Overview: Achieving Bytecode-Level EVM Equivalence with Zero-Knowledge Proofs
Layer 2 scaling architectures for Ethereum have historically bifurcated into two primary paradigms: optimistic rollups, which rely on economic fault proofs and multi-day challenge windows, and zero-knowledge rollups (ZK-rollups), which utilize succinct cryptographic proofs to establish instantaneous mathematical finality on Ethereum Layer 1. Within the ZK-rollup domain, engineering teams face a fundamental trade-off between prover efficiency and EVM compatibility. Early zero-knowledge architectures, such as Starknet with Cairo or early iterations of zkSync, opted for language-level or VM-level transpilation. By executing on an algebraic, ZK-optimized virtual machine and translating Solidity code into custom intermediate representations, these networks achieved faster proving cycles at the cost of breaking direct compatibility with Ethereum bytecode, tooling, and low-level opcode semantics.
Scroll was engineered to eliminate this fragmentation by pursuing true bytecode-level EVM equivalence (classified as a Type 2 / Type 2.5 zkEVM in Vitalik Buterin's taxonomy). Founded by Sandy Peng, Ye Zhang, and Haichen Shen in close collaboration with the Ethereum Foundation's Privacy and Scaling Explorations (PSE) group, Scroll verifies native EVM execution traces directly at the opcode level. Smart contracts deployed on Ethereum mainnet can be deployed to Scroll without modifying a single line of Solidity code, recompiling through custom toolchains, or auditing transpiled intermediate representations. Developers interact with the network using standard JSON-RPC APIs, Ethereum development frameworks (Foundry, Hardhat), and production client tooling without behavioral divergence.
However, proving the native EVM within zero-knowledge circuits represents one of the most demanding computational challenges in computer science. The original EVM specification, finalized in the 2015 Yellow Paper, was designed without algebraic proof systems in mind. The EVM operates on native 256-bit word sizes, relies on non-algebraic cryptographic primitives such as Keccak-256 and SHA-256, incorporates irregular gas accounting, and features dynamic execution flows with arbitrary memory expansions and jump destinations. Scroll resolves these computational barriers through a hierarchical zero-knowledge proving architecture, hardware-accelerated proving nodes, and a two-tier proof aggregation pipeline.
The Hierarchical Zero-Knowledge Proving System
Rather than attempting to encode the entire state transition of the Ethereum Virtual Machine into a single, monolithic arithmetic circuit (which would exceed hardware memory limits and produce unmanageable proving times), Scroll decomposes the EVM into specialized, modular sub-circuits implemented in the Halo2 proving framework over the BN254 (alt_bn128) elliptic curve.
Decomposing the EVM into Specialized Cryptographic Circuits
The Scroll zkEVM architecture divides transaction execution into dedicated cryptographic modules, each tailored to prove a specific domain of the virtual machine:
- EVM Circuit: The central state machine circuit. It models the core execution flow of each opcode, tracking the program counter (PC), call depth, execution gas counters, stack pointers, and opcode state transitions. It validates that every opcode executes in strict adherence to the Ethereum specification.
- State / RAM Circuit: Proves the correctness of read and write access to transient execution memory, the operand stack, and contract storage slots. Because memory operations occur non-deterministically across execution steps, the State Circuit uses multiset equality checks and permutation arguments to sort memory accesses by address and timestamp, mathematically proving that no unauthorized read or uncommitted write occurred.
- Bytecode Circuit: Enforces that the contract bytecode executed by the EVM circuit matches the actual deployed bytecode stored on-chain. It prevents malicious execution flows where an adversary could attempt to execute arbitrary uncommitted instructions.
- Storage Circuit (MPT Circuit): Verifies all updates and queries against the global state tree. While Ethereum Layer 1 uses a Keccak-based Merkle Patricia Trie (MPT), computing Keccak hashes inside ZK circuits is computationally expensive. Scroll's MPT circuit validates state trie transitions and account storage slots using algebraic-friendly cryptographic constructions.
- Specialized Precompile and Hash Circuits: Dedicated sub-circuits engineered to verify cryptographic hash functions (Keccak-256, SHA-256) and elliptic curve operations (ECDSA secp256k1 signature verification) independently from general opcode arithmetic.
Global Lookup Tables and Permutation Arguments
A primary architectural breakthrough in Scroll's design is the use of cross-circuit lookup arguments. In Halo2, custom gates and lookup tables allow one circuit to look up values verified by another circuit. For instance, when an opcode in the EVM Circuit executes a Keccak-256 hash operation, the EVM circuit does not compute the algebraic constraints of the hash inline. Instead, it writes the input string and output digest into a dedicated bus table.
The specialized Keccak Circuit independently verifies the full mathematical execution of the hash function and exposes its results in a corresponding lookup table. Global copy constraints and multiset permutation arguments bind these tables together. If any execution trace in the EVM circuit claims a hash result that does not exist in the certified Keccak table, the global proof polynomial cannot be satisfied, causing proof generation to fail deterministically.
Two-Tier Proof Aggregation: From Chunks to Batches to Bundles
Generating a zero-knowledge proof for a single Ethereum block can consume significant GPU computing capacity. Submitting an individual zero-knowledge proof for every single block directly to Ethereum Layer 1 would result in unsustainable L1 gas expenditure, completely undermining the cost-efficiency of Layer 2 scaling. Scroll implements a hierarchical two-tier proof aggregation pipeline to maximize throughput and minimize on-chain verification overhead.
The Execution and Proving Hierarchy
Scroll organizes transaction processing across four structured abstractions:
- Block: A standard collection of consecutive EVM transactions bundled and executed by the Scroll sequencer, updating the local Layer 2 state.
- Chunk: A contiguous sequence of consecutive blocks. The chunk boundary is dynamically determined by the sequencer based on accumulated execution steps, ensuring that the total gas and circuit constraint count fits within the physical memory limits of a single prover node.
- Batch: A sequence of contiguous chunks. Multiple chunk proofs are gathered by the coordinator and fed into an aggregation circuit to create a single aggregated validity proof for the entire batch.
- Bundle: A high-level grouping across multiple batches, allowing the protocol to compress multiple batch proofs into a single on-chain transaction when Ethereum Layer 1 gas prices are elevated.
Recursive SNARK Verification and the Aggregation Circuit
In the first tier, independent prover nodes (Rollers) generate a chunk proof using the core zkEVM circuits. This chunk proof mathematically proves that every transaction in the chunk executed correctly and that the resulting post-chunk state root is valid.
In the second tier, an Aggregation Circuit takes multiple chunk proofs as inputs. Utilizing recursive SNARK composition, the aggregation circuit verifies the validity of each chunk proof within an algebraic circuit. It recursively folds the polynomial commitment checks and pairing evaluations into a single, compact aggregate SNARK proof. When this final aggregate proof is submitted to the ScrollChain verifier contract on Ethereum, the Ethereum Virtual Machine executes a single cryptographic pairing check using the ECPAIRING precompile (address 0x08). This constant-time pairing verification consumes approximately 250,000 to 300,000 gas on Layer 1, regardless of whether the underlying batch contains ten transactions or ten thousand transactions.
The Roller Network: Decentralized Prover Architecture and Hardware Economics
A critical architectural vulnerability across many production ZK-rollups is the reliance on a single, centralized proving cluster operated exclusively by the protocol foundation. If the centralized prover experiences hardware failure, network outages, or regulatory coercion, the rollup loses the ability to finalize state transitions on Ethereum. Scroll designed the Roller Network to establish a permissionless, distributed prover ecosystem.
Roles in the Proving Pipeline: Coordinator and Rollers
The Roller Network decouples proof coordination from proof computation:
- Prover Coordinator: The orchestration service that acts as the bridge between the sequencer and the prover network. When a new chunk or batch is constructed, the coordinator receives the execution traces from the sequencer, broadcasts proof generation tasks to registered Rollers, monitors task deadlines, and handles failovers if a node fails to deliver a proof within the target time window.
- Rollers (Prover Nodes): Independent hardware operators who register with the network by locking collateral. Rollers download execution traces from the coordinator, run the traces through local zkEVM witness generators, construct arithmetic constraint matrices, and compute the mathematical proofs.
Hardware Acceleration: Multi-Scalar Multiplication and NTT Optimization
Generating zero-knowledge proofs is overwhelmingly dominated by two mathematical operations: Multi-Scalar Multiplication (MSM) over elliptic curve points, and Number-Theoretic Transforms (NTT) for polynomial interpolation. These operations account for over 85% of total proof generation time. To achieve practical proving latencies, Rollers employ specialized hardware acceleration configurations:
- GPU Acceleration: Production Rollers utilize enterprise-grade GPU clusters (such as NVIDIA A100, H100, and RTX 4090 configurations) executing custom CUDA and OpenCL kernels optimized for low-latency MSM and NTT computation.
- FPGA and ASIC Pipelines: Advanced hardware operators develop custom field-programmable gate arrays (FPGAs) that pipeline finite field arithmetic, delivering higher energy efficiency and lower cost per proof than general-purpose server hardware.
The Three-Stage L1 Settlement Pipeline: Commit, Prove, Finalize
Scroll coordinates state transitions between Layer 2 and Layer 1 through a deterministic three-stage pipeline implemented in smart contracts on Ethereum mainnet.
Phase 1: Batch Commitment and Calldata / Blob Dissemination
The sequencer bundles consecutive chunks into a batch and calls the commitBatch function on the L1 ScrollChain contract. This transaction submits the transaction data or state differences to Ethereum to guarantee data availability. With the introduction of Ethereum's Dencun upgrade and EIP-4844, Scroll posts transaction payloads as ephemeral data blobs rather than permanent contract calldata. At this stage, the batch is committed to L1 history, meaning transactions cannot be retroactively reordered or hidden, but the validity of the execution has not yet been cryptographically verified.
Phase 2: Decentralized Proof Generation and Collation
Once the batch is committed, the Prover Coordinator assigns chunk tasks to Rollers across the network. Rollers generate the chunk proofs in parallel and return the cryptographic proofs to the coordinator. The coordinator then feeds the verified chunk proofs into the Aggregation Circuit, producing the single consolidated batch proof.
Phase 3: L1 State Finalization and ECPAIRING Verification
The operator calls the finalizeBatchWithProof function on the ScrollChain contract, passing the aggregated SNARK proof, the previous finalized state root, and the new post-execution state root. The contract forwards the proof and public inputs to the on-chain ZK verifier contract. The verifier checks:
- That the public input hash matches the committed batch data on L1.
- That the recursive proof aggregation correctly links the continuous chain of state roots.
- That the elliptic curve pairing equation holds true.
When the pairing verification confirms the validity of the proof, the state root is updated in the contract storage. Transactions within the batch achieve irreversible, trustless settlement secured by the full economic consensus of Ethereum Layer 1.
Economic Scaling and EIP-4844 Blob Space Integration
The operational cost structure of a zero-knowledge rollup is governed by three primary variables: the cost of Layer 1 data availability, the gas cost of Layer 1 proof verification, and off-chain prover hardware electricity and depreciation expenses.
Prior to EIP-4844, data availability dominated over 80% of total rollup operational costs, as posting transaction data via standard Ethereum calldata cost 16 gas per non-zero byte. By integrating EIP-4844 blob space, Scroll isolates transaction data dissemination into dedicated 128 KB data blobs that automatically prune after approximately 18 days. This architectural migration reduced the L1 data cost by over 90%, enabling sub-cent user transaction fees on Layer 2 while maintaining full cryptographic validity and state reconstruction guarantees.
Critical Vulnerabilities, Security Assumptions, and Architectural Trade-Offs
A rigorous engineering analysis of Scroll requires an objective assessment of the operational trust assumptions, economic bottlenecks, and failure modes present in the system.
Sequencer Centralization and L1 Force-Inclusion Mechanics
Like the vast majority of active Layer 2 rollups, Scroll currently operates a centralized sequencer controlled by the core foundation. While the sequencer cannot steal user funds (because it cannot forge valid zero-knowledge proofs for unauthorized state transitions), a centralized sequencer presents censorship risks and single-point-of-failure vulnerabilities. If the sequencer goes offline, L2 block production halts. To mitigate this risk, Scroll is designing a forced-transaction inclusion mechanism on Ethereum Layer 1, allowing users to bypass a censoring sequencer by queueing deposits or withdrawals directly through the L1 smart contract.
Prover Hardware Capital Intensity and Latency-Gas Trade-Offs
While the Roller Network is designed for decentralized participation, the intense computational requirements of Halo2 zkEVM circuits create natural capital concentration. Proving a single chunk requires top-tier GPUs with substantial VRAM. Smaller node operators who cannot afford enterprise hardware arrays face economic exclusion. Furthermore, because proof generation requires several minutes of compute per chunk, there is an inherent latency window between when a transaction receives "soft confirmation" from the L2 sequencer (sub-second) and when it receives mathematically irreversible L1 settlement (often 20 to 60 minutes, depending on batch accumulation intervals).
Soundness and Completeness in High-Complexity ZK Circuits
The primary existential risk of any bytecode-equivalent zkEVM is the presence of circuit bugs. Translating the entire EVM opcode specification into hundreds of thousands of polynomial constraints carries immense mathematical complexity. If a circuit contains an under-constrained variable (a soundness bug), an attacker could theoretically construct a mathematically valid proof for an invalid state transition, such as minting tokens out of thin air. Conversely, if a constraint is over-constrained (a completeness bug), valid transactions could trigger proof generation failures, halting the settlement pipeline. Scroll addresses this risk through extensive multi-firm security audits, formal verification of critical circuit modules, bug bounty programs, and dual-prover research.
Upgradeability Timelocks and Security Council Governance
The core contracts of Scroll on Ethereum (including the ScrollChain rollup contract and the ZK verifier addresses) are proxy contracts upgradeable by a multi-signature wallet administered by a Security Council. While a multi-day timelock prevents unexpected immediate code updates under normal operations, an emergency execution path exists for zero-day response. Users and decentralized applications must recognize that during the early maturity phases of the protocol, governance participants retain administrative upgrade authority.
Conclusion
Scroll achieves an important milestone in Ethereum scaling by delivering native bytecode-level EVM equivalence backed by rigorous zero-knowledge mathematics. By decomposing the complex execution rules of the EVM into modular arithmetic circuits, leveraging cross-circuit lookup arguments, and aggregating chunk proofs into compact batch SNARKs, Scroll reconciles developer convenience with cryptographic finality. Supported by the decentralized Roller Network and modern EIP-4844 data availability economics, Scroll establishes a durable, open-source Layer 2 foundation designed to scale decentralized applications without sacrificing Ethereum's foundational security guarantees.
