Author | Callum@Web3CN.Pro
As a way to expand Ethereum, ZK Rollup allows transactions to be processed off-chain and merged as a single compressed transaction on the main chain. This process improves transaction throughput, reduces transaction costs, ensures the validity of the state through zero-knowledge proofs, and improves the privacy and security of the main chain. Therefore, ZK Rollup is considered the ultimate solution for Ethereum expansion.
However, the generation of zero-knowledge proofs currently requires a lot of computing power and is technically more difficult. At the same time, since the Ethereum Virtual Machine (EVM) is not designed to support ZK circuits, smart contracts cannot be executed directly. To solve this problem, many developers have tried to develop zkEVM, which can run smart contracts in a way that is compatible with zero-knowledge proof calculations. For many ZK Rollups, achieving EVM equivalence means achieving full bytecode-level compatibility. At present, zkEVM is the key to Ethereum's expansion.
This article will study five common types of zkEVM and the progress of each type of project, and point out the design challenges of each type of zkEVM.
What is zkEVM
zkEVM is an EVM-compatible virtual machine that supports zero-knowledge proof computing. It is an application development platform based on Ethereum blockchain technology. EVM contracts can be deployed and run directly without modification, and the validity of the program can be proved through zero-knowledge proof of its calculation.
Advantages of zkEVM
1. zkEVM improves compatibility. zkEVM is highly compatible with smart contracts written to run in EVM and can be seamlessly integrated with EVM infrastructure. Developers can migrate existing Ethereum applications to L2 without redeveloping applications. At the same time, zk proof inherits the security of the Ethereum network.
2. zkEVM enhances scalability. zkEVM uses non-interactive proofs, which improves throughput and reduces latency because verifying the proof of an L2 block is faster than re-executing every transaction in a newly proposed block.
3. zkEVM reduces storage costs. zkEVM Rollup can choose to publish commitments to its final state only on Ethereum L1, thereby reducing on-chain storage costs. Validity proof guarantees the correctness of the new state of zkEVM, so the sorter does not have to publish all the data required to re-execute state transition changes.
It is with the continuous improvement of zkEVM that the limitations of ZK Rollup are resolved. Utilizing the security and efficiency of ZK Rollup and the compatibility of EVM, applications can interact with smart contracts and improve the application experience.
Five different types of zkEVM and related projects
When EVM was first designed, it was not considered to support zero-knowledge proof, which made it difficult to build an EVM-compatible zk virtual machine. However, with the progress of research, EVM calculations can be wrapped into zero-knowledge proofs. Different zkEVM projects use different methods to combine EVM execution with zero-knowledge proof calculations.
Ethereum founder Vitalik Buterin also wrote an article explaining the trade-offs between different types of zkEVM. Vitalik Buterin believes that the core goals of these projects are the same: to use ZK-SNARK technology to provide cryptographic proof of the execution of Ethereum-like transactions, so that it is easier to verify the Ethereum chain itself or to build ZK Rollups equivalent to the one provided by Ethereum, but more scalable than Ethereum.
Type 1 (consensus-level equivalence — completely equivalent to Ethereum)
Type 1 zkEVM strives to be completely equivalent to Ethereum. It does not change any part of the Ethereum system to make it easier to generate proofs, and does not replace hashing, state trees, transaction trees, precompiles, or any other consensus logic.
The advantage of Type 1 zkEVM is that it is perfectly compatible with Ethereum. In the long run, modifications to Ethereum tested in Type 2 or Type 3 ZK-EVM may be introduced to Ethereum itself, but this re-architecture has its own complexity, so Type 1 is what is ultimately needed to make Ethereum L1 itself more scalable. At the same time, Type 1 zkEVM is also ideal for rollups because they allow rollups to reuse a lot of infrastructure.
The downside of the Type 1 zkEVM is the verification time issue. Ethereum was not originally designed around ZK-friendliness, so many parts of the Ethereum protocol require a lot of computation to perform ZK proofs. The Type 1 zkEVM is designed to be an exact replica of Ethereum, so it does not mitigate these inefficiencies. The Type 1 zkEVM is the most ideal zkEVM, and there are many projects building or exploring this type.
Currently, Type 1 zkEVM related projects include Taiko and Kakarot.
Taiko built the Type 1 zkEVM, which enables developers and users to experience Ethereum safely, with lower transaction fees and without having to consider any changes. It raised $22 million in two seed rounds, with the first round led by Sequoia China at $10 million and the second round led by Generative Ventures at $12 million. On June 7, Taiko launched the Alpha-3 incentive testnet. According to Taiko officials, the testnet focuses on the decentralized, Ethereum-equivalent ZK-EVM part.
Kakarot zkEVM is an EVM deployed using the Cario language, which expands the reliability of the Starknet ecosystem by enhancing EVM compatibility. Kakarot zkEVM can exist in different forms. In the first phase, EVM will be brought to Starknet. In the second phase, Kakarot and Madara will be merged into a unified stack to support L3 zkEVM. In the third phase, Kakarot and Madara can also be combined to enable Type 1 zkEVM. On June 2, Kakarot zkEVM completed a pre-seed round of financing, with participation from institutions such as StarkWare and LambdaClass, as well as angel investors such as Vitalik Buterin, Nicolas Bacca, and Rand Hindi.
Type 2 (bytecode-level equivalence — completely equivalent to the EVM)
Type2 zkEVM strives to be completely equivalent to EVM, but not completely equivalent to Ethereum. That is, they look exactly like Ethereum from the inside, but they have some differences externally, especially in data structures such as block structure and state tree. The goal is to be fully compatible with existing applications, but make some small modifications to Ethereum to make development easier and make proof generation faster.
The advantage of Type 2 zkEVM is perfect equivalence at the VM level. Type 2 zkEVM makes changes to data structures that hold things like the Ethereum state. These are structures that the EVM itself cannot directly access, so applications running on Ethereum can almost always run on a Type 2 zkEVM rollup. This type cannot use Ethereum execution clients as is, but can use them with some modifications and still use EVM debugging tools and other infrastructure.
The downside of Type 2 zkEVM is that verification times are still slow. Type 2 zkEVM provides faster verification times than Type 1 zkEVM, primarily by removing parts of the Ethereum stack that rely on unnecessarily complex and ZK-unfriendly cryptography. For example, they may change Ethereum’s Keccak and RLP-based Merkle-Patricia trees, and possibly the block and receipt structures. These modifications significantly improve prover time, but do not solve all problems. Due to all the inefficiencies and ZK-unfriendliness inherent in EVM, proving EVM is still slow.
Currently, Type 2 zkEVM related projects include Linea and Polygon.
Linea is a Type-2 zkEVM powered by Consensys. By integrating ZKP with full EVM compatibility, developers can create scalable DApps or transfer existing DApps to new platforms without changing code or rewriting smart contracts. The public testnet was released on March 28 this year and has been added to the default network options of the Metamask extension. Linea released Alpha v0.2 at 12:00 on June 13. This version focuses on testing substantial architectural upgrades in preparation for the mainnet launch.
Polygon zkEVM is open source and uses Type 2 zkEVM. It uses ZK proofs to reduce transaction fees and increase throughput while maintaining the security of Ethereum L1. On February 14 this year, Polygon stated that Polygon zkEVM has passed 100% of the Ethereum test vectors applicable to zkEVM. Developers do not need to modify or rewrite any code, and all Ethereum tools can work seamlessly with Polygon zkEVM, which means that ZK Rollup's EVM compatibility has taken another big step forward and has reached the level of Type 2, which is completely equivalent to EVM. The Polygon zkEVM mainnet beta was officially launched on March 27, 2023.
Type 2.5 (EVM equivalent, except for gas cost)
One way to improve verification time is to significantly increase the gas cost of specific operations in the EVM that are difficult to ZK-proof. This could involve precompiles, keccak opcodes, and possibly specific patterns of calling contracts or accessing memory or storage or recovery.
Changing gas costs may reduce compatibility of developer tools and break some applications, but is generally considered less risky than "deeper" EVM changes. Developers should be careful not to require more than a block's worth of gas in a single transaction, and not to make calls with hard-coded gas amounts.
There is no specific project to develop Type 2.5 EVM yet, it is just entering a stage of Type 2.
Type 3 (bytecode-level equivalent — almost equivalent to EVM)
Type 3 zkEVM is almost EVM equivalent, but some sacrifices are made for exact equivalence in order to further reduce proof time and make the EVM easier to develop with.
The advantages of Type 3 zkEVM are that it is easier to build and has faster verification time. Type 3 zkEVM may remove some features that are particularly difficult to implement in zkEVM implementations. In addition, Type 3 zkEVM sometimes has subtle differences in how it handles contract code, memory, or the stack.
The downside of the Type 3 zkEVM is that it is less compatible. The goal of the Type 3 zkEVM is to be compatible with most applications, with minimal rewrite effort required for the rest. That said, there will be some applications that will need to be rewritten because they use precompilations that the Type 3 zkEVM removes, or because of subtle dependencies on edge cases that the VM handles differently.
Currently, Type 3 zkEVM related projects include Scroll.
Scroll is an EVM-equivalent zk-rollup developed by the Scroll team in collaboration with the Ethereum Foundation's PSE (Privacy and Scaling Explorations) group. It is currently in the Pre-Alpha testnet stage and is designed to be fully compatible with the EVM at the bytecode level. This means that developers can create smart contracts in any EVM-compatible language and deploy them to Scroll. Although Scroll is currently building a Type 2 EVM, many more complex precompilations have not yet been implemented, so it is considered a Type 3 EVM. According to Scroll, it is expected to be on the mainnet in July or August this year, and it said that a partner program to incentivize ecological development may be launched.
Currently, Type 3 EVM is just a transitional phase until the complex work of adding precompilation is completed, and then projects can move to type 2.5 zkEVM. But in the future, Type 1 and Type 3 EVM may add new ZK-SNARK-friendly precompilations to provide developers with low verification time and low gas cost features.
Type 4 (development language level equivalence — high-level languages are equivalent to EVM)
The Type 4 EVM works by compiling smart contract source code written in a high-level language (such as Solidity, Vyper, or an intermediate language) into a language that is explicitly designed to be ZK-SNARK friendly.
The advantage of Type 4 zkEVM is faster proof speed. Because this type does not perform zk proofs on all the different parts of each EVM execution step, but starts directly from the high-level code, a lot of costs can be avoided.
The disadvantage of Type 4 zkEVM is that it is less compatible. First, the addresses of contracts in Type 4 systems may be different from their addresses in EVM; second, many applications use handwritten EVM bytecode in some parts to improve efficiency, which may not be supported by Type 4 systems, and many debugging infrastructures cannot be inherited.
Currently, Type 4 zkEVM related projects include zkSync Era and StarkNet.
zkSync Era was created by Matters Lab. zkSync Era is the first EVM to be launched on mainnet and is fully accessible to the public to bridge their funds to the system or deploy their code on the network. zkSync Era uses a different bytecode format to support Solidity by providing a compiler. It supports Solidity but not the EVM bytecode itself. Tools such as Hardhat cannot be used directly, although plugins for zkSync are available.
StarkNet, created by StarkWare, is a zk-rollup L2 that uses zero-knowledge proofs to create an off-chain execution layer for Ethereum. In fact, EVM is not a native feature of Starknet. Starknet uses the Warp converter (provided by Nethermind) to convert Solidity code to Cairo to support smart contract deployment.
Challenges and Future of zkEVM
Since the EVM was not built with zk-proof computation in mind, it has features that are unfriendly to proof circuits, especially in terms of special opcodes, stack-based architecture storage overhead, and proof costs. However, several breakthroughs in zero-knowledge technology have made it possible to mitigate these issues.
There is no clear good or bad among the five types of zkEVM. The lower-numbered types are more compatible with existing infrastructure but slower, while the higher-numbered types are less compatible with existing infrastructure but faster. In general, it is beneficial for the development of zkEVM and Ethereum for different projects to explore different types.
In the future, there will be multiple zkEVM implementations that can be used both for ZK Rollup and for validating the Ethereum chain itself. In theory, Ethereum does not need to use a single standard zkEVM for L1, and different clients can use different proofs. However, it will take quite some time for such a future to become a reality. In the meantime, we will see more innovation on different paths to scaling Ethereum and ZK-rollup on Ethereum.