zkEVM, short for Zero-Knowledge Ethereum Virtual Machine, is a virtual machine that executes Ethereum smart contract transactions compatible with both zero-knowledge proof (ZKP) computation and the existing Ethereum infrastructure. It forms the computational backbone of zero-knowledge rollups, a class of layer-2 scaling solutions designed to increase transaction throughput and reduce costs on Ethereum while preserving the security guarantees of the underlying blockchain.
Zero-knowledge proofs and the Ethereum Virtual Machine were developed separately, and combining them presented significant engineering challenges. Recent advances in cryptographic research have made their integration possible and increasingly practical, with several zkEVM implementations now running in production.
The Ethereum Virtual Machine (EVM) is the runtime environment where smart contracts deployed on Ethereum are executed. It functions as a distributed state machine, transitioning from one global state to another in response to transactions. Each new block triggers the EVM to parse smart contract instructions written in high-level languages like Solidity, translate them into bytecode, and update the Ethereum state.
This architecture operates on a stack-based model following the last-in, first-out (LIFO) principle, where the most recently added data is the first to be removed. While this design is straightforward and accessible to developers, it was not built for zero-knowledge computations, which introduced fundamental friction when engineers later sought to combine the two.
Ethereum's original design prioritized decentralization and security, which limited its transaction throughput. The network can process roughly 15 transactions per second under normal conditions, and during high demand, average gas fees for simple transfers have surpassed $50. This constraint has spurred significant research into layer-2 solutions that extend Ethereum's capacity without compromising its core properties.
A zero-knowledge proof is a cryptographic technique that allows one party, the prover, to convince another, the verifier, that a statement is true without revealing any information beyond its truth. Simply put, a prover can demonstrate knowledge of a secret number without disclosing it.
When applied to blockchains, ZKPs allow a party to prove that a set of transactions was computed correctly without broadcasting full details to every participant. This makes zero-knowledge proofs attractive for scaling: instead of every Ethereum node verifying every transaction, a single compact proof covers all verification.
The specific proof systems most commonly used in zkEVM implementations are zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge). These proofs are both small in size and fast to verify, making them well suited to the demands of an on-chain verifier operating under gas cost constraints.
A zkEVM takes an initial blockchain state, processes a batch of transactions, and produces two outputs: an updated state and a cryptographic proof attesting the computation was correct. This process has three stages.
In the first stage, compilation, the EVM bytecode that governs how smart contracts function is translated into a set of mathematical constraints that the zero-knowledge proof system can evaluate.
In the second stage, proof generation, an off-chain component called the prover generates a zk-SNARK proof. This proof cryptographically confirms that the EVM code satisfies the defined constraints and that each transaction within the batch was executed correctly, without exposing any of the underlying input data.
In the third stage, verification, the compact proof is submitted to the Ethereum mainnet. An on-chain verifier contract checks the proof's validity. If the proof passes, the updated state is accepted as correct and recorded permanently on the Ethereum layer-1 chain.
This approach reduces the computational burden on the Ethereum mainnet. Instead of every node processing every transaction individually, nodes verify a single succinct proof covering an entire batch. After Ethereum's Dencun upgrade in March 2024, transaction costs on rollups including zkEVMs dropped by more than 80%.
A zkEVM is structured around three interconnected components, each serving a distinct role in the overall execution pipeline.
The execution environment runs smart contracts. It behaves like the EVM, accepting inputs, executing opcodes in sequence, and producing state changes. The zkEVM generates proofs for each step, covering bytecode access (whether the correct code was loaded from the right address), read and write operations (whether the program fetched and stored correct values), and computation (whether opcodes executed in the correct order without skipping steps).
The proving circuit is a mathematical construct encoding the rules of valid EVM execution into a form zero-knowledge proof systems can evaluate. It uses cryptographic techniques including Elliptic Curve Cryptography, polynomial commitments, Merkle trees, and homomorphic encryption to validate transactions without revealing contents.
The verifier contract is a smart contract deployed on the Ethereum mainnet. It receives the proof generated off-chain and checks its validity. This contract is deliberately lightweight, since proof verification must be fast and economical in terms of gas costs.
In August 2022, Ethereum co-founder Vitalik Buterin published a classification framework for zkEVM implementations that became the industry standard. The framework organizes zkEVMs along a spectrum where lower-numbered types prioritize Ethereum compatibility and higher-numbered types prioritize proving speed.
Type 1 zkEVMs are fully Ethereum-equivalent. They do not alter any aspect of the Ethereum protocol to ease zero-knowledge proof generation. As a result, all existing Ethereum tooling, including block explorers and execution clients, can be reused without modification. The trade-off is longer proving times since parts of the Ethereum protocol are computationally demanding to encode in a zero-knowledge circuit.
Type 2 zkEVMs are fully EVM-equivalent but introduce minor modifications to internal representations, such as chain state storage, to improve proof generation times. These systems maintain compatibility with existing Ethereum applications and developer tooling, though minor adjustments may be needed for edge cases.
Type 3 zkEVMs depart from strict EVM equivalence by removing or modifying certain features, most commonly EVM precompiles, that are costly to prove. Most Ethereum applications function in this environment, but those relying on removed features may require code changes. No production team intends to remain at Type 3 permanently; it is generally a transitional stage while precompile support is developed.
Type 4 zkEVMs abandon EVM bytecode compatibility at the execution level. Instead, they compile high-level languages like Solidity or Vyper directly into a custom virtual machine designed for zero-knowledge proof generation. This delivers the fastest proving times and lowest costs but means contract addresses may differ from Ethereum counterparts and debugging infrastructure must be rebuilt.
Buterin noted zkEVM classifications are not static. A project may begin as Type 3 and advance to Type 2 as precompile implementation matures. If Ethereum adopts ZK-friendly modifications, Type 2 systems could become Type 1 without changing their code.
Several zkEVM projects reached mainnet between 2023 and 2025, each representing a distinct position on the compatibility-performance spectrum.
zkSync Era, developed by Matter Labs, is a Type 4 system that compiles Solidity and Vyper to a custom bytecode optimized for zero-knowledge proof generation. It targets maximum proving efficiency at the cost of some compatibility with existing Ethereum tooling.
Polygon zkEVM (formerly Polygon Hermez) is an open-source project targeting Type 2 EVM-equivalence. Polygon's team described transaction cost cuts of up to 90% compared to Ethereum mainnet while maintaining security. Later, Polygon Labs released a Type 1 prover capable of generating proofs for Ethereum mainnet blocks at an average cost of roughly $0.002 to $0.003 per transaction.
Scroll is a collaborative project with ties to Ethereum Foundation researchers. It targets Type 2 EVM-equivalence with an emphasis on security and transparency, and has progressed through Type 3 toward Type 2 compliance as precompile support has been completed.
Taiko is a general-purpose ZK rollup network built specifically for Type 1 EVM-equivalence, prioritizing zero friction for existing applications and maximum compatibility with Ethereum's existing developer ecosystem.
zkEVMs offer several advantages over both the Ethereum mainnet and earlier layer-2 approaches.
On scalability, zkEVMs process transactions off-chain in batches and submit a single proof per batch to Ethereum. This increases transaction throughput while reducing per-transaction gas fees. The rollup approach means verifying a batch of hundreds of transactions costs no more than verifying a single proof.
On security, once a zkEVM proof is validated by the Ethereum mainnet verifier, the state update is recorded permanently and is tamper-resistant. Unlike optimistic rollups, which assume transactions are valid and rely on a challenge period for fraud detection, zkEVMs submit mathematical proof of correctness upfront. This also means withdrawals from zkEVM rollups do not require the multi-day waiting periods of optimistic systems.
On privacy, zero-knowledge proofs allow transactions to settle without broadcasting sensitive input data to the entire network. Wallet addresses, transaction amounts, and other details can be shielded while remaining provably valid. Ethereum co-founder Vitalik Buterin reiterated support for this in April 2025, noting that information concentration leads to power concentration and that privacy is an important guarantor of decentralization.
There are also challenges. The EVM's stack-based architecture was not designed for ZK-friendliness, so translating EVM execution into a zero-knowledge circuit requires overcoming significant technical friction. Proof generation remains computationally intensive, though proving times have dropped from around 16 minutes in early systems to under 16 seconds as of 2026. Hardware acceleration continues to drive improvements. Ensuring decentralization of the proving role, given that proof generation requires specialized hardware, is an ongoing design challenge.
.webp)