Five common zkEVM types and representative projects

Author | Callum@Web3CN.Pro

ZK Rollup, as a way of scaling Ethereum, allows transactions to be processed off-chain and merged on the main chain as a single compressed transaction. This process improves transaction throughput, reduces transaction costs, ensures the validity of the state through zero-knowledge proof, and improves the privacy and security of the main chain. Therefore, ZK Rollup is considered to be the ultimate solution for Ethereum expansion.

However, at present, the generation of zero-knowledge proof requires a large amount of computing power, and the technical difficulty is also higher. At the same time, because the Ethereum Virtual Machine (EVM) is not designed to support ZK circuits, it cannot directly execute smart contracts. To solve this problem, many developers have tried to develop zkEVM, which can run smart contracts in a manner compatible with zero-knowledge proof calculations. For many ZK Rollups, achieving EVM equivalence means achieving complete bytecode-level compatibility. At present, zkEVM is the key to the expansion of Ethereum.

This article will study five common zkEVM types and the progress of each type of project, and point out the design challenges of each type of zkEVM.

What is zkEVM

zkEVM is an EVM-compatible virtual machine that supports zero-knowledge proof computing, and it is an application development platform based on Ethereum blockchain technology. The EVM contract can be directly deployed and run without modification, and the operation of the program can prove the validity of its calculation through zero knowledge.

Advantages of zkEVM

1. zkEVM improves compatibility. zkEVM is highly compatible with smart contracts written to run in the EVM, and can be seamlessly integrated with the EVM infrastructure. Developers can migrate existing Ethereum applications to L2 without redeveloping applications. At the same time, zk proof inherits Ethereum network security.

2. zkEVM enhances scalability. zkEVM uses non-interactive proofs, which improves throughput and reduces latency because it is faster to verify proofs for L2 blocks than to re-execute each transaction in a newly proposed block.

3. zkEVM reduces storage costs. A zkEVM Rollup can choose to only publish commitments to its final state on Ethereum L1, reducing on-chain storage costs. Validity proofs guarantee the correctness of the new state of the zkEVM, so the orderer does not have to publish all the data needed to re-execute the state transition change.

It is with the continuous improvement of zkEVM that the limitations of ZK Rollup are resolved. Using the security and efficiency of ZK Rollup, coupled with the compatibility of EVM, applications can interact with smart contracts to improve the application experience.

Five different types of zkEVM and related projects

At the beginning of the EVM design, it was not considered to support zero-knowledge proofs, which made it difficult to build an EVM-compatible zk virtual machine. However, as research progresses, EVM calculations can be wrapped into zero-knowledge proofs. Different zkEVM projects use Different approaches combine EVM execution with zero-knowledge proof computation.

Vitalik Buterin, the founder of Ethereum, also published an article explaining the trade-offs between different types of zkEVM. V God believes that the core goals of these projects are the same: use ZK-SNARK technology to provide encrypted proofs for the execution of transactions similar to Ethereum, so that Easier to verify the Ethereum chain itself or build ZK Rollups equivalent to what Ethereum offers, but more scalable than Ethereum.

Type 1 (consensus level equivalence - completely equivalent to Ethereum)

Type 1 zkEVM strives to be completely equivalent to Ethereum. It does not change any part of the Ethereum system to make it easier to generate proofs, does not replace hashes, state trees, transaction trees, precompilations, or any other consensus logic.

The advantage of Type 1 zkEVM is that it is perfectly compatible with Ethereum. In the long run, the modifications to Ethereum tested in Type 2 or Type 3 ZK-EVM may be introduced into Ethereum itself, but this re-architecture has its own complexities, so Type 1 is what is ultimately required to make Ethereum Square L1 itself is something more scalable. At the same time, Type 1 zkEVMs are ideal for rollups because they allow rollups to reuse a lot of infrastructure.

The disadvantage of Type 1 zkEVM is the verification time issue. Ethereum was not originally designed around ZK-friendliness, so many parts of the Ethereum protocol require a lot of computation to perform ZK proofs. The Type 1 zkEVM is designed to replicate Ethereum exactly, so it cannot mitigate these inefficiencies. Type 1 zkEVM is the most ideal zkEVM, and there are many projects building or exploring this type.

Currently Type 1 zkEVM related projects include Taiko and Kakarot.

The Type 1 zkEVM built by Taiko enables developers and users to experience Ethereum safely, with lower transaction fees, and without having to consider any changes. Raised $22 million in two seed rounds, the first round was $10 million led by Sequoia China, and the second round was $12 million led by Generative Ventures. On June 7th, Taiko launched the Alpha-3 Incentive Testnet. According to Taiko’s official introduction, the testnet focuses on the decentralized, Ethereum-equivalent ZK-EVM part.

Kakarot zkEVM is an EVM deployed using the Cario language, extending the reliability of the Starknet ecosystem by enhancing EVM compatibility. Kakarot zkEVM can exist in different forms, in the first stage to bring EVM to Starknet, in the second stage Kakarot and Madara will be merged into a unified stack to support L3 zkEVM, in the third stage Kakarot and Madara can also be combined in Together, Type 1 zkEVM is enabled. On June 2, Kakarot zkEVM completed the pre-seed round of financing. StarkWare, LambdaClass and other institutions and angel investors such as Vitalik Buterin, Nicolas Bacca and Rand Hindi participated in the investment.

Type 2 (bytecode-level equivalence - fully equivalent to EVM)

Type2 zkEVM strives to be fully equivalent to EVM, but not to Ethereum. That is, they look identical to Ethereum internally, but they have some differences externally, especially in terms of data structures such as block structures and state trees. The goal is to be fully compatible with existing applications, but with some minor modifications to Ethereum to make development easier and proof generation faster.

The advantage of Type 2 zkEVM is perfect equivalence at the VM level. Type 2 zkEVM makes changes to the data structures that hold things like the state of Ethereum. These are structures that the EVM itself does not have direct access to, so applications running on Ethereum will almost always run on Type 2 zkEVM rollups. This type cannot use Ethereum execution clients as-is, but with some modifications they can be used, and EVM debugging tools and other infrastructure can still be used.

The downside of Type 2 zkEVM is that verification time is still slow. Type 2 zkEVM provides faster verification times than Type 1 zkEVM, primarily by removing cryptography that relies on unnecessarily complex and ZK-unfriendly parts of the Ethereum stack. For example, they may change Ethereum's Keccak and RLP-based Merkle-Patricia trees, and may also change the block and receipt structure. These modifications improve prover time significantly, but do not solve all problems. With all the inefficiencies and ZK-unfriendliness inherent in the EVM, proving that the EVM is still slow.

Currently, Type 2 zkEVM related projects include Linea and Polygon.

Linea is a Type-2 zkEVM powered by Consensys. By integrating ZKP with full EVM compatibility, developers can create scalable DApps or transfer existing DApps to new platforms without changing code or rewriting smart contracts. The public testnet was launched on March 28 this year and has been added to the default network options of the Metamask extension. Linea released Alpha v0.2 at 12:00 on June 13. This version focuses on testing substantial architecture upgrades and preparing for the launch of the mainnet.

Polygon zkEVM is open source and uses Type 2 zkEVM. It employs ZK proofs to reduce transaction fees and increase throughput while maintaining the security of Ethereum L1. Polygon stated on February 14 this year that Polygon zkEVM has passed 100% of the Ethereum test vectors suitable for zkEVM. Developers do not need to modify or rewrite any code, and all Ethereum tools can work seamlessly with Polygon zkEVM. It means that the EVM compatibility of ZK Rollup has taken another big step, and has reached the level of Type 2, which is completely equivalent to EVM. The Polygon zkEVM mainnet beta was officially launched on March 27, 2023.

Type 2.5 (EVM equivalent, except gas cost)

One way to improve verification time is to greatly increase the gas cost of certain operations in the EVM that are difficult to ZK proof. This may involve precompilation, keccak opcodes, and possibly specific patterns of invoking contracts or accessing memory or storage or restoration.

Changing the gas cost may reduce developer tool compatibility and break some applications, but is generally considered less risky than "deeper" EVM changes. Developers should be careful not to ask for more than one block of gas in a transaction, and never make calls with hard-coded gas amounts.

At present, there is no specific project to do Type 2.5 EVM, it just entered a stage of Type 2.

Type 3 (bytecode-level equivalence - almost equivalent to EVM)

Type 3 zkEVM is almost EVM equivalent, but some sacrifices are made for exact equivalence in order to further reduce proof time and make EVM easier to develop.

The advantages of Type 3 zkEVM are easier to build and faster verification time. Type 3 zkEVM may remove some features that are particularly difficult to implement in zkEVM implementations. Additionally, Type 3 zkEVMs sometimes have subtle differences in the way they handle contract code, memory, or the stack.

The disadvantage of Type 3 zkEVM is that it is less compatible. The Type 3 zkEVM aims to be compatible with most applications while requiring minimal rewrite effort for the rest. That said, there will be some applications that will need to be rewritten because they use precompilations removed by the Type 3 zkEVM, or because of subtle dependencies on edge cases that the VM handles differently.

Currently Type 3 zkEVM related projects include Scroll.

Scroll is an EVM equivalent zk-rollup developed by the Scroll team in cooperation with the PSE (Privacy and Scaling Explorations) group of the Ethereum Foundation. It is currently in the Pre-Alpha testnet stage and aims to be fully compatible with EVM at the bytecode level . This means that developers can use any EVM-compatible language to create smart contracts and deploy them on Scroll. While Scroll is currently building a Type 2 EVM, many of the more complex precompilations are not yet implemented and are therefore considered a Type 3 EVM. According to Scroll, it is expected to launch the mainnet in July and August this year, and said that it may launch a partner program to stimulate ecological development.

Currently, the Type 3 EVM is only a transitional stage until the complex work of adding precompilation is complete, and then projects can move to the Type 2.5 zkEVM. But in the future, Type 1 and Type 3 EVMs may add new ZK-SNARK friendly precompilation, providing developers with low verification time and low gas cost functions.

Type 4 (development language-level equivalence - high-level language equivalent to EVM)

The Type 4 EVM works by compiling smart contract source code written in a high-level language (such as Solidity, Vyper, or intermediate language) into some language explicitly designed to be ZK-SNARK friendly.

The advantage of Type 4 zkEVM is faster proof speed. Because this type does not zk proof all the different parts of each EVM execution step, but starts directly from the high-level code, a lot of costs can be avoided.

The downside of Type 4 zkEVM is that it is less compatible. One is that the addresses of contracts in the Type 4 system may be different from their addresses in the EVM; the other is that many applications use handwritten EVM bytecodes in some parts in order to improve efficiency, which the Type 4 system may not support. Facilities cannot be inherited either.

Currently Type 4 zkEVM related projects include zkSync Era and StarkNet.

zkSync Era was created by Matters Lab. zkSync Era is the first EVM to launch on mainnet and have full access to the public to bridge their funds to the system or deploy their code on the network. zkSync Era uses a different bytecode format to support Solidity by providing a compiler. It supports Solidity, but not the EVM bytecode itself. Tools such as Hardhat cannot be used directly, although a plugin for zkSync is available.

Created by StarkWare, StarkNet is a zk-rollup L2 that uses zero-knowledge proofs to create an off-chain execution layer for Ethereum. In fact, EVM is not a native feature of Starknet. Starknet uses a Warp converter (provided by Nethermind) to convert Solidity code to Cairo to support smart contract deployment.

The challenges and future of zkEVM

Since the EVM is not built with zk-proof computation in mind, it has features that are unfriendly to proof circuits, especially in terms of special opcodes, stack-based architectural storage overhead, and proof costs. But several breakthroughs in zero-knowledge technology have made it possible to alleviate these problems.

The five types of zkEVM have no clear who is good and who is bad. The lower numbered type is more compatible with existing infrastructure but slower, while the higher numbered type is less compatible with existing infrastructure but slower. faster. In general, different projects exploring different types are beneficial to the development of zkEVM and Ethereum.

In the future, there will be multiple zkEVM implementations that can be used both for ZK Rollup and for validating the Ethereum chain itself. In theory, Ethereum does not need to use a single standard zkEVM for L1, and different clients can use different proofs. However, it will be quite some time before such a future is realized. At the same time, we will see more innovations in the different paths of scaling Ethereum and Ethereum-based ZK-rollup.