As one of the important Layer2 scaling solutions for Ethereum, zero-knowledge rollups (ZK rollups) have continued to heat up this year. Not only is the sector increasingly drawing the attention of the media and VCs, but it also boasts a number of leading projects that are making notable progress day by day, especially in terms of testnets and mainnets.

However, will ZK rollups be the future of rollups? What are the prospects of this segment from an investment perspective? In this report, senior analysts of Bing Ventures will walk you through the background, technical paths, and application scenarios of ZK rollups, as well as analyze for you the major projects one by one to generate thoughts on the sector’s status quo, future trends, and prospects.

Executive Summary

• The current TVL penetration rate of rollups is only 5%, which implies a lot of room for follow-up improvement.

• ZK rollups are superior to Optimistic rollups (OP rollups) in terms of underlying logic, ease of use, privacy transactions, etc. Their current slow pace of expansion is mainly restricted by technological limitations. They are expected to become the mainstream rollup solution in the future.

• The current rollup solutions are highly homogenous. In light of the high migration costs adopters face, ZK rollup operators could achieve differentiation by providing high-quality value-added services ("Rollup as a Service") to application developers to reduce the difficulty of application migration. Of these services, customized solutions will be beneficial for short-term revenue, while SDKs for long-term revenue.

• At present, VCs are quite enthusiastic about the ZK rollup sector, with valuations of the top ZK rollup projects, Starkware and ZKSync, reaching USD8bn and ~USD1bn respectively.

• The author believes that the ZK Rollup technology itself is excellent, but it is not necessarily a good choice from an investment perspective at this stage.

• As ZK rollups have yet to see explosive growth, they still wait to be validated technologically as well as from the value and revenue points of view.

• VC funds usually have duration limits. However, the time it takes for a project to generate returns may be longer. So VCs may not necessarily be willing to bet on these unvalidated technologies, while individual investors are more flexible in this regard.

• Right now, rollups are still in the stage of burning cash for user acquisition. And the majority of ZK rollups have not even come to this stage yet because their core competitiveness is still being developed. Thus, based on their phase of technological development, it's highly risky to invest in a single project.

• Investing in the whole segment may be a sound strategy, but attention should be paid to the impact of valuation levels on subsequent earnings.

Intro to ZKP

What is Zero-Knowledge Proof?

A Zero-Knowledge Proof (ZKP) allows you to prove the truth of a statement without revealing any information related to the statement. It has three basic characteristics:

1. Completeness: If the underlying statement is true, and the prover and verifier act honestly, the proof can be accepted.

2. Soundness: If the statement is invalid, it is theoretically impossible to trick an honest verifier into believing the statement is valid.

3. Zero-knowledge: The verifier learns nothing about a statement beyond its validity or falsity. The mathematical workings behind ZKP are extremely complex, so we will only introduce its most basic features here to help readers understand the discussion below.

The core of the ZKP algorithms lies in：

1. Reducing complex problems into simple validations: • Mathematically, when checking whether two vectors X: (x1, x2,...) and Y: (y1, y2,...) are equal, it is necessary to compare each component one by one (x1 == y1?, x2 == y2?, ...), which is highly time-consuming. • With ZKPs, it's not necessary to check whether two vectors are equal. Instead, you only need to check whether two polynomials are equal (Q (X, s) == Q (Y, s)?, s is a random number), which only requires calculating the polynomials' value at a few sample points and therefore is substantially easier.

2. Ensuring that the verifier cannot obtain any information related to the statement itself by using elliptic curve cryptography algorithms, regardless of whether the statement is right or wrong.

zk-SNARK

SNARK: Succinct Non-interactive Argument of Knowledge

• Succinct: The proof is smaller and can be verified quickly.

• Non-interactive: Little or no interaction is required between the prover and verifier, which only interact once during the proof generation, submission, and verification processes.

• Argument: It can resist the attack of a prover with limited computing power. The encryption algorithm used to generate the proof is complex enough that it cannot be brute-force cracked within acceptable time and economic cost under the existing computing power conditions.

• Of Knowledge: Without knowing what to prove, it is impossible to construct a proof.

zk-STARK

STARK: Scalable Transparent Argument of Knowledge

• Scalable: Developers can perform calculations and store data off-chain to exponentially improve scalability. Zero-knowledge proofs are used to verify these off-chain activities and submitted on-chain to interested parties for verification.

• Transparent: ZK-STARK relies on publicly verifiable randomness to generate public parameters for proving and verification instead of a trusted setup. That's the biggest difference between ZK-STARK and ZK-SNARK.

Application Scenarios for ZKPs

All on-chain data is publicly visible. Being able to prove the authenticity of a statement without revealing the content of the statement, ZKPs are powerful in that they can be used for real-world problems such as privacy protection, the design of sensitive systems or contracts, etc.

The two main features of ZKP, zero knowledge and integrity, can, respectively, solve two pain points in the development of blockchain.

• Zero-knowledge: The consensus mechanisms of blockchains require that everything on-chain should be open to the public and transparent, which makes privacy protection an issue.

• Integrity: Verifications are necessary for the decentralized nature of blockchains. However, they have also become a major hindrance to performance. Thus, lightweight proofs are in high demand. Based on these features, the two major use cases of ZKPs at this stage are privacy protection and ZK Rollup.

Privacy Protection

Blockchain sacrifices user privacy for the transparency of transactions. While the real entities using the on-chain accounts are anonymous, the transaction data of their accounts is almost completely transparent. That means, if intended, people can easily track these transactions. But most users are actually unwilling to be tracked.

• A typical case is 3AC, who confidently disclosed some of their addresses, in order to prove their superb trading skills and enhance their reputation to facilitate fundraising.

• However, in the Luna incident, some short sellers tracked these addresses and did opposite transactions. In this way, they accelerated the formation of bigger selling orders and eventually expedited the liquidation of 3AC.

At present, most solutions use this technology to encrypt users' transaction information to protect user privacy. In the future, we expect more innovative solutions to appear, such as combining ZKP with blockchain games to turn complete information games into incomplete information games for improved playability.

Digital currency with privacy features: ZCash

ZCash was announced in 2013 with the core technical team from MIT. The ZCash blockchain, ZChain was launched in October 2016 together with the issuance of the ZCash coin (ZEC). ZEC's design essentially copies BTC. It uses a PoW mechanism and has a total amount of 21mn. ZEC's current market cap is ~USD59bn.

It uses ZKP technology to hide transaction addresses, thereby concealing the sender and receiver of funds and protecting user privacy.

In 2020, it was decided that 20% of the ZEC networks' mining rewards would be distributed to the ZCash Foundation for running the project. But some participants were discontented with this and they created a fork of the chain, ZCL.

Privacy-protective coin mixing protocol: Tornado Cash

Tornado Cash started testnet testing in December 2019 and officially launched in December 2021. It is a coin mixer that allows users to deposit supported assets (ETH, DAI, USDC, and other ERC-20 tokens) and withdraw them from a different crypto address. It encrypts the depositor's wallet address using ZK technology, and mixes it with those of other users depositing in the same token, making it difficult for the outside world to track the whereabouts of the fund.

It got deployed on Ethereum, BSC, Polygon, and the Optimism Network. Before it was sanctioned, there had already been ~USD8bn that went through Tornado Cash.

• On August 8, 2022, the Office of Foreign Assets Control (OFAC, under the United States Department of the Treasury) blacklisted Tornado Cash, announcing that it is illegal for US citizens, residents, and companies to receive or send funds through the service. Meanwhile, the US Treasury Department accused it of laundering more than USD7bn in virtual currency, USD455mn of which is believed to have been stolen by the hacking group Lazarus Group supported by DPRK.

• On August 10, 2022, Tornado Cash developer Alexey Pertsev was arrested in Amsterdam on charges of "involvement in concealing criminal financial flows with the decentralized mixer on Ethereum Tornado Cash and facilitating money laundering through the mixing of cryptocurrency."

Sensitive Information Disclosure

The FTX incident reinforced distrust in CEXes. To rebuild market confidence, it is necessary that CEXes disclose their assets in a more transparent way than before. However, this brings privacy issues, since many users and institutions do not want their account balances to be public.

Vitalik Buterin pointed out that, CEXes can store all user balances in Merkle trees or KZG commitments, and use ZK-SNARK to prove that all balances are non-negative and add up to the total deposit value claimed by the exchange, which not only protects user privacy but also effectively discloses the status of assets.

ZK Rollup

Simply put, ZK rollups can be used to scale the Ethereum mainnet by ensuring consensus between the mainnet and the rollup chain using ZKPs. The ZKPs are generated to validate the transactions on the rollup chain. They are sent to the Ethereum mainnet and validated by pre-deployed smart contracts on Layer1.

ZK Rollup

What's Rollup?

In short, rollups are Layer2 scaling solutions that solve the congestion problem of Ethereum by increasing throughput, reducing gas costs, and optimizing application efficiency.

The Necessity of Scaling Ethereum

The current capacities of the Ethereum mainnet cannot meet the ever-increasing demand. It is reflected in the aspects below.

• Limited block size: The gas fee for each Ethereum block is about certain. A block will be entirely written after this amount of gas is spent. The target size of each block is 1.5m gas, the maximum is 3m gas. With the minimum gas payment per transaction standing at 21k gas, each Ethereum block can contain approximately 70~140 transactions.

• Long transaction time: The average block interval is ~12s, with an average of 10-15 transactions per second. From the user's perspective, it takes between 15 seconds and 5 minutes to process a transaction.

• High transaction fees: Cost per transaction (Gas) = Gas unit (21k) * (basic fee + priority fee), the latter is the price of each unit of Gas. According to YCharts, the average daily gas price was 22Gwei (~0.7USD) recently. And the gas price reached as high as 475Gwei (~14.5USD) on May 1, 2022.

Scaling solutions

The three ideal properties of blockchain are decentralization, security, and scalability, but a basic blockchain architecture can only achieve two of them (the impossible triangle). Ethereum chose decentralization and security, resulting in low scalability because:

• Decentralization requires that every node on the network must verify transactions, and the more nodes involved in verification, the higher the security.

• If you want to improve the scalability of the Ethereum mainnet, its decentralization and security will be hurt, no matter if you approach the problem from which of the above three aspects, namely block size, block interval, and transaction fees. That is, whether you increase the block size, reduce transaction time, or lower gas fees, you will hurt the morale of miners, resulting in a reduction in the number of nodes and thus making Ethereum less decentralized and secure.

Therefore, under the premise of Ethereum's adherence to decentralization and security, improving its performance needs to start at a higher level. Currently, major solutions can be divided into two categories: on-chain and off-chain scaling.

• On-chain scaling (Layer1 scaling): Changing the scalability of the Ethereum mainnet protocol, including changing the consensus mechanism (PoW -> PoS), sharding, expanding the block size, etc. Layer 1 scaling requires the consent of all nodes, which can cause a lot of trouble. In many cases, not all network users will agree to such a change. This may lead to community division or even a hard fork.

• Off-chain scaling: Moving transactions to chains that are implemented separately from the Ethereum mainnet, without changing the existing Ethereum protocol. There are 2 kinds of off-chain scaling solutions nowadays: sidechains and Layer2.

Sidechains

Sidechains are blockchains that run independently, in parallel with the Ethereum mainnet, and are connected to the Ethereum mainnet via cross-chain bridges.

In general, sidechains sacrifice decentralization and security to some extent to improve transaction speed. Most sidechains are compatible with EVM. So developers can use sidechains to explore and test features and use cases that are not available on the mainnet.

However, as sidechains have their own consensus mechanism, they cannot inherit the security properties from Ethereum.

Major projects include Polygon, Gnosis Chain, Skale, Palm, and Ronin.

Layer2

Layer2 solutions reduce the resource occupation on Layer1 through off-chain calculation/execution & returning results to the main chain, offline batch processing of data, etc., but still obtain security directly from the Ethereum Layer1 consensus.

Different Layer2 solutions find different balances between security, scalability, decentralization, and generality.

Introduction to Layer2 solutions

Currently, major Layer2 solutions include:

State Channels

How it works:

• Users pledge tokens on L1 to lock an initial state, move subsequent transactions off-chain to be processed, and upload the final state to L1 after completion.

• There will be a one-week-long fraud proof period on L1 on the submitted results. All the previous offchain operations need to have signatures from both parties + timestamps. If a challenger provides evidence that contains a valid signature and the timestamp is newer, L1 will deem the user fraudulent and deduct the token pledged by the user.

Pros: low transaction costs, strong privacy, suitable for high-frequency micropayment.

Cons: withdrawals are slow (at least a week); owners need to be 100% online; it does not support smart contracts.

Major projects: BTC Lightening Network

Compared to other solutions, state channels focus more on security than performance improvement.

Plasma

How it works:

• Similar to the sidechains, Plasma uses a separate blockchain.

• Users execute transactions off-chain but send the state root (Merkel root) to the Ethereum mainnet where the settlement is done.

• The Merkel root makes it easy to verify that a small piece of data is part of a larger dataset, so the authenticity of the transaction can be confirmed by verifying the Merkel root on the mainnet, allowing the Plasma chain to inherit part of the security of the mainnet.

• However, since Plasma does not upload complete transaction information to the mainnet, transactions are not verified by all the mainnet nodes by calculating the Merkel root.

• When users request withdrawals from the Plasma chain, they will need to undergo a week-long fraud test.

Pros: high throughput, low transaction costs

Cons: slow withdrawals, little support for smart contracts

Major projects: OMG Foundation (converted to BOBA, OP Rollup), Polygon (converted to sidechain).

In theory, the Plasma chain could have subchains that form L3 or L4, but it seems that the effect will not be good at present.

Validium

How it works:

• Validium chains are standalone blockchains. They use cryptographic algorithms (such as ZKP) to pack data into packets and send them to the main Layer1 chain where smart contracts are deployed to verify the authenticity of the received data.

• Users execute transactions off-chain but send the state root (Merkel root) to the Ethereum mainnet along with the proof of validity, and the smart contract deployed on the mainnet automatically verifies the authenticity of the proof of validity. If the proof is valid, the mainnet updates the verified state and finally determines the transaction result in the batch.

• Funds belonging to Validium users are controlled by smart contracts on the mainnet. Once the proof of the validity of the withdrawal request is verified on the mainnet, the user can withdraw money, without the need to delay withdraws and wait for fraud-proof like Plasma.

Pros:

• Mandatory verification of the integrity of off-chain transactions through proof of validity.

• Improve the efficiency of users' funds (without delaying the withdrawal of funds back to Ethereum).

• A high degree of privacy and suitability for blockchain applications that prioritize privacy (such as confidential transactions, chain games, etc.).

Cons:

• Proofs of validity require specialized hardware to generate, which increases the cost of running a node and is not conducive to decentralization.

• Low compatibility with EVM. It requires specialized languages to develop applications on the Validium chain. So, migrating existing applications will mean a lot of work.

• Generating a validity proof requires a large amount of computation, resulting in higher off-chain gas costs than other optimistical solutions like sidechain, plasma, and OP Rollup.

Rollups

How it works:

• In rollups, not only will the state root be sent to the Ethereum main chain, but the transaction data will also be sent in compressed forms with 1/10 the size of the original forms.

• At present, there are 2 major rollup solutions: OP Rollup and ZK Rollup.

OP Rollups

OP rollups are similar to Plasma. They both suppose the off-chain transaction is valid, and instead of uploading the proof of the validity of the transaction, fraud-proof is used to detect the incorrect calculation of the transaction.

The difference is: Plasma keeps all transaction data and calculations off-chain, only uploading the Merkel root, while OP Rollup keeps some data on the Ethereum blockchain. As a result, all Ethereum nodes can verify the transactions on the rollup chain rather than just nodes participating in the rollup chain. The obvious benefits are enhanced security and avoidance of centralization.

OP rollups are generally well-compatible with EVM, so migrating existing Ethereum applications to OP rollups requires almost no new coding.

ZK Rollups

ZK rollups are similar to Validium. They both upload proof of the validity of each transaction. The smart contract deployed on the Ethereum main chain confirms the transaction by verifying ZK proofs.

The difference is: Validium only sends the state root to the main chain, not the state data itself, which makes its security completely dependent on proof of validity. So, if something goes wrong with Validium's operator, users may not be able to withdraw money from contracts on the Ethereum main chain. To solve this problem, Validium protocols propose a Data Availability Committee (DAC) mechanism, which allows some large entities to store copies of state and provide data when users need it (for example, to generate Merkle proofs for withdrawal requests). But in essence, it is similar to the consortium chain and is less decentralized. However, in ZK rollups, the state data itself will be sent to the Ethereum main chain together with proof of validity. Therefore, the ZK chain's state can be tracked on the main chain by verifying the validity of the state data.

Horizontal comparison of scaling solutions

The below table shows a horizontal comparison of the above-mentioned scaling solutions.

ZK Rollup Sector Analysis

Working Mechanism

1. Users deposit money into the ZK rollup chain by locking assets in the contract on the mainnet.

2. The user creates a transaction and sends the transaction content to the relayers.

3. Before accepting the transaction, the relayer verifies the legitimacy of the transaction (whether the user has enough money, etc.).

4. After collecting enough transactions, the relayer will sort the transactions (first in, first out), execute the transactions, update the Layer2 state, package and compress the data, and generate a ZK proof. Then upload the compressed data and ZK proof to the rollup contract on the Ethereum main chain as a batch.

5. After receiving the batch, contracts on the main chain: • Confirm the format of the content in the batch, and reject content that does not meet the format. • Check if the previous state root in the batch matches its contract's current state root (ensure block order). • Verify the uploaded zero-knowledge proof to ensure the correctness of the proof. • If the verification is passed, replace the current state root with the post-state root in the batch.

Business Model

1. Gas Fee： • Revenue: Charge apps and users on the ZK rollup for off-chain transaction gas fee • COGS (Direct cost for revenue): Pay a gas fee to Ethereum Layer1, and pay mining reward to ZK miners who provide hashrate for generating ZK proofs.

2. ZK rollup solution customization: • Revenue: Provide customized solutions to applications seeking deployment on ZK rollups, and charge service fees. • COGS (Direct cost for revenue): R&D cost, intangible asset amortization, ...

Market size evaluation

Key assumptions:

1. Referring to StarkEx's 2021 revenue, customization revenue is set at USD55mn. Considering dYdX ending cooperation with Starkware, the 2022 revenue is discounted.

2. Annual Gas Fee Revenue = Gas Fee Per Transaction * Transaction Num, Transaction Num = Total TPS of all ZK Rollup Chains * Annual Transaction Time

The calculation result is as below:

ZK rollup technology is still in its early stages. It is expected that the scale of the ZK Rollup operators' annual revenue will reach the level of USD1~10bn.

The development of ZK rollups faces high uncertainty. As a technology that has yet to see explosive growth, they still wait to be validated technologically as well as from the value and revenue points of view. And it is difficult to predict the annual growth rate. So, the evaluation above will only be referable in terms of the order of magnitude.

Competition Landscape

Based on statistics of L2Beat, the current market share breakdown of the rollup sector by TVL is as follows (assuming that the TVL outside Arbitrum and Optimism belongs to ZK rollups).

OP rollups currently occupy the majority share of the TVL, ~ 80%.

At present, the ZK rollups sector is very concentrated with several large projects occupying ~ 99% of the market share. It is mainly due to Starkware's dependence on several large customers of their StarkEx products, which creates dominance at first sight:

• StarkEx uses zk-STARK technology and allows for interactive proofs and easier application migration than other projects using zk-SNARK.

• StarkEx provides a higher level of customization. By offering customized rollup solutions to well-known projects such as dYdX and Immutable X, StarkEx improved its own influence.

• StarkEx has high customer concentration with dYdX accounting for more than 75% of the TVL.

• However, the stickiness of these large applications is poor. For example, for dYdX, using StarkEx is only a stopgap measure, and it is ready to move to Cosmos at the end of 2022, which will have a great impact on Starkware's short-term performance and market share.

• StarkNet, the open-source ZK Rollup built by Starkware, has little TVL now, only USD3mn.

It is expected that after dYdX leaves Starkware, the competition landscape of ZK rollup will change greatly.

Different Technical Paths

Data Availability of SNARKs/STARKs

The chart below categorizes the existing larger ZK rollup projects according to whether SNARK or STARK technology is used, and whether data is available on the Ethereum main chain.

Compatibility with EVM

Vitalik divides the existing ZK EVM/rollup solutions on the market into five categories according to the level of EVM compatibility from high to low.

Different types of ZK EVMs have different performances. Generally speaking, the better the compatibility with Ethereum/EVMs, the easier the design and refactoring process will be when mitigating apps to the ZK rollup chain, but the more difficult it is to generate ZK proofs later.

ZK Rollup Development Trends

The current TVL penetration rate of rollups is only 5%, which implies a lot of room for follow-up improvement.

Rollup TVL had explosive growth in 2020, peaking at $7.5 billion.

Now rollup TVL is at $4.3 billion, accounting for~ 5% of the total market capitalization of cryptocurrency, with a low penetration rate and a lot of room for improvement.

Rollups enjoy the highest correlation with Ethereum in terms of security among all Layer2 solutions. And the level of security is also higher than sidechains and new public chains. With equal or better performance, rollups are poised to become the dominant scaling solution for Ethereum.

Technical Paths of Rollups: OP enjoys short-term hype, while ZK is set for the long-term win

The following chart compares OP/ZK rollups on the key issues affecting the usability of scaling solutions:

At present, most of the existing rollup solutions are OP rollups. From the TVL perspective, the proportion is OP: ZK = 8:2.

Mainstream voices, including Vitalik Buterin, believe OP rollups are better choices for the short term as they have a lower barrier in terms of cost and technology, and are easier for developers to get started. Therefore, they are more suited for the current stage. On the contrary, ZK rollups have a higher development barrier and are more suitable for areas with higher demand for security and privacy. In the long run, with the continuous development of ZK-related technologies, the limitations of ZK rollups may be addressed, enabling them to unleash stronger potential.

The author basically agrees with the above point of view and believes that the reasons behind ZK rollup's superiority include the following.

ZK rollups outperform OP rollups in security

OP rollups rely on the counterbalance among honest players, verifiers, counterfeiters, and other participants for security, while ZK rollups rely on the mathematical mechanisms provided by the ZK algorithms for security. The ZK rollups' approach is more rigorous and secure.

Compared with OP rollups' flowed security logic, ZK rollups' weaknesses are basically technical ones. With a large number of excellent R&D personnel involved in research, we believe these problems will be solved.

ZK rollups enable short withdrawal time, which is more suitable for user habits

With OP rollups, users need to delay withdrawals for a week from requesting. This is inherently unintuitive, just like complex mnemonic words and long strings of private keys. Institutional investors have stronger liquidity, so they have a higher tolerance for this. But individual users will be much more sensitive about this.

On the contrary, ZK rollup allows users to withdraw money immediately when they want. This suits the usage habits of Web2 users better and is conducive to possible mass adoption in the future.

ZK rollups have larger potential in private transactions

As aforementioned, traders have the need for private transactions. In the current ZK rollup solutions, ZKP algorisms are mainly used to generate validity proofs for off-chain translations. There have yet emerged solutions that look to encrypt transactions. Indeed, to compete with other scaling solutions, ZK rollups are preoccupied with reducing the size of proofs because generating proofs requires a lot of computation and is limiting their performances. Therefore, at present, private transactions are not a focus.

However, as the token price falls and Ethereum converts to PoS, it is expected that a large amount of hash power will be turned into idle due to the revenue falling below the cost. At this time, if ZK rollups can harness this part of the hash power, the current limitation on performance will be greatly alleviated. At that time, ZK rollup projects will be able to incorporate private transactions into the existing ecosystems to create new growth points relying on their high familiarity with ZK encryption algorithms.

Therefore, it is believed that with the improvement in ease of use brought by technological progress, ZK rollups will replace OP rollups and become the mainstream of rollup solutions.

Differentiated Competition: Rollup as A Service capability is the key

Current mainstream rollup solutions, both OP and ZK, are highly homogenetic technologically.

In terms of OP rollups, the techniques applied by the top 2 OP rollup projects Arbitrum and Optimism are not very different in nature.

• There are differences in the fraud-proof verification process (Arbitrum relies on multiple rounds of off-chain fraud proofs, while Optimism uses a single round of fraud-proof on L1).

• Optimism uses Ethereum's virtual machine (EVM), while Arbitrum uses its own virtual machine (AVM), so Optimism only has a solidity compilation, while Arbitrum supports all EVM Compilation languages (Vyper, Yul, etc.).

Among ZK rollup projects, there is little difference in how they implement the rollups, apart from whether they choose to adopt zk-STARK or zk-SNARK. They all generate ZKPs for transaction data and send them to the main chain for verification. The major difference only lies in their compatibility with EVM.

So, against this backdrop, the competition in the L2 space is intense. Whoever can take the lead in grabbing the majority of users has the opportunity to generate the best attraction to applications, and become the largest liquidity pool for some tokens, thereby attracting more users, and then profiting from the network effect and defeating other opponents.

Most of the current projects are still trying to acquire users with large-scale airdrops. This competition is no different from that in the cash-burning stage in Web2. Essentially, it is difficult to continue forever and cannot build high barriers. Users attracted by your airdrop today can also be snatched away by other projects' larger airdrops tomorrow.

However, technological homogeneity does not translate to service homogeneity. Projects can provide a range of various added services ("Rollup as a service") to onboarded applications apart from the rollup platform, such as:

• Customized solutions (eg. StarkWare)

• Technical support (eg. ZKSync, Polygon Hermez)

• Financial support (eg. Polygon Hermez)

The author thinks that among the various RaaS services:

• In the short term, providing **customized solutions **is most effective for income growth. For example, customizing a ZK rollup chain to optimize specific characteristics for applications (such as Starkware built individual StarkEx chains for dYdX and other projects).

• In the medium to long term, providing support for software development offers more sustainable value, such as providing developers with a useful SDK (Software Development Kit).

Due to the higher difficulty of software development on ZK rollups, it is easier to build barriers in this regard with ZK rollups than with OP rollups. Since Ethereum is not ZK-friendly, migrating EVM applications to ZK EVM requires a particularly heavy amount of code restructuring, causing inconvenience to developers and reducing their willingness to use ZK rollups.

• In the short term, ZK rollup projects can provide customized solutions for applications based on their high familiarity with ZK development, eliminating some of their workloads, thereby attracting applications to get onboard and charging service fees, such as Starkware's StarkEx products.

• In the long run, ZK Rollup projects can standardize the solution, provide developers with SDKs for developing applications on ZK rollups freely, and preferably enable developers to write programs on ZK rollups in the language they are familiar with, reducing the developers' re-learning cost, which is conducive to attracting more developers to settle in and accelerating the construction of the ecosystem. The following figure shows the main differences between the ZK Rollup project coding and Ethereum. Most projects use Solidity to give developers a familiar development environment, but there are differences in bytecode and virtual machine compatibility.

Therefore, when evaluating ZK rollup project, in addition to focusing on the compatibility with EVM and its existing ecosystem, investors can further focus on the attractiveness of rollups' additional services to users, which may be the key to determining whether projects can win out in the future.

However, providing additional services to facilitate application migration is based on the poor compatibility of zkEVM and Ethereum EVM. With the advancement of ZK technology, in the long run, if the gap between the two is gradually narrowed, the value of additional services will continue to decrease. Therefore, when analyzing independent third-party ZK rollup SDK providers (like Stackr Network, a start-up project), investors should focus more on their revenue sustainability.

Representative Project Introduction

Starkware

Starkware was founded in 2018. One of the leaders of their technical team was Alessandro Chiesa, co-founder of Zcash. The team proposed a new scalable ZKP algorithm zk-STARK, which is mainly dedicated to providing solutions for blockchain scaling and privacy protection.

The main product is StarkEx, which is a hybrid L2 solution that is compatible with both ZK rollups and Validium, and users can switch freely between them. Applications that have been deployed now include dYdX (will move to Cosmos later), Immutable, rhino.fi, etc.

Meanwhile, the team is developing a new product, StarkNet, an open-source ZK Rollup chain, in which any user and developer can deploy smart contracts without Starkware's permission.

TVL：USD573mn（StarkEx USD534mn + StarkNet USD3mn）。

The latest valuation was USD8bn, and historical investors include Sequoia, Paradigm, Alameda Research and 3AC.

ZKSync（Matter Labs）

Analyzed as a key project below.

Loopring

Founded in 2017, Loopring is the first team in the world to implement ZK rollups. Using ZK-SNARK technology, it provides developers with an open-source ZK rollup protocol, and developers can use it to establish a decentralized exchange based on order books.

Also, the project has established a self-operated decentralized exchange and wallet on Loopring ZK rollup, hoping to build a more complete self-operated Defi ecosystem in the future.

TVL: USD83mn

Project token ($LRC) market cap: USD307mn, historical investors include Kosmos Ventures, China Growth Capital, etc.

Aztec

Aztec was founded in 2017, originally with a focus on privacy. It used ZK-SNARK to provide users with a privacy cross-chain bridge Aztec Connect, allowing users to privately access dApps on Ethereum.

In addition to serving the Web3 field, it also cooperates with traditional financial institutions such as JP Morgan to provide ZK encryption solutions to solve privacy protection problems in private settlements.

In March 2021, it launched its own ZK rollup, zk.money.

TVL: USD8mn (Aztec Connect USD6mn + other Aztec products USD2mn)

The latest valuation was not disclosed but was expected to be USD68~102mn. The total amount of financing was USD17mn. Historical investors include Paradigm, Coinbase Ventures, IOSG etc.

Polygon Hermez

Hermez Network started as an independent Defi company. It now has two generations of products:

• The 1.0 version, released in March 2021, is a payment platform that is operating today.

• The 2.0 version is under development. The team is using zk-SNARK to develop ZK virtual machines and ZK verification smart contracts to be deployed on the Ethereum mainnet.

The project established the "proof of donation" mechanism. In each period, everyone bids to obtain the right to create the next block, and 40% of the bidding income will be used to reinvest in the on-chain dapps to accelerate ecosystem development.

TVL: USD324k

Hermez was acquired by Polygon for USD250mn in August 2021, who fully integrated Hermez Network into the Polygon ecosystem.

Scroll

Scroll was founded in early 2021. The core founders are from Peking University, Tsinghua Yao Class, and Cambridge.

The team's goal is to develop a class 2 ZKVM (fully equivalent to the EVM), in close cooperation with the Ethereum Foundation. Early testing of ZK Rollup and zk-EVM launched in July 2022.

The latest round valuation was undisclosed, while the total amount of financing reached USD33mn (Serie A 30mn + Angel 3mn), with historical investors including Polychain Capital, Bain Capital Crypto, Robot Ventures, Geometry DAO, and some Ethereum Foundation members.

Key project analysis: ZKSync (Matter Labs)

Project History

Developed by Matter Labs, ZKSync 1.0 was released on the Ethereum mainnet in June 2020, with an embedded trading platform (Zigzag) that provides users with functions such as transferring and minting NFTs.

Its zkEVM started public testing in February 2022, which is the first EVM equivalent zkVM in terms of programming languages. It is under optimization with an objective to support 99% of the smart contracts written in Solidity.

ZKSync 2.0 Baby Alpha version was released on October 28, 2022, with the built-in zkEVM Alpha version. It will open to applications in their ecosystem for deployment, including browsers, new cross-chain bridges, wallets, etc.

According to the latest announcement of Matter Labs on December 23, 2022, ZKSync 2.0 will enter its Fair Launch Alpha phase in 2023Q1, opening up to dApp developers for deployment so that they can test and upgrade their contracts. The period is expected to last for several months. The full alpha version of ZKSync 2.0 will be launched in 2023Q2 when it will be available to common users.

Main products

TVL：USD85mn（ZKSync USD50mn + ZKSpace USD35mn）

ZKSync 1.0: a zk-SNARK-based ZK rollup, mainly used for token exchange and transfer and does not support smart contracts. Due to the lack of smart contract support, the adoption rate of ZKSync 1.0 was poor compared to other generic Layer2 solutions.

ZKSync 2.0: a ZK rollup with built-in zkEVM, supports smart contracts, and allows users to develop dApps.

ZKSpace: an AMM DEX based on the ZKSwap protocol on ZKSync.

ZK Porter: a new L2 solution developed by ZKSync where users can choose to store data off-chain and enjoys a security level between that of ZK rollups and Validium and per transaction gas fees of only a few cents.

Hyperlink: the L3 solution under development, which aims to improve interoperability among different L2 chains and is expected to be released in 2023Q1.

Potential growth points

On customization, ZKSync has deep cooperation with well-known Defi dApps such as Uniswap, Maker, and 1inch. In the future, it can charge service fees and improve short-term income by providing solutions specifically optimized for these applications.

As for gas fees, with these applications getting onboard on ZKSync, they will bring a lot of transaction volume and gas fee revenue, and increase ZKSync's sustainable revenue.

Tokenomics

zkSync hasn't issued tokens yet. Matter Labs once promised to publish their tokenomics proposal in early November, but it was delayed until now.

Historical Financing

Layer3 Introduction

Weaknesses of Layer2

Returning to the blockchain trilemma discussed earlier -- decentralization, security, and scalability. Although Ethereum abandoned scalability on Layer1, it has achieved de facto scalability through various Layer2 scaling solutions  (sidechains, Layer2, etc.) by moving most of the transactions off the main chain.

It now appears that L2 solutions will increase in number, and these projects with different technical paths will coexist for a long time.

But these L2 solutions are quite isolated. It is difficult to migrate applications between different chains. This will pose problems for Ethereum and these various solutions.

Liquidity Fragmentation

In the short to medium term, the crypto market is limited in size. Different chains are splitting the market and their interoperability is poor. As a result, liquidity on each chain will be fragmented, resulting in problems such as trading difficulties and slippage.

For example, AMM Uniswap and SushiSwap are both on Ethereum, but they are both working to implement on separate Layer2 chains (Optimism and Polygon). Therefore, to transfer ERC-20 tokens from Uniswap's L2 to SushiSwap L2, the user must transfer his tokens from Optimism to the Ethereum main chain and then to Polygon. This inefficient process results in higher costs and longer processing times, which can sometimes take several days due to some Layer2 protocols requiring fraud proof to complete transactions.

Communication Difficulties

Different side chains and Layer2 chains have different consensus and validity verification mechanisms. Relatively speaking, OP rollups, Plasma, and some performance-focused sidechains almost copied EVM, so it is relatively easier to process data packs sent by other chains, while ZK rollups, Validium, and other privacy-focused sidechains lower EVM compatibility. Also, there exists quite a difference between virtual machines developed by different chains. The data packets they send may be difficult for other chains to process, making cross-chain communication difficult.

Low Contract Standardization

Each new protocol built on Ethereum has high standardization (such as ERC-20, ERC-721, ERC1155...), and other protocols can be easily built on top of them, which is one of the reasons for the rapid development of DeFi. But as various scaling solutions, especially ZK-based scaling solutions, gradually diverge from Ethereum's architecture, the contract standards between different chains will also diverge, making it difficult to migrate applications between chains.

Low Composability

Low composability is a problem resulting from communication difficulties and low contract standardization. It is mainly reflected in the interaction between dApps on the Ethereum main chain and other scaling chains. If the communication difficulties and low contract standardization problem cannot be solved well, dApps need to re-establish their own ecosystem on different scaling chains, which will cause a greater waste of resources.

Under the influence of these factors, the lack of interoperability between different blockchains and layer 2 solutions has resulted in highly fragmented user experiences, which could seriously hinder the large-scale adoption of blockchain technology.

Layer3 Concept

The "Layer3" concept was proposed to solve the interoperability problem between Layer1 and Layer2, and different Layer2 chains**.**

• By definition, interoperability (or cross-chain functionality) means that two blockchains with separate ecosystems (like Bitcoin and Ethereum) can communicate and interact without any centralized intermediaries.

  The relationship between Layer3 and Layer2 is very different from that between Layer2 and Layer1. (Researches show that stacking the same scaling solution to form a three-tier structure often does not work well.) Instead of compressing and moving data across, Layer3 offers more innovative functions.

• Layer2 for scaling, Layer3 for customized features (e.g. privacy):  Adopting different layers to meet the custom requirements of different use cases.

• L2 for generic expansion, L3 for customizable expansion: Customized scaling can come in different forms: specialized applications that are computed using virtual machines other than EVMs, rollups that are optimized for the data formats of specific applications, etc.

• L2 for trustless extension (rollups), Layer3 for weak trust extension (Validium): As mentioned earlier, Validium is a system that uses SNARK to validate computations, but leaves data availability to trusted third parties or committees. Vitalik believes that Validium is highly undervalued. He believes that many "enterprise blockchain" applications are best served by a centralized server that runs a Validium prover and periodically submits hash value to the main chain, which is less secure but much cheaper.

ZKSync and Layer3

The ZKSync team has conducted research in Layer3. They believe that Layer3 will become a customizable ecosystem powered by zkEVM, which will be infinitely scalable through unlimited customization, and will improve security, performance, cost reduction, ease of programming, and composability compared to current L2 solutions.

ZKSync's Layer3 project, HyperLink, will launch its testnet in 2023Q1. At that time, developers can choose ZK rollups, ZK Porter, and Validium according to their preferences on performance, security, and cost. They also provide developers with other customization options, such as:

• Customizable completely private solutions: dApps can choose to privately store and circulate all the data (for example, store the data offline).

• dApps can publish separate tokens in Layer3 to build their economic systems.

• Replacing 3rd-party cross-chain bridges with ZKSync's own cross-chain bridge to improve the security of dApps on ZKSync Layer2 and Layer3.

Currently, in addition to ZKSync, there are also several other L3 projects developing interoperability protocols to connect different L2 chains, such as Interledger Protocol, IBC Protocol, Quant, and ICON. However, most of these projects are still at the theoretical stage.

References:

https://www.realvision.com/blog/ethereum-scalability

https://education.district0x.io/general-topics/ethereum-scaling/introduction-to-ethereum-scaling/

https://ethereum.org/en/layer-2/

https://ethereum.org/en/developers/docs/scaling/sidechains/

https://ethereum.org/en/developers/docs/scaling/state-channels/

https://blog.matter-labs.io/zksync-l3-pathfinder-to-hit-testnet-in-q1-2023-367a425592db

https://trends.aax.com/layer-3-solutions-on-bitcoin-blockchain

https://vitalik.eth.limo/general/2022/09/17/layer_3.html

https://blog.hermez.io/introducing-proof-of-donation/

https://vitalik.eth.limo/general/2022/08/04/zkevm.html

https://medium.com/coinmonks/easy-to-understand-ethereum-layer-2-scaling-solutions-channels-vs-plasma-vs-rollups-1dc1d4e9cb52