Because of Kevaundray Wedderburn, Alex Stokes, Tim Beiko, Mary Maller, Alexander Hicks, George Kadianakis, Dankrad Feist, and Justin Drake for suggestions and assessment.
Ethereum goes all in on ZK. Ultimately we count on emigrate to utilizing ZK proofs in any respect ranges of the stack, from consensus layer signature aggregation to onchain privateness with shopper facet proving, and improve the protocol to be easier and extra zk-friendly. However step one shall be an L1 zkEVM.
How we will ship an L1 zkEVM in lower than a 12 months
The quickest and most secure strategy to ship an L1 zkEVM is to begin by giving validators the choice to run purchasers that, quite than re-executing execution payloads, statelessly confirm a number of (let’s say three) proofs generated by totally different zkVMs every proving totally different EVM implementations. As a result of proof verification is so quick and proof measurement so succinct, downloading and verifying a number of proofs could be very cheap and permits us to use the identical protection in depth as present shopper range to zkVMs.
For this plan to initially confirm execution proofs offchain, all we want from the protocol is a few type of pipelining in Glamsterdam to permit for extra proving time.
Initially, we count on few validators to run ZK purchasers. Over time, their safety shall be demonstrated in manufacturing. With the EF additionally placing sources into formal verification, specification writing, audits, and bug bounties; we count on adoption will slowly enhance.
When a supermajority of stake is snug operating ZK purchasers, we will enhance the gasoline restrict to a stage that may require validators operating cheap {hardware} to confirm proofs as a substitute of re-executing blocks. As soon as all validators are verifying execution proofs, the identical proofs will also be utilized by an EXECUTE precompile for native zk-rollups.
Defining realtime proving for the L1
Our biggest benefit in executing this plan is the flexibility to harness your complete zkVM trade in direction of making Ethereum by far the most important ZK software on the earth. Many zkVMs are already proving Ethereum blocks and efficiency breakthroughs are being introduced on a weekly foundation.
With the intention to preserve the safety, liveness, and censorship-resistance properties of the L1 the Ethereum Basis is proposing a standardized definition of realtime proving for zkVM groups to work in direction of.
On the proof system facet, zkVMs focusing on realtime proving ought to intention for 128 bits of safety, which we contemplate the precise long-term goal for Ethereum L1. Nonetheless, we’re prepared to just accept a minimal of 100 bits of safety within the preliminary months of deployment, to accommodate short-term engineering challenges in reaching 128 bits. Proof measurement ought to stay beneath 300KiB and should not depend on recursive wrappers that use trusted setups. We count on proof techniques to maneuver to 128-bit safety by the point ZK purchasers are in manufacturing and to additional tighten safety necessities (e.g. relating to conjectures) as proving time decreases.
With the present slot time of 12 seconds and most time to propagate knowledge throughout the community of ~1.5 seconds, realtime means 10 seconds or much less. We count on zkVMs to have the ability to show at the very least 99% of mainnet blocks on this window, with the tail finish (in addition to artificial DOS vectors) mitigated in future laborious forks.
With the intention to preserve the very best ranges of liveness and censorship resistance, our definition of realtime proving goals to allow “house proving” with the concept a number of the solo stakers who presently run validators from house will opt-in to proving. Despite the fact that we count on to harden censorship resistance by means of enforced transaction inclusion earlier than verifying ZK proofs is made necessary, house proving is a vital remaining safeguard.
Since proving within the cloud is already fairly low-cost with multi-GPU spot situations, the main focus for zkVM groups focusing on realtime proving will largely be optimizing for operating provers on-prem the place the specs are way more constrained. On-prem realtime proving ought to require a most capital expenditure of 100k USD (at time of writing it requires ~$80k in stake to run a validator). We count on this to return down over time even because the gasoline restrict is elevated.
Greater than {hardware} price, essentially the most important constraint for house proving utilizing GPUs is vitality utilization. Most residential properties have at the very least 10kW coming into from the road and a few can have circuits meant for electrical home equipment or charging electrical autos with 10kW capability. Subsequently, realtime proving should be potential on {hardware} operating at 10kW or much less.
This brings us to our working definition of realtime proving:
Latency: <= 10s for P99 of mainnet blocksOn-prem CAPEX: <= 100k USDOn-prem energy: <= 10kWCode: Totally open sourceSecurity: >= 128 bitsProof measurement: <= 300KiB with no trusted setups
The race to realtime
Between now and Devconnect Argentina, we hope to see zkVM groups proceed innovating in direction of realtime house proving, and for the main zkVMs to grow to be future core infrastructure for Ethereum.
