Technical Deep Dive
Scroll's Halo2 implementation is a masterclass in balancing generality with performance. At its core sits the PLONKish architecture, a term that describes a family of proof systems derived from the original PLONK (Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge) protocol. The key innovation is the separation of the circuit into multiple columns and gates, where each gate can be a custom polynomial constraint.
Architecture Breakdown:
- Custom Gates: Unlike fixed-gate systems (e.g., early Groth16), PLONKish allows developers to define arbitrary polynomial identities. For example, an Ethereum `ADD` opcode can be implemented as a single custom gate that checks `a + b = c` modulo 2^256, rather than decomposing it into many smaller gates. This drastically reduces the number of constraints.
- Lookup Tables: Halo2 supports lookup arguments (based on the Caulk protocol), enabling efficient range checks and table-driven operations. Scroll uses this for opcodes like `SHA3` or `BALANCE`, where the correct output can be precomputed and looked up rather than recomputed in-circuit.
- Multi-threaded Proof Generation: The library is written in Rust and uses Rayon for parallelizing the heavy polynomial arithmetic (NTTs, MSMs). Benchmarks show near-linear scaling up to 32 cores, critical for proving blocks with thousands of transactions.
- Memory Optimization: Scroll employs a technique called "chunked proving" — splitting a large circuit into smaller segments that are proven independently and then aggregated. This avoids the O(n^2) memory blowup typical of monolithic PLONK provers.
Performance Data (from Scroll's internal benchmarks):
| Metric | Scroll Halo2 (zkEVM) | Generic Halo2 (unoptimized) | Groth16 (fixed circuit) |
|---|---|---|---|
| Constraints per second (proving) | 1.2 million | 400,000 | 2.5 million |
| Proof size | 2.5 KB | 2.5 KB | 200 bytes |
| Proving time (10k tx block) | 8 minutes | 25 minutes | N/A (requires trusted setup) |
| Memory usage (peak) | 6 GB | 18 GB | 4 GB |
| Setup required | None (transparent) | None | Trusted setup (toxic waste) |
Data Takeaway: Scroll's optimizations yield a 3x improvement in proving throughput over a generic Halo2 implementation, while keeping memory under control. The trade-off is a larger proof size compared to Groth16, but the elimination of trusted setup is a major operational advantage for a public blockchain.
Relevant Open-Source Repositories:
- `scroll-tech/halo2` — The core library. Currently at ~1,200 stars. It includes the PLONKish backend, lookup argument implementation, and serialization utilities.
- `scroll-tech/zkevm-circuits` — The EVM circuit definitions built on top of Halo2. This is where the custom gates for each opcode live. Worth studying for anyone building EVM-compatible ZK circuits.
Key Players & Case Studies
Scroll Team: The project was co-founded by Sandy Peng, Haichen Shen, and Ye Zhang — all with deep backgrounds in distributed systems and cryptography. Ye Zhang previously contributed to the Zcash protocol and has published research on recursive proof composition. The team's decision to build on Halo2 (rather than Groth16 or Plonk) was strategic: Halo2's transparent setup and flexibility made it the only viable choice for a complex, evolving zkEVM.
Competitive Landscape:
| Project | ZK System | Prover Performance | EVM Compatibility | Trusted Setup |
|---|---|---|---|---|
| Scroll | Halo2 (PLONKish) | High (optimized) | Full | No |
| zkSync Era | Boojum (custom PLONK) | Very High | Full | No |
| Polygon zkEVM | PIL (custom) | Medium-High | Full | No |
| StarkNet | STARK | Low (but no pairing) | Partial (Cairo VM) | No |
| Aztec | PLONK (custom) | Medium | No (private) | No |
Data Takeaway: Scroll's Halo2 sits in a competitive sweet spot — it offers full EVM compatibility with strong performance, but it's not the fastest prover. zkSync's Boojum claims 2x faster proving for similar workloads, but uses a more rigid circuit model. The choice of Halo2 gives Scroll more flexibility for future upgrades (e.g., adding new opcodes or precompiles) without redesigning the entire system.
Case Study: Verifiable Computation Beyond Blockchain
Scroll's Halo2 is already being used by Succinct Labs for their SP1 zkVM, which aims to prove arbitrary Rust programs. By leveraging Scroll's optimized lookup tables, Succinct reduced the proving time for a simple Merkle tree verification from 30 seconds to under 5 seconds. This demonstrates the library's utility outside of Ethereum L2.
Industry Impact & Market Dynamics
The release of a production-grade, open-source Halo2 implementation has several ripple effects:
1. Lowering the Barrier to ZK Development: Before Scroll's work, building a custom ZK circuit required deep expertise in cryptography and months of engineering. Now, developers can fork `scroll-tech/halo2` and define custom gates with relatively little overhead. This is accelerating the adoption of ZK proofs in areas like decentralized identity (e.g., proving age without revealing birthdate) and machine learning inference verification.
2. Ethereum L2 Market Share: Scroll currently processes ~$150M in daily transaction volume (as of June 2025), with a TVL of ~$2.5B. The proving cost is a significant operational expense — estimated at $0.02 per transaction. As Scroll optimizes Halo2 further (e.g., using GPU acceleration), this cost could drop to $0.005, making it competitive with zkSync's sub-cent costs.
3. Funding and Ecosystem Growth: Scroll has raised $80M from investors including Polychain, Bain Capital Crypto, and Sequoia China. The Halo2 library is a key differentiator in their pitch to developers: "Build on Scroll, and you get a future-proof ZK stack."
Market Data:
| Metric | Scroll (2025 Q2) | zkSync Era (2025 Q2) | Polygon zkEVM (2025 Q2) |
|---|---|---|---|
| Daily transactions | 1.2M | 3.5M | 800K |
| Average proving cost per tx | $0.02 | $0.008 | $0.015 |
| Developer count (ZK circuits) | ~200 | ~800 | ~150 |
| GitHub stars (ZK repo) | 1,200 | 4,500 (Boojum) | 2,100 (PIL) |
Data Takeaway: Scroll trails in developer mindshare and transaction volume, but its Halo2 library is gaining traction as a standalone tool. The proving cost is still higher than zkSync's, but the flexibility advantage could attract projects that need custom circuits (e.g., privacy-focused DeFi).
Risks, Limitations & Open Questions
1. Proving Time Scalability: While 8 minutes for a 10k-tx block is acceptable for a rollup (blocks are produced every 10-15 minutes), it leaves little headroom for spikes. If transaction volume doubles, proving time could exceed block time, causing delays. Scroll is exploring GPU acceleration (CUDA kernels for NTT) but this is not yet merged.
2. Proof Size vs. Verification Cost: At 2.5 KB, Halo2 proofs are larger than Groth16 (200 bytes) but smaller than STARKs (tens of KB). On Ethereum L1, verifying a Halo2 proof costs ~500,000 gas, compared to ~300,000 for a Groth16 proof. This adds ~$5 to the cost of finalizing a batch, which is passed to users.
3. Security of Custom Gates: The flexibility of PLONKish is a double-edged sword. A poorly designed custom gate could introduce soundness bugs. Scroll uses formal verification (via the `halo2` library's built-in constraint checker) but the burden is on circuit developers to ensure correctness.
4. Centralization of Proving: Currently, only Scroll's sequencer runs the prover. This is a single point of failure and a centralization vector. Decentralized proving networks (e.g., =nil; Foundation's proof market) are emerging, but Scroll has not yet integrated with them.
AINews Verdict & Predictions
Scroll's Halo2 implementation is a significant engineering achievement that will have lasting impact beyond the project itself. Our editorial team makes the following predictions:
1. By Q1 2026, Scroll's Halo2 will be the most forked ZK library on GitHub for custom circuit development, surpassing even the original Zcash Halo2. The combination of documentation, performance, and real-world testing (via Scroll's mainnet) makes it the default choice for new ZK projects.
2. GPU acceleration will be merged within 6 months, reducing proving time by 5x and bringing Scroll's per-tx cost below $0.005. This will trigger a wave of DeFi protocols migrating from zkSync to Scroll to take advantage of custom gate support for complex financial logic.
3. The biggest risk is not technical but ecosystem lock-in. If Scroll fails to attract a critical mass of developers, the Halo2 library will remain a niche tool. However, the recent partnership with Succinct Labs and the growing interest in ZK co-processors (e.g., Axiom) suggest a vibrant ecosystem is forming.
4. Watch for the "Halo2 Recursive Upgrade." Scroll has hinted at adding recursive proof composition (proving that a proof is valid, then aggregating). This would allow infinite scaling: proving a block of 1M transactions by recursively combining smaller proofs. If successful, it would make Scroll the first zkEVM with truly unbounded throughput.
Final Takeaway: Scroll's Halo2 is the unsung hero of the zkEVM race. While competitors fight over marketing buzzwords, Scroll is quietly building the most flexible and developer-friendly ZK proving engine. The next 12 months will determine whether this technical lead translates into market dominance.