May 15, 2023 4 min read

ZK Rollups for Smooth Brains

If you’ve been frequenting the IOTA Discord lately, you may have seen some posts claiming that ZK Rollups are the future and will usher in a new era for the protocol. But what are ZK Rollups, and why should we care?

tl;dr: A Zero-Knowledge (ZK) Rollup is a means of verifying and bundling a number of digital ledger transactions off-chain via Smart Contracts so they can be anchored to the underlying base layer (the Tangle in our case) all at once, vastly improving the scalability of the base layer.

We know that the Tangle is already much more scalable than traditional blockchains due to the parallelism of our DAG structure. But looking ahead to the future it’s easy to envision a time when payment transactions, IOT data packets, shipment identifiers / location tags and various other use cases will require very high-throughput. During times of peak use, will 1000 transactions per second even be enough? It’s important to consider scaling solutions now before it’s an issue.

Ethereum has already experienced some these growing pains, and Layer 2 scaling solutions offer much promise. In addition to improving the scalability of the base layer, these transaction-bundling solutions also greatly reduce the gas fees (by up to 100x) since the fees can be split between the batched transactions. While IOTA does not have high gas fees to contend with since transactions on the Tangle are free, Layer 2 scaling solutions can greatly reduce congestion on the Tangle. By anchoring batched transactions on the Tangle, the security and decentralization of the transactions can be maintained, while the Tangle benefits from improved speed and throughput. This keeps the Tangle lean and mean!

Rollups are a specific type of scaling solution and currently the preferred method for Ethereum. While there is still much development needed before we see widespread use of ZK rollups on IOTA, the groundwork is being completed and battle-tested on other chains right now. Hundreds of transactions can be bundled together, compressed to a high degree and sent to the base layer with one proof. There are currently two different types of rollups: optimistic and zero-knowledge.

Optimistic rollups (like those utilized by the Optimism or Arbitrum networks) are so-called because the batched transactions are assumed to be valid when anchored to the Ethereum network. They can be challenged through a fraud proof if validity is suspect. If proven to be faulty, the challenger gets a reward and the rollup issuer loses their deposit. Since challengers must be given some amount of time to contest the bundle before it’s accepted, this increases the time-to-finality for Optimistic rollups. In fact, finality could take a week or longer in some cases. Also, security is a factor with these rollups since it is pushed to the validators and not sourced directly from the base layer.

Zero-Knowledge (ZK) rollups (like those used by Loopring or Starkware) verify the transactions first through complicated cryptographic validity proofs and then anchor the compressed data to the base layer. These validity proofs offer a means to trust that the bundle is valid without specific knowledge about individual transactions, hence ‘Zero-Knowledge’. Since the transactions are pre-verified, there is no need to challenge the validity. Also, there is no need to trust the validators since the security is generated through the cryptography used to publish the proof and the underlying security of the layer that anchors the proof. Lastly, ZK rollups are relatively fast because the validity proof is already included so the rollup can be processed immediately without requiring time for challengers to contest the batch.

As a practical use of Zero-Knowledge proofs, consider a club that could scan your fingerprint for admittance without the need for a bouncer to check your ID and know your exact birthdate, address etc. Or consider a scanner that could scan your iris and know that you could afford the payments for a new car without a car salesman needing specific knowledge about your job or income. This technology can thus also help to preserve privacy. For this reason, ZK proofs are particularly useful in cases relating to Decentralized Identity.

At this point you may be thinking, “Why would any network choose to use Optimistic rollups over ZK rollups if ZK rollups have so many advantages?” Great question! Maybe your brain isn’t as smooth as you think. Well, it turns out that since ZK validity proofs require complicated cryptographic calculations, they require higher-end hardware to process. This makes ZK rollups bit more expensive to implement than Optimistic rollups. ZK rollups are also much more difficult to develop technically. Even the smallest changes to the functionality of the rollup can require extensive changes to the programming. Currently, relatively few devs are able to build on ZK rollups. Additionally, Optimistic rollups were developed first, so their use has been more battle-tested. ZK rollups are still in development and will need some more time to be mainstream. Lastly, due to the complexity some ZK rollups don’t have EVM support.

Even with the notable drawbacks listed above, ZK rollups offer a very attractive scaling solution. With the IF hyper-focussed on research and the future of IOTA, perhaps sharding will become a more important topic of discussion when attempting to improve the scalability of the Tangle. Even so, ZK rollups will be a viable solution in a much shorter time frame and can be used in conjunction with sharding to offer a multi-faceted approach to scaling. This will ensure that the Tangle can handle the future demands that we place on it with ease.