In August of 2023, we released Zeth, an open-source ZK block prover for Ethereum built on the RISC Zero zkVM, and committed ourselves to the Optimism Foundation’s mission to bring ZK to the OP Stack.
Today, we’re proud to announce that Zeth now supports the ability to build and derive OP Mainnet blocks from the Ethereum mainnet in zero knowledge and verify those proofs on-chain. Like the first release, the second is built on the power of pre-existing revm, alloy, ethers crates, and their support for the OP Stack.
This release marks the fully open-source release of new Zeth features and serves as a reminder of how far the RISC Zero zkVM and Bonsai service have advanced.
The original goal for Zeth was to preserve the Ethereum layer-one in open-source, ethically homegrown ZK in a way that allows applicability to OP Mainnet’s EVM-based second-layer solution.
Soon after the release of our core continuations technology (which allows the RISC Zero zkVM to produce short proofs for arbitrarily long computations), we set our sights on the Optimism Foundation’s request for proposals. We produced the initial Zeth prototype and continued to refine the zkVM to push the bar of applicability, cost-effectiveness, and performance.
Throughout this journey, Zeth was the first functional Type-1 zkEVM to see the light of day, surpassing all performance expectations. We augmented our proving system with composition, a generalized form of recursion that unlocks limitless possibilities inside the RISC Zero zkVM.
With the zkVM redefining the scaling limits of existing zero-knowledge tools, we took on the challenges of deriving and building blocks to produce a solution that can be used to redefine the fraud-proving process on OP Mainnet. The elegance of OP Mainnet is to run the EVM optimistically within the EVM itself, ensuring a smooth and transferable experience for Ethereum developers.
In this article, we look at how the RISC Zero zkVM achieves EVM inception on OP Mainnet and reliably consecrates the OP Stack data availability mechanism in zero-knowledge.
To build a block, one executes a batch of transactions on top of a previous block.
In the Ethereum layer-one (L1) blockchain, a “proposer” is anointed every block by the powers of consensus through Proof-of-Stake to determine this batch of transactions for the entire network. OP Mainnet is an Optimistic Rollup, a layer-two (L2) network designed to scale Ethereum by offloading transaction computation responsibilities and freeing up resources.
In Optimism, this is done by ensuring all transactions are live, in a compressed format, and on an Ethereum contract that can be read by anyone, at any time. This yields consensus in the L2 on the “true” sequence of transactions and provides the rollup with a reliable data-availability (DA) mechanism that intertwines the existence of the OP Stack Chain with that of Ethereum.
Interacting with this DA contract to derive the true OP Stack Chain falls beyond the scope of the Type-1 zkEVM definition. It is a process specifically designed to secure OP Mainnet using Ethereum. Consequently, this process is carried out natively by Optimism nodes outside the EVM, except when it comes to executing the derived transactions. This means that even if you can enshrine the EVM in ZK, you still need a reliable way to further consecrate subprotocols that build on Ethereum.
We’ve augmented Zeth to do just that.
The Core Development team has fully implemented the OP Stack DA mechanism (or derivation process) in the zkVM using continuations and composition as our bedrock. This is crucial for resolving disputes on the correctness of the transactions executed in the L2, and disputes which transactions should comprise the true OP Stack Chain. This expands ZK-backed possibilities across the Superchain ecosystem, including the potential introduction of a much more simplified fraud-proving process and full-validity proofs.
For all potential intent and purposes, Zeth also supports stand-alone OP block-building mode. If your development needs are purely on OP Mainnet, this is probably what you’re looking for.
Securing composed proofs required some care. Unlike in continuations, when using composition, one has to be careful when composing several independent proofs together because continuity is not verified for free in this case.
Consider a simple composition proof that takes two state transition proofs, one proving that it is possible to go from state “A” to state “B,” and one from state “B” to state “C,” and yields a proof that it is possible to go from state “A” to state “C.” The logic of this composition must ensure that the transitions it stitches together are continuous (i.e. the first proof ends in “B,” and the second proof starts from “B”) to remain sound.
Similarly, we had to ensure that when composing two (or more) derivation proofs together, these proofs yield logically sequential Optimism blocks and are derived using the same sequence of Ethereum blocks. This second requirement is quite subtle and arises mainly due to the resilient nature of the way Optimism data is posted to Ethereum.
Accordingly, we designed a simple composer that validates the last read Ethereum block of every composed derivation proof belongs to a single Merkle tree that commits to the continuous sequence of all Ethereum blocks scanned for L2 data during derivation. Because of the many subtleties in the OP derivation process, we determined this an efficient way to compose derivation proofs.
In our first article on Zeth, we shared some exciting numbers for our zkVM’s performance.
At the time, we constructed proofs for computations worth billions of cycles, which was more than enough to build verifiable Ethereum blocks. To satisfy our proposal criteria, we had to prove computations much larger than before: 10 distinct Optimism epochs, and one continuous segment of at least 180 blocks.
The largest proof we had previously published was just north of 9.5 billion cycles. For Optimism, we composed a single proof from a large set of proofs that attest to computations worth just shy of 190 billion, stressing Bonsai 20 times harder than ever before.
The stats on the proofs we generated can be found below, and are live on Sepolia.
When we released the zkVM back in early 2022, we strongly believed that the general-purpose approach to ZK would win due to the benefits of writing code instead of circuits. That belief was affirmed when we released Zeth in 2023.
Since then, we’ve seen this thesis spread like wildfire. What was once an absurd proposition is now rightly seen as the obvious solution. Maybe custom circuits make sense if your logic is simple enough and unlikely to require much maintenance. But for everything else, the benefits to engineering velocity and code reuse provided by a fully-featured zkVM are too great to ignore. This project was no exception.
As part of this work, we had to add support to Zeth for Optimism’s L1 → L2 Derivation Process (i.e the process that governs the construction of new OP blocks based on data published to the Ethereum). This process is complex. It involves scanning every Ethereum block, looking for data from the Op sequencer, decompressing that data and maintaining state machines for channels and frames. Implementing this as a custom circuit would have been a monumental undertaking; implementing it in Rust, on the other hand, was a walk in the park.
This work does more than validate our thesis about general-purpose zkVMs. It also shows a path towards simpler fault proofs for the OP ecosystem, and eventually full validity proofs.
This is explained particularly well by Cem Özer, who described the concept in the context of the Sovereign SDK as follows:
This means the delay period could be dropped from days to hours (see timing info here). And as proving gets faster, those delays could go from hours to minutes, and eventually be dropped altogether in favor of full ZK validity proofs.
We are excited by the Optimism Foundation’s progress in this direction and look forward to participating in future ZK work in the Optimism ecosystem!
