Source: Four Pillars; Translated by: Baishui, Golden Finance
Summary
In 2023, zkRollups transitioned from the research phase to the production phase, with projects such as Starknet, zkSync, Scroll, Polygon zkEVM and Linea launching their respective solutions.
With the development of new concepts such as coprocessors, attestor marketplaces, shared attestors, and zk aggregation layers, the zkRollup ecosystem becomes more efficient and decentralized.
There are three main phases involved in running a zkRollup: execution, proof generation, and proof verification, and various projects are focused on optimizing each component in the zkRollup supply chain.
zkRollups such as zkSync, Starknet, Merlin, and SNARKnado are developing their infrastructure, but they are still in the early stages of optimizing supply chains.
In 2022, zkRollups are mostly in the research phase. 2023 marks the beginning of their future. Many projects, including Starknet, zkSync, Scroll, Polygon zkEVM, and Linea, have put their Rollups into production. The benefits are obvious, as it has shorter finalization times, more secure interoperability, and lower operating costs than optimistic rollups. Despite these advances, zkRollups are still in the experimental stage compared to optimistic rollups, and their technical roadmap changes frequently.
So, what does the future hold for zkRollups? New terms such as coprocessors, attestor marketplace, shared attestors, and zk aggregation layer are often seen in many projects. zkRollup is being developed in different ways, and in the zkRollup ecosystem, many components are being built to make zkRollups more efficient and decentralized. If we think about how zkRollups operate, the process involves three phases: execution, proof generation of execution, and proof verification. Each phase has corresponding projects. To briefly summarize:
Execution: zkVM, coprocessor
Proof Generation: Proof Marketplace, Proof Aggregator
Proof Verification: Settlement Layer
It’s still early days for each of these categories, but as this supply chain becomes more developed, the zkRollup ecosystem will become more efficient. In this article, we’ll first explore the basics of zk, then dive into the projects being built in the zkRollup supply chain, as well as some of the major zkRollups in Ethereum and Bitcoin.
1. ZKP and zkRollup Basics
The zkRollup mentioned in the title of this article is a rollup method that uses zero-knowledge proofs (ZKP). If you have come across the term zero-knowledge proof in the blockchain ecosystem, you may be familiar with it (if not, don’t worry; it will be explained later). However, if you ask why and how this technology is applied to rollups, you may find it difficult to answer immediately.
To find the answer to this question, in this chapter, we will explore what zero-knowledge proofs and zkRollups are, how they work, and why ZKP technology is a good fit for rollups.
1.1 What is ZKP?
1.1.1 ZKP Overview
Before we delve into the details of ZKP, let’s first understand the components involved in this process. There are two main components:
Prover: The prover holds the statement they want to prove to the verifier in the ZKP process.
Verifier: A verifier participates in the ZKP process to determine whether the prover’s statement is true based on the evidence provided.
Now, let’s explore ZKP in detail. ZKP is a cryptographic technique where a prover can prove a specific fact without revealing the fact itself or any related information. ZKP has three main characteristics: completeness, soundness, and zero-knowledge:
Completeness: If the prover’s statement is true, then the verifier will be confident that the statement is true.
Soundness: If the prover’s statement is false, the prover cannot deceive the verifier into believing it is true.
Zero-knowledge: During the proof process, the verifier does not obtain any other information other than the truth or falsity of the statement.
1.1.2 ZKP Examples
The definition alone may not be easy to understand, so let’s use a well-known example, “Ali Baba’s Cave”, to explain zero-knowledge proof.
Consider the following scenario: In Ali Baba’s cave, there are two paths, A and B, which meet deep inside the cave but are blocked by a secret door. The prover (P) claims to have the key to pass through this secret door, and the verifier (V) wants to verify whether P actually has the key.
The verification process follows these steps: P enters the cave and chooses path A or B. V does not know which path P took, but can ask P to come out via a specific path. If P has the key, P can come out via any path. After repeating this process several times, V can be confident that P has the key. However, V does not learn anything about the shape or nature of the key.
Applying this to the characteristics of zero-knowledge proofs:
Completeness: If P consistently follows V’s instructions over many repetitions, V can be confident that P has the key.
Reliability: If P does not actually have the key, but lies about it, then it is inevitable that a situation will arise where P is unable to follow V’s instructions, thus proving P’s claim to be false.
Zero knowledge: V is certain, through many iterations, that P has the key, but knows nothing about the key’s appearance or properties.
1.2 So what are Rollup and zkRollup?
So far, we have explored the A to Z of zero-knowledge proofs. However, it is important to remember that the focus of this article is zkRollups. Now, let’s take a deeper look at what rollups and zkRollups are.
1.2.1 Rollup Quick Overview
Rollup is a Layer 2 scaling solution that processes transactions on the Layer 2 blockchain and then publishes the Rollup state to the Layer 1 blockchain for recording and management.
There have been many previous proposals to address Ethereum’s scalability issues. The earliest is sharding, which is dividing the Ethereum network into several smaller "shards" to significantly increase transaction throughput. Similar to how multiple computers process tasks simultaneously, sharding enables the Ethereum network to process more transactions quickly and efficiently.
Despite its benefits, Ethereum developers abandoned direct sharding due to concerns about potential centralization and technical challenges, which would lead to delays. Instead, they adopted an approach of indirect sharding through Layer 2 solutions. In this approach, the process of transferring transaction data in batches to Layer 1 is called rollup. Currently, Optimistic Rollup and zkRollups are the two main types leading the ecosystem.
1.2.2 Why ZK Proof and Rollup are a perfect match
zkRollups differ from Optimistic rollups in that they use validity proofs instead of fraud proofs. zkRollups use zk-SNARK or zk-STARK to compress a large number of transactions into a single small proof, which is recorded and verified on the Layer 1 blockchain. Unlike Optimistic rollups, this approach significantly improves processing speed and efficiency and does not require a dispute period for erroneous results.
The non-interactive nature of zero-knowledge proofs is critical to the efficiency and convenience of zkRollups. It allows rollups to independently manage the rollup process, maximizing efficiency by bundling and sending transaction data to Layer 1 according to their own schedule. This non-interactive approach prevents potential delays and inefficiencies that can arise from a more interactive process between Layer 1 and rollup.
Simplicity is another key factor in the effectiveness of zkRollups. zk-SNARKs and zk-STARKs are able to compress large amounts of data into small proofs, which ensures economic efficiency when sending transaction data to the more expensive but more secure Layer 1. This compression capability enables zkRollups to process multiple transactions as a single batch, greatly enhancing the scalability of Layer 1 while providing users with a more cost-effective blockchain infrastructure in a rollup environment.
1.2.3 zkRollup Operation
Let’s explore further how zkRollup works and what components are involved. zkRollup mainly operates by two components:
Sequencer: The sequencer collects and processes transactions occurring on Layer 2 and submits the processing results to Layer 1. Although some rollup projects have separate entities for sequencing and generating validity proofs, for simplicity, we treat them as combined roles here.
Rollup Contract: The rollup contract is a smart contract on layer 1 that determines the state and transactions of the rollup. It receives, stores, and verifies the data submitted by the sequencer, ensuring that the data is properly stored and managed after it is verified.
The operation process of zkRollup is as follows:
[Sequencer <> L2] Transaction batching and state change calculation: Aggregate multiple transactions executed on Layer 2 into a batch, execute each transaction in the batch, and generate a state root that records the new state changes.
[Sequencer<> L2] Validity Proof Generation: Generate a validity proof using the new state root to prove the correctness of the state root. This proof guarantees that all transactions within the batch have been executed correctly without revealing the details of each transaction.
[Sequencer <> L2] Submission of state root and validity proof: The generated validity proof, state root, and hidden transaction data are submitted to the Layer 1 Rollup contract. The Rollup contract verifies the submitted data.
[Sequencer <> Rollup Contract (L1)] Verify and update: The Layer 1 Rollup contract receives the validity proof, state root, and verification transaction data from the sequencer. It verifies the data, updates the state root, and stores the verification transaction data if there are no problems. If problems are found, the verification and storage process will not be performed.
2. zkRollup Supply Chain Overview
From a bird’s eye view, let’s look at how the entire supply chain of zkRollups works. There are three main processes involved in zkRollups: execution, proof generation, and verification.
Execution: This happens off-chain, with transactions being executed in batches on a separate rollup network, updating the rollup state.
Proof Generation: Compiles inputs such as transaction batches and state roots. The Proof Routes process transactions and generate succinct zk-proofs that cryptographically prove the validity of state transitions without revealing data.
Proof Verification: The zk proof and related data are submitted to the validator contract on the settlement layer (mainly Ethereum) for verification. If valid, the rollup contract will update its state to reflect the new post-state and complete the change after a short time buffer.
There are projects dedicated to each process to make zkRollups run more efficiently. In the next section, let’s take a deeper look at what each process is and which projects are handling them.
2.1 Execution - Execution in ZK Routes
The execution and settlement layers are separated, the computation is performed on separate machines, and the proof of execution is generated in the zk route. This execution environment can be divided into two parts: zkVM and Co-Processor.
2.1.1 zkVM
Source: Foresight Ventures: zk, zkVM, zkEVM and their future | Author: Foresight Ventures | Medium
A zkVM (zero-knowledge virtual machine) is a specialized virtual machine designed to perform computations and generate zero-knowledge proofs to verify the correctness of those computations without revealing the underlying data. There are several types of zkVM, each tailored to a specific virtual machine and programming language. Here are some of the categorizations of these projects:
zkEVM: It aims to replicate the EVM environment while incorporating zero-knowledge proof capabilities. This allows existing Ethereum smart contracts and dApps to be seamlessly ported to zkEVM-based Rollups. However, due to the complexity of developing a zk route for EVM and its frequent upgrades, pure EVM has compatibility issues.
Universal zkVM based on RISC-V and MIPS: zkRISC is a specific implementation of zkVM developed by RISC Zero. It is designed to be a universal zkVM capable of executing arbitrary computations and generating zero-knowledge proofs. It allows programming languages such as C, Python, and Rust to be deployed and generate proofs of execution.
CairoVM: Cairo VM is designed to optimize the generation of validity proofs for program execution. Unlike zkEVM solutions that focus on making the EVM compatible with validity Rollups, Cairo VM is designed from the beginning to maximize the efficiency of STARK proofs. This approach allows for better performance and scalability without being limited by the limitations of the EVM. However, there are barriers to building dapps as developers need to learn a new language.
2.1.2 Coprocessor
Source: Phala’s Path to 2024: Coprocessors for Blockchain — AI, Hooks, and DePin
Coprocessors are developed as off-chain processors to assist with specific computations. For example, a graphics processing unit (GPU) manages the massive parallel computations required for 3D rendering, allowing the central CPU to focus on general-purpose processing. In this sense, coprocessors support blockchains with complex execution that would be costly on blockchains. Each type of coprocessor is designed to maximize efficiency in processing its specialized workload.
By leveraging ZKP, coprocessors can implement trustless and verifiable off-chain computations, ensuring the correctness and integrity of the results without leaking sensitive data. Some known projects include:
Axiom: Axiom is developing a “ZK coprocessor” system that allows smart contracts to query historical blockchain data and perform complex computations off-chain while maintaining data privacy and integrity through ZKP.
Phat Contracts (Phala Network): Phat Contracts is a co-processor that enhances scalability, enables a gas-free experience, supports multi-chain functionality, and provides dApps with secure access to off-chain data.
2.2 Proof Generation — Generating Zero-Knowledge Proof
To prove the validity of a state transition, the rollup operator (the prover) generates a ZKP. This proof confirms that the new state root was correctly computed from the previous state. Because generating ZKPs requires significant computational resources, the proof generation process has limitations, especially for large transaction batches or complex smart contracts. This can limit the throughput of zkRollups and the types of applications they can effectively support.
Furthermore, since the entity generating zk proofs requires expertise in the field and needs to keep the hardware up to date, the management costs can be high, not to mention the centralization risks. As a result, some progress has been made in the field to make it more efficient. The approach is divided into two parts: building a proof generation market to outsource the generation process, and creating an aggregation layer to make it more cost-effective.
2.2.1 Proof Generation Market
Source: Gevulot Introduction | Gevulot
Key features provided by the attestation market include decentralized attestation generation, an auction mechanism, and hardware utilization and cost efficiency. Applications submit attestation requests to the network, and attestors respond using attestation generation hardware, ensuring that attestation requests are processed efficiently. The auction mechanism matches these requests with attestors, enabling competitive attestation pricing. In addition, attestors use specialized hardware, reducing attestation costs, and the decentralized market allows attestation requests from different applications to be aggregated, thereby improving hardware utilization and cost efficiency.
The proof market also ensures censorship resistance and fast finality, and implements a staking mechanism. The market guarantees short-term censorship resistance, so that the bids of provers are not unfairly blocked or ignored. Provers are required to stake with the network to prevent malicious activity and ensure the reliability and integrity of the network.
Finally, the marketplace leverages economies of scale. Coordinating ZKP generation at scale reduces costs for end users. Aggregating proof order flow enables provers to invest in and operate more efficient infrastructure. Applications also benefit from reduced on-chain verification costs because proofs can be aggregated for optimization. Some projects include:
Succinct Network: Succinct Labs is developing a decentralized attestor marketplace as part of its Succinct Network, which aims to create a unified protocol for ZKPs. This marketplace will allow applications to outsource their attestation generation to a specialized attestor network, providing a more efficient and cost-effective solution for ZKP-based systems. The attestor marketplace will operate through an auction mechanism that matches an application's attestation request with a set of different attestors.
=nil; Foundation: =nil; Foundation has developed a Proof Market, a decentralized distributed system designed to serve as a spot market for ZKPs. This market allows proof requesters (e.g. applications) to outsource the generation of zkProofs to specialized proof producers. The Proof Market runs on top of =nil; Foundation's database management system and functions more like a "Proof DEX" than a centralized service.
Gevulot: Gevulot is not a traditional prover marketplace, but a decentralized proof layer for a modular stack. It is a permissionless and programmable layer 1 blockchain specifically designed for deploying proof systems as on-chain programs. Unlike typical prover marketplaces, Gevulot allows users to deploy prover and verifier programs directly on the blockchain, similar to deploying smart contracts on Ethereum. This approach enables applications to benefit from decentralized proofs without having to bootstrap their prover network or rely on centralized solutions.
2.2.2 Proof Aggregation
Source: Prove It: Shared Attesters, Attestation Aggregation, and the Attester Marketplace - Delphi Digital
ZKP aggregation is a technique that combines multiple ZKPs into a single proof, reducing the overall cost of verifying these proofs on-chain. This is especially beneficial for Rollups that rely heavily on ZKPs. Some notable projects include:
Polygon AggLayer: It aims to enable smooth interoperability between L2 solutions in the Polygon ecosystem by leveraging aggregate ZKP and a unified bridge contract (LxLy Bridge). Aggregate proofs ensure that dependent chain states and bundles are consistent, preventing invalid Rollup states from being settled on Ethereum if it depends on an invalid state of another chain.
Nebra: Its product Universal Proof Aggregation (UPA) is a protocol for aggregating ZKPs. Nebra's UPA can aggregate proofs from different routes, proof systems, and parties, reducing the gas cost of on-chain verification by more than 10 times. Nebra works with projects such as AltLayer to integrate UPA into their Rollup solutions, enabling AltLayer users and dApps to benefit from significantly reduced costs.
Electron Labs: Electron Labs has developed Quantum, an aggregation layer that leverages zk-recursion to aggregate proofs from different protocols and various proof schemes into a “super proof.” This super proof is then verified on Ethereum, amortizing the verification costs of multiple protocols and providing cheaper verification for a single protocol.
2.3 Proof Verification
The proof generation process in zkRollups is computationally expensive. However, verifying these proofs on the Ethereum mainnet is relatively lightweight, enabling scalability while maintaining the security guarantees of the underlying blockchain.
The zk-validation smart contract in Ethereum uses an efficient cryptographic algorithm to verify the validity proof. If the proof is valid, the proposed state transition is correct and the new state root is accepted, updating the rollup state on the mainnet. Some projects, such as Aligned Layer, provide faster and cheaper verification by leveraging validators in Ethereum.
2.3.1 Alignment Layer
Source: whitepaper.alignedlayer.com
Aligned Layer is a decentralized ZKP verification and aggregation layer designed specifically for Ethereum. As the EigenLayer Active Verification Service (AVS), it leverages Ethereum’s economic security through a process called “re-staking” to ensure that ZKPs are accurately verified and settled on the Ethereum blockchain.
Aligned Layer offers two different modes of operation to meet different needs. Fast mode is optimized for minimal verification cost and low latency, making it ideal for applications that require fast and cost-effective proof verification. On the other hand, Slow mode leverages proof aggregation to fully exploit Ethereum's security guarantees, providing comprehensive security. This dual-mode approach enables Aligned Layer to provide a flexible solution that balances speed and security based on the specific requirements of different use cases.
3. Analysis of zkRollups
As discussed in Section 2, various projects are working on optimizing the zkRollup supply chain. Let’s take a closer look at the most notable zkRollup projects in production, specifically EVM-compatible projects zkSync and Starknet, and Bitcoin-compatible projects Merlin Chain and SNARKnado.
3.1 zkSync
zkSync is a zkRollup solution developed by Matter Labs to address the scalability challenges facing the Ethereum network. While zkSync's initial focus is on scaling Ethereum, its ambitions extend far beyond being an L2 solution. Matter Labs envisions zkSync as the foundation for a comprehensive cross-chain ecosystem, designed to seamlessly connect a variety of zkSync-based rollups. To achieve this goal, zkSync is developing a complex but user-friendly cross-chain environment that incorporates zkRollup technology, ZK Chain, and Hyperbridge. Let's take a look at each concept.
3.1.1 zkRollup — Economic Efficiency Optimization
zkSync uses zkRollup technology based on zk-SNARK, and the proof generation and verification method of zk-SNARK has small proof size and fast verification speed. However, as the advantages of zk-STARK such as quantum resistance and large-scale processing become more prominent, zkSync is also trying to partially adopt zk-STARK. For example, the proof generation system called "Boojum" uses the zk-STARK method for proof generation.
3.1.2 Structural components
Sequencer: The Sequencer in zkSync arranges and processes transactions according to specific rules. The Sequencer includes the Prover, which generates proofs and transaction data that cannot be viewed in detail and sends them to Layer 1.
Prover: The Prover in zkSync uses zk-SNARK to generate proofs. The data used in the proof generation process includes transaction data that cannot be viewed in detail and state change data before and after the L2 chain state change. The generated proof is verified by the Rollup contract on Layer 1.
Settlement: zkSync uses the data generated on Layer 2 for verification and updates it in the Layer 1 smart contract. If a verification problem occurs, the transactions in the affected batch will not be updated. This process is modular, and each ZK Chain will be connected to one or more smart contracts as described below.
3.1.3 ZK Chain
ZK Chain is a blockchain that goes beyond Layer 2 and includes the infrastructure provided by zkSync. It is called beyond Layer 2 because zkSync adopts an unrestricted layered structure, including fractal structures such as L3.
The most well-known ZK Chain at present is zkSync Era built by zkSync. It is EVM-compatible and allows the deployment of simple dapps. However, for zkSync's ultimate cross-chain ecosystem goal, the relationship between different ZK Chains is crucial. zkSync focuses on how to connect with other future ZK Chains.
An example of leveraging the ZK Chain environment is Hyperbridge. Through Hyperbridge, users can conveniently send all assets from connected chains to their chain-specific wallets. When users need to use assets on their chains, relayers facilitate the bridging, destruction, and issuance of assets.
For example, if cross-chain Uniswap is used, and a user on the era.zksync chain wants to exchange 1 ETH for 10,000 DAI, the flow is as follows:
Generate a “1 ETH → 10,000 DAI” transaction from the era.zksync chain wallet.
The relayer transfers 1 ETH to uni.chain, converting it into 10,000 DAI.
The relayer then transfers the swapped 10,000 DAI back to the era.zksync chain.
This way, users can easily use zkSync’s environment to perform cross-chain transactions without having to know detailed information about other chains.
3.1.4 EVM Compatibility
zkSync currently claims 99% compatibility with Solidity and Vyper. Initially, zkSync supported Zinc, a Rust-like language, to implement a more suitable and efficient zkEVM. However, they shifted their focus to Solidity compatibility and stopped development of Zinc in September 2021 to ensure full optimization.
3.2 Starknet
Starknet is similar to zkSync in that it is a layer 2 solution based on zkRollup, but its technology stack and internal technology are different. Notably, it uses zk-STARK instead of zk-SNARK and uses its own smart contract language Cairo.
3.2.1 zk Rollup - Focus on high-capacity Rollup processing
Starknet uses zk-STARK to generate and verify Rollup-related proofs. Similar to zkSync, it only uses the previous and next state changes to more efficiently manage Rollup data at Layer 1.
In addition, since Starknet uses zk-STARK, it benefits from a trustless environment and the ability to process a large number of transactions simultaneously. This makes Starknet a top choice for DeFi dApps or gaming dApps with high transaction volumes.
3.2.2 Structural characteristics
Structurally, Starknet adopts a similar architecture to other zkRollups. But it differs in that it actively utilizes the zk-STARK zero-knowledge proof model and maintains EVM compatibility through its proprietary programming language Cairo.
Source: Starknet Architecture: An Overview
Sequencer: The Sequencer in Starknet plays a vital role in managing the verification and execution of transactions and proposing blocks. Its main function is to process transactions in batches. Transactions that fail to pass verification are restricted by the Sequencer, and only verified transactions are included in the block. The Sequencer also includes a prover, who is responsible for sending the completed rollup data to Layer 1.
Provers: Provers in Starknet use zk-STARK to generate proofs. During the proof generation process, the prover saves each transaction execution step to create an Execution Trace and track state changes in the L2 chain, recording State Diff. The proof generation process requires a lot of computing resources and is designed to support parallel processing, allowing multiple provers to divide the work and perform tasks simultaneously.
Settlement: Data generated on Layer 2 is transferred to Layer 1 (e.g. Ethereum), where components accept transactions and manage proofs and state differences. These components are handled by two smart contracts: the Validator contract and the Starknet Core contract. The Validator contract analyzes the proofs received from Layer 2 and exercises veto power on the transaction if any issues are found. If the validity of the proof is confirmed, it is transferred to the Starknet Core contract, which updates the Layer 1 chain with the provided state changes. This updated state is added to the Layer 1 chain block, and once the block passes through the Layer 1 process, it is affected by Layer 1.
3.2.3 EVM Compatibility
Starknet is developing its own unique path to EVM compatibility through the Cairo language. To deploy smart contracts on Starknet, you must use Cairo. While Cairo does not yet support many Solidity features, and although the number of Cairo developers is increasing, it still lags behind Solidity in terms of community size and adoption.
Starknet's smart contract language Cairo inherits Rust's functionality. It is optimized for zk-STARK proof generation and can efficiently execute and generate proofs for smart contracts. Overcoming the barriers to using Cairo allows smart contracts to be deployed and executed in a better environment and data can be securely aggregated to Layer 1.
The following table summarizes the main differences between Cairo and Solidity.
3.3 Merlin Chain
Merlin Chain is a Bitcoin-based layer 2 zkRollup solution developed by Bitmap Tech, which mainly focuses on Ethereum. Based on Polygon's zero-knowledge proof technology, Merlin Chain has the advantage of being compatible with EVM while securely storing Rollup data to Bitcoin L1. In this way, Merlin Chain aims to increase liquidity and expand the ecosystem within the Bitcoin network, including BTC, with the slogan "Make Bitcoin Fun Again".
3.3.1 zkRollup - A hybrid approach to Bitcoin’s unique features
Merlin Chain uses zkRollup technology that combines zk-SNARK and zk-STARK. Initially, due to the structural characteristics of the Bitcoin network being Turing incomplete, ZKP could not be directly verified on the Bitcoin network. However, after the Taproot upgrade, some verification became feasible. Merlin Chain uses Taproot to record the Rollup data and proof data generated off-chain onto the Bitcoin network.
In Merlin Chain, zkProver is responsible for verifying the validity of transaction data and generating proofs based on the verified data. The stages of this process are as follows:
The sequence nodes of Merlin Chain store the current state information in the database.
The sequencer sends the transaction to zkProver.
zkProver accesses the database to retrieve the data required for transaction verification.
Once zkProver finishes verifying the transaction, it generates a proof and sends it to the sequencer node.
The process involves several steps. First, transactions are verified and processed using the zkEVM based on zk assembly language (zkASM) developed by the Polygon zkEVM team. The generated data is then aggregated and compressed using the high-capacity processing power of zk-STARK to optimize Rollup economic efficiency. Finally, a proof that produces a consistent proof size is generated using zk-SNARK. The generated data and proofs are then verified in the decentralized Merlin Chain oracle network environment and uploaded to the Bitcoin network via Taproot.
3.3.3 Future upgrades: on-chain fraud proofs
While zkRollup seems to be a good candidate for L2 solutions in the Ethereum ecosystem (as described in Section 3.2.1), it cannot perfectly guarantee the validity and accuracy of transactions within the rollup. In order to bridge the gap caused by the structural differences in the Bitcoin network, Merlin Chain uniquely plans to introduce an on-chain anti-fraud mechanism similar to optimistic rollup.
The on-chain fraud prevention mechanism operates in the relationship between the rollup data proposer and the challenger. If the challenger believes that the rollup data is incorrect, they can challenge the transaction data, ZK state information, and ZK proof uploaded to the Bitcoin network. Most L2 transactions do not need to be re-verified on the Bitcoin network (L1), but if a challenge is made to a previously proposed rollup data, the data and transactions must be re-executed and verified. If a role is found to be at fault, they will be punished.
3.3.4 EVM Compatibility
Merlin Chain achieves EVM compatibility by using zkEVM based on zkASM in its zkProver. This enables smart contracts developed using existing Ethereum development tools and infrastructure to be executed on the Bitcoin network, providing the advantage of extending Ethereum’s functionality to Bitcoin.
3.4 SNARKnado
SNARKnado is a Bitcoin-based layer 2 solution implemented by Alpen Labs using zk-SNARKs. Alpen Labs aims to use SNARKnado to enable blockchains to focus more on verification rather than computation, thereby achieving greater scalability and efficiency in the Bitcoin ecosystem.
3.4.1 zkRollup - BitVM's successor
SNARKnado is a modified model that is further optimized for zk-SNARKs, borrowing the prover-challenger structure used in the BitVM Optimism method. This improves its performance by about eight times compared to BitVM. However, it still does not reach the advantage of BitVM2 that allows anyone to initiate challenges, as SNARKnado currently limits the challenge ability to allowed roles.
3.4.2 Structural features
Proof Verification Method - Bisection Polynomial
Using zk-SNARKs allows SNARKnado to manage Rollup data and proof data on Bitcoin with smaller proof sizes, but Bitcoin's restrictions on complex computations require optimizations for proof verification. SNARKnado solves this problem by transforming proof data using a bisection polynomial. The verification process is performed through on-chain computation enabled by the Taproot upgrade.
When the prover receives a challenge, they disclose some data required for the challenge and go through the verification process with the challenger. The bisection polynomial method is used for verification to determine which role (the prover or the challenger) is at fault.
3.4.3 SNARKnado and BitVM or BitVM2
SNARKnado has many similarities to BitVM, especially appearing as a midpoint between BitVM and BitVM2. So, what are the differences between them? (Since BitVM2 is a more advanced model than BitVM, the comparison will focus mainly on BitVM2.)
First, consider Bitcoin's internal resource usage. BitVM2 inherently shows a linear increase in on-chain resource usage, while SNARKnado reduces this increase to square root levels, optimizing on-chain resource usage. Another difference is the accessibility of roles that can issue challenges. While SNARKnado restricts challenges to allowed roles, BitVM2 allows anyone to issue challenges without permission.
3.4.4 EVM Compatibility
According to Alpen Labs’ latest records, EVM compatibility is not officially supported yet, and there are currently no future plans for EVM compatibility.
4. Looking to the future
Looking back at recent zkRollups mainnet launches, we see zkSync Era in August 2023 and Polygon zkEVM in December 2023. These projects haven’t been around very long, so most are still under active development. Additionally, development is not limited to zkEVM. General purpose zkVM, zkWasm, and off-chain coprocessors are also being developed in part, using custom zk routes.
As basic execution and attestation generation become more reliable, efforts are underway to improve supply chain efficiency. Strategies include building a marketplace of attestors, aggregating multiple attestations, and creating verification layers for cost-effective verification. It is expected that supply chains for zkRollups will become more efficient and affordable in the future.
