Subscribe to polynya
>900 subscribers
Share Dialog
Share Dialog
There seems to be a common misconception that Ethereum only scales via L2s. I may harbour some blame for that for writing aggressively about L2 rollups and not covering the L1 scaling roadmap enough, for which I apologise - here I’m attempting to fix that mistake now that L2s are well understood, accepted and adopted by the space. Arbitrum One, in particular, has arguably proven itself as the #2 smart contract chain after Ethereum L1 by economic activity.
But first, an even worse version of this is “ETH” scales only with L2s. To be clear, ETH as a monetary asset scales via L1, sidechains, other L1s, L2s, L2-like constructions like validiums and optimistic chains, and indeed, even CEXs and centralized service providers.
There’s millions of ETH bridged to L2s and non-L2 chains alike and untold millions more to non-blockchain venues. Yes, ETH on L1 and (mature) L2s offer you native security guarantees, but even though the other solutions may have different security assumptions, they still scale ETH or ether, the asset. As an aside, indeed, BTC is the perfect example of an asset that scales largely via centralized services, and it’s still the dominant asset in the industry. Remember - all you need for an asset to be valuable is for the top 1% wealthy people, families and institutions to believe in it.
Of course, this doesn’t mean Ethereum scales, my point is it’s imperative to distinguish ETH or ether from Ethereum. Now, there’s further nuance to this. For example, BSC scales Ethereum’s tech stack, and it does bridge ETH and ERC-20s, but some may argue it does not scale Ethereum the network.
With that little side-rant aside, let’s get back to upgrading Ethereum L1 to zkEVM. Actually, before, that usual disclaimer - I’m an amateur blogger, I have zero knowledge experience on how blockchain development works, and I have no idea if what I’m talking about is even possible. So, just take it as an armchair hobbyist day-dreaming.
Scaling blockchains using ZKPs is an old concept. I don’t know when it was first talked about, but I believe it was about Bitcoin and predates Ethereum itself. ZK-SNARKing Ethereum specifically also predates the concept of rollups. Of course, research on ZK-SNARKing Ethereum went into overdrive when ZK rollups proved the concept in Q1 2020 with Loopring and later in Q2 with StarkEx and zkSync (now Lite) and also Mina. In 2021, I believe it was Matter Labs that popularized the “zkEVM” terminology, which stuck. Ethereum Foundation’s Privacy & Scaling Explorations team is the primary innovator on L1-zkEVM, later joined by Scroll, Consensys, Taiko and other contributors.
Is it zkEVM, ZK-EVM, ZkEVM, Zkevm? Who knows, but let’s just call it zkEVM.
So, how will the L1 zkEVM upgrade work? There are many ways to do it, but here’s my perception. Once again, I have no idea if it’s even possible, so just take it as concept art.
The first step is to see Type-2/2.5 and Type-1 zkEVM rollups battle-test the concept in production - upcoming projects include Scroll, Linea (?) and Taiko, get proving times down etc. The next (these happen in parallel, so saying “next” may be misleading) pre-requisites are EIP-4844, statelessness and PBS. (Note: of course, zkEVM can be done without these, but I’m going to just talk about how I perceive it, as mentioned above.)
Next, I’d like to see an Enshrined zkEVM bridge. This will allow Type-1 zkEVMs to be deployed on top of L1. This will battle-test the exact code and zk circuits that’ll eventually be used for L1 zkEVM. It’ll also allow L2s to exist fully decentralized without any smart contracts - effectively enshrined L2 zkEVM rollups. These will plug in to the PBS infrastructure, with builders acting as sequencers. You only need one honest builder. These builders will sequence blocks and submit to L1 every slot. This means finality of these enshrined rollups will be identical to L1. This will also open up fun new possibilities like atomic composability between these enshrined rollups.
It’s worth noting that Type-1 zkEVM rollups can exist outside of such an enshrined zkEVM bridge - like Taiko - so perhaps we can differentiate by calling these Type-0? To be clear that these use identical code to the future L1 upgrade.
Once these are battle-tested in prod, the L1 execution layer is finally ready for the zkEVM upgrade. Once again, builders will sequence transactions, generate proofs and submit proofs and data to the consensus layer. Note that for the L1 zkEVM, the proofs are now verified on the consensus layer. Builders will not just generate validity proofs, but also verkle/state proofs and data availability/kzg proofs. Non-builder nodes will then simply have to verify these proofs, effectively verifying a gazillion TPS - including on L2s, L3s, whatever, all of this is proven by a single succinct proof of the L1 zkEVM, one proof to rule them all - on consumer smartphones or laptops.
The enshrined zkEVM bridge will continue to exist on top of the L1 execution layer. An alternate approach would be to move this to the consensus layer, and we can have many enshrined L1 rollups. But I believe the best approach is to have one canonical L1 enshrined rollup. As an aside, I used to call them “canonical rollups” in 2021, later I saw Justin Drake refer to the same idea as “enshrined rollups” and that nomenclature has stuck. So, anyway, you have one L1 enshrined rollup, many Type-0 enshrined L2 rollups on top, and of course, traditional L2s and sovereign rollups.
At this point, it’s important to note that enshrined L2 rollups come with their own set of trade-offs. By the time all of this happens, zkEVM will be very slow-moving, there’ll be throughput and functionality restrictions, and we may only have an upgrade every few years, if ever. There’ll also be no governance or sovereignty - they’ll be completely enforced by Ethereum noderunners. As a result, the innovation will always be on traditional L2s, which in a mature state would have >99% of benefit of the enshrined rollups without any of their drawbacks, and I expect >90% of users to continue on them. Traditional L2s, L2-like hybrids like validiums or optimistic chains, enshrined L2s, and enshrined L1 rollup all offer different tradeoffs and functionality to users, and I believe all combined they’ll be able to satisfy almost every need in the blockchain ecosystem for decades to come.
Of course, it’s just as likely that all of this is overkill, we don’t really need so much throughput, and it’s more prudent to ossify L1 as is, and we may never see zkEVM on L1. Even if it happens, I’d say we’re looking closer to the end of the decade. Who knows? But I for one would like to see the vision come to life because it sounds fun. I’ll leave you with an old post, Fanciful Endgame. Of course, things have evolved since, but the spirit remains.
There seems to be a common misconception that Ethereum only scales via L2s. I may harbour some blame for that for writing aggressively about L2 rollups and not covering the L1 scaling roadmap enough, for which I apologise - here I’m attempting to fix that mistake now that L2s are well understood, accepted and adopted by the space. Arbitrum One, in particular, has arguably proven itself as the #2 smart contract chain after Ethereum L1 by economic activity.
But first, an even worse version of this is “ETH” scales only with L2s. To be clear, ETH as a monetary asset scales via L1, sidechains, other L1s, L2s, L2-like constructions like validiums and optimistic chains, and indeed, even CEXs and centralized service providers.
There’s millions of ETH bridged to L2s and non-L2 chains alike and untold millions more to non-blockchain venues. Yes, ETH on L1 and (mature) L2s offer you native security guarantees, but even though the other solutions may have different security assumptions, they still scale ETH or ether, the asset. As an aside, indeed, BTC is the perfect example of an asset that scales largely via centralized services, and it’s still the dominant asset in the industry. Remember - all you need for an asset to be valuable is for the top 1% wealthy people, families and institutions to believe in it.
Of course, this doesn’t mean Ethereum scales, my point is it’s imperative to distinguish ETH or ether from Ethereum. Now, there’s further nuance to this. For example, BSC scales Ethereum’s tech stack, and it does bridge ETH and ERC-20s, but some may argue it does not scale Ethereum the network.
With that little side-rant aside, let’s get back to upgrading Ethereum L1 to zkEVM. Actually, before, that usual disclaimer - I’m an amateur blogger, I have zero knowledge experience on how blockchain development works, and I have no idea if what I’m talking about is even possible. So, just take it as an armchair hobbyist day-dreaming.
Scaling blockchains using ZKPs is an old concept. I don’t know when it was first talked about, but I believe it was about Bitcoin and predates Ethereum itself. ZK-SNARKing Ethereum specifically also predates the concept of rollups. Of course, research on ZK-SNARKing Ethereum went into overdrive when ZK rollups proved the concept in Q1 2020 with Loopring and later in Q2 with StarkEx and zkSync (now Lite) and also Mina. In 2021, I believe it was Matter Labs that popularized the “zkEVM” terminology, which stuck. Ethereum Foundation’s Privacy & Scaling Explorations team is the primary innovator on L1-zkEVM, later joined by Scroll, Consensys, Taiko and other contributors.
Is it zkEVM, ZK-EVM, ZkEVM, Zkevm? Who knows, but let’s just call it zkEVM.
So, how will the L1 zkEVM upgrade work? There are many ways to do it, but here’s my perception. Once again, I have no idea if it’s even possible, so just take it as concept art.
The first step is to see Type-2/2.5 and Type-1 zkEVM rollups battle-test the concept in production - upcoming projects include Scroll, Linea (?) and Taiko, get proving times down etc. The next (these happen in parallel, so saying “next” may be misleading) pre-requisites are EIP-4844, statelessness and PBS. (Note: of course, zkEVM can be done without these, but I’m going to just talk about how I perceive it, as mentioned above.)
Next, I’d like to see an Enshrined zkEVM bridge. This will allow Type-1 zkEVMs to be deployed on top of L1. This will battle-test the exact code and zk circuits that’ll eventually be used for L1 zkEVM. It’ll also allow L2s to exist fully decentralized without any smart contracts - effectively enshrined L2 zkEVM rollups. These will plug in to the PBS infrastructure, with builders acting as sequencers. You only need one honest builder. These builders will sequence blocks and submit to L1 every slot. This means finality of these enshrined rollups will be identical to L1. This will also open up fun new possibilities like atomic composability between these enshrined rollups.
It’s worth noting that Type-1 zkEVM rollups can exist outside of such an enshrined zkEVM bridge - like Taiko - so perhaps we can differentiate by calling these Type-0? To be clear that these use identical code to the future L1 upgrade.
Once these are battle-tested in prod, the L1 execution layer is finally ready for the zkEVM upgrade. Once again, builders will sequence transactions, generate proofs and submit proofs and data to the consensus layer. Note that for the L1 zkEVM, the proofs are now verified on the consensus layer. Builders will not just generate validity proofs, but also verkle/state proofs and data availability/kzg proofs. Non-builder nodes will then simply have to verify these proofs, effectively verifying a gazillion TPS - including on L2s, L3s, whatever, all of this is proven by a single succinct proof of the L1 zkEVM, one proof to rule them all - on consumer smartphones or laptops.
The enshrined zkEVM bridge will continue to exist on top of the L1 execution layer. An alternate approach would be to move this to the consensus layer, and we can have many enshrined L1 rollups. But I believe the best approach is to have one canonical L1 enshrined rollup. As an aside, I used to call them “canonical rollups” in 2021, later I saw Justin Drake refer to the same idea as “enshrined rollups” and that nomenclature has stuck. So, anyway, you have one L1 enshrined rollup, many Type-0 enshrined L2 rollups on top, and of course, traditional L2s and sovereign rollups.
At this point, it’s important to note that enshrined L2 rollups come with their own set of trade-offs. By the time all of this happens, zkEVM will be very slow-moving, there’ll be throughput and functionality restrictions, and we may only have an upgrade every few years, if ever. There’ll also be no governance or sovereignty - they’ll be completely enforced by Ethereum noderunners. As a result, the innovation will always be on traditional L2s, which in a mature state would have >99% of benefit of the enshrined rollups without any of their drawbacks, and I expect >90% of users to continue on them. Traditional L2s, L2-like hybrids like validiums or optimistic chains, enshrined L2s, and enshrined L1 rollup all offer different tradeoffs and functionality to users, and I believe all combined they’ll be able to satisfy almost every need in the blockchain ecosystem for decades to come.
Of course, it’s just as likely that all of this is overkill, we don’t really need so much throughput, and it’s more prudent to ossify L1 as is, and we may never see zkEVM on L1. Even if it happens, I’d say we’re looking closer to the end of the decade. Who knows? But I for one would like to see the vision come to life because it sounds fun. I’ll leave you with an old post, Fanciful Endgame. Of course, things have evolved since, but the spirit remains.
No comments yet