1 of 71

Scaling Ethereum through ZK-Rollups and zkEVMs

Péter Garamvölgyi

2 of 71

📓 save the slides!

https://bit.ly/scroll-eth-hungary

@thegaram33

3 of 71

  • An amazing tool for scaling and privacy
  • ZKPs can compress computations into a cheap proof
  • ZKPs can prove correctness without revealing all information
  • But: ZKPs are (were) not accessible to most people ("assembly era")

A bit about zero-knowledge proofs (ZKPs)

@thegaram33

4 of 71

  • Intro to zero-knowledge proofs
  • Scaling Ethereum
  • Rollups under the hood
  • zkEVMs and Scroll

Outline

@thegaram33

5 of 71

About me

Doing web3 dev and research since 2017

Infrastructure Engineer @ Scroll

Previously: Core Team @ Conflux

Twitter @thegaram33

Email peter@scroll.io

@thegaram33

6 of 71

Zero-knowledge proofs

@thegaram33

7 of 71

Non-mathematical view of ZKPs - Errol Drummond

video: https://www.youtube.com/watch?v=I-hRWMwUlag�slides: https://bit.ly/pse-zkp-intro

​

Proofs, Arguments, and Zero-Knowledge (Justin Thaler)

https://people.cs.georgetown.edu/jthaler/ProofsArgsAndZK.pdf

Getting started with ZKPs

@thegaram33

8 of 71

ZKPs prove�circuit satisfiability

@thegaram33

9 of 71

Computational circuits�logic gates�operating on bits

Zero-knowledge circuits�arithmetic gates�operating on integers of a finite field

Translating computation into circuits

+

a

b

c

✕

a

b

c

NAND

a

b

c

AND

a

b

c

10 of 71

d = NAND(NAND(a, b), c)

e = (a + b) ✕ d

Computational circuits

Zero-knowledge circuits

Translating computation into circuits

+

a

b

c

✕

c

d

e

NAND

a

b

NAND

c

d

11 of 71

e = (a + b) ✕ d

Producing a proof for a zk-circuit

+

a = 2

b = 3

c = 5

✕

c = 5

d = 2

e = 10

π

12 of 71

+

a

b

c

✕

c

d

e

Verifying a zk-proof π

π

a = 2, b = 3, d = 2 → e = 10

V(π, a, b, d, e) = true or false

13 of 71

+

a

b

c

✕

c

d

e

Verifying a zk-proof π

π

a = 2, b = 3, d = 2 → e = 10

V(π, a, b, d, e) = true or false

1. completeness: if the values are correct,�I can produce π such that V(π) = true

if e = (a + b) ✕ d , then V(π, a, b, d, e) = true

14 of 71

+

a

b

c

✕

c

d

e

Verifying a zk-proof π

π

a = 2, b = 3, d = 2 → e = 10

V(π, a, b, d, e) = true or false

2. soundness: if the values are incorrect,�I cannot produce π such that V(π) = true

if e ≠ (a + b) ✕ d , then V(π, a, b, d, e) = false

15 of 71

3. zero-knowledge: I can choose which inputs and outputs to reveal or hide��→ privacy

+

a

b

c

✕

c

d

e

Verifying a zk-proof π

π

a = 2, b = 3, d = 2 → e = 10

V(π, a, b, c, e) = true or false

16 of 71

4. succinctness: V has a bounded cost, often much cheaper than actually executing the computation��→ scalability

+

a

b

c

✕

c

d

e

Verifying a zk-proof π

π

a = 2, b = 3, d = 2 → e = 10

V(π, a, b, d, e) = true or false

17 of 71

Examples

@thegaram33

18 of 71

  • The circuit C defines the relationship between X and Y and it also defines the verification function V

Example circuit 1: Hash preimage

+

a

b

c

✕

c

d

e

input (private): X

output (public): Y = Hash(X)

circuit C

@thegaram33

19 of 71

Example circuit 1: Hash preimage

+

a

b

c

✕

c

d

e

input (private): X

output (public): Y = Hash(X)

circuit C

  • The prover chooses X = "vitalikissatoshi"
  • The prover produces Y = "0x2c321427" and π

π

@thegaram33

20 of 71

Example circuit 1: Hash preimage

+

a

b

c

✕

c

d

e

input (private): X

output (public): Y = Hash(X)

circuit C

  • The verifier evaluates V(π, "0x2c321427")

→ If true, the verifier is convinced that the prover knows X

→ The verifier does not learn X → privacy

π

@thegaram33

21 of 71

Example circuit 2: Expensive computation

Expensive function F(x) = H(H(H(...(x))))

@thegaram33

22 of 71

Example circuit 2: Expensive computation

+

a

b

c

✕

c

d

e

input (public): X

output (public): Y = F(X)

  • The verifier evaluates V(π, X, Y).

→ If true, the verifier is convinced that Y == F(X)

→ V is much cheaper than F. No need to recompute F. → scalability

Expensive function F(x) = H(H(H(...(x))))

@thegaram33

23 of 71

Scaling Ethereum

@thegaram33

24 of 71

  • Many approaches over the years: sharding, state channels, side chains, plasma, rollups
  • Off-chain scaling: remove computation and/or data from Ethereum (L1) to another chain (L2)
  • "Rollups move computation (and state storage) off-chain, but keep some data per transaction on-chain." (Vitalik)
  • Rollups can offer very strong guarantees and safety guards

Scaling Ethereum

@thegaram33

25 of 71

Scaling (ethereum.org)�https://ethereum.org/en/developers/docs/scaling

​

An Incomplete Guide to Rollups (Vitalik Buterin)�https://vitalik.ca/general/2021/01/05/rollup.html

​

A rollup-centric Ethereum roadmap�https://ethereum-magicians.org/t/a-rollup-centric-ethereum-roadmap

Scaling Ethereum

@thegaram33

26 of 71

@thegaram33

27 of 71

So how do rollups work?

@thegaram33

28 of 71

Executing a block

tx0�tx1�tx2�…

RootN-1

RootN

BlockN

29 of 71

Connecting L1 and L2

Rollup Contract

tx0�tx1�tx2�…

BlockN (txs)�RootN

tx5�tx6�…

BlockN+1 (txs)�RootN+1

30 of 71

block data

state root

Connecting L1 and L2

31 of 71

How can L1 verify�the state root?

@thegaram33

32 of 71

Optimistic rollups

RootN-1

RootN-1

RootN

…

block data

state root

33 of 71

Optimistic rollups

RootN-1

RootN-1

RootN

RootN

RootN

RootN-1

…

block data

state root

RootN

RootN is incorrect! Here is the proof: P

34 of 71

ZK rollups

RootN-1

RootN-1

RootN

…

block data

state root

ZKP

verification passed�update accepted

35 of 71

ZK rollups

RootN-1

RootN-1

RootN

RootN

RootN

…

block data

state root

ZKP

RootN

RootN

block data

incorrect root

ZKP

verification passed�update accepted

verification failed�update rejected

36 of 71

Example circuit 3: L2 state transition

+

a

b

c

✕

c

d

e

input (public): RootN-1, tx1, …, txk

output (public): RootN

circuit C

@thegaram33

37 of 71

  • The prover (aka the sequencer) executes the block, produces RootN and π

Example circuit 3: L2 state transition

+

a

b

c

✕

c

d

e

input (public): RootN-1, tx1, …, txk

output (public): RootN

circuit C

@thegaram33

38 of 71

Example circuit 3: L2 state transition

+

a

b

c

✕

c

d

e

input (public): RootN-1, tx1, …, txk

output (public): RootN

circuit C

  • The verifier (aka the rollup contract) evaluates V(π, RootN-1, tx1, …, txk, RootN)

→ If true, the verifier is convinced that the state root was updated correctly

→ V is much cheaper than re-executing the block → scalability

@thegaram33

39 of 71

Components of a zk-rollup

@thegaram33

40 of 71

Components of a zk-rollup

Smart Contract

 

 

……

 

Layer 2 node

data

proof

41 of 71

Components of a zk-rollup

 

……

 

Sequencer

prover

Relayer

Bridge Contract

Rollup Contract

data

proof

 

42 of 71

Liveness & censorship-resistance

The sequencer cannot cheat (cannot forge a ZKP) but it can withhold data or ignore transactions.

  • Data availability: Data is available on L1 => anyone can re-execute transactions and compute the correct state
  • Enforced transactions: If a user is censored (or the sequencer is down) users can submit withdraw transactions on L1

@thegaram33

43 of 71

An EVM-equivalent zk-Rollup (a zkEVM)

What is Scroll?

@thegaram33

44 of 71

From zk-rollups to zkEVMs

  • The state transition function is the Ethereum Virtual Machine (EVM)
  • Circuit C verifies the behavior and side effects of each EVM state transition (opcodes, storage updates, block correctness, etc.)

+

a

b

c

✕

c

d

e

input (public): RootN-1, tx1, …, txk, …

output (public): RootN

circuit C

@thegaram33

45 of 71

From zk-rollups to zkEVMs

Why? You can take your code (Solidity or even EVM bytecode), redeploy on Scroll, and it works the same way as on Ethereum

source: https://mirror.xyz/labs.taiko.eth/w7NSKDeKfJoEy0p89I9feixKfdK-20JgWF9HZzxfeBo

increased Ethereum�compatibility

increased prover�performance

Type 1

Type 4

Type 2.5

Type 2

Type 3

46 of 71

📓 save the slides!

https://bit.ly/scroll-eth-hungary

@thegaram33

47 of 71

Validating Bridges as a Scaling Solution for Cryptocurrency w/ Patrick McCorry

https://www.youtube.com/watch?v=oE4dI6p6ri4

​

Scroll Pre-Alpha Testnet Upgrade by Ye Zhang | Devcon Bogotá https://www.youtube.com/watch?v=a6kOGas--dE

​

The different types of ZK-EVMs (Vitalik Buterin)

https://vitalik.ca/general/2022/08/04/zkevm.html

Further resources

@thegaram33

48 of 71

join an open, innovative community that is building the future of Ethereum scaling and zk technology

@thegaram33

49 of 71

The workflow of Scroll

@thegaram33

50 of 71

The workflow of Scroll’s zk-Rollup

block data

validity proof

51 of 71

  • Pre-committed: indicates a block has been proposed by a Sequencer and included in the L2 chain.
  • Committed: indicates the transaction data of this block has been posted on the rollup contract on Ethereum.
  • Finalized: indicates the correct execution of transactions in this block has been proven by verifying a validity proof on-chain on Ethereum.

L2 Block status

52 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

1

Roller 2

Roller 3

Roller 4

Time

1

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

1

53 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

1

1

1

D1

54 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

55 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

T1

Proof generation

56 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

T1

Proof generation

D2

T2

Proof generation

2

57 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

T1

Proof generation

D2

T2

Proof generation

2

4

D3

D4

T3

Proof generation

3

58 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

T1

Proof generation

D2

T2

Proof generation

2

4

D3

D4

P1

P2

P3

T3

Proof generation

3

59 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

T1

Proof generation

D2

T2

Proof generation

2

4

D3

D4

P1

P2

P3

T3

Proof generation

3

Aggregate proof generation

60 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

T1

Proof generation

D2

T2

Proof generation

2

4

D3

D4

P1

P2

P3

T3

Proof generation

3

Aggregate proof generation

A

61 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

1

T1

Proof generation

D2

T2

Proof generation

2

4

D3

D4

P1

P2

P3

T3

Proof generation

3

Aggregate proof generation

A

Verify

62 of 71

Rollup Contract

Sequencer

Coordinator

Roller 1

Roller 2

Roller 3

Roller 4

Time

Proof

Data

Trace

Pre-committed Block

Committed Block

Finalized Block

The workflow of Scroll’s zk-Rollup

D1

T1

Proof generation

D2

T2

Proof generation

4

D3

D4

P1

P2

P3

T3

Proof generation

Aggregate proof generation

A

Verify

1

2

3

63 of 71

Rollup explorer shows the block status

64 of 71

Rollup explorer shows the block status

65 of 71

Scroll Pre-Alpha Testnet

@thegaram33

66 of 71

Three months ago, we have released our testnet

  • Users can play with pre-deployed DApps through metamask
  • Can bridge their assets between L1 and L2 and use the Rollup Explorer
  • Now we support arbitrary smart contract deployment!
  • “Boring”TM: Develop using Solidity, Remix, Truffle, Hardhat

67 of 71

A summary for users and developers

  • The developer experience will be exactly the same as Ethereum
  • Layer 2 block generation takes <3 seconds
  • Deposit takes 2 minutes (wait for 6 L1 blocks to be safe)
  • Withdraw takes more than 6 minutes (depends on prover & TPS)

68 of 71

Prover setup

  • Advanced cryptography and hardware acceleration makes it efficient
  • 1M gas block takes 6 minutes to generate the zk proof on GPU prover
  • Prover setup: CPU with 500GB memory and very cheap GPUs
  • Prover is open-sourced from day 1, anyone can run it!

​

69 of 71

Scroll Architecture

Sequencer

Coordinator

Relayer

Roller

zkEVM

Roller

zkEVM

Roller

zkEVM

Decentralized Prover Network

Bridge Contract

Rollup Contract

data

proof

 

……

 

 

70 of 71

Readable Cairo

Cairo assembly

zkVM

Zinc

IR

LLVM

zkVM

Better compatibility

Solidity

IR

Bytecode

EVM

Solidity

IR

Bytecode

zkEVM

Solidity

IR

Bytecode

zkASM

zkExecutor

Language

Bytecode

Runtime

Solidity

Solidity

Zinc instruction

How do we compare to other solutions?

71 of 71

PHASE1

Pre-Alpha testnet

PHASE3

Layer-2 proof outsourcing

​

PHASE2

Alpha testnet

PHASE4

zkEVM mainnet

PHASE5

Decentralized sequencer �more efficient zkVM

Roadmap

@thegaram33