Author: Donovan Choy, Blockworks; Translated by: Wuzhu, Golden Finance

It all starts with Ethereum. L1 is too slow. Each node needs to re-execute transactions in the block redundantly to ensure validity, which limits scalability.

By 2020, the Ethereum community will unite around rollups as an extension solution. Vitalik's landmark blog post on rollups in 2021 explains how optimistic and zk rollups scale Ethereum.

Zk rollups have technical advantages in scaling, but the technology is still too expensive and far behind (more on that later).

So, optimisticrollups first break into the market. Optimisticrollups Assume that all transactions are valid until someone challenges them with fraud proof during a seven-day challenge period.

Optimisticrollups are valid, but they have hidden costs. The challenge period means that users need longer transaction end time before withdrawing funds. Locking liquidity means capital efficiency and generally poor user experience, especially in terms of chain interoperability.

At the same time, zk is catching up. At ETHCC 2022, Polygon, zkSync and Scroll have all announced zkEVM, which allows Solidity developers to write code and prove the execution of EVMs – effectively allowing Ethereum to leverage zero-knowledge technology.

By 2023, zk rollups are starting to really gain attention.

Why is zk proof better than optimistic fraud proof? That is, because zk proves to be much smaller (~1-10 KB) compared to the original transaction data (megabyte size).

Proving Ethereum transactions by using zk encryption, these highly compressed proofs mean lower data availability costs and better scalability.

Although zk is taking off, the cost of generating proofs is still high. According to zkstats.io, the average cost of generating zk proofs in December 2023 is $80.21.

Fast forward to 2025. Proof costs have dropped to $1.3 per proof, an increase of about 98.4%.

What changes have been made?

Now, each core part of the zk rollup stack is broken down.

First of all, zkVM has been released. These dedicated virtual machines speed up the zk development experience and make proof of effectiveness generation more efficient. Before zkVM emerged, developers neededWrite complex mathematical "circuits" to prove the execution of EVMs.

Now, ZkVMs such as SP1, RISC Zero, Nexus, and OpenVM effectively enable all developers (C++, Rust) who do not have the expertise in zk encryption to democratize zk development. In the past, zkEVM enabled Solidity development only on zk rollups. Think of zkVM as a more general concept than zkEVM.

Secondly, due to market competition, the cost of generating proof is declining. Today, Risc Zero, Cysic, Lagrange and Succinct operate many competitive markets. Some are still in the test network, and some are already in operation.

Zk L2 is also turning to proof aggregation technology to amortize verification costs. It roughly works by batching multiple proofs into one proof, thus making the final proof more quickly.

These markets are also license-free, meaning that anyone with a GPU device can register, issue a margin and generate zk certificates. Previously, zk rollups used "centralized provers", which meant they rented GPU/FPGA hardware from Google or Amazon.

Better proof systems are also being launched. These proof systems (e.g. Groth16, Halo2-KZG, STARK, Plonk, Expander) define algorithmically the rules for how to build and verify zk proofs. They are getting better, which means that zk proofs are getting smaller and faster and faster. This in turn means zkVM performance improvements.

Lastly, there is the zk coprocessor built on top of zkVM. These things basically allow on-chain applications that do not exist in the zk execution environment to exploit the miracle of zk technology. The way it does this is to move the calculation off-chain, and thus run asynchronously with the execution of the blockchain. This enables the application to calculate complex statistics off-chain, prove it with zk, and then publish the proof on the chain.

Apps like Frax, Azuki, Etherfi, and Gearbox are using Lagrange's zk coprocessor to bypass Ethereum L1 restrictions.

So you get it. That's why zk is the ultimate goal.