A decade after the first block was generated on July 30, 2015, Ethereum’s roadmap has a renewed sense of direction and purpose.
Sure, the recent price increase helps a lot, but after years of mucking around with scaling via L2s, the Ethereum L1 finally has a credible path to maximal scaling while preserving maximal decentralization.
The TL;DR is that the gas limit and transactions per second (TPS) will increase multiple times a year from here on out. Validators will switch from reexecuting transactions to simply verifying zero-knowledge (ZK) proofs, enabling the base layer to hit 10,000 transactions per second.
The L2s will scale up in concert to process hundreds of thousands, if not millions of TPS, and a new type of L2 called “native rollups” will act like programmable shards of a unified blockchain offering the same security as the base layer.
While these proposals are yet to be signed off on by the governance processes, they build on ideas Ethereum creator Vitalik Buterin began exploring in 2017 and are being championed by high-profile Ethereum Foundation researcher Justin Drake. At EthCC earlier this month, Drake said:
“We’re at this inflection point for Ethereum scaling. And in particular, I have conviction that we will enter a gigagas era for the L1…. that’s roughly 10,000 TPS. And the key unlock for the gigagas era is zkEVMs and real time proving.”
Drake wants the ecosystem to hit 10 million TPS within 10 years, and no single blockchain can achieve that level of throughput. That means that horizontal scaling, using a “network of networks” — each L2 with different use cases, tradeoffs and benefits — is the only way to scale the ecosystem to the needs of the entire world.
(Jump straight to the zkEVM roadmap to 10K TPS explainer if you are already familiar with the background and rationale.)
Why has Ethereum L1 been unable to scale?
While other blockchains use greater hardware and computing power to scale up throughput, Ethereum has always had an ideological, some would say utopian, fixation on decentralization.
From the point of view of ETH maxis, “data center chains” like Solana have multimillion-dollar centralized points of failure that a government could target to censor transactions. Even chains with lower hardware specs, like Sui, have prohibitive costs and bandwidth requirements that impact decentralization.
Ethereum can run on a bunch of Raspberry Pis. These low specs enable “home stakers” to participate in a network of 15,000-16,000 public nodes and 1 million validators. As a result, it’s almost impossible to censor transactions and the network is resilient against attacks. Even after 50%-70% of the network complied with US government sanctions on Tornado Cash, the little guys kept confirming those transactions.
The trade-off is the network is very slow and currently processes around 18-20 transactions per second compared to Solana’s 1,500 TPS.
Blockchains are horribly inefficient by design — a bit like a Google spreadsheet that makes every computer with a copy recalculate the figures before updating a cell.
“They basically want anyone to be able to keep up with the chain and reexecute the transactions,” explains Uma Roy, co-founder of ZK-proofs specialist Succinct Labs. “That means that you can’t just have an arbitrarily high amount of transactions because there’s overhead from this reexecution.”
The inability to scale the L1 enough while preserving decentralization forced Ethereum to adopt the much criticized L2 roadmap in 2020.
Zero-knowledge proofs solve blockchain trilemma
Buterin coined the phrase the “blockchain trilemma” to describe how difficult it is to achieve security, scalability and decentralization all at once in a blockchain network. Every scaling proposal worked on any two of the three properties, but came at the cost of the third.
Until now.
Zero-knowledge proofs, which Drake aptly describes as “moon math,” are able to prove mathematically that a bunch of complicated transactions have been performed correctly without revealing what those transactions are.
While generating a proof is difficult, verifying it’s correct is fast and easy.
So, instead of getting a bunch of underpowered Raspberry Pis to laboriously reexecute every single transaction, the plan is to get those validators to just check the math in a tiny ZK-proof.
“Instead of having people reexecute stuff, you just give them a proof that something happened,” explains Roy. “And now anyone can verify the proof, and they don’t have to redo the computation.”
Forget Raspberry Pis — Drake claims that even a $7 Raspberry Pi Pico, which has less than one-10th of the computing power of its elder sibling, could validate ZK-proofs.
Ethereum’s zkEVM roadmap to 10,000 TPS, explained
The Ethereum Foundation’s Sophia Gold caused a lot of excitement with her recent blog announcing that a ZK-powered Ethereum Virtual Machine (zkEVM) could be added to the L1 within the space of a year.
Interestingly, the L2s have been pioneering a lot of the practical work on ZK technology, Linea, which spun out of Ethereum co-founder Joe Lubin’s Consensys.
Linea is a ZK EVM that’s 100% compatible with the current EVM, so anything that works on Ethereum works exactly the same on Linea. It sees itself as an extension of Ethereum and has just announced it will burn 20% of its ETH transaction fees to support L1 value accrual.
Declan Fox, head of Linea, explains that ZK tech solves the blockchain trilemma.
“It allows us to increase the gas limit on the L1 by orders of magnitude, as the magic of ZK is that the computation can scale without increasing the complexity of verification,” he says. “As ZK proving latency and cost continues to improve, we can process more throughput whilst keeping verification available to simple hardware, even such as a smartwatch.”
Don’t get too excited because the plan to integrate a ZK EVM in the space of a year is not going to enable 10,000 TPS on day one.
Slowly, slowly and then all at once
Ethereum has five major software clients that can be used to run the network, meaning that if one fails, the network doesn’t shut down, as has happened on Solana.
The transition plan will see two or three adapted clients released allowing validators to switch to checking ZK-proofs rather than reexecuting transactions. Only a few validators will do so initially until the bugs are ironed out.
“Transitioning to a snarkified EVM is going to be a gradual process,” explains Ladislaus from the Ethereum Foundation’s Protocol Coordination team . (“Snarkified” refers to SNARKs, which are the type of ZK-proof used.)
“Users will primarily and gradually notice a difference in the form of higher gas limits allowing for higher economic activity on L1.”
While the transition to ZK-proofs will take time, the L1 gas limit looks set to scale massively in the meantime. Last week, the gas limit jumped 22% to 45 million, and researcher Dankrad Feist has proposed an EIP that would see clients automatically raise the gas limit three times a year. After four years, the network would be running at 2,000 TPS. Drake has proposed extending this another two years to get to 1 gigagas and 10,000 TPS in total by 2031.
What is real-time proving, and why is it important to Ethereum?
An essential part of the plan is achieving “real-time proving.”
That’s “the idea that you can prove Ethereum mainnet blocks in less than 12 seconds,” explains Roy.
“Once you have the ability to prove blocks in real-time, Ethereum can start using this in their protocol and then they can scale the gas limit basically arbitrarily without sacrificing verifiability.”
While 12 seconds is the length of a block, even real-time proving requires some change to the protocol. Ladislaus explains that next year’s Glamsterdam update is likely to include upgrades that “decouple block validation from immediate execution” in order to give provers “almost a full slot worth of time to craft a zkEVM proof.”
Succinct is on the verge of achieving the milestone. Back in May, it unveiled the SP1 Hypercube zkVM, which was able to prove 93% of 10,000 mainnet blocks in real time, using a 200-GPU cluster.
Roy says the project is on track to prove 99% of blocks within 12 seconds by the end of the year. While “prover killers” will probably mean the occasional proof won’t be generated in time, she says there are workarounds the protocol could build in, such as “skipping that block and moving to the next one.”
Complicating matters, another EIP that could be included in Glamsterdam would cut block times to six seconds. This would mean quicker confirmations and a better experience for L1 users, but makes the task twice as difficult for provers. But Roy isn’t too worried.
“Even if they halve the block time, it’ll be okay because basically every year, ZK has gotten 10x more performance,” she says.
In June, Linea announced it was now able to prove 100% of activity on the network with ZK-proofs. Linea has two-second block times, runs at two TPS at present (due to demand rather than capacity) and sends its proofs through to custom verifier smart contacts on the L1. So, while it’s not an exact match, it’s foreshadowing how snarkification of the L1 could work in practice.
Hardware requirements for Ethereum provers outlined
The foundation is targeting tech specs for provers that include hardware costs under $100,000 and the use of less than 10 kilowatts of electricity — similar to the power draw of a Tesla wall battery.
Cyber Capital founder and ETH skeptic Justin Bons criticized these as “insane hardware requirements for provers, way beyond that of even SOL validators…”
But Bons is comparing apples with oranges, as validators and provers have very different roles. Ladislaus points out that Ethereum only needs one correct ZK-proof to show the transactions were executed correctly — because a ZK-proof is either correct or it’s not.
“I’m very optimistic we’ll always find one [correct proof] with $100,000 and 10-kW requirements. That’s why we put the requirements below data center levels. Even garage-grown enthusiasts will be able to prove Ethereum,” says Ladislaus.
“We’ll need just one honest garage-prover to keep Ethereum running.”
The tech specs are also just an initial target to aim for, with Gold estimating they’ll be met before Devconnect Argentina in November.
Roy believes costs and hardware will continue to fall, and Succinct should be able to get GPU requirements down to “16 GPUs or something by early next year.” That hardware would cost roughly $10,000-$30,000.
Succinct has already established a decentralized network of “hundreds of provers” on testnet with “millions of proofs generated.” The idea is that participants compete to bring down proving times and costs. But while multiple provers compete for each job, “once one is selected then just one person does the proof,” explains Roy.
The risky business of switching the Ethereum L1 to ZK
Managing this transition to ZK is similar in complexity to the switch from proof-of-work to proof-of-stake in the Merge in 2022 and requires consideration of a range of edge cases and scenarios that could bring the network down.
On the EthProofs call in July, Drake raised potential issues, including bad actors inserting malicious prover killers into blocks to knock the network offline and the possibility that activity could drop so low there isn’t enough transaction fee revenue to pay for the cost of proving a block.
“It’ll take a few years,” says Ladislaus. “We particularly need to take care about the security implications. ZkVMs are nascent tech, complex beasts and more likely than not prone to bugs. Over time, tools like proof diversity, robust prover incentives and also formal verification can make their use in the context of Ethereum L1 much more viable.”
In concert with all of this, Ethereum’s consensus layer is being overhauled as the Beam Chain to make it so ZK friendly from day one, the whole thing will be able to be proven using a single laptop CPU according to Drake.
“Snarkifying” the Ethereum L1 can help make native rollups a reality
Integrating a zkEVM in mainnet will also help the protocol establish native rollups.
Native rollups are theoretical at present but would use Ethereum’s L1 validators to replace the proof system employed by current L2s. The proposal requires adding code for an “execute precompile” to the L1 clients that enables them to verify ZK-proofs of the L2’s state transitions (which refers to all the transactions that just happened on the L2). “Validators consume these proofs of a rollup’s execution and verify their correctness,” explains Ladislaus.
Also read: What are native rollups? Full guide to Ethereum’s latest innovation
So, if native rollups get off the ground, not only will the L1 validators be checking proofs of what happened on the L1, they’ll also be checking proofs of what happened on native rollups.
That would mean storing $10 million on a native rollup is every bit as secure as storing it on Ethereum itself.
Fox says Linea intends to become a native rollup, which he likens to a more programmable and customizable version of the abandoned ETH 2.0 sharding plan (which was basically like running 64 blockchains in tandem).
“These are better than the old sharding plan as native rollups can be heterogeneous, whereas the ETH 2.0 sharding plan had 64 homogenous shards limiting customization and differentiations for end users,” he says.
Native rollups are yet to be formally adopted, but it makes sense to upgrade the L1 for them as the ZK overhaul gets going in earnest.
“There’s quite a lot of synergies between snarkifying the EVM and making native rollups happen, as both mechanisms share common underlying technologies,” explains Ladislaus.
“Native rollups require a hard fork on L1 (i.e., clients implementing the precompile), and it thus has to go through the Ethereum governance process. My bullish take would be to have an EIP by the end of the year, very optimistically targeting the fork after Glamsterdam.”
“Take this with a grain of salt,” he says about the timeline.
Andrew Fenton
Hong Kong hoses down stablecoin frenzy, Pokémon on Solana: Asia Express