Partnered With:

Analyzing zero-knowledge proofs and zkEVM principles based on real-world scenarios.

Read this article in 35 Minutes

Zero-knowledge proofs and zkEVM: Where do they come from and where are they going?

Original Title: "Zero-Knowledge Proofs and zkEVM: Where Do They Come From and Where Are They Going?"

Original Source: ChainCatcher

一、零知证明

1. Zero-Knowledge Proof

First of all, we need to be clear that zero-knowledge proofs (ZKP) are really difficult.

If we try to summarize ZKP in a few sentences, there will definitely be a gap between understanding and reality. However, we believe that in the face of the huge appeal of TL;DR, everyone will not be too concerned. Below, let us use real-life scenarios to describe the progression of three scenarios to vividly understand the principles of ZKP.

Scenario A:

Imagine the scene where a summer vacation ends and school starts again. The teacher checks the "Summer Life" assignment, and the whole class hands in a stack of thick notebooks. The teacher cannot correct each question one by one, so he quickly flips through the exercise book to check if there are any blank spaces in the homework to see if the students have written every question.

In this scenario, the teacher does not know whether each question is answered correctly by the student. Instead, the teacher can only confirm whether the student has completed the assignment.

Scenario B:

He found that some classmates filled in meaningless content in the blank spaces, such as "Häagen-Dazs ice cream bars" and "KFC Crazy Thursday", and he realized that he was too naive - the students were cheating. So he sent all the homework back and announced that he would spot-check some of the questions, hoping that the students would take it seriously.

In this scenario, the teacher verifies whether the students have completed their homework correctly by randomly checking a very small portion of the questions.

Scenario C:

After the teacher collected the homework for inspection, most of the students completed the homework well due to fear of spot checks, and the teacher expressed satisfaction. However, there are always some people who continue to cheat and write randomly under a small number of randomly selected questions. The teacher can only randomly check some of the questions. If it weren't for some people's bad luck to be caught by the checked question, they would almost pass by them.

So the teacher ultimately needs a solution that can ensure that every question is completed correctly by the students while also minimizing their own workload.

This is the real difficulty that zero-knowledge proofs currently overcome in the blockchain industry: how to ensure the overall correctness of the answers while verifying as few questions as possible. In the above scenario, there is no logical connection between the answers to each question, meaning that the correctness of one question has no bearing on the correctness of another. Therefore, is there a clever way for a teacher to check the correctness of one question and determine whether all the answers in the entire assignment are correct?

So, here comes the surreal part: the teacher wanted to "string" all the correct answers together and introduced a new mathematical tool for this purpose: polynomials. By constructing equations containing polynomials for verification, the correctness of both individual and overall answers of the students can be confirmed almost simultaneously. In this way, the teacher can finally announce with confidence that the students have completed their summer homework correctly and completely.

So what is polynomial magic?

Here's a simple example: the homework only has three questions, with the corresponding numbers and answers being (1,4), (2,6), and (3,3). We can combine them into a polynomial "string" to get y=-52x2+192x-3.

So far, the teacher only needs to complete two steps to correct the homework: 1) check the polynomial itself to verify if the overall solution is correct; 2) randomly select a point to verify if the student really solved the problem. Of course, this is a very naive example. In actual engineering, we construct equations containing polynomials, part of which is to verify a statement expressed in mathematical language, and the other part is verifiable and complete information strung together by polynomials (smart readers may have already thought of the concept of data availability, DA).

Polynomials have many wonderful properties, and in zero-knowledge proofs, we mainly utilize two of them:

The original information has been strung together, and we can verify the entire equation by verifying the points in a set of polynomial equations.

If a polynomial equation holds at some randomly chosen points, then it is highly likely that the equation also holds over the entire set.

Summary: The essence of zero-knowledge proof is a probabilistic proof, which is equivalent to a validity proof. It compensates for the integrity defects of simple random sampling by introducing polynomial construction and some cryptographic tools.

Interestingly, in the context of rollup, the "zero knowledge" of zero-knowledge proofs is more reflected in the compression of validity proofs for information, rather than the intuitive privacy processing of each individual piece of information.

二、所以 zkp 有什么用？

translates to:

2. So, what is the use of zkp?

I believe you should have heard of ZK-Rollup. We spent a lot of time in the previous article explaining how the teacher found a way to be lazy while completing the homework, and what ZK-Rollup does is also being lazy.

In short, for example, if there are one thousand statements (usually transactions) now, with the help of ZK, only ten verifications are needed to prove their correctness. As the proof workload increases, the corresponding increase in the required number of verifications is far less than a linear relationship. That is, when the number of statements increases to ten thousand, the number of verifications does not increase to one hundred times. We may only need eleven verifications to prove it.

So this is a great scaling solution. Similar to other scaling solutions (such as Optimistic Rollup), the current process for ZK-Rollup applications is as follows:

The user locks assets in the smart contract of a ZK-Rollup on a certain L1.

The user begins to conduct transactions, and these transaction contents are organized and packaged by the sequencer of L2, generating a validity proof (using ZK proof) and updating the state in each batch.

The update and proof of the state will be verified by the ZK-Rollup smart contract on L1 to update the state on L1.

The user uses the updated state in L1 to perform the next operation.

三、ZK-Rollups vs Optimistic Rollups

Translation:

3. ZK-Rollups vs Optimistic Rollups

As one of the two technical routes of Rollups, ZK-based Rollups provide higher security. This is because ZK-Rollups rely solely on mathematics and the security guarantees provided by Ethereum itself, while Optimistic Rollups rely on economic incentives and penalties under the game theory framework in this regard.

For users, this means that ZK-Rollups have faster L1 finality confirmation, while Optimistic Rollups require a one-week challenge period. Of course, there are various cross-chain protocols now available that can make the user experience of Optimistic Rollups more convenient and fast using DeFi means, such as Celer, Stargate, Across, Synapose, etc. However, this often sacrifices some overall security to improve the user experience of local single-point, and the withdrawal fees paid by users in these protocols are generally several times higher than the official withdrawal channels.

Although ZK Rollups have theoretical advantages over OP Rollups, the current situation is that the ecosystem based on ZK-Rollups is far less prosperous than OP Rollups, making it difficult for users to obtain similar interactive experiences in the ZK ecosystem as in the OP ecosystem. In the short term, ZK Rollups are also unlikely to demonstrate some advantages that can only be reflected after scaling (such as high concurrency, low latency, and L1 interaction security).

Four, so what is the problem with zkp?

Because ZKP did not reach practical usability until no earlier than 2015 in theory, Ethereum had no relationship with ZKP in its design. From reading section one, you may have a vague feeling that this is a very mathematical thing. Your feeling is correct, and the most direct problem it brings is that the core infrastructure of EVM is not compatible with ZK-Rollup, including but not limited to Ethereum's storage layout and Ethereum's signature encryption mechanism. The operation of Ethereum EVM is based on the mathematical world of normal people, while the computation and proof of ZKP are based on prime fields. (Note: This is parallel to the previous two points logically.)

And such incompatibilities bring additional overhead to ZKP-based blockchain projects on the one hand; on the other hand, because of the need for ZKP's engineering implementation, the complexity of mathematical concepts such as arithmetic circuits and logic gates becomes a constraint that developers must consider when programming, which also requires developers to make certain trade-offs between development learning costs and implementation accuracy.

At the application layer, existing ZKP-based technology stacks, either deploy smart contracts on L1 pointing to a specific L2 ZK-Rollup (which I refer to as general ZK-Rollups), or design dedicated ZK-Rollups based on Dapp, such as the ZK-Rollup used by dYdX V3 (essentially a dedicated ZK-Rollup based on Starkware).

Regardless of the form, the huge differences in the underlying mathematics have led to poor composability between these ZK Projects and other projects. For example, in a Defi protocol deployed in the ZK-rollup ecosystem, a credible oracle is needed. This scenario is a real demand, but because the protocol is developed based on ZK-Rollup, it is very difficult to interact with other protocols. For example, Etherscan cannot simply fork and directly serve this chain on a ZKP-based blockchain.

5. Why do we need to be compatible with Ethereum (or EVM)?

Because the Ethereum ecosystem is so large, the more your chain looks like it, the better it is to have only a different Chain ID. This increases the probability that your ecosystem will be supported by some apps developed based on Ethereum. For example, Polygon has always been committed to supporting Ethereum, providing various efficient and inexpensive scaling solutions, and making great contributions to users and the development of the Ethereum ecosystem.

From the perspective of users (developers), familiarity, affordability, and painless conversion are the gold standards. For the vast majority of developers, the learning cost of a new high-level language (such as Rust/Move) is much lower than that of a serious math course (not to mention the introduction of complex engineering practical applications such as ZKP). Therefore, the difficulty of redeveloping a protocol project on a new public chain, such as Solana/Aptos, is much lower than that of a blockchain based on a serious, precise, and complex mathematical logic language (ZK-based).

Of course, it is not necessarily impossible to create a new standard. With a strong development team and moderate economic incentives, Solana has also achieved great success. With the support of EVM, the Cosmos ecosystem has also successfully attracted a large number of Solidity developers to deploy their own protocols.

Therefore, if ZKP can be seamlessly compatible with EVM, developers will be able to more easily port existing Dapps and smart contracts to ZK-based L2, or develop new types of Dapps within this new framework. Furthermore, if the composability issue mentioned in section four can also be improved, allowing ZK-based projects to have better interactions with other applications, then we will have a more prosperous ZK-based L2 ecosystem. In this regard, ZK L2 players and L1 players such as Solana and Aptos share the same underlying driving force.

Six, is there a way to make ZKP and EVM compatible?

Some. Many teams are working on this now.

6.1 Wait a minute, what is EVM?

EVM is the virtual machine that runs smart contracts on Ethereum.

6.2 Wait a minute, what is a virtual machine?

A virtual computer that is almost identical to a real computer, simulated using software.

6.3 Why does Ethereum need a virtual machine?

Because Ethereum introduced smart contracts, a computer is required to execute the contract. In a decentralized network, the premise of generating consensus is that different nodes need to produce the same results for the same contract calculation and processing, that is, different computers calculating 1+1 (real field) should all get the result of 2. However, each node's physical computer may have a different underlying environment. To avoid interference caused by these underlying environment differences, smart contracts need to run on a virtual machine to ensure that the same problem produces the same result, that is, determinism.

There are many articles or summaries that have already outlined the technical differences between these different approaches. I won't go into detail here as I think you may not be interested. So let's talk about common sense, business, and something more user-oriented.

The first question is what expectations do we have for the ecosystem.

The current situation is that teams such as ZkSync and StarkWARE have done a lot of Application specific zk-rollups, and the development of toB business has matured, such as Immutable on Starkware has already carried large Web3 games like Illuvium that are highly anticipated. However, due to the reasons mentioned in the previous paragraphs (mainly the lack of composability), these projects are still waiting for a common and common ecology to form in order to develop together.

Scroll/ Polygon Hermez/ zkSync Era's efforts in building a ZK-based L2 ecosystem aim to reduce the difficulty of developing and porting existing protocols to an almost painless level. In the process of achieving full EVM equivalence (type 2 by Vitalik), we are currently at the "almost" EVM equivalence stage (type 3 by Vitalik) in practice. For example, zkSync Era can enable 99% of Ethereum projects to deploy without refactoring or re-auditing any code.

For users, when there is no significant difference in the interactive experience, the choice of which chain to use mostly depends on which chains are already in use. Polygon has a certain advantage in this regard, especially with its existing ecosystem carrying a large number of native games, social protocols, and users, as well as its unique Web2 brand exposure.

However, we believe that Scroll and zkSync Era will not face significant constraints in attracting existing protocol deployments in the short to medium term. This is mainly based on our long-term observation of the developer ecosystem, which includes the following factors:

The deployment and development difficulty of Dapps in the Ethereum ecosystem on Zk-based L2 is gradually decreasing to the turning point that triggers large-scale migration.

L2toL2 and L1toL2 cross-chain protocols are gradually becoming simpler, more convenient, and cheaper. L2 native directional cross-chain bridges are also expected to emerge. Although centralized challenges may still exist in the long term,

From the familiar field we know, due to the expectation of economic incentives and positive operations (referring to the experience of successful multi-round airdrop incentives of Optimism, the developer community operation logic of Arbitrum, etc.), users can try multiple protocols on multiple chains one by one.

The second question is how to transition from centralization to decentralization.

First of all, it should be noted that the vast majority of ZK-Rollups currently have a very centralized structure. One of the main reasons for this is path dependence: because there is currently no composability, there is no need to combine with others, so centralization is not a problem for the time being. However, if you want to develop into an ecosystem, this centralization issue must be addressed.

Currently, the mainstream ZKEVM solution providers have recognized the necessity of solving this problem. In this regard, Scroll/Polygon Hermez/Zksync Era believe that the process of decentralizing the prover network and sequencer network should be gradual, ultimately achieving the outsourcing and commercialization of prover/sequencer work through token economics, although there are still differences in specific implementation steps among them.

So we are back to the familiar territory: those who have money invest, those who have power contribute, and then everyone waits for the platform to distribute dividends. Here we have a small concern that the cost of generating proof through computing power is actually quite high, so the threshold for prover in zk-based L2 will be much higher than the corresponding department in PoS chain; while the problem of sequencer producing incorrect blocks is actually a common problem for all blockchain networks, not just zk-based L2. Therefore, I believe that in the ZK ecosystem, the decentralization of the prover network may face greater challenges.

Seven, ZK-based L2 Ecological Development Ambition

StarkNet：

As the founder of the cryptographic theory behind the Ethereum ZK scaling solution and zk-STARK, which is the highest valued private equity valuation, the technology represented by Starknet has always been the industry standard. Founder Eli Ben-Sassen is even the inventor of zk-SNARKs and ZK-STARKs, which are widely used in blockchain.

On the one hand, through the mature Starknet, we continue to provide customized development services for projects with large-scale ZKP demand, such as AAA games from Web2 game companies, or large-scale experiments of IP holders in the on-chain metaverse.

Unlike OP-Rollups, which require the establishment of a smart contract wallet on the Ethereum mainnet through EIP-4337, Starknet supports account-based smart contract wallets on L2 from the beginning. The smart contract wallets deployed on Starknet can utilize the encryption security capabilities of mobile embedded chips to achieve hardware signature and multi-factor authentication, and complete social recovery, mobile wallet payments, and other scenarios through innovation at the blockchain contract layer.

At that time, we can imagine a large mobile hardware company with a massive Web2 user base entering Starknet and Web3 through the Metaverse or large-scale on-chain games.

zkSync Era：

zkSync, which has just released its zkEVM 2.0 version, is also one of the most anticipated zk L2 solutions. It is designed to have an extremely high performance ceiling while also ensuring security and user experience, with a potential TPS of over 20,000. The latest zkSync Era uses the Solidity compiler based on LLVM, zkSync's self-developed and award-winning GPU prover, and Matter Labs' upcoming Redshift proof system, which will reduce transaction fees to far less than 1 cent per transaction.

zkSync Era is also committed to addressing the issue of blockchain data storage. In addition to EIP-4844, it also provides innovative zkPorter functionality, which allows users and developers to choose data availability formats based on different security level requirements, balancing development focus between high-performance validium (zkPorter) with seamless interoperability and high-security validity (zk-Rollup).

Additionally, zkSync Era has introduced Hyperchains' fractal scaling solution as its main development direction for "L3". Hyperchains is a fractal instance similar to zkEVM that utilizes LLVM (LLVM is the world's most mature compiler stack architecture) and can achieve parallel execution and joint settlement on L1. Anyone can deploy Hyperchains without permission, and it has a highly customizable modular zkEVM chain stack, supported by the same zkEVM engine as the main zkSync L2. Developers can choose different solutions, select corresponding virtual machines (such as MoveVM), sequencer design, and data availability (such as zkRollup, zkPorter, and zkValidium) as mentioned above.

zkSync Era has launched such a highly customizable modular stack, which reminds us of the OP stack that recently entered the public eye through Coinbase's Base chain.

We believe that the development path of zkSync's B-side may refer to Optimism's experience, which is to use the existing large-scale users and strong institutional supporters background, establish a benign cycle of airdrop expectations and governance mechanisms that promote ecological development (Token House, RetroPGF, etc.) with the developer community. This can not only promote innovative applications beyond infrastructure, but also encourage the latest versions of existing protocols (such as traditional DeFi blue chips on L1) to come and deploy on Era.

From the perspective of the C-end, zkSync Era may focus on building the strongest social network and social graph applications within the Ethereum system to attract more lightweight Web3 users, starting from the current weak Web3 social aspect of Ethereum L2. We noticed that Hyperchains also have an innovation that is very suitable for social protocols. It can also be used to implement high concurrency and short-lived execution environments. For example, developers can launch a Rollup to cheaply mint millions of homogeneous NFT assets within a social network, then bridge these NFTs to another execution layer, and finally close the temporary Rollup to provide necessary infrastructure capacity elasticity for social protocols.

Polygon zkEVM：

The overall strategy of the Polygon ecosystem has always been very clear, and the team has executed it very firmly. We can see that Polygon has formed differentiated competition with other Ethereum Rollups. In terms of social ecology, Polygon has become one of the two giants of Web3 social networking alongside BNB, thanks to the Lens Protocol ecosystem and Galxe. Games such as Planet IX, Hunters On-Chain, and Benji Bananas also have hundreds of thousands of monthly active wallet addresses. Recently, Polygon zkEVM also announced a strategic partnership with Immutable at the 2023 GDC conference to better serve studios and developers in creating high-quality on-chain games. According to Cumbeland's report, Polygon is expected to generate $300 million in revenue from non-crypto partners in the short to medium term, more than ten times the daily gas fee revenue of tens of thousands of dollars currently.

The most special thing is that Polygon has become the image ambassador of Web3 in traditional industries through close cooperation with a large number of brands outside the blockchain industry. Through close cooperation with Forum3, the organizer of the Starbucks Odyssey event, Polygon is expected to welcome nearly 27 million almost new North American blockchain users in the next year, which is a huge shock to the industry stock. Recently, Polygon has also joined Disney's accelerator program, integrated with Stripe's global payment system, supported Reddit's emoji NFT system, and reached commercial cooperation with world-renowned brands such as Adobe, Nike, Adidas, Mercedes-Benz, Mastercard, Coca-Cola, etc.

We believe that Polygon zkEVM (Hermez) can inherit the strong competitiveness of the entire Polygon ecosystem in the traditional field, achieve a more complete integration through zkEVM L2 and the Ethereum ecosystem, and allow Web2 brands to enjoy the asset security premium brought by Ethereum L1. We are optimistic about the continued rapid growth of the gaming and social sectors in the Polygon ecosystem.

Scroll：

As the youngest Ethereum zk L2 solution, Scroll may be the development team that is closest to the Ethereum Foundation, bringing together one of the latest and most powerful zero-knowledge proof teams. Based on its implementation technology capabilities and iteration speed, Scroll is striving to catch up with the development progress of other zk-based rollups.

Scroll is at the forefront of the decentralized design of the prover network and sequencer, especially with the proposed solution of using GPU/ASIC to improve computational power and further decentralize the verification network. The EVM of Scroll has a higher code compatibility ceiling in theory compared to zkSync Era and Starkware, which means that developers do not need to rely on new virtual machines and compilers (such as zkSync's LLVM) and can avoid the risks associated with using intermediate code to achieve EVM compatibility during transaction execution (as in the current solution of Polygon zkEVM).

Scroll's team has been deeply integrated with Ethereum's core activities since day one, building its own brand awareness and infrastructure suite, such as oracles and wallets. Although all Ethereum L1 and even L2 protocol development can theoretically be quickly deployed to Scroll, we believe that Scroll's biggest opportunity lies in capturing the crown jewel of DeFi: decentralized central limit order book (CLOB) exchanges. Scroll's powerful performance potential, combined with the urgent need for a secure and efficient trading environment with a large amount of liquidity on the Ethereum mainnet, may lead to the explosion of such dex protocols. We also note that Web3 projects such as Lens Protocol are beginning to deploy on Scroll - we look forward to more good news like this.