ZKSwap Introduces Practical ZK-Rollups — ZKSpeed, Achieving High TPS and Low Gas Fees in Real Layer2 DeFi Use Cases

ZKBase

Published in

ZKBase

9 min readFeb 9, 2021

TL;DR

We are thrilled to introduce Practical ZK-Rollups — ZKSpeed!

ZKSpeed is a ZK-Rollups-based layer2 scalability protocol, combining practicality and engineering optimization. It is a practical and scalable ZK-Rollups protocol.

In a nutshell, ZKSpeed achieves high layer2 TPS and significantly reduces gas fees through aggregating multiple zero-knowledge proofs, parallel processing of the PLONK algorithm, and the categorization of off-chain data.

Compared with other layer2 solutions like zkSync, Optimistic Rollups, and Plasma, ZKSpeed has achieved remarkable breakthroughs in real use cases and will be the first to support large-scale deployment of DeFi applications in Layer 2.

Why layer2?

As the most active development platform in blockchain, the Ethereum’s network congestion and high gas fee have come to a point almost unbearable for applications and users. The recent average gas fee of a single transfer soared to US$ 24.7, which screams for an immediate solution.

Many blockchain researchers have looked into different flavors of scalability solutions, such as solutions focusing on the layer1 like ETH 2.0, which modifies the consensus mechanism to accelerate the block time and enables faster on-chain transactions. There are also layer-2 centric solutions that move computation and data off-chain to layer2 with security and accuracy ensured by cryptography while maintaining a simple and stable layer1.

In the long term, layer2 centric solutions will likely win out.

The blockchain has evolved into a clear infrastructure framework, stable and easy to maintain. Adding complex logic to layer1 will make it more and more fragile. Therefore, a sound blockchain design should be: keep layer1 as stable as possible and place complex logic and innovative applications on layer2. (Unless there is a substantial need for changes such as modification of the cryptographic primitives brought by a breakthrough in cryptography.)

Researchers have gradually come to realize this, which explains the booming solutions on layer2. However, when the theory is put to implementation, developers like us have discovered in many cases we need to weigh the pros and cons of different schemes and make balanced trade-offs.

So far, among all layer2 scalability solutions, the most discussed are ZK-Rollups, Optimistic Rollups, Validium, and Plasma. Below is a table made by Avihu Levy at StarkWare for a quick categorization:

The features of these four layer2 solutions are as follows:

ZK-Rollups: Proposed by Ethereum researchers, all computation happens off-chain, stored on-chain, and the plaintext data is sent to the on-chain contract via calldata, reducing storage costs. The zero-knowledge proof guarantees the correctness of the off-chain computation. This scheme can greatly increase the TPS and reduce gas fees.

Optimistic Rollups: As can be seen from the table above, Optimistic Rollups and ZK-Rollups are in the same column because they share one common feature — the plaintext data is sent to the on-chain contract via calldata; the difference is that Optimistic Rollups use fraud-proof to somewhat achieve the accuracy of the off-chain computation. “If anyone discovers that one batch had an incorrect post-state root, they can publish a proof to chain, proving that the batch was computed incorrectly. The contract verifies the proof and reverts that batch and all batches after it.”(Vitalik) Compared to ZK-Rollups, Optimistic Rollups have weaker security assumptions and take about one week when withdrawing from layer2 to layer1.

Validium: Proposed by StarkWare, in Validium, computation is off-chain. The zero-knowledge proof algorithm guarantees the correctness of the computation. The verification is completed on-chain, and the final state is stored on-chain. The transaction data is also stored off-chain for better scalability, and the credible Data Availability Committee(DAC) provides proof of data availability. Compared with ZK-Rollups and Optimistic Rollups, Validium loses a certain amount of data availability, but it provides better scalability. Therefore, this solution may be more favored in some applications scenario.

Plasma: Proposed by Vitalik, Plasma was the earliest compared to the other three solutions, with computation off-chain, storage on-chain, and transaction data stored off-chain. Users can initiate fraud proofs to prove the operator’s fraudulent behavior, thereby obtaining rewards and slashing the fraudulent operator.

Although the above schemes have all been introduced on paper, there is no real application running on layer2, so it is difficult to determine which is better. The most robust application on Ethereum is DeFi. Among them, DEXes use most of the network resources. Layer2 will obviously bring more room for growth for DEXes. Below we will look into ZKSwap, the actual implementation of a DeFi project on layer2.

ZKSwap, Pioneer of DeFi on Layer2

As a pioneer of DeFi on layer2, we, the ZKSwap team, are thrilled to announce the ZKSpeed Protocol, a practical and scalably ZK-Rollups solution. The table below shows where ZKSwap positions regarding technical design.

ZKSpeed combines the strength of ZK-Rollups, Validium, and Plasma, and adds proof aggregation, GPU compatibility, and proof circuit optimization to significantly improve the entire network's throughput.

Before a detailed introduction, it is necessary to explain why ZKSpeed stores transaction data off-chain. In fact, our original plan was to implement it strictly follow the ZK-Rollups solutions, so it could reduce transaction costs, ensure on-chain data availability, and users could provide proof of the Merkel tree's validity, and withdraw funds from layer2 to layer1 at any time.

Unfortunately, after testing in real scenarios, with the above mentioned technical route, the on-chain cost is still prohibitive.The Gas Limit of each layer2 transaction would be about 6,000. To put things into perspective, the Gas Limit of Ethereum on Layer1 is 21,000, and the Gas Limit of an ordinary ERC20 transfer is about 50,000. So a 6,000 gas limit is far from the layer2’s goal of high throughput and low Gas fees. Although it is fast enough get proof on-chain, the transaction cost is still high, which will hinder users’ willingness to use. With no user and no trading volume, a high-throughput does not have any meaning.

Therefore, when we implement layer2 scalability solution in actual use cases, we first need to have absolute security of funds on layer2; second, we need fast layer2 TPS, which ZKSwap has already achieved with a layer2 TPS above 100 and improving🤩; and third, we ideally need the gas fee for each layer2 transaction to be only 5%, or 2% of that of the underpinning layer1 network.

With the ZKSpeed solution, the off-chain data processing is divided into two parts. First, all data related to layer1 transactions will be on-chain in real-time to ensure the safety of funds and generate zero-knowledge proofs and verification proofs in real-time. Second, for transactions only related to layer2, ZKSpeed adopts a distributed storage solution, revealing the original transaction data in real-time, and puts the data summary on-chain in real-time. The data summary will be released by the layer2 operator itself, but anyone can verify the summary's accuracy in real-time. In the long run, the computation and release of the data summary can be carried out in a distributed manner after introducing community verification. By categorizing off-chain data, ZKSpeed greatly improves the scalability of data.

Regarding data availability, the scalability of the ZKSpeed is better than the Optimistic Rollups where all transactions are on-chain. Subject to the limitations of each Block Gas Limit of Ethereum’s layer1, if all data is stored on-chain, there is a clear ceiling for the scalability of the layer2 system. Considering the huge gas cost, the TPS of such layer2 solutions can hardly exceed 20 in a real application, and its practicality is greatly limited.

The ZKSpeed Protocol categorizes off-chain data, balances the trade-off between data availability and data scalability. After solving the problem of data availability, the next is to improve the availability and processing speed of the zero-knowledge proof system. ZK-Rollups use the zero-knowledge proof algorithm to ensure the accuracy of the changes in the world state caused by all transactions. With this, multiple transactions are processed at one time to achieve the first improvement in system performance and bring a higher TPS. However, the improvement effect brought by this is marginal and barely acceptable to us. That’s why we kept looking for new technical solutions to achieve even higher system capacity and lower transaction costs. After relentless efforts, we found a new solution, Aggregative Proof.

Aggregative Proof

The logic of the Aggregative Proof is actually elementary. In a basic layer2 solution, one block corresponds to one proof of validity, and the on-chain contract verifies the proof. The average block time of Ethereum is 15s. If the on-chain contract can verify the validity of multiple proofs at one time, the cost amortized on each transaction will be greatly reduced.

Following this concept, ZKSpeed implements an Aggregative Proof scheme. With Aggregative Proof, it is still one proof for one layer2 block. Still, it aggregates multiple proofs generated within a period of time or a fixed number of blocks, and verifies their validity with zero-knowledge proof. Think of the verification process as some circuit. In this way, one on-chain verification can verify the validity of multiple layer2 block proofs.

After actual testing, by adopting the Aggregative Proof scheme, the cost of a single transaction has also been reduced to 1,000 Gas Limit, 1/50 of the ERC20 transfer cost on the Ethereum mainnet(50,000). A 50x reduction is amazing! Imagine that if more zero-knowledge proofs can be generated within the block interval of the layer1 network, the TPS of the entire system will be substantially improved. For this reason, the ZKSwap team has also made a lot of efforts to achieve the GPU version of the PLONK algorithm, which is more than 3x faster than the CPU version. Additionally, we at ZKSwap have invested heavily in high-performance servers specifically for the generation of zero-knowledge proofs. A super large circuit with a scale of 2²⁸ takes less than 2 minutes to generate proof. But due to the limitation of the elliptic curve parameters used by the algorithm, there is an upper limit of transactions and the number of provable proofs in each block, which also sets an upper limit of the system. Despite this constraint, thanks to the ZKSpeed Protocol, the ZKSwap TPS is over 100 in the recent pressure test.

ZKSpeed will next focus on recursive SNARKs. Compared with Aggregative Proofs, recursive SNARKs will not require trusted settings. The number of layer2 blocks that can be verified at one time will be unlimited, only depending on the block time and the speed of proof generation.

ZKSwap System Actual Testing Results

Below is the list of fees corresponding to several commonly used transaction types on ZKSwap compared to that on the Ethereum layer1. See the table for details:

Because the Deposit and Withdrawal involve interactions with layer1, the transaction cost is higher than that of the layer2 transfer and swap. However, regardless of the transaction type, the gas cost of each transaction on ZKSwap is already much lower than that of other products in the industry. ZKSwap, the layer2 dex based on the ZKSpeed Protocol, has achieved fund security, high TPS, and low gas fees with a balanced trade-off of data availability and scalability. The ZKSpeed Protocol is highly practical and presents great technical advantages in real layer2 use cases.

The Vision of the ZKSpeed Protocol

The ZKSpeed layer2 scalability protocol is a ZK-Rollups solution combining practicality and engineering optimization. Through aggregating multiple zero-knowledge proofs, parallel processing of the PLONK algorithm, and the categorization of off-chain data, ZKSpeed greatly improves the TPS of the layer2 system and significantly reduces the gas cost of layer2 transactions.

Compared with other layer2 solutions such as zkSync, Optimistic Rollups, and Plasma, ZKSpeed has made greater breakthroughs in production-ready implementation. ZKSpeed will be the first to support the large-scale deployment of DeFi applications on layer2. For more details of the ZKSpeed Protocol, please stay tuned for the upcoming ZKSpeed technical white paper and demo examples at zkspeed.org.

ZKSwap is a layer2 dex based on the Practical ZK-Rollups — ZKSpeed protocol and using the AMM model.