What is zk-rollup?

A layer-2 design that posts a cryptographic proof with every batch, so the base chain verifies correctness mathematically rather than waiting for someone to object.

It is one of the two main rollup families. The other, the optimistic rollup, publishes results and assumes they are correct unless challenged within a dispute window. A zk-rollup proves each batch instead, which removes the window and replaces a social assumption with a cryptographic one.

The name is a persistent source of confusion. Almost none of these networks are private. The zero-knowledge machinery is used for succinctness, and several projects prefer the term validity rollup for that reason.

How it works

Transactions are executed off chain by a sequencer, which orders them and produces a new state root. A prover then generates a validity proof that running those transactions against the previous state root really yields the new one. Both the proof and the transaction data are posted to the base chain, where a verifier contract checks the proof and accepts the state root if it holds.

Publishing the data matters as much as the proof. The proof establishes correctness, and the data is what lets anyone reconstruct the state and exit independently if the operator disappears. Ethereum's EIP-4844 introduced blob transactions specifically to make that data cheaper for rollups to post, which is why layer 2 fees fell sharply after it activated.

Withdrawals are the visible difference from optimistic designs. There is no seven-day challenge period, so a withdrawal to the base chain finalizes once the next proof is verified, typically minutes to hours depending on how often the network submits proofs.

The costs are real. Proving is computationally expensive and requires specialized hardware, and full compatibility with existing Ethereum tooling took years of engineering that optimistic rollups got largely for free.

Example

Illustrative. You bridge $2,000 back to Ethereum from two layer 2 networks.

From an optimistic rollup, the withdrawal enters a challenge period commonly set at seven days before it can be claimed. Most people instead pay a third-party liquidity provider a fraction of a percent to front the funds immediately, so the fast path costs money.

From a zk-rollup, the withdrawal waits for the next proof to be generated and verified. That is minutes to hours, it costs only the transaction fees, and no intermediary is required. Same asset, same destination, and a difference measured in days.

Why it matters when you buy

Layer 2 networks are where cheap transactions live, and the exit path back to a base chain or an exchange is where the designs differ most. If you plan to move funds back and forth, proof cadence determines how long that takes. The chain pages cover settlement by network, the fee comparison covers withdrawal costs by exchange, and the guide on sending crypto across chains covers the mechanics.

Related terms

• validity proof: what each batch posts
• optimistic rollup: the challenge-window alternative
• sequencer: who orders transactions off chain
• rollup: the broader scaling category
• data availability: why transaction data is published
• blob transaction: the cheaper data format rollups use

Questions

Are my transactions private on a zk-rollup?

No, in almost all cases. Transaction data is published on the base chain so the state can be reconstructed. The cryptography compresses verification rather than hiding activity.

Why are withdrawals still not instant?

Because a proof must be generated and posted, and networks batch that work to control cost. The wait is set by proving cadence rather than by any mandatory dispute period.

Is a zk-rollup safer than an optimistic rollup?

The assumptions differ rather than one being strictly stronger. A zk-rollup depends on the proof system and verifier contract being correct, while an optimistic rollup depends on at least one honest party watching and challenging in time.