ETH researcher: How to build a native zkEVM on Ethereum Layer 1?

Original: 《Ethereum L1 zkEVM》

Author: Polynya

Compiled by: Kate, Marsbit

There seems to be a common misconception that Ethereum can only scale through L2. I might be subject to some criticism for having written too much about L2 Rollups without adequately covering the L1 scaling roadmap, for which I apologize—here, I attempt to correct that mistake, now that L2 has been well understood, accepted, and adopted. Especially Arbitrum One, which has proven itself to be the second-largest smart contract chain after Ethereum L1.

But first, a worse version is that "ETH" can only scale with L2. It is important to clarify that ETH, as a currency asset, can scale through L1, sidechains, other L1s, L2s, and L2-like structures (such as validium and optimistic chains), and even through CEXs and centralized service providers.

Millions of ETH are bridged to L2 and non-L2 chains, and millions more are bridged to non-blockchain venues. Yes, ETH on L1 and (mature) L2 provides you with native security assurances, but even if other solutions may have different security assumptions, they can still scale ETH or Ether assets. By the way, Bitcoin is actually a perfect example of an asset that scales primarily through centralized services, yet it remains the dominant asset in the industry. Remember—an asset has value if you can convince the wealthiest 1% of people, families, and institutions to believe in it.

Of course, this does not mean Ethereum cannot scale; my point is that ETH or Ether must be distinguished from the Ethereum network. Now, there are further nuances here. For example, BSC scales Ethereum's tech stack and indeed bridges ETH and ERC-20, but some may argue that it does not scale Ethereum's network.

Putting that aside, let's return to the question of upgrading Ethereum L1 to zkEVM. In fact, before that, a standard disclaimer—I am an amateur blogger, I know nothing about how blockchain development works, and I don't even know if what I am saying is possible. So, consider this a daydream of an armchair enthusiast.

Using ZKP to scale blockchains is an old concept. I don't know when it was first discussed, but I believe it was about Bitcoin, predating Ethereum itself. ZK-SNARKing Ethereum also predates the concept of rollups. Of course, when ZK rollups proved this concept in Q1 2020 with Loopring and subsequently in Q2 with StarkEx and zkSync (now Lite) and Mina, research into ZK-SNARKing Ethereum entered a phase of rapid development. In 2021, I believe Matter Labs popularized the term "zkEVM," which has been carried forward. The Ethereum Foundation's Privacy and Scaling Exploratory Team is the main innovator of L1-zkEVM, later joined by Scroll, Consensys, Taiko, and other contributors.

Is it zkEVM, ZK-EVM, Zkevm? Who knows, let's just call it zkEVM.

So, how will the L1 zkEVM upgrade proceed? There are many ways to do this, but here is my view. Once again, I don't know if this is feasible, so consider it conceptual art.

The first step is to look at Type-2/2.5 and Type-1 zkEVM rollups for real-world testing of the concept—upcoming projects include Scroll, Linea (?), and Taiko, shortening verification times, etc. The next prerequisite is EIP-4844, statelessness, and PBS (these occur in parallel, so saying "next" may be misleading). (Note: Of course, zkEVM can exist without these, but this is just how I see it, as mentioned above.)

Next, I want to see an Enshrined zkEVM bridge. This would allow Type-1 zkEVM deployments on top of L1. It would provide real-world testing of the exact code and zk circuits ultimately used for L1 zkEVM. It also allows L2 to exist fully decentralized without any smart contracts, effectively embodying L2 zkEVM rollups. They will be inserted into the PBS infrastructure, with builders acting as sequencers. You only need one honest builder. These builders will order the blocks and submit each slot to L1. This means the final result of these enshrined rollups will be the same as L1. This will also bring interesting new possibilities, such as atomic composability between these enshrined rollups.

It is worth noting that Type-1 zkEVM rollups can exist outside such a closed zkEVM bridge—like Taiko—so perhaps we can distinguish them by calling them Type-0? It should be noted that this code uses the same code as future L1 upgrades.

Once they have been tested in a production environment, the L1 execution layer will be ready for the zkEVM upgrade. Builders will again order transactions, generate proofs, and submit proofs and data to the consensus layer. Note that for L1 zkEVM, proofs are now verified at the consensus layer. Builders can not only generate validity proofs but also generate verkle/state proofs and data availability/kzg proofs. Then, non-builder nodes only need to verify these proofs, effectively validating a large amount of TPS, including L2, L3, etc., all proven by a single concise proof of L1 zkEVM, one proof to rule them all, on consumer smartphones or laptops.

The Enshrined zkEVM bridge will continue to exist above the L1 execution layer. Another approach is to move it to the consensus layer, and we could have many enshrined L1 rollups. But I think the best approach is to have a normative enshrined L1 rollup. By the way, I referred to them as "normative rollups" in 2021, and later I saw Justin Drake calling the same idea "enshrined rollups," which has been carried forward since. So, in any case, you have an L1 enshrined rollup, many Type-0 enshrined L2 rollups above it, and of course, traditional L2 and sovereign rollups.

At this point, it is important to note that enshrined L2 rollups have their own set of trade-offs. When all this happens, zkEVM will be very slow, with throughput and functionality limitations, and we may only upgrade it every few years, if at all. There will also be no governance or sovereignty—it will be entirely executed by Ethereum node operators. Therefore, innovation will always be on traditional L2s, and in a mature state, it will have 99% of the benefits without any downsides; I expect 90% of users will continue to use them. Traditional L2s, hybrid versions similar to L2, such as validiums or optimistic chains, enshrined L2s, and enshrined L1 rollups all provide users with different trade-offs and functionalities, and I believe that all these combinations together will be able to meet almost all needs in the blockchain ecosystem for decades to come.

Of course, all of this may be superfluous; we don't really need that much throughput. A more cautious approach would be to keep L1 as it is, and we may never see zkEVM on L1. Even if that happens, I would say we are approaching the end of this decade. Who knows? But I personally hope to see this vision come true because it sounds interesting. I'll leave you with an old post, Fanciful Endgame. Of course, things have changed, but the spirit remains.