A ZK rollup is a Layer 2 scaling architecture that executes transactions off the base chain and then posts a zero-knowledge validity proof back to the base chain to confirm the new state is correct. Where an optimistic rollup says “this state is valid unless someone proves otherwise within a week”, a ZK rollup says “here is a mathematical proof that this state is valid, verify it now”. The base chain does not re-execute the rolled-up transactions; it just checks the proof, which is small and fast to verify regardless of how many transactions were bundled into it. This produces the same practical result — many transactions cheaper than running them all on L1 — with a very different trust model and a very different set of engineering challenges.
The canonical ZK rollups on Ethereum as of 2026 are zkSync Era, Starknet, Linea, Scroll, and Polygon zkEVM. Each of these processes transactions in its own execution environment, batches them, generates a proof, and submits the proof to an Ethereum L1 verifier contract that either accepts the new state root or rejects it. Once the proof is verified on L1, the state transition is final — there is no challenge period, no dispute window, and no way for anyone to dispute what happened short of breaking the cryptography. Funds that are bridged out of a ZK rollup back to L1 can be withdrawn as soon as the proof covering them has been verified, which in practice is usually a few hours rather than the seven days that optimistic rollups require.
The EVM Equivalence Problem
The hard part of building a ZK rollup is making the proving system efficient enough to handle arbitrary smart contract execution. The Ethereum Virtual Machine was not designed with ZK proving in mind — several of its operations (keccak hashes, elliptic curve operations, the gas-accounting model, the storage trie) are expensive to prove inside a ZK circuit. The first generation of ZK rollups (Loopring, early zkSync) avoided this problem by supporting only simple transaction types like transfers and swaps. Building a ZK rollup that runs general smart contracts — a “zkEVM” — required either reimplementing the EVM in a proving-friendly way or proving the EVM directly with all its inefficiencies.
Different projects chose different points on this tradeoff. Vitalik Buterin described the spectrum in a 2022 post that became the standard framework: Type 1 zkEVMs prove the actual Ethereum execution layer exactly, which is the purest but slowest approach. Type 2 zkEVMs are equivalent at the Solidity bytecode level but diverge slightly from Ethereum’s internal representations. Type 3 introduces more compromises for prover efficiency. Type 4 compiles Solidity down to a custom proving-friendly VM and loses bytecode equivalence entirely. Starknet’s Cairo VM is the clearest Type 4 example — Cairo is a new language designed for ZK proving — while Scroll and Polygon zkEVM aim closer to Type 2. As proving technology has improved, the industry has moved generally toward higher-fidelity EVM equivalence, but the tradeoff between fidelity and prover cost is still real.
What ZK Rollups Actually Do Better
The theoretical advantages of ZK rollups over optimistic rollups are meaningful but narrower than the marketing sometimes implies.
Finality is faster. When a ZK proof is verified on L1, the state transition is settled with no challenge period. Users can withdraw to L1 as soon as the next batch proves, which is hours rather than the seven days an optimistic rollup requires. This matters most for bridges and for users who want to move large amounts of capital quickly, and less for users who just transact inside the rollup.
The trust model is simpler. A ZK rollup is secure as long as the cryptography is sound and the proving system has no bugs. An optimistic rollup is secure as long as at least one honest actor is watching and willing to submit a fraud proof within the challenge window. Both models are defensible, and in practice both have worked so far, but the ZK model is cleaner to reason about because it depends on math rather than game-theoretic monitoring.
Data availability is the same. Both rollup types post their transaction data to L1 (or to a DA layer) so that anyone can reconstruct the state. ZK rollups do not save on data cost — they save on execution verification cost. After EIP-4844 introduced blob storage in March 2024, the data cost dropped significantly for both rollup types, which is why L2 transaction fees fell by roughly an order of magnitude across the entire rollup ecosystem in 2024.
The Prover Cost Problem
Generating a ZK proof for a batch of transactions is expensive — it takes time and significant computational resources, and the cost of running the prover is currently the dominant economic cost of operating a ZK rollup. Most current ZK rollups run their provers on specialised high-memory machines (often with GPU acceleration) and amortise the cost across the batch. As of 2026, proving cost per transaction has come down substantially from where it started — by roughly an order of magnitude every two years — but it is still a meaningful fraction of the operating cost of a ZK rollup and a reason why L2 transaction fees, while low, are not yet as low as they could theoretically be.
Improving prover efficiency is a major research and engineering focus. Newer proving systems (Plonky2, Plonky3, Boojum, various recursive constructions) have made proving considerably cheaper. Specialised hardware (ASIC provers) is starting to appear, which could drop costs by another order of magnitude if the designs work out. The long-term expectation in the ZK rollup ecosystem is that proving will eventually be cheap enough that the overhead is negligible, at which point the main remaining cost will be data availability, and that is itself expected to keep dropping as DA layers (EigenDA, Celestia, Avail, and Ethereum’s own blob capacity expansion plans) mature.
Where They Fit in the Rollup Ecosystem
ZK rollups have not displaced optimistic rollups the way some early projections expected. Arbitrum and Optimism (both optimistic) remained the two largest L2s by TVL and activity through 2025, with the leading ZK rollups (zkSync Era, Starknet, Linea) occupying the next tier. The reason is partly that optimistic rollups were shipped earlier and built up network effects, partly that the prover cost of ZK rollups slowed their scaling, and partly that developer experience on optimistic rollups has been simpler because they are direct bytecode-equivalent EVM implementations from the start.
The expectation for 2026 and beyond is that ZK rollups will gradually close the gap as proving costs drop and as zkEVM fidelity improves. Optimistic rollups are also investigating ZK proof integration (Optimism has been exploring this under the “ZK optimistic” banner), which would let them keep their existing architecture while also producing validity proofs that eliminate the challenge window. If that transition happens, the distinction between “optimistic rollup” and “ZK rollup” may eventually blur into just “rollup with fast finality”, and the current taxonomy will look like an artifact of the specific engineering constraints of the mid-2020s rather than a permanent feature of the landscape.