritize scalability and fast finality over privacy, and some researchers prefer the more precise label "validity rollups" to reflect this distinction.
Public blockchains such as Ethereum process all transactions through a single global network of nodes, each independently executing and verifying every operation. This architecture guarantees security and decentralization but imposes a hard ceiling on throughput. As user demand grows, transactions compete for limited block space, driving up fees and slowing confirmation times.
This tension between scalability, security, and decentralization is called the blockchain trilemma. Layer 2 solutions address it by shifting most computation off the main chain while still anchoring final settlement to the security of Layer 1. ZK-rollups represent one approach alongside other techniques such as state channels, plasma chains, and optimistic rollups.
A ZK-rollup consists of two environments working together. On the Layer 1 blockchain, two smart contracts are deployed: a main rollup contract that stores the rollup's state and tracks deposits, and a verifier contract that checks the validity of cryptographic proofs submitted by the rollup operator. Off-chain, a separate virtual machine executes transactions and maintains its own state.
When a user submits a transaction, it is sent to a Layer 2 operator, or sequencer, who collects a batch of pending transactions and executes them off-chain. After execution, the operator compresses the batch into a state update and generates a validity proof showing the new state is the correct result of applying those transactions to the prior state. Both the compressed data and proof are posted to the Layer 1 verifier contract. If the proof checks out, the main rollup contract accepts the updated state, finalizing all transactions in the batch with a single on-chain operation.
Compressing thousands of transactions into one on-chain submission drives scalability gains. Full Layer 1 nodes no longer re-execute every transaction; they only verify the proof, which is computationally cheap compared to full execution.
The mathematical engine at the heart of a ZK-rollup is the validity proof, which comes in two main variants: ZK-SNARKs and ZK-STARKs.
A ZK-SNARK, short for Zero-Knowledge Succinct Non-Interactive Argument of Knowledge, produces very small proofs that verify quickly. Most early ZK-rollup implementations relied on SNARKs. Their main limitation is that generating them requires a trusted setup ceremony, a one-time cryptographic ritual dependent on participants behaving honestly. If compromised, fraudulent proofs could be produced. SNARKs also rely on elliptic curve cryptography, considered vulnerable to powerful quantum computers.
A ZK-STARK, short for Zero-Knowledge Scalable Transparent Argument of Knowledge, addresses both concerns. STARKs do not require a trusted setup and use hash functions resistant to quantum attacks. They produce larger proofs and are more expensive to verify on-chain but offer greater transparency and long-term security. Starknet, developed by StarkWare, is the most prominent production system built on STARKs. Most other major ZK-rollup projects, including zkSync Era, Scroll, and Polygon zkEVM, use SNARK-based proof systems.
The two dominant rollup designs on Ethereum take fundamentally different approaches to proving transaction validity. Optimistic rollups assume all submitted transactions are valid by default and rely on a fraud-proving scheme: if a participant detects an invalid transaction, they can submit a fraud proof within a challenge window, typically around seven days. This window also forces users to wait before withdrawing assets back to Layer 1.
ZK-rollups do not assume anything. Every batch comes with a cryptographic proof of correctness, so the Layer 1 contract can finalize transactions as soon as the proof is verified. Withdrawals can settle in minutes rather than days. The tradeoff is the computational cost of generating proofs, which is more demanding than optimistic execution, and the added engineering complexity of building compatible proof systems.
As of early 2025, optimistic rollups such as Arbitrum and Optimism account for a larger share of total value locked on Ethereum Layer 2 networks, largely because they were easier to build and deploy with full Ethereum Virtual Machine compatibility. The balance is expected to shift as zero-knowledge proving technology matures.
One early barrier to ZK-rollup adoption was limited compatibility with existing Ethereum tooling. Proving arbitrary computation in a zero-knowledge circuit is more complex than proving simple operations like token transfers, and early systems required developers to write contracts in specialized languages. Starknet, for example, uses a language called Cairo rather than Solidity.
The zkEVM, or zero-knowledge Ethereum Virtual Machine, is the solution the community converged on. A zkEVM recreates the opcodes and execution environment of the standard EVM inside a zero-knowledge circuit, allowing developers to deploy existing Solidity smart contracts with little or no modification. Projects differ in how closely they replicate the native EVM. Type 1 zkEVMs aim for full bytecode equivalence. Type 2, which most production projects now target, balances compatibility and performance with minor deviations. Polygon zkEVM, Scroll, and Linea all fall into this category.
Separately, efforts are underway to bring zero-knowledge proving into optimistic rollup stacks. Teams such as RISC Zero and OP Succinct are working to integrate ZK proofs into Optimism's OP Stack, which could eventually produce hybrid systems that combine the developer familiarity of optimistic designs with the fast finality of validity proofs.
Several production ZK-rollup networks are live on Ethereum mainnet. zkSync Era, developed by Matter Labs, was among the first zkEVMs to reach production and uses a SNARK-based proving system with its own compiler toolchain. Starknet uses STARKs and the Cairo programming language, offering a distinct execution environment optimized for proof generation rather than EVM compatibility. Scroll and Linea, developed by a community team and Consensys respectively, both aim for high EVM equivalence using SNARK proofs. Polygon zkEVM is part of Polygon's broader zero-knowledge strategy, which also includes Polygon Miden and Polygon Zero, each targeting different use cases.
Beyond general-purpose smart contract platforms, ZK-rollup technology also powers more specialized applications. Loopring uses a ZK-rollup specifically for decentralized exchange operations. ImmutableX applies the technology to NFT markets. Aztec focuses on privacy-preserving transactions, using the zero-knowledge property of its proofs not just for scalability but to shield transaction details from public view.
ZK-rollups inherit the security of their underlying Layer 1 network because every state transition is mathematically verified on-chain. Users can exit the rollup independently, even if the operator goes offline, by submitting a proof directly to the Layer 1 contract. This contrasts with sidechains, where a network failure can leave user funds inaccessible.
Transaction costs within a ZK-rollup scale favorably with usage. The fixed cost of verifying a proof on-chain is shared across all transactions in a batch, so per-transaction cost decreases as batch sizes grow. This is the opposite of the base layer, where higher usage increases individual costs.
Generating validity proofs is computationally intensive and requires specialized hardware for production-scale systems. Proof generation latency can delay batch submission, though typically by seconds to minutes rather than days as with optimistic rollup withdrawal windows. Building and auditing ZK-rollup systems also demands deep cryptographic expertise, making them more complex to develop and maintain than simpler scaling approaches.
.webp)