Scroll is a ZK-Rollup for Ethereum built by a team led by Ye Zhang (co-founder and CEO), Sandy Peng (co-founder and CEO), and chief architect Haichen Shen, with deep research collaboration with the Ethereum Privacy and Scaling Explorations (PSE) group. Scroll’s primary technical commitment is Type-2 EVM equivalence — meaning it proves the execution of the identical EVM bytecode that runs on Ethereum mainnet, with minimal divergence.

The technical documentation, maintained at docs.scroll.io, and research publications describe the zkEVM circuit design, proof generation pipeline, and the coordination protocol between Scroll and Ethereum L1. Scroll mainnet launched October 2023.

> Source: Technical documentation at docs.scroll.io/en/technology/. Research publications at scroll.io/blog. Code at github.com/scroll-tech.

---

Publication and Context

In 2021–2022, multiple teams raced to build a production-quality zkEVM. The race was ranked by Vitalik Buterin into EVM type categories:

Type	Description	Examples
Type 1	Fully Ethereum-equivalent; proves Ethereum blocks directly	None in production yet
Type 2	EVM-equivalent; proves EVM bytecode; minor internal differences	Scroll, Polygon zkEVM
Type 3	EVM-compatible; some incompatible precompiles	Earlier Polygon zkEVM
Type 4	Custom VM compiled from Solidity	zkSync Era

Scroll explicitly targets Type 2: the highest compatibility level achievable without full Ethereum block inclusion (Type 1). This means:

• Solidity contracts deploy with zero modification
• Developer tooling (web3.js, ethers.js, Foundry, Hardhat) works identically
• Existing Ethereum contracts and security audits remain valid

---

zkEVM Circuit Architecture

Scroll’s core challenge is constructing a ZK circuit that verifies the execution of arbitrary EVM bytecode. This is one of the most complex ZK engineering challenges because the EVM was not designed with ZK provability in mind.

Circuit decomposition approach:

Scroll decomposes EVM execution into a set of specialized sub-circuits, each responsible for proving specific EVM components:

Sub-circuit	What it proves
EVM circuit	High-level constraint: that each opcode was executed correctly
State circuit	Storage and memory read/write consistency
Bytecode circuit	That the bytecode being executed is correctly loaded from the state
Tx circuit	Transaction signature validity; correct initial state
MPT circuit	Merkle Patricia Trie state updates
Keccak circuit	Correct execution of the keccak256 hash function
Poseidon circuit	Hash function used internally in Scroll’s circuit

The sub-circuits are interconnected via lookup tables (a technique from the Halo2 proving framework): one circuit’s outputs become lookup table inputs for another, ensuring consistency.

---

Proving System: Halo2 + KZG

Scroll uses the Halo2 proof system — originally designed by the Zcash Electric Coin Company — combined with KZG polynomial commitments (the same commitment scheme used in EIP-4844).

Why Halo2?

• Supports custom gates (custom constraints beyond R1CS)
• Supports lookup arguments (efficient for ROM/RAM-like access patterns)
• Compatible with KZG commitments (no trusted setup ceremony required when using transparent variants, though Scroll uses a KZG-based setup)

Recursion: Scroll uses proof aggregation: multiple execution proofs are recursively compressed into a single proof submitted to Ethereum. This reduces the per-transaction L1 verification cost.

---

Data Availability

Scroll posts compressed state diffs and transaction data to Ethereum. Post-EIP-4844 (March 2024), Scroll posts data as blobs, dramatically reducing per-transaction costs.

The commitment structure:

1. An L2 block is produced by the Scroll sequencer
2. The EVM circuit proves the block’s execution correctly
3. A batch of L2 blocks is aggregated into one proof
4. The batch proof + compressed data is submitted to Ethereum’s Scroll rollup contracts
5. Ethereum verifies the proof and records the new state root

---

Decentralization Roadmap

Like other ZK-Rollups, Scroll launched with a centralized sequencer and centralized prover. The decentralization roadmap includes:

• Decentralized proving: Multiple provers compete to generate proofs for rewards
• Decentralized sequencing: Validator committee or permissionless sequencer rotation
• Permissionless withdrawal: Users can force withdrawals directly from L1 regardless of sequencer state

---

Reality Check

Scroll mainnet launched successfully and has attracted significant developer activity. However:

• Proof generation time: Generating ZK proofs for complex transactions can take minutes on current hardware
• Proving costs: GPU proving is expensive; reflected in higher L2 fees than Optimistic Rollups for compute-heavy operations
• Type 2 caveats: Some precompiles (keccak, ecrecover, SHA-256) are expensive to prove and may have different gas costs than Ethereum mainnet
• No governance token at launch: Scroll did not launch a token immediately, financing operations through VC funding

---

Legacy

Scroll’s close collaboration with the Ethereum PSE group means its zkEVM circuit work has influenced Ethereum’s own zkEVM research. The sub-circuit design pattern and Halo2 usage have been widely studied and referenced. Scroll is one of the cleaner examples of open-source ZK research translated directly into production infrastructure.

---

Related Terms

• ZK-Rollup
• Zero-Knowledge Proof
• Data Availability
• zkSync Whitepaper
• StarkWare Whitepaper

---

Research

• Scroll Research Team. (2022). zkEVM: Achieving EVM Equivalence with ZK Proofs. scroll.io/blog.

— Core technical blog series; covers circuit decomposition, Halo2 design, and the sub-circuit architecture.

• Bünz, B., Fisch, B., & Szepieniec, A. (2020). Transparent SNARKs from DARK Compilers. EUROCRYPT 2020.

— Relevant to the Halo2 polynomial commitment construction.

• Zhang, Y., et al. (2023). Scroll zkEVM Architecture. docs.scroll.io.

— Official technical documentation covering the full proving pipeline.