^{A look at how sharded Ethereum with ZK-rollups becomes an unstoppable pragmatic force.}

The scalability trilemma is present in all blockchain networks. The harder an L1 network pushes scalability, the higher the minimum hardware requirements will be to run a full node. Networks become more centralized when full nodes are not easily accessible. It is clear Ethereum has long prioritized security and decentralization over scalability at the base layer. With the pivot to a rollup centric roadmap, Ethereum is leveraging its base layer (specifically, its vast network of full nodes) to offer robust data availability in place of L1 scalability while maintaining security and decentralization.

^{The scalability trilemma, illustrated. Credits: Vitalik Buterin}

The intention of this pivot is that the majority of the execution on the Ethereum network we're used to today (DeFi, NFTs, etc.) will move to rollups instead of occurring on mainnet. While it is against the ethos of this industry for an L1 to focus on speed and security over decentralization, the same trilemma does not apply to rollups. They inherit security from mainnet Ethereum. With the hard parts handled by Ethereum, rollups are able to focus on being the best execution layer possible.

You've probably heard of Optimism and Arbitrum by now, both of which are optimistic rollups. Just on the horizon is another kind of rollup—ZK-rollups. There are a few instances of ZK-rollups live already, but none of them offer general computation EVM compatibility, or zkEVM. This will not be the case for long, as zkSync 2.0, Scroll, StarkNet, and others are on the case and progressing rapidly.

So why is this important? When Ethereum undergoes its metamorphosis from a monolithic chain to a modular system, it changes the dynamics of the competition. As polynya has put it before, L1 smart contract blockchains are no longer competing with Ethereum directly; they are competing with rollups. It is my belief that the advent of EVM-compatible general purpose ZK-rollups will bring about the obsolescence of not only optimistic rollups, but every other L1 smart contract blockchain.

The reality is, with competing implementations and the freedom to focus on execution efficiency, rollups will iterate toward the best versions of themselves at extreme speed. Because of the rapid changes they are all likely to undergo, in this article I will not be attempting to crown a specific ZK-rollup. Instead, I will be highlighting the capabilities and possibilities of ZK-rollups in a post-Merged, post-sharded Ethereum world.

Security

The rich security assurances of rollups enable some interesting dynamics.

The escapeHatch()

If you had your funds on Polygon PoS or Solana and the network went offline for some odd amount of hours, there would be nothing you could do about your stuck funds during the downtime. Unlike using a "sidechain" or alternative smart contract chain, mainnet rollup contracts contain "escape hatches," immutable functions that allow users to exit rollups back to mainnet even if the rollup network is offline. You can always manually submit transactions to the mainnet Ethereum rollup contract as you need, including exiting the rollup with your funds.

^{Ideally, exiting a rollup won't quite feel like exiting an airplane mid flight.. It should be a relatively cozy process.
Credits: Some stock photo site; thanks Google!}

Centralized Sequencers and Provers
(and Why They Aren't That Scary)

I know that in my introduction I said I'd be covering the 'best' that rollups have to offer.. Before someone blows a gasket here, I'll clarify the obvious: the ideal scenario would be total decentralization of sequencers and provers. However, this will not be the case initially. Most rollups will launch with varying degrees of centralization and progressively decentralize from there. That said, a centralized sequencer in a rollup is much safer than centralization in an L1 chain, a fact which merits highlighting.

When using a rollup with a centralized sequencer or prover you are compromising on trust and censorship resistance, but not security. Sequencer operators cannot steal your funds and you can always withdraw back to mainnet Ethereum. In effect, you are mostly depending on the central sequencer for liveness.

We've all heard the jokes before about such-and-such blockchain being a "datacenter chain." With ZK-rollups, you can actually have a datacenter full of ultra high spec machines dedicated to proving and it's not an existential risk to the network.

Decentralized Sequencers and Provers

Thankfully, because of the ability to trigger the escape hatch when needed and the inability to steal funds, rollup developers can experiment with various schemes without worrying about catastrophic consequences. The design space for decentralizing sequencers and provers is fairly large. In its final form, I expect sequencing and proving to be generally open to the public with various forms of economic incentives (tokens, stake, penalties, etc) in place to ensure rational behavior. Instead of just one central warehouse full of provers, we can support multiple! More importantly, we'll have a distributed network of businesses, rollup developers, and hobbyists alike running provers.

Data Availability

Data availability refers to the data each Ethereum node is required to maintain. On-chain data storage is valuable where immutability is desired, however, data capacity on Ethereum is finite and resource-intensive to maintain; storage ain't cheap!

Once Ethereum pivots to a modular system with data shards, rollups will enjoy an abundance of data capacity that will only increase with time. The sheer amount of full nodes and validators means Ethereum will possess the highest capacity data availability.

Ethereum Data Shards

Sharding is a multi-phase upgrade to Ethereum. The shards will act as load balancers for network data storage demand, allowing for immense scalability gains on the rollup execution layer. Importantly, this also avoids putting high demand on full nodes, which allows the network to maintain decentralization.

Initially, there will be 64 data shards or "shard chains." Eventually, there will be 1,024 data shards. Data shards do not handle transactions or smart contracts; they will instead offer additional data capacity for rollups.

^{Post-sharding Ethereum diagram, illustrated. Credits: Hsiao-Wei Wang}

Rollups act as a form of transaction compression, occasionally posting a single state root update to mainnet Ethereum that contains the outcomes of many different transactions as they occurred on the rollup layer. Because they must post these state root updates to mainnet, rollup gas fees are subject to fluctuations in blockspace demand; a cost which is generally passed on to the rollup's users (more on this in the Amortization section). Once sharding is live, there will be an almost 20x increase in capacity. This will allow rollups to operate cheaper and faster.

Synergistically, being the ultimate chain for rollups means Ethereum users also get to benefit from alternative data availability solutions only ZK-rollups can bring to the table.

Volitions

Volitions are ZK-rollups that contain a rollup chain and a validium instance. Volitions commit state roots and proofs to Ethereum like ZK-rollups but where they differ is their ability to allow a user to choose whether they want or need to utilize on-chain data availability through the volition's rollup or off-chain data availability through the volition's validium. This is a tradeoff that is only available in the ZK-rollup space; optimistic rollups are not capable of volitions.

One example of a volition is zkSync 2.0:

^{zkSync volition, illustrated. Credits: Matter Labs}

zkSync's validium is called zkPorter. In this scheme, data availability is secured by zkPorter validators. Matter Labs claims this enables over 20,000 tp/s and a 100x reduction in gas costs. It's worth bearing in mind that the ultimate upper bound of transaction capacity on a ZK-rollup is actually a function bounded by their prover's computational and storage capabilities. I'd wager 20,000 tp/s might actually be a bearish estimate in the long term.

Adamantium

There are proposals like Adamantium, a trustless off-chain data availability solution, or TODA, which further seek to innovate the data availability space. Arguably, they fall under the umbrella of a volition. A snippet from the proposal: "...Adamantium, a protocol for Autonomous Data Availability ... retains the scaling benefits of off-chain data availability, while removing all trust assumptions for any willing user. Willing to do what? To be online; and if they aren’t online, their funds cannot be stolen, nor frozen - rather, the funds are moved from L2 back to an Ethereum address under the user’s control."

Like volitions, this solution is only possible on ZK-rollups.

Transaction Costs and Throughput

Transaction costs on rollups are already fairly low, but they aren't low enough. Thankfully, there are far more optimizations on the way which will bring huge reductions in gas costs. In addition, there are numerous techniques that will be deployed to increase transaction throughput.

An Army of Rollups

Given the lightweight nature of rollups on mainnet, there will likely be many hundreds of rollups operating in parallel, each capable of supporting hundreds of thousands of users, each with their own enormous throughput, all powered and secured by Ethereum. In the event one rollup is saturated (RPC or sequencer buckling under load, etc.), it will be trivial to hop over to another rollup and begin transacting. Should you need to, it is also trivial to fork a rollup and deploy a copy of it yourself.

Validity Proof Amortization

Validity proof amortization refers to the number of transactions in each batch of transactions on a ZK-rollup as it relates to the total cost of gas for verification.

I'll provide you with a quick way to internalize the concept of amortization in this context. Please bear in mind that for simplicity's sake this example isn't mathematically accurate. The formula I provide is just for the sake of illustration; in reality, the breakdown of rollup transaction costs is not so simple. That said, in our imaginary scenario: - it costs a rollup 5,000,000 gas to update a state root - just like mainnet, users pay a gas fee when transacting on a rollup - the price per transaction follows a formula x = 5000000 / y, where x is the price per transaction and y is the number of transactions in any given batch

You should be able to deduce: - the per-transaction cost at 200 batched transactions is 25,000 gas - the per-transaction cost at 100,000 batched transactions is 50 gas, essentially negligible

The amortized cost of transactions becomes cheaper as more people submit to a batch. This is completely opposite from monolithic blockchains, like Ethereum today, where demand for blockspace increases as the amount of active users increases, causing a surge in gas prices.

An example of amortization in the wild: StarkEx offers a mechanism called SHARP, short for "Shared Prover," which amortizes costs across all StarkEx deployments.

Volitions (again)

Most of the relevant information about volitions was covered in the prior Volitions section. Still, they are relevant to the story of rollup throughput, so it's worth giving them a second mention. For a brief recap: - volitions give developers and users the ability to utilize off-chain data availability in a validium - this off-chain data availability, while not as secure as on-chain data availability, leads to an enormous reduction in transaction costs - in addition to reduced costs, off-chain data availability unlocks tons of additional transaction throughput

Privacy

As we all know, privacy is not inherent to Ethereum. We cannot expect the average person or business to give up their financial privacy. By default, ZK-rollups are not private. The 'zero knowledge' in 'ZK-rollup' refers to computation taking place off-chain and later being verified as legitimate on mainnet with a zero-knowledge proof, it does not mean 'your activity is hidden from prying eyes.' All is not lost, though. There is plenty of work being done in the way of permissionless privacy for ZK-rollups.

Recursive Proofs

In 'An Incomplete Guide to Rollups,' Vitalik writes a bit about some key differences between optimistic and ZK-rollups. One of which was how either kind of rollup can handle privacy. He specifically mentions recursive proofs. 'Recursive proof' refers to the act of verifying a proof inside of another proof e.g., verifying a SNARK inside of another SNARK. This is a handy compression technique that allows for greater efficiency and reduced privacy costs.

Aztec is working on what is known as a ZK-ZK-rollup or ZK²-rollup, which leverages their innovative PLONK proofs and Turbo-PLONK to provide transaction privacy. In short: - a ZK-SNARK represents each transaction on a ZK²-rollup. These are "inner" SNARKs. - another ZK-SNARK, the rollup SNARK, handles the work of proving the correctness of the inner SNARKs

Note that optimistic rollups are incapable of this innovation, as they cannot safely allow the inner SNARK verification to happen outside of the rollup; the data must be posted on-chain. This is not to say optimistic rollups cannot benefit from zero-knowledge proofs, but they will always be less efficient and less cost effective.

At this time, zkSync and Mina Protocol have already adopted PLONKs. As time progresses, we can expect further innovations with recursion (including from other proofs like Groth16, Marlin, Fractal, Halo2, etc.) to bring cheaper and more powerful forms of privacy to all ZK-rollups.

^{Turbo-PLONK polynomial logic unit, illustrated. Credits: Zero Knowledge Summit; presentation video here}

Flexibility

ZK-rollups enjoy the freedom to innovate on multiple fronts without the risks of catastrophic failure that L1 chains carry. One of the key principles of a rollup-centric roadmap for Ethereum is that the free market is being sourced to discover all of the best ways to build a rollup, rather than a small group of core developers making the assumption of what should be best.

Because developing and deploying a rollup is a permissionless endeavor, we'll see many different approaches to rollups in the race to onboard users. This includes varying styles governance, tokenomics and liquidity incentives, different tradeoffs within the decentralization spectrum, different expressions of ideology, and even different choices of VM environments like LLVM, custom VMs, and more.

Not everything mentioned in this section is exclusive to ZK-rollups, though. Despite falling short on some of the features ZK-rollups offer, optimistic rollups possess much of the same flexibility. Other L1 smart contract blockchains, however, cannot iterate on any of these as rapidly as rollups can. Remember: it is now rollups vs L1 smart contract platforms.

If an L1 chain tries to iterate too quickly, foregoing proper testing and security measures, it becomes high risk for its users. All funds on these networks are a bounty at all times. When an L1 chain fails, losses can be catastrophic. Downtime would also impact any scaled execution environments (rollups, state channels, etc) the L1 may have. There is a benefit to prioritizing security and decentralization.

In a worst case scenario, when a rollup breaks, it will need to be operated manually until it is fixed. I can imagine, similar to interacting with contracts on Etherscan, rollup developers and app developers may provide "in case of emergency" web portals that allow users quick and easy ways to operate rollups manually if needed. Thankfully, these rapid iterations are likely to be hashed out early on (in the grand scheme of things), and I imagine their development will be done with ample care.

Miscellaneous

Outsourcing computation (and data availability) enables a host of new on-chain applications that are not feasible on mainnet Ethereum or any other smart contract platform online today. This new paradigm also allows us to build superior versions of any existing on-chain product.

Application Specific ZK-Rollups

While this article has predominantly focused on the benefits of general computation ZK-rollups, there is a lot to be said about the impact of application specific ZK-rollups.

The dYdX Exchange

dYdX, powered by StarkEx, is a decentralized exchange that supports perp, margin, and spot trading, as well as lending and borrowing. Since its L2 launch, dYdX has garnered liquidity rivaling FTX on its ETHUSD pairs. While a lot of this is likely mercenary liquidity taking part in their $DYDX token reward program, I am confident dYdX or some other ZK-rollup native DEX will one day surpass all perp exchanges in volume and liquidity for good.

^{dYdX's ETH liquidity rivals FTX; Sep. 26, 2021. Credits: Hsaka}

In terms of UX, you only need an Ethereum wallet and some ETH to sign in and begin trading on dYdX. Unlike your average centralized exchange, there is no KYC required, no need to store your personal information with third parties, and of course the DEX is non-custodial. You do need to transfer funds to the rollup to use the DEX, but you are in control and can pull funds back to mainnet when you want. Users of dYdX have anecdotally remarked that it feels every bit as responsive as using a centralized exchange.

Certain chains have garnered attention from the HFT (high-frequency trading) crowd. Assuming HFT firms are rational, profit-motivated entities, I imagine this activity will predominantly reside on ZK-rollups with time.

Immutable X

Another example rapidly gaining traction is Immutable X, a volition (also powered by StarkEx) that provides massive scaling benefits to NFTs. Recently, Immutable X was chosen by TikTok as the platform for their TikTok Top Moments NFTs. Instead of paying $100-$1000 in gas costs to mint an NFT, Immutable X lets users mint them for pennies on the dollar or even free. An excerpt from their alpha trading announcement: Immutable X offers gas-free and instant trades: For any marketplace, game and decentralized app, Immutable X provides gas-free trades (gasless minting, trading, earning, collecting), instant NFT trades (up to 9,000+ transactions per second) driving scalability, without compromising user custody.

Did you catch the part where they said up to 9,000+ transactions per second?

Physics and Game Engines (DOOM on ZK-Rollups When?)

A twitter user by the name of guiltygyoza has shown off quite a few of his experiments with physics on StarkNet. I expect, as tooling becomes more robust and experimentation continues, we'll see tons of new on-chain games that were not previously conceivable.

^{Simple lattice & the two body problem in gravitational field, running on StarkNet. Credits: guiltygyoza}

Other Concepts

Volitions will enable new approaches to Web 3.0's mission. Things like chain-native social networks, for instance, should benefit greatly from off-chain data availability. Jack Dorsey has talked about his plans to turn Twitter into an open source, distributed system, where Twitter is merely a client on top of a "Twitter" protocol. Volitions (validiums, more specifically) could play a key role in that reality.

On a similar note, I can imagine an open source resurrection of Vine, where the characteristically short (6 seconds or less) user-submitted videos are minted as NFTs. TikTok and their 'Top Moments' program is similar to this idea, but TikTok is ultimately a closed source entity and a little disruption is never a bad thing.

What's next for the competition?

ZK-rollups bring a lot to the table, and Ethereum will soon be positioned to let them flourish to the best of their abilities. But what of the competing chains? Outclassed in every sense, what becomes of them? It's a good question with inevitably many complicated answers. I have a few thoughts on their fate.

The Pragmatic Blackhole of Ethereum

Over the last year, we've seen a number of "cheap and fast" EVM chains spring up. We've also seen chains come online with the promise of having "defeated the scalability trilemma!" at the base layer, waving away at the notion of scaling in layers (what they really mean is they have sacrificed decentralization for speed and security).

It should be clear by now that general computation ZK-rollups will be more secure, faster, more decentralized, more adaptive and flexible, and more lightweight than any L1 smart contract chain could ever hope to be. These facts are important; each standalone chain will be carrying unnecessary security overhead and risks while being an inferior product.

In my opinion, the pragmatic solution in the future is for these chains to relinquish their redundant consensus mechanisms and data availability and become a ZK-rollup or volition. They should assimilate to Ethereum's best-in-class security, its data availability, and its settlement assurances.

Outsourcing the legwork of consensus and security to Ethereum will allow these chains to focus strictly on execution. In a post-sharded, post-rollup dominance world, this is their shot at retaining relevance. Their security baggage will otherwise be far too heavy to keep up. This will be a reality that becomes exponentially clearer—cacophonously obvious—over time. It will be impossible to justify the negligence.

^{Ethereum (left) & all other L1 execution layers (right), circa 2023.
Credits: NASA/CXC/M.WEISS}

Arguably, networks like Solana, Avalanche, Fantom, and Binance Smart Chain have a leg up on any potential rollup governance tokens. The native tokens for these networks (and others like them): - have had time to reach some level of distribution - are 'known entities' - have exchange support - have deep liquidity

This is to say, abandoning their redundant consensus mechanisms and security overhead to become an Ethereum rollup does not mean their token disappears. Rather, they can repurpose the token to align prover and sequencer incentives or provide on-chain liquidity incentives. The chains do not need to sacrifice their identity, just their dangerous baggage. It's a net positive for all.

Reality

It would be foolish to assume the architects, VC's, and users of these chains would be so quick to accept this reality, if willing at all. Memes are strong, there is no shortage of pride, and plenty of VC's have a dream they'd like to continue selling to retail investors.

History has shown us the death of a blockchain is never a fast process. You can observe thousands of empty blocks on the likes of Ethereum Classic today, showing a clear-cut lack of adoption anywhere at all. Ethereum Classic isn't alone; there are many others like it. Still standing, standing still, until one day they aren't anymore. Should one choose, there is plenty of time for cognitive dissonance before reality collects its dues.

Time

Even if these chains choose the pragmatic approach, an enormous amount of research, preparation, and care will need to go into a change of this magnitude. It will take a long time for anyone to execute. Perhaps counterintuitively, my gut instinct is that Solana will be one of the earliest to do so.

Disclaimers

A ZK-rollup future might seem like a magical technological solution to all problems in the world, but there are some things that you would do well to keep in mind.

General

This is not an all-inclusive list. - Depending on the rollup, centralized sequencers (or sequencers generally) may have privileged positions to execute MEV.

• Depending on the implementation of data availability committees on the validium side of a volition, it may be possible that data committee validators can maliciously freeze or refuse to update the validium's state. This does not affect the ZK-rollup's state in the volition.
• Many rollups means many places for liquidity, whether its in the form of trading tokens or trading NFTs. While ZK-rollups allow for fast movement between rollup and mainnet, or even rollup-to-rollup, liquidity fragmentation may cause early turbulence. dAMM aims to solve this exact problem.

• It is computationally demanding to run a prover, and we would do well to find ways to reduce the potential kW/h consumption of them while making them more efficient.

  Note that proving is not a game of attrition like proof-of-work mining; it does not get harder over time. It is therefore unlikely the energy usage from provers will ever come close to that of Ethereum's energy usage during the PoW era.
  

That said, with the exception of MEV, I expect the market will provide solutions for most issues relatively quickly. As far as MEV goes, it's a tricky problem that unfortunately isn't solved by any one magic solution or protocol, but various approaches to MEV minimization and democratization will help to reduce its impact.

Optimistic Rollups

While I am unconvinced of the long term feasibility of optimistic rollups, it remains the case that they are the best EVM compatible scaling solution for Ethereum today. General computation EVM-compatible ZK-rollups are not live yet and it will be some time before we get to realize all the benefits I've covered in this article.

Optimism recently announced a thrilling change to their execution environment that will massively benefit users and developers alike. Arbitrum will soon be receiving its Nitro upgrade, which bolsters EVM compatibility and provides even more speed for its users.

Increasingly, new and existing DeFi apps alike are deploying on these rollups. There is multiple billions of dollars of liquidity between the two networks. Both networks are very much worth trying out and supporting. Bridging to Optimism and Arbitrum takes just a matter of minutes!

You can try out Optimism by bridging here: https://gateway.optimism.io/welcome

and you can try out Arbitrum by bridging here: https://bridge.arbitrum.io/

I urge you to verify the validity of each URL before interacting with either website. You can always double check the profile-linked websites on both Optimism's Twitter and Arbitrum's Twitter.

At the time of writing, Optimism is whitelist-only for smart contracts, but users are free to use any of the whitelisted smart contracts as much as they'd like. I suspect this whitelist will be lifted very soon. Arbitrum does not have a whitelist; users and developers are free to transact and deploy to their heart's content.

Bear in mind the first-party bridges back to mainnet for both networks take 7 days (a product of the manner in which optimistic rollups handle fraud). There are third-party service bridges where you can swap back and forth from rollup to mainnet, for a fee. Do your own research before using any of them and always double check your quoted slippage and rates.

Conclusion

We are on the verge of a gargantuan paradigm shift that will forever change the crypto ecosystem. ZK-rollups will scale Ethereum and they will do the best job of it. The paradigm shift is strong enough that it very clearly marks the beginning of the end for every L1 smart contract chain—even Ethereum as we know it today.

There have been many different propositions for scaling. Thousands of hours of research, implementation, success, and failure have gone toward finding the right way to create this proverbial light bulb—and, of course, the work is far from over. The road ahead is full of twists and turns, but the destination has never been clearer.

I hope this article has helped shape your mental model when considering the future of this industry. I am endlessly excited to see what is in store for us all.