Layer 2: Optimistic Rollups vs ZK Rollups
Optimistic or ZK rollups, blobs, sequencers, withdrawal delays, L2BEAT stages: understand how Ethereum's layer 2s work and what their risks are.
The essentials
This guide is general information and is not investment advice. The networks mentioned are given as illustrations.
Why layer 2s exist
Ethereum, the "layer 1" (L1), processes on the order of 15 transactions per second on its main chain according to ethereum.org. When demand exceeds this capacity, users compete for space in blocks and fees ("gas") rise.
This problem is often described with the blockchain trilemma: it is hard to achieve decentralization, security and throughput all at once. Simply increasing block size would make nodes more expensive to run, and therefore the network less decentralized.
The approach taken by the Ethereum ecosystem is to keep a robust layer 1 and move transaction execution to layer 2s. ethereum.org defines a layer 2 as a separate blockchain that extends Ethereum and inherits its security guarantees.
The principle of a rollup
A rollup bundles hundreds of transactions executed on the L2 into a single batch, published on Ethereum. The cost of this publication is shared among all users in the batch, hence lower costs per transaction.
The rollup publishes two types of information on Ethereum:
- Transaction data (in compressed form): it lets anyone reconstruct the L2's state, meaning balances and contract state, without trusting the operator. This is called data availability.
- A commitment to the new state (a "state root," a cryptographic summary of all balances): it serves as a reference for the rollup contract deployed on Ethereum, which handles deposits and withdrawals in particular.
As ethereum.org sums it up, once the data is published on layer 1, reversing a rollup transaction would require reversing Ethereum itself.
One question remains: how does the contract on Ethereum know the new state root is correct, when it hasn't executed the transactions? This is where the two families diverge.
Blobs: EIP-4844
For a long time, rollups published their data in the calldata field of Ethereum transactions, a space that is stored permanently and therefore expensive.
The EIP-4844 proposal (known as "proto-danksharding") introduced blob-carrying transactions. A blob is a large packet of data (128 KB, or 4,096 elements of 32 bytes) attached to a block, but which smart contracts cannot access directly: only a cryptographic commitment (KZG type) is readable by the EVM.
Three characteristics matter:
- A separate fee market: blobs have their own price, adjusted to demand, independent of regular gas.
- Limited retention: nodes are only required to keep blobs for about 18 days (4,096 epochs). That is enough for anyone to verify the data and challenge a batch, without durably burdening nodes.
- A capped capacity: the initial specification targeted 3 blobs per block on average, with a maximum of 6. These parameters may change with network upgrades.
The EIP presents this mechanism as a significant but temporary relief for rollups, pending more complete scaling solutions. Today, rollups can publish their data as calldata or as blobs.
Optimistic rollups
The principle: presumed valid
An optimistic rollup publishes its batches assuming they are correct, without providing a proof. Hence the name "optimistic."
Security relies on fraud proofs (also called fault proofs): during a challenge period, any authorized participant who observes an incorrect batch can challenge it. ethereum.org describes a multi-round interactive proof system: the challenger and the batch's author progressively narrow their disagreement down to a single computation step, which the contract on Ethereum verifies itself. If fraud is established, the batch is reverted.
In theory, a single honest actor watching the network is enough to guarantee security, provided the data is available and that kind of actor has the right to challenge.
The consequence: about 7 days to withdraw
As long as the challenge period isn't over, a batch isn't final from Ethereum's point of view. To withdraw funds from an optimistic rollup to Ethereum via the official bridge, you have to wait for the end of this period, one week according to ethereum.org.
To avoid this wait, there are fast withdrawals: a liquidity provider pays you immediately on Ethereum, for a fee, and then collects your pending withdrawal. This introduces an additional intermediary to assess.
Transfers from Ethereum to the L2 (deposits) don't face this wait.
Examples often cited of optimistic rollups: Arbitrum One, OP Mainnet, Base.
ZK rollups
The principle: proven valid
A ZK rollup (zero-knowledge) accompanies each batch with a validity proof: a cryptographic proof that the new state root really results from the correct execution of the transactions. The contract on Ethereum verifies this proof; if it is invalid, the batch is rejected.
Two main families of proofs are used:
- SNARK: compact proofs that are quick to verify, but most variants require an initial "ceremony" (trusted setup). ethereum.org specifies that if the secret information from this ceremony were compromised, fake proofs could be produced.
- STARK: no initial ceremony and supposed resistance to quantum computers, but larger proofs, hence more expensive to verify on Ethereum.
Advantages and trade-offs
- No challenge period: according to ethereum.org, withdrawals are executed as soon as the contract has verified the validity proof. The practical delay then depends on how often the operator publishes proofs.
- A significant computation cost: generating proofs takes a lot of power, and verifying them on Ethereum costs on the order of 500,000 units of gas per batch according to ethereum.org. These costs are passed on to fees.
- EVM compatibility is harder: proving the execution of any Ethereum smart contract is complex. zkEVM projects aim to reproduce the EVM within proof circuits.
Examples often cited of ZK rollups: ZKsync Era, Starknet, Linea, Scroll.
Quick comparison
| Criterion | Optimistic rollup | ZK rollup |
|---|---|---|
| Batch validity | Presumed, challengeable | Proven for each batch |
| Withdrawal to Ethereum (official bridge) | About 7 days | After the proof is verified |
| Main cost | Data publication | Data + proof generation |
The sequencer, a central point to know
In most rollups, an actor called the sequencer receives users' transactions, decides their order, produces the L2's blocks and publishes the batches on Ethereum. Today, this sequencer is often single and operated by the project's team.
Consequences:
- The sequencer can order transactions as it pleases, and in theory censor certain users.
- If it goes down, the network can be slowed or interrupted.
To limit the risk of censorship, ethereum.org describes a forced inclusion mechanism: the user can submit their transaction directly on Ethereum, and the sequencer must include it within a given time. The existence and terms of this mechanism vary by project.
L2BEAT's decentralization stages
L2BEAT is an independent site that analyzes layer 2s, and ethereum.org points to it for assessing each project's risks. Its "Stages" framework, introduced in 2023, classifies rollups according to the level of "training wheels" they retain, meaning centralized human control.
- Stage 0: the basic requirements of a rollup are met (state roots and data published on Ethereum, software allowing the state to be reconstructed), but the operator keeps extensive control.
- Stage 1: a functioning proof system is in place, users can exit without the operator's cooperation, and indefinitely blocking withdrawals requires compromising a large majority of a security council (a multisig of several members, partly external). Upgrades not decided by this council must give users at least 7 days to exit.
- Stage 2: the proof system is open to everyone without permission, users have at least 30 days to exit in case of an unwanted upgrade, and the security council can only intervene on objectively detectable errors.
A project's stage changes over time: check L2BEAT directly rather than relying on old information.
Risks to keep in mind
- Upgradable contracts: a rollup's contracts on Ethereum can often be upgraded. If the upgrade is immediate, those who control it could in theory change the rules, including those for withdrawals. Hence the importance of the "exit window" measured by L2BEAT.
- Centralized sequencer: risk of censorship and downtime.
- Restricted or absent proofs: an optimistic rollup where only a few authorized actors can challenge offers fewer guarantees.
- Bugs: proof systems are complex and recent. ethereum.org reminds us that many layer 2s are still young and partly experimental.
- Third-party bridges: using an unofficial bridge or a fast-withdrawal provider adds counterparty risk.
A concrete example
You have 0.5 ETH on an optimistic rollup and want to get it back on Ethereum.
- Via the official bridge: you initiate the withdrawal on the L2. The batch containing your transaction is published on Ethereum. You wait for the end of the challenge period, about 7 days, then finalize the withdrawal with a transaction on Ethereum, which costs L1 gas fees.
- Via a fast-withdrawal service: you receive your ETH on Ethereum in a few minutes, paying a fee. You then depend on that service.
On a ZK rollup, the same withdrawal via the official bridge has no challenge period: it becomes executable once the batch's proof is verified on Ethereum.
Before using an L2, you can check its L2BEAT page: stage, type of proofs, time to exit in case of an upgrade, how the sequencer works.
Mistakes to avoid
- Believing all L2s have Ethereum's security: it depends on the proofs, upgrade rights and the sequencer.
- Confusing a rollup with a sidechain: a sidechain has its own consensus and doesn't necessarily publish its data on Ethereum.
- Being surprised by the 7-day delay of an official withdrawal from an optimistic rollup: plan for it.
- Sending funds to the wrong network: the same address can exist on Ethereum and on several L2s, but balances are separate. Check the network selected in your wallet and on the platform.
- Using an unknown bridge found through an ad or a message: it's a frequent scam vector.
- Relying on an old L2BEAT stage: it can change, in either direction.
Key takeaways
- A rollup executes transactions outside Ethereum, then publishes the data and a commitment to the new state there, which reduces the fee per transaction.
- Since EIP-4844, rollups can publish their data in blobs, which are cheaper and kept for about 18 days.
- Optimistic rollup: batches presumed valid, challengeable by fraud proof, official withdrawal to Ethereum in about 7 days.
- ZK rollup: each batch comes with a validity proof verified on Ethereum, with no challenge period, but with a high computation cost.
- The sequencer, often centralized, and upgradable contracts are the main trust points; L2BEAT's stages help assess them.