During the past few months, the congestion of Ethereum has led to high costs and poor user experience, which leads to an intense discussion about Ethereum2.0, scaling and Layer2. It is when ZK-Rollup stands out. The purpose of this paper is to focus ZK-Rollup in detail, thus we skip over wider concepts like Layer2.
## What is ZK-Rollup?
To understand ZK-Rollup, first we need to take a look at Layer2.
Layer2 is a secondary protocol built on top of the main chain parallel with it, sending and receiving information from the latter, so that transactions and changes in states that take place in Layer2 can be returned to and saved on the main chain. In this way, a great portion of computation can be moved from the main chain to this second layer, so the main chain only takes the responsibility of data verification and storage, which considerably lightens the load and improves the efficiency of the main chain.
ZK-Rollup is one of the Layer2 solutions, and can be understood with two concepts: Rollup and ZK, which stands for zero-knowledge.
The main idea of rollup is to batch a collection of transactions that happened off-chain, and post the compressed data with the previous account state and the new state on layer1. To be more specific, a rollup smart contract is placed on the main chain which maintains and updates a state root (a Merkle root, including the state and balance of accounts). When a collection of transactions are compressed into a batch (which also includes the previous state-root and the new state root) and sent to the main chain, the smart contract will check if the previous state root in the batch matches the current state root stored in the contract, and will update the Merkle root with a positive answer.
To guarantee the consistency of Layer1 and Layer2, and to prevent malicious activity, the post-state root in the batches must be guaranteed to be correct and safe by technological means, and ZK-Rollup uses zero-knowledge proof on this matter.
*‘Zero Knowledge Proof’ is a technique which employs cryptographic algorithms so that various parties can verify the veracity of an item of information without sharing the data that compose it. — — Teresa Alameda*
When the transaction is being packed, every batch includes a cryptographic proof called a ZK-SNARK (zero knowledge succinct non-interactive argument of knowledge, using the PLONK protocol), which proves that the post-state root is the correct result of executing the batch. SNARK proves that this series of transactions is correctly approved and signed by the users and that the update of the account balance is correct from the previous Merkle root to the new Merkle root, so it is impossible for the relayer to submit an invalid or manipulated batch. As a result, ZK-Rollup is as safe as main chain on Ethereum.
Besides, ZK-Rollup will greatly reduce the burden of layer1, because hundreds of transactions are compressed into one batch, and the only thing that the smart contract on the main chain needs to verify is the ZK-SNARK. In this way, not only the transaction speed will be improved, but also gas fees will be reduced considerably.
## Advantages of ZK-Rollup
ZK-Rollup has absolute dominance in user experience, which can be concretely expressed as a high level of security, fast and economic transactions.
The reason why ZK-Rollup comes as the first choice is its security. As mentioned above, every change in state during transaction must be verified by a rollup smart contract, before the state can be updated. That is to say, no one can manipulate the state of the transaction or forge an invalid state. Secondly, other popular solutions like Plasma and Validium don’t have the on-chain data availability, however, ZK-Rollup not only returns the transaction results to the main chain, but also attaches sufficient data (necessary transfer information) with the batch to guarantee the consistency of account states in both layer1 and layer2. Moreover, ZK-Rollup only depends on the censorship-resistance of the main chain for its liveness rather than its security, meaning that even the censorship attack on layer1 can not manipulate the state on layer2, further ensures the security of assets and accounts.
Because of its high security, high TPS, low transactions fees, and short waiting time, ZK-Rollup is considered the best Layer2 scaling solution in the long run.
## Why are there so few ZK-Rollup projects?
Despite the fact that ZK-Rollup is well-known by blockchain players, there are only few applications which actually land: zkSync, as the first project to explore ZK-Rollup, is still waiting for its complete application on Layer2; Loopring has released the first ZK-Rollup scaling Dex on Ethereum; ZKSwap recently realized the swap on a single chain by using ZK-Rollup… It is easy to notice that among all the projects using ZK-Rollup technique, the latter is only implemented for some specific function points, lacking in a more general and thorough application.
This is because the development of ZK-Rollup is much more difficult and code-intensive than Optimistic Rollup and any other Layer2 scaling solutions. More advanced cryptographic knowledge, stronger coding capability, and longer development time are required to support the deployment of EVM. It takes time for ZK-Rollup to be fully compatible with EVMs, behind which is a higher standard for the team and capital.
However, it can be expected that ZK-Rollup, as the safest and the most user-friendly scaling solution, will become the mainstream in the near future. Those fewer and better teams who can play with ZK-Rollup can be trusted to create more attractive applications with superior quality and sustainable development ability, firing up the second evolution for Ethereum and other public chains.