With Rollups-as-a-Service (RaaS) platforms emerging as the leading infrastructure solution in Web3, more developer teams will inevitable find themselves faced with the difficult, company-defining decision of building their chain on an Optimistic rollup stack (eg. Arbitrum Orbit, OP Stack) vs. a ZK-rollup stack (eg. Polygon CDK, zkSync).

At Caldera, as a Rollups-as-a-Service provider focused on helping teams design, deploy, and scale performant AppRollups, we’re fortunate to have unique insight into this nuanced decision process. So in this post, we’ll break down both sides of the debate so that you, and everyone else interested in launching their own rollup chain, will be able to navigate the decision for yourselves going forward.

A Refresher on Rollups

Before diving deeper into specific comparison points, let’s first establish definitions for Optimistic and ZK-rollups so that we’re all equipped with a solid foundation of understanding. If you're already confident in your knowledge in these concepts, feel free to skip past the next three sections! For the purposes of this piece, we’ll assume you have a basic understanding of Ethereum L2s and appchains.

First off, let’s quickly refresh ourselves on what an Ethereum rollup is. At a high level, a rollup is an approach to scaling Ethereum that involves moving computation and state storage off-chain. Put simply, instead of relying on every Ethereum node to execute every transaction (which is incredibly expensive), rollups execute transactions outside of Ethereum by bundling, or “rolling up”, multiple off-chain transactions together in large batches before submitting them back to Ethereum for settlement. In effect, this approach allows rollups to offer dramatically reduced fees and processing times for end-users, while still inheriting security and objective finality from Ethereum.

This naturally raises the question: if all its transactions are processed off-chain, how is a rollup still validated and secured by Ethereum? Well, that’s where proofs come in. Rollups “prove” their correctness to Ethereum using specialized proofs that allow Ethereum to validate transactions despite not directly executing those transactions. The core difference between Optimistic and ZK-rollups lies in the types of proofs used to accomplish this shared goal. Let’s discuss how they work.

Optimistic Rollups

Under the hood, optimistic rollups accomplish this (and earn their name) by assuming transactions are “good” and valid by default, which means they don't need to publish proofs of validity for transaction batches posted on-chain (a defining feature of ZK-rollups). Instead of validity proofs, optimistic rollups use fraud proofs. In the case of fraud proofs, after a given rollup batch is submitted back to Ethereum from the optimistic rollup, there's a time window (called a challenge period) during which anyone can challenge the results of a rollup transaction by computing a fraud proof. If this fraud proof succeeds in identifying a fraudulent transaction, the transaction is reverted and the sequencer responsible for approving it receives a penalty.

ZK-Rollups

On the other hand, ZK-rollup operators submit a summary of the changes required to represent all the transactions in a batch, along with validity proofs to prove the correctness of those changes in order to successfully update state. In this case, the validity proof is a cryptographic assurance that the state-change proposed by the rollup is truly the result of executing the given batch of transaction”. These validity proofs allow parties to prove the correctness of a statement without revealing the details of the statement itself. As such, ZK-rollups use validity proofs to confirm the correctness of off-chain state transitions without having to re-execute transactions on Ethereum. In practice, this allows ZK-rollups to only send back validity proofs to finalize transactions on Ethereum rather than posting all transaction data back on-chain like optimistic rollups.

Comparing more closely

Great, now that we have definitions out of the way, let’s move on to comparing Optimistic and ZK-rollups more closely along the following axes:

• Cost

• Security

• Speed

• Customizability

• EVM-Compatibility

Cost

Optimistic rollups: Since proofs aren’t required to be submitted for batches of transactions except in the event of a dispute, Optimistic rollups generally only require nodes to execute contract calls, making them quite cheap to operate in comparison to ZK-rollups.

ZK-rollups: For the sake of security, ZK-rollups require each block of data to receive validation in order to ensure correctness, which is accomplished through zero-knowledge validity proofs. Though this leads to larger fixed costs compared to the optimistic alternative, it ensures security effectively through complex cryptographic validity proofs that are computed over each instruction executed.

Security

Optimistic rollups: The fraud proofs that secure optimistic rollups facilitate trustless finality and ensure transaction validity by enabling honest validators to secure the blockchain network. Trustless finality is a quality of optimistic rollups that guarantees that a transaction, assuming it’s valid, will always eventually be confirmed. In practice, this means that even if malicious nodes try to delay the confirmation of a valid rollup block via false challenges, fraud proofs will always eventually prove the rollup block’s validity because the validity of the entire chain relies on (and can function successfully with) the existence of just a single honest node. That honest node can then advance the chain by posting valid assertions and disputing invalid ones, while malicious nodes will lose their stake in the fraud proving process.

ZK-rollups: Instead of depending on honest validators, ZK-rollups use cryptographic validity proofs (or zero-knowledge proofs) to validate transactions. The advantage of these ZK proofs is that they provide sure-fire security guarantees through reliance on cryptographic proofs rather than by human validators. However, as a tradeoff, each of these validity proofs require sophisticated, specialized hardware devices (and/or significant parallelism) to operate, which can lead to issues around centralized control along with notably higher costs.

Speed

Optimistic rollups: In optimistic rollups, the fraud proof mechanism that assumes all transactions are valid allows for minimal overhead and latency around verifying back to the settlement layer. As a result, these rollups provide users fast finality, with guarantees that nobody can revert those transactions The disadvantage that comes along with this mechanism is associated with the 7-day challenge period, as transactions can not be completely finalized on the rollup's base chain until this dispute period is concluded.

ZK-rollups: In theory, the finality of ZK rollups can be nearly instant, as its cryptographic proof does not require a challenge period. As soon as the proof is submitted and validated on-chain, transactions on a ZK-rollup are considered finalized. This enables faster finality, which results in faster bridge withdrawal times.

Customizability

Optimistic rollups: Since optimistic rollups use fraud proofs on WASM / MIPS, developers can easily make modifications to the execution client that are still fraud-provable, which enables smooth support for custom precompiles and powerful tools like Arbitrum stylus (both of which we at Caldera are able integrate for partners building on optimistic rollups).

ZK-rollups: ZK-rollups, on the other hand, must naturally remain efficiently zk-provable, which currently makes it more difficult to add new features to the chain with new ZK circuits requiring significant cryptographic and engineering experience. With that said, there are many strides being made on this front at both zkSync and Polygon.

EVM-Compatibility

Optimistic rollups: Optimistic rollups (both Arbitrum and Optimism) use Go-Ethereum (GETH) under the hood, ensuring full EVM-compatibility, while providing access to Ethereum's robust community / developer tools as well as an easy path to merge in future protocol upgrades to Ethereum. As a result, it's quite easy for app-developers to port Solidity-based smart contracts over to an optimistic rollup, making for a seamless developer experience with a relatively small learning curve.

ZK-rollups: ZK-rollups have a disadvantage in becoming both compatible and comparable to the EVM due to the complexity of implementing the EVM in a zero-knowledge-compatible manner. Some opcodes are inherently difficult to process in the ZK circuit, while other cryptographic primitives and precompiles face incompatibility issues with the zkEVM.

Build your Rollup with Caldera

Hopefully these data points will help you make a more informed decision on which rollup stack makes the most sense for you. And of course, if you’re interested in deploying a custom rollup for yourself and are still unsure about the best path forward, we at Caldera are more than happy to help discuss pros and cons for your specific use-case!