TL&DR：

• The succinctness feature of zero-knowledge proof (zkp) makes it stand out as a solution to Ethereum Layer 2 scalability

• The mathematical language of zkp is not compatible with Solidity, making it very hard for developers to port their contracts on Rollups using zero-knowledge proofs, thus several solutions emerge

• We believe Scroll, the EMV-compatible zkVM is a long-term driven and the most practical approach given its unique technical approach, close work relationship with Ethereum Foundation, and strong research background in the zero-knowledge field

The Importance of ZK Proof in Scaling Ethereum

What is Zero Knowledge Proof

A zero-knowledge proof is a way of proving the validity of a statement without revealing the statement itself, using sophisticated mathematical computations. Normally it consists of two parties, the 'prover' that tries to prove a claim and the 'verifier' that validates the claim. The use of public and private key pairs is a perfect illustration of zero-knowledge proof. I can claim ownership of a crypto account without explicitly showing you my private key. Instead, I can send you a signature generated with my private key to confirm the public key of this account.

Two crucial characteristics of zero-knowledge proof are succinctness and non-disclosure. Succinctness means it's easy and quick to verify, so it is usually used to scale up transactions while non-disclosure means it is private by nature and can be used to build private networks. Notably, these two features don't always come together, since they require different circuits to build. For example, the majority of ZK-rollup scaling solutions do not incorporate the transaction-shielding privacy component of zero-knowledge proof. For the purpose of this article, we will focus only on its succinct nature.

Why do we need zero-knowledge proofs

Unlike the counterparty Layer2 scaling solution - Optimistic rollup, which works under the optimistic assumption that all verifiers are honest and have a seven-day withdrawal period, Rollups using zk proofs rely on the mathematical mechanisms that are more rigorous and secure (proof cannot be generated if there are invalid transactions) with millisecond verification time. However, ZK-Rollups are incompatible with Ethereum Virtual Machine (EVM), making it challenging to write and operate Solidity-based Dapp’s protocols. A detailed comparison of Optimistic Rollup and Zk Rollup can be seen here.

In the medium to long term, ZK rollups will win out in all use cases as ZK-SNARK technology improves. --- Vitalik Buterin

Zk-rollup is usually classified as ZK-Snark and ZK-Starck and presented the latter as superior to the former given its post-quantum resistance and trustless setup. However, as our research found out, given polynomial commitment schemes (such as KZG)， there is less difference between the circuits of zk-Snark and zk-STACK. Some Rollups, such as Polygon Hermez, incorporate a mix of the two in designing their front and back ends.

Several efforts are geared towards creating a zero-knowledge EVM (zkEVM) implementation that helps developers to leverage the security and scalability guarantees of zero-knowledge while using familiar (and battle-tested) tooling and languages, including Scroll, Polygon zkEVM, zkSync and etc.

A battle between zkVM vs. zkEVM

We classify ZK-rollups into 3 types, based on their compatibility with Ethereum, which refers to the ability for developers to easily port contracts from Ethereum L1. Part of EVM compatibility depends on the amount of opcode coverage on the non-EVM machine, which has 141 opcodes. Achieving perfect compatibility hits diminishing returns if the majority of development does not necessitate full 1:1 opcode conversion.

zkEVM projects are working on incorporating as many opcodes as possible to enhance developer experience, while zkVM protocols' instruction set is generally smaller than the number of opcodes of EVM, but developers have to grasp a new language, such as Cairo for Starknet. We believe EVM-equivalent is the long-term driven yet most practical approach for L2 Scaling.

Within the zkEVM bucket, these are Polygon Hermez and Scroll. Though providing both bytecode level EVM compatibility, Polygon is different from Scroll in that it has its own execution logic without using Geth, the Go implementation of Ethereum in handling transactions, deployment, and execution of smart contracts. Whereas Scroll achieves opcode level equivalent zkEVM with the same execution logic as Ethereum, meaning that developers can have the exact same experience on Scroll as they have with Ethereum.

With the aforementioned advantages, we believe Scroll is the most promising protocol in the L2 scaling arena. Next, we will dive deeper into the architecture and innovations of Scroll.

Scroll

Anatomy of Scroll’s architecture

Scroll, building towards zkEVM, is able to execute native EVM bytecode on L2 while inheriting strong security guarantees from base layer Ethereum.

There are mainly three components of Scroll, namely the scroll node, roller network, and Layer 1 contracts.

• Scroll Nodes can be largely seen as the sequencer that executes transactions and generates new L2 blocks with new state root and trace. Then the nodes will randomly select a Roller for proof generation.

• Roller Network is the pool of provers, who first convert the execution trace received from the coordinator to circuit witness and generate proofs for each of the zkEVM circuits written for each opcode in the trace (this is where zkEVM comes into play!). Finally, it will use proof aggregation to bundle proofs from multiple zkEVM circuits into a single block proof and send the proof back to the Scroll Nodes.

• Layer 1 contracts consist of a roll-up contract and bridge contracts, the first one being the data availability on L1 and the second being the messager between L1 and Scroll. Once the coordinator receives the aggregated proof, it submits the proof to the Rollup contract to finalize L2 blocks.

What’s special about Scroll

Meeting the Team Behind

Who's building it

• Ye Zhang: is a Ph.D. student at New York University studying Computer Science. He also holds a Bachelor’s degree from Peking University in China. He has been a researcher in zero-knowledge proof for four years and published some of the pioneer papers in zkp application and improvement

• Sandy Peng: works on the strategy side of Scroll with her experience in investment and management. She used to be the partner for Fission Capital in Hongkong and holds a B.A. From Cambridge University in the UK

• Haichen Shen: Before funding Scroll, Haichen was a Senior Applied Scientist with a focus on AI compilers. He holds a PhD degree in Computer Science and previously graduated from Tsinghua University in China.

The team currently has around 45 members, 30 of which are engineering backgrounds. Members are located in Europe, Asia, and North America. They have been working with the PSE team from the Ethereum foundation since day one.

Who’s funding it

Scroll raised $30 million in Series A fundraising in April 2022. Polychain was as the funding's lead investor, and other investors included Bain Crypto and Geometric DAO. They had already obtained $3 million from angel investors. Ye Zhang said in an interview that while choosing investors, they were very picky about their backgrounds and specifically chose those with backgrounds in research and technology so they could help Scroll during the growing process by introducing more zk professionals to their team.

What’s the current status of it

Scroll is currently at its public pre-alpha test. The features are exactly the same as its mainnet being launched later in H2 this year, as a permissionless network. Notable protocols such as Uniswap V3, LensProtocol, and Safe have all been deployed on Scroll testnet. From recent research by Messari, we can see Scroll leads the way in user adoption with the highest number of unique wallet addresses and transactions.

The next two big things ahead are to decentralize the sequencer i.e. Scroll Nodes and to accelerate provers' proof generation time. Several proposals have been made regarding how to decentralize the operation nodes. They may introduce forced arbitrary execution if a transaction has not been executed in one or two days to avoid censorship. In terms of Proof Acceleration, Scroll has partnered with a few hardware companies such as Cysic (btw who just raised a 600m seed fund) to test out the most suitable GPU form. They aim to fully decentralize prover networks in 2024.

Parting Thoughts

Throughout the examination of Scroll and additional zkEVM projects, I find Scroll really special in its vision and value. They appear to be working toward a very specific objective: using zero-knowledge-proof technology to scale Ethereum while maintaining security, decentralization, and developer-friendly conditions. All of their investors and team members are research-focused, providing them with the ideal individuals to carry out the right actions. By collaborating with Ethereum's PSE team from day one, Scroll has the ultimate goal of helping Ethereum scaling - 'zk SNARK everything‘.

Lastly, it’s necessary to mention that this article only focuses on the advantages of Scroll, emphasizing its competitive advantages of building an EVM-equivalent Layer 2 scaling solution. Further analysis of the strategy and architecture of other similar projects such as Taiko, Polygon, zkSnyc, and Starknet is necessary to fully understand the arena of zk-rollup.