Technical Deep Dive
Scroll's `zkevm-circuits` repository is a Rust-based implementation that decomposes the complex task of proving EVM execution into several specialized sub-circuits. The architecture follows a modular pattern: a State Circuit handles read/write operations to the Ethereum state trie, an EVM Circuit proves the correctness of opcode execution, and a Bytecode Circuit ensures the bytecode being executed is authentic. These sub-circuits are then combined using a Super Circuit that coordinates the constraints and generates a single, aggregated proof via the Halo2 proving system.
A key engineering decision is the use of Halo2 over alternatives like Groth16 or PLONK. Halo2 offers a transparent setup (no trusted ceremony required for universal parameters) and supports custom gates and lookup tables, which are essential for efficiently constraining complex EVM operations like SHA3 hashing or elliptic curve operations. The circuit uses a layered architecture where each layer corresponds to an execution step, allowing for parallelization across multiple CPU cores or GPUs. This is a direct response to the bottleneck of sequential proof generation that plagues earlier zkEVM designs.
Recent commits to the repository (as of early June 2025) show significant optimizations in the keccak256 circuit, which previously accounted for over 40% of the total proving time. By implementing a more efficient lookup table and reducing the number of rows required per hash operation, the team has reportedly cut keccak proving time by nearly 30%. This is critical because keccak256 is used extensively in Ethereum's account and storage trie proofs.
| Metric | Scroll zkEVM (Current) | zkSync Era (v2.0) | Polygon zkEVM (v1.1) |
|---|---|---|---|
| Proving Time (per batch, 1000 tx) | 45 seconds | 38 seconds | 52 seconds |
| Circuit Size (constraints per tx) | ~1.2 million | ~1.5 million | ~1.8 million |
| EVM Equivalence | Full (bytecode-level) | Full (with minor precompile differences) | Full (bytecode-level) |
| Proving System | Halo2 (transparent) | PLONK (with trusted setup) | PLONK (with trusted setup) |
| Gas Overhead (vs L1) | ~5x | ~8x | ~6x |
Data Takeaway: Scroll's modular design yields a lower circuit size per transaction compared to its main competitors, which directly contributes to its lower gas overhead. However, zkSync Era's slightly faster proving time suggests its more aggressive optimization of the PLONK prover gives it an edge in throughput. The trade-off is that Scroll's Halo2-based system avoids the need for a trusted setup, which is a security and decentralization advantage.
Key Players & Case Studies
Scroll is the primary developer and maintainer of the `zkevm-circuits` repository, but the project is deeply intertwined with the broader Ethereum research community. The team includes notable researchers like Haichen Shen (former AWS and Facebook engineer) and Ye Zhang (a PhD in cryptography), who have published papers on efficient zkEVM construction. The repository itself is a collaborative effort, with contributions from independent developers and researchers from the Ethereum Foundation's Privacy and Scaling Explorations (PSE) group.
A key case study is Scroll's integration with the Ethereum mainnet. Unlike many L2s that launch with a centralized sequencer, Scroll's circuits are designed to support a decentralized prover network. This means that any node with sufficient hardware can download the circuit, generate proofs, and submit them to the L1 contract. The modularity of the circuits makes this feasible because different provers can work on different sub-circuits in parallel, then submit their partial proofs to an aggregator. This is a stark contrast to zkSync Era, which uses a single, centralized prover operated by Matter Labs, and Polygon zkEVM, which relies on a permissioned set of validators.
Another important comparison is with Linea, ConsenSys's zkEVM. Linea uses a modified version of the gnark proving library (Go-based), while Scroll's Rust-based Halo2 implementation offers better memory management and lower latency for large circuits. In benchmarks, Scroll's circuit generation is approximately 20% faster than Linea's for equivalent transaction loads, though Linea's integration with MetaMask gives it a user experience advantage.
| Feature | Scroll | zkSync Era | Polygon zkEVM | Linea |
|---|---|---|---|---|
| Prover Decentralization | Yes (open prover network) | No (centralized) | No (permissioned) | No (centralized) |
| Circuit Language | Rust (Halo2) | Rust (PLONK) | Go (PLONK) | Go (gnark) |
| Mainnet Launch Date | Oct 2023 | Mar 2023 | Mar 2023 | Aug 2023 |
| Total Value Locked (TVL, June 2025) | $1.2B | $3.8B | $2.1B | $0.9B |
| Average Block Time | 3 seconds | 1 second | 2 seconds | 4 seconds |
Data Takeaway: Scroll's commitment to prover decentralization is a differentiator that appeals to Ethereum purists, but it comes at the cost of slower block times compared to zkSync Era's centralized sequencer. The TVL figures show that while Scroll has a solid foothold, it still trails behind the market leaders. The modular circuit design gives Scroll a path to improve block times without sacrificing decentralization, but execution is everything.
Industry Impact & Market Dynamics
The modular circuit architecture pioneered by Scroll is influencing the entire zkEVM landscape. Other projects, such as Taiko and Risc Zero, are adopting similar approaches, breaking down the monolithic proving problem into composable sub-circuits. This trend is accelerating the commoditization of zkEVM technology—if any project can assemble circuits from open-source components, the competitive moat shifts from raw proving efficiency to network effects, developer tooling, and user experience.
The market for zkEVM-based L2s is projected to grow from $5 billion in TVL in early 2025 to over $30 billion by the end of 2026, according to multiple industry estimates. Scroll's ability to capture a disproportionate share of this growth depends on its circuit performance. Every millisecond saved in proving time translates to lower L1 verification costs, which can be passed on to users as lower fees. In a market where L2 fees are already converging toward sub-cent levels, even a 10% improvement in circuit efficiency can be a decisive factor.
A significant market dynamic is the Ethereum blob fee market introduced by EIP-4844 (Proto-Danksharding). Scroll's circuits must generate proofs that fit within the blob data structure efficiently. The current circuit design produces proofs that are approximately 200 KB per batch, which is well within the 128 KB per blob limit (with multiple blobs per block). However, as blob space becomes more competitive with other L2s, Scroll's ability to produce smaller proofs (via better aggregation) will be a competitive advantage.
| Year | Estimated L2 Market TVL | Scroll Projected TVL | Scroll Circuit Cost per Tx |
|---|---|---|---|
| 2025 | $15B | $1.5B | $0.002 |
| 2026 | $30B | $4.0B | $0.001 |
| 2027 | $50B | $8.0B | $0.0005 |
Data Takeaway: The projections show Scroll's TVL growing faster than the overall market, assuming circuit costs continue to decline. This is a reasonable assumption given the team's track record of optimizations, but it also assumes that no breakthrough in alternative proving systems (like STARKs or folding schemes) renders Halo2-based circuits obsolete.
Risks, Limitations & Open Questions
Despite its technical elegance, Scroll's zkEVM circuit approach faces several risks. The most immediate is proving time variance under load. The modular architecture, while parallelizable, introduces coordination overhead. If the number of transactions in a batch spikes, the state circuit may become a bottleneck, causing proof generation to lag. This could lead to longer confirmation times for users during network congestion.
Another risk is circuit security. The Halo2 proving system, while transparent, is relatively new compared to Groth16 or PLONK. The `zkevm-circuits` repository has undergone multiple audits (by firms like Trail of Bits and Veridise), but the complexity of the EVM means that subtle bugs in constraint generation could lead to invalid proofs being accepted. A single vulnerability could allow an attacker to forge a proof and steal funds from the bridge contract. The community must remain vigilant.
There is also the question of hardware requirements. While Scroll aims for decentralization, the current prover requires a machine with at least 32 GB of RAM and a modern GPU (NVIDIA RTX 4090 or equivalent) to generate proofs in a reasonable time. This creates a barrier to entry for individual provers, potentially leading to a small, centralized set of proof generators. The team is working on a light prover mode that reduces memory usage to 16 GB, but this is still in development.
Finally, the EVM equivalence claim is not absolute. While Scroll supports all opcodes, certain precompiles (like the BLS12-381 curve operations) are implemented as circuits rather than native hardware instructions, leading to higher gas costs for those operations. This creates a subtle but real incentive for developers to avoid certain smart contract patterns, undermining the promise of seamless portability.
AINews Verdict & Predictions
Scroll's `zkevm-circuits` is a masterclass in modular engineering, but it is not a silver bullet. The team has made the right bet on Halo2 for transparency and customizability, and the modular architecture is forward-looking. However, the real test will come when Ethereum's blob space becomes scarce and L2s compete fiercely for every byte.
Our predictions:
1. Within 12 months, Scroll will release a v2 of its circuits that incorporates folding schemes (like Nova or SuperNova), reducing proof size by 50% and enabling recursive proof aggregation. This will cut L1 verification costs by an order of magnitude, making Scroll the cheapest zkEVM to use.
2. Within 18 months, at least one major security incident will occur in a competing zkEVM (likely zkSync Era or Polygon zkEVM) due to circuit bugs, driving a flight to quality toward Scroll's more thoroughly audited and modular design.
3. Within 24 months, the `zkevm-circuits` repository will be forked by at least three other L2 projects, becoming the de facto standard for zkEVM circuit design, much like the Ethereum Yellow Paper became the standard for EVM implementation.
What to watch next: The team's progress on the light prover and any announcements regarding proof compression. If Scroll can produce a proof that is 50 KB or smaller per batch, it will dominate the blob fee market. The next major commit to watch is the integration of lookup arguments for the state circuit, which could reduce proving time by another 20%.
Final editorial judgment: Scroll's zkEVM circuits are the most architecturally sound implementation in the market today, but they are not yet the fastest or cheapest. The team's focus on decentralization and modularity is a long-term bet that will pay off as the market matures. For now, they are a strong No. 2 behind zkSync Era, but the gap is closing fast.