ZK Rollups and Validity Proof Systems
Executive summary
ZK rollups, long promised as the endgame for Ethereum scaling, transitioned from research prototype to production reality between 2023 and 2026. The zkEVM landscape consolidated around five major implementations (Polygon zkEVM, zkSync Era, Linea, Scroll, Starknet), with each pursuing distinct trade-offs between EVM equivalence, prover performance, and decentralization timeline. Validity proof systems matured rapidly: Halo2, PLONK derivatives (UltraPLONK, HyperPLONK), and STARK-based systems each found production deployments. Prover hardware became a discrete industry, with companies like Cysic, Ingonyama, and Fabric Cryptography racing to ship FPGA and ASIC accelerators. By 2026, ZK rollups collectively held several billion dollars in TVL but trailed optimistic rollups in absolute scale, with the gap closing as proving costs fell. The strategic question for 2027 is whether ZK technology graduates from rollup execution into a more general primitive (zk-coprocessors, zk-light-clients, zk-ML) that reshapes Ethereum's roadmap.
What ZK rollups actually do
A ZK rollup batches user transactions off-chain, executes them in a virtual machine, and posts to Ethereum L1 a compact validity proof attesting that the post-state is the correct result of applying those transactions to the prior state. The validity proof - a zk-SNARK or zk-STARK - is verified by an L1 contract in milliseconds. This contrasts with optimistic rollups, which post state without proof and rely on a fraud-proof window for security. The architectural advantages are immediate: ZK rollups have near-instant L1 finality (limited only by L1 inclusion plus the fraud-proof-equivalent of waiting one or two L1 blocks), no withdrawal delays, and stronger security assumptions because validity is mathematically verified rather than economically incentivized. The architectural costs are equally clear: generating ZK proofs is computationally expensive, the prover infrastructure is complex, and achieving full EVM equivalence at the proof-system level is hard. Through 2024-2026, the cost of proving fell by roughly an order of magnitude as proof systems improved and prover hardware specialized. By 2026, posting a ZK rollup batch's validity proof to L1 cost in the low-cents-per-transaction range, comparable to optimistic rollup costs and projected to fall further with continued hardware acceleration.
The zkEVM landscape: five distinct paths
By 2026, five zkEVMs dominated the production landscape. Polygon zkEVM (now part of Polygon's broader Polygon CDK ecosystem) pursued bytecode-level EVM equivalence, executing standard Solidity contracts without modification, with the proof system based on a Plonky2 derivative. zkSync Era, by Matter Labs, took a Type-4 approach: language-level Solidity compatibility but a custom bytecode and VM, optimized for prover performance at the cost of some opcode-level equivalence. Linea, by Consensys, hewed close to EVM equivalence with a PLONK-based prover and tight integration into the broader MetaMask and Infura ecosystem. Scroll, by the Scroll team, pursued bytecode-level EVM equivalence (Type-2) using Halo2-based proofs, prioritizing developer compatibility. Starknet, by StarkWare, took the most divergent path: a custom VM (Cairo) with native ZK-friendly operations, requiring developers to write in Cairo or use Solidity-to-Cairo compilers. By 2026, Starknet retained the highest TVL among ZK rollups due to its earlier launch and ecosystem development, while zkSync Era and Polygon zkEVM occupied second and third positions. Linea grew steadily on the back of Consensys distribution. Scroll captured developer mindshare for its purist EVM-equivalence stance. Aggregate ZK rollup TVL by Q1 2026 was in the $5-10B range, well behind Arbitrum and Optimism's optimistic rollup TVL but with faster percentage growth.
Prover economics and the hardware acceleration race
Generating a ZK proof for a rollup batch involves running computationally expensive operations - Number Theoretic Transforms (NTTs), Multi-Scalar Multiplications (MSMs), and FRI (Fast Reed-Solomon Interactive Oracle Proofs) for STARK-based systems. By 2024, the prover cost per transaction dominated rollup operating economics, with provers running on specialized GPU clusters. The 2024-2026 window saw an acceleration race. Cysic, Ingonyama, and Fabric Cryptography each pursued FPGA and ASIC implementations of the core ZK primitives, with target speedups of 10-100x over GPU baselines. By 2026, FPGA-based provers were in production for several rollups, with first-generation ASIC provers in testing. The economics shifted: prover hardware became a meaningful capex category, similar in profile to Bitcoin mining capex but oriented toward ZK proof generation rather than hash power. Rollup operators began running their own prover networks or contracting with specialized provers (RiscZero, Succinct, Lagrange). The strategic implication is that ZK rollup operating costs are heading toward parity with optimistic rollup costs, removing the historical economic disadvantage of validity-proof systems. The deeper implication is that prover hardware specialization may become a moat for operators who invest in it.
Validity proof systems: PLONK, STARK, Halo2 and beyond
The proof system layer underwent rapid evolution between 2020 and 2026. PLONK, introduced in 2019 by Aztec, became the foundational template for many production zkEVMs because of its universal trusted setup and recursive-friendly structure. UltraPLONK and HyperPLONK extended PLONK with custom gates and sumcheck-based optimizations. Halo2, originally from Electric Coin Company for Zcash, became the proof system for Scroll's zkEVM and several other implementations. STARK-based systems, championed by StarkWare, offered the advantage of no trusted setup and post-quantum security but at the cost of larger proof sizes (mitigated by recursive proof composition that produces a final SNARK proof verified on-chain). By 2026, recursive proofs - where many smaller proofs are aggregated into a single proof verified on-chain - became standard practice across all major zkEVMs, dramatically reducing on-chain verification costs. Folding schemes (Nova, Hypernova, ProtoStar) emerged as a complementary approach for incrementally verifiable computation, attractive for ZK virtual machines like RiscZero's zkVM. The proof system layer remains an active research area; what looked novel in 2024 (lookups, custom gates, folding) became standard production techniques by 2026.
ZK beyond rollups: coprocessors, light clients, and ML
By 2026, ZK technology had spread beyond rollups into a broader infrastructure category. ZK coprocessors (Axiom, Lagrange) allow smart contracts to query historical Ethereum state, run computations off-chain, and verify the result with a ZK proof, dramatically expanding what L1 contracts can practically do. ZK light clients (Polyhedra, Succinct) enable cross-chain bridges where one chain verifies another chain's state via a ZK proof, replacing trusted multisigs with cryptographic verification. ZK-ML (Modulus Labs, Giza, EZKL) attempts to verify that a machine learning inference was performed correctly using a specific model, with applications in onchain prediction markets, AI agents, and verifiable model attribution. ZK identity (Polygon ID, World ID, Sismo) allows users to prove attributes about themselves (age, jurisdiction, accreditation) without revealing underlying credentials. Each of these subcategories had production deployments by 2026, though mainstream adoption lagged behind technical capability. The strategic implication is that ZK is graduating from a rollup-execution technology into a general primitive for verifiable computation, similar to how cryptographic signatures graduated from a banking technology into a general primitive for digital authentication. The Ethereum roadmap (Verge, Purge, Splurge) explicitly assumes ZK availability across multiple layers.
Recent milestones (2024 to 2026)
Major milestones in this stretch: Polygon CDK launch in 2024, allowing developers to deploy zk-rollups using Polygon's stack and interconnect them via the AggLayer; zkSync Era's ZK token launch in 2024 with associated airdrop; Linea's expansion through 2024-2025 with deep MetaMask integration; Scroll's mainnet maturation and developer-traction growth; Starknet's appchain announcements (Madara, Paradex) and its v0.13 sequencer upgrades; the Pectra upgrade in 2025 introducing EIP-7702 and other features that affected rollup design choices; Polyhedra and Succinct shipping production ZK light-client bridges; Axiom and Lagrange shipping ZK coprocessor production deployments; the EigenLayer-Lagrange integration for ZK-as-an-AVS; and the broader emergence of ZK proof marketplaces (Succinct's Prover Network, RiscZero's Bonsai). Hardware-side, Cysic shipped FPGA proving products to multiple rollup customers in 2025; Ingonyama and Fabric Cryptography progressed toward ASIC tape-out. Aggregate ZK rollup transaction volume crossed several billion daily by 2026, though still trailing optimistic rollups in absolute scale. The Ethereum L1 itself prepared for ZK-EVM integration via the EOF/Verge proposals, with active research and prototyping but no L1 ZK execution shipped by Q1 2026.
Risks, decentralization, and outlook through 2027
ZK rollups face three core risks. First, prover centralization: most production zkEVMs run a single prover operated by the team, which is a centralization risk equivalent to (or worse than) the sequencer centralization issue in optimistic rollups. Roadmaps for prover decentralization exist (Polygon's prover network, Succinct's prover marketplace, Starknet's roadmap toward decentralized proving) but most are not fully shipped by Q1 2026. Second, governance and upgrade risk: zkEVM contracts often contain admin keys controlled by the team, and bugs in proof systems are catastrophic if exploited. The L2BEAT 'stage' classification (Stage 0/1/2) tracks progress toward trustless rollups; most major zkEVMs were in Stage 0 or transitioning to Stage 1 by 2026. Third, EVM-equivalence completeness risk: subtle differences between zkEVM execution and L1 EVM execution can cause unexpected behavior in deployed contracts; the longer track record matters here. Looking forward to 2027, the realistic outlook is convergence. The cost gap between ZK and optimistic rollups will continue to close. Decentralized prover networks will mature into production. ZK coprocessors and ZK light clients will become standard infrastructure across DeFi protocols. The longer-term question - whether Ethereum L1 itself adopts ZK execution as part of the Verge - is more political than technical and will likely be a 2027-2028 milestone rather than 2026.
Watch points
- Prover cost per transaction across major zkEVMs and the hardware acceleration roadmap
- L2BEAT stage progression for zkSync Era, Polygon zkEVM, Linea, Scroll, Starknet
- Polygon AggLayer adoption and the broader ZK-rollup interoperability story
- Ethereum L1 ZK execution roadmap (Verge) and any timeline updates
TL;DR
ZK rollups (Polygon zkEVM, zkSync Era, Linea, Scroll, Starknet) reached production maturity by 2026 with $5-10B aggregate TVL, prover costs collapsing via FPGA/ASIC hardware acceleration, and ZK primitives expanding into coprocessors, light clients, and ML, with prover decentralization the binding constraint into 2027.
Get DeFi Intel research in your inbox
Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.