Introduction

Motivations

In previous upgrades we tried to lower the costs of committing data to L1, by supporting data-availability via an EIP-4844 blob-carrying transaction and furthermore encoding (compressing) the data being made available. In the next planned upgrade, our goal is to lower verification costs.

Currently every batch's proof is verified on-chain (L1 EVM) which finalizes the state root post-batch. A batch already aggregates proofs from multiple chunks, essentially not requiring each of those chunk proofs to be verified on-chain. We are now pushing these verification costs even lower by recursively bundling those batches into a single bundle that can be verified on-chain. As opposed to the aggregation scheme used from a list of chunks to a single batch (where we have an upper bound to the number of chunks we can aggregate), the current recursive aggregation scheme is not bound by such a limit to the number of batches we can aggregate. Instead, the number of rounds of recursion can solely be defined by the latency we wish to achieve on L1 for those batches.

Terminology

• A chunk is a list of L2 blocks and will be proven by the ChunkCircuit (this is in fact the ZkEVM SuperCircuit)
• A batch is a list of chunks that will be aggregated using the BatchCircuit
• A bundle is a list of batches that will be aggregated recursively using the RecursionCircuit

In terms of multiple layers at which proofs are generated, we have:

• Layer 0: Chunk-level ZkEVM proof generation (SuperCircuit/ ChunkCircuit), that takes as inputs the execution traces for all the blocks part of this specific chunk

• Layer 1: Compression layer on top of Layer 0’s proof (Wide compression)

• Layer 2: Compression layer on top of Layer 1’s proof (Thin compression)

• Layer 3: Batch-level proof generation (BatchCircuit), take takes as inputs the list of chunk proofs, parent batch’s state root and the batch’s header (‣ )

  <aside> 💡 The BatchHeaderV3 does not include stateRoot, in order to avoid having to revert a committed batch if it could not be proven (due to potential circuit-layout overflow issues). Which means that the stateRoot is decoupled from the batchHash (Keccak hash identifier of the BatchHeaderV3)

  </aside>

• Layer 4: Compression layer on top of Layer 3’s proof (Thin compression)

• Layer 5: RecursionCircuit's proofs over a list of batch proofs. We operate on this layer until we have a final proof (that represents a bundle of batches)

• Layer 6: Compression layer on top of Layer 5’s proof (Thin compression). This is also the proof that will finally be verified in EVM using the ZkEvmVerifier contract.

Scope

Pull Request including all the circuit-side code changes listed below: https://github.com/scroll-tech/zkevm-circuits/pull/1352