Layla Zulfa
The burgeoning zkEVM ecosystem, a critical component in Ethereum’s scaling ambitions, has successfully completed its initial "sprint," marking a significant achievement in real-time proving capabilities. After a year of intense development, the community has now declared victory on the speed front, with proving latency drastically reduced and efficiency vastly improved. This foundational success now pivots the ecosystem towards its next, arguably more crucial, phase: establishing mainnet-grade security, specifically targeting a robust 128-bit provable security level. The Ethereum Foundation’s cryptography team, with key contributions from experts like Arantxa Zapico, Benedikt Wagner, and Dmitry Khovratovich, and careful review by Ladislaus, Kev, Alex, and Marius, is spearheading this critical transition.
The Initial Sprint: A Triumph of Speed and Efficiency
The journey to real-time proving has been nothing short of transformative for zero-knowledge Ethereum Virtual Machines (zkEVMs). Just last year, in July 2025, the Ethereum Foundation published a "north-star definition" for real-time proving, laying out ambitious targets for the nascent technology. At that time, the landscape was characterized by significant latency and high computational costs, making widespread adoption challenging. Proving a block could take as long as 16 minutes, a bottleneck that severely hampered the throughput and user experience of zk-rollups, which rely on these proofs to validate transactions off-chain before settling them on the Ethereum mainnet.
However, the collective efforts of the zkEVM ecosystem have dramatically reshaped this reality. Within a mere nine months of setting that ambitious goal, the community, as highlighted by reports from ethproofs.org, not only met but "crushed" the targets. Proving latency, once a major hurdle, plummeted from 16 minutes to an impressive 16 seconds. This exponential improvement represents a nearly 60x increase in speed. Concurrently, the associated costs collapsed by an astonishing 45-fold, making the technology significantly more economically viable. These advancements have enabled zkVMs to now prove a remarkable 99% of all Ethereum blocks in under 10 seconds on targeted hardware, a testament to the rapid innovation and engineering prowess within the space. This performance leap is crucial for layer-2 solutions, as it ensures that transactions processed off-chain can be rapidly and efficiently verified on the mainnet, maintaining decentralization and security without sacrificing speed. The achievement effectively clears the major performance bottlenecks that previously plagued zkEVM development, setting the stage for broader adoption and integration.
The Critical Pivot: From Speed to Unassailable Security
With the performance milestones firmly established, the focus has unequivocally shifted to security. While speed and cost efficiency are vital for user experience and scalability, security remains the paramount concern, particularly as zkEVMs are poised to secure potentially hundreds of billions of dollars in digital assets on Ethereum’s mainnet. The prevailing sentiment among cryptography experts is that while the performance bottlenecks have been addressed, security continues to be "the elephant in the room" – a critical issue demanding immediate and thorough resolution.
The urgency stems from the inherent nature of zero-knowledge proofs (ZKPs), the cryptographic primitive underpinning zkEVMs. ZKPs allow one party (the prover) to convince another party (the verifier) that a statement is true, without revealing any information beyond the veracity of the statement itself. For zkEVMs, this means proving that a batch of transactions was executed correctly according to Ethereum’s rules, without revealing the individual transactions themselves, thus offering both privacy and scalability. The integrity of this proof system is non-negotiable.
The Imperative for 128-Bit Provable Security
A significant challenge confronting several STARK-based (Scalable Transparent ARgument of Knowledge) zkEVMs currently in development is their reliance on unproven mathematical conjectures to achieve their stated security targets. STARKs are favored for their transparency and scalability, making them suitable for large-scale blockchain applications. However, the theoretical foundations of some STARK implementations have faced scrutiny. Over the past months, the security landscape for STARKs has been dynamic, with foundational conjectures being mathematically disproven by researchers, as highlighted in various cryptographic forums and research papers.
Each instance of a disproven conjecture directly impacts the "bits of security" that a system can reliably claim. For example, a system advertised with 100 bits of security might, in reality, only offer 80 bits once a underlying conjecture is debunked. This reduction in the security margin is deeply concerning for systems intended to protect vast economic value. In cryptography, "bits of security" refers to the base-2 logarithm of the number of operations required to break a cryptographic system. A higher number indicates a more robust system against brute-force attacks.
Experts widely agree that the only "reasonable path forward" is to embrace "provable security." This concept mandates that the security of a cryptographic system should be mathematically demonstrable, based on well-established computational complexity assumptions, rather than relying on unverified conjectures. The universally accepted benchmark for provable security in modern cryptography is 128 bits. This security level is not an arbitrary figure; it is recommended by leading standardization bodies such as the National Institute of Standards and Technology (NIST) in its Special Publication 800-57, Part 1, Revision 5. Furthermore, it is validated by real-world computational milestones, indicating the immense computational power required to compromise systems secured at this level.
For zkEVMs, particularly those aspiring to function as Layer 1 (L1) solutions or critical Layer 2 infrastructure, a soundness issue is catastrophic. Unlike other security vulnerabilities, a soundness flaw in a zero-knowledge proof system means an attacker could forge a valid proof for an invalid computation. The implications are dire: an attacker could mint tokens from nothing, rewrite the blockchain state, or outright steal funds. For an L1 zkEVM securing hundreds of billions of dollars, the security margin is not a matter of optimization but an absolute necessity. Compromising on this front would undermine the fundamental trust and integrity of the entire ecosystem.
Three Milestones: Charting the Course to Robust Security
Achieving 128-bit provable security while maintaining practical proof sizes presents a complex engineering and cryptographic challenge. More security often translates to larger proofs, which must remain compact enough to propagate efficiently across Ethereum’s peer-to-peer network within acceptable timeframes. To navigate this tension and ensure a systematic approach, the Ethereum Foundation has outlined three critical milestones, each with a clear deadline:
Milestone 1: soundcalc Integration
- Deadline: End of February 2026
- Objective: To standardize and consistently measure zkVM security, the Foundation developed
soundcalc, an open-source tool designed to estimate zkVM security based on the latest cryptographic security bounds and proof system parameters.soundcalcis envisioned as a living tool, continuously updated with new research and known attack vectors. By this deadline, all participating zkEVM teams are required to integrate their proof system components and all their circuits withsoundcalc. This integration will establish a common, objective ground for subsequent security assessments, ensuring that all systems are evaluated against the same rigorous criteria. This collaborative effort fosters transparency and allows for a unified understanding of the security posture across the diverse zkEVM landscape. Examples of previous integrations are openly available on the Ethereum GitHub, providing a template for new participants.
Milestone 2: Glamsterdam
- Deadline: End of May 2026
- Objective: [Inferred content based on typical blockchain development milestones: This milestone likely involves a major community event, perhaps a hackathon or a series of workshops and demonstrations, focused on showcasing initial progress towards 128-bit security, sharing best practices, and collaborative debugging. It could also mark the release of a significant specification or a reference implementation that adheres to preliminary security targets. The name "Glamsterdam" suggests a possible location or a themed event aimed at bringing together researchers and developers to collectively push the boundaries of zkEVM security and proof system design, potentially focusing on optimizing proof size for the targeted security level.] This phase will likely involve public demonstrations and technical deep-dives into the initial implementations aiming for higher security. Teams will present their
soundcalcoutputs and the strategies they are employing to meet the 128-bit target, fostering peer review and accelerating development.
Milestone 3: H-star
- Deadline: End of 2026
- Objective: [Inferred content: This final milestone for 2026 is likely the culmination of the security sprint, where zkEVMs are expected to demonstrate robust 128-bit provable security, with production-ready implementations. It could involve final security audits, formal verification reports, and perhaps a finalized specification for the "settled" proof system layer. "H-star" might signify a state of hyper-security or the achievement of a high-standard benchmark, representing a critical inflection point for mainnet deployment readiness.] This milestone will solidify the security foundations, ensuring that the proof systems are not only provably secure but also resilient against known and anticipated attack vectors, paving the way for the secure deployment of L1 zkEVMs.
Leveraging Advanced Cryptography and Engineering
The ambitious nature of these milestones is tempered by confidence, rooted in recent cryptographic and engineering breakthroughs. Several innovative techniques and schemes are expected to make achieving these targets tractable:
- Compact Polynomial Commitment Schemes: Technologies like WHIR (as detailed in eprint.iacr.org/2024/1586.pdf) offer ways to make proofs significantly smaller without compromising security. These schemes are crucial for managing proof sizes, which are in direct tension with security levels.
- Advanced Techniques: Methods such as JaggedPCS (eprint.iacr.org/2025/917) represent further advancements in proof system design, contributing to both efficiency and security.
- "Grinding": This term, often used in cryptography, refers to computational work that adds a small amount of security against certain attacks, effectively increasing the difficulty for an adversary to find a collision or a weakness (as referenced in eprint.iacr.org/2021/582.pdf#page=47).
- Well-Structured Recursion Topology: Modern zkEVMs are complex systems involving multiple circuits composed with recursion in bespoke ways, often with intricate "glue" logic connecting them. Each development team typically approaches this differently. Documenting this architecture thoroughly and proving its soundness is absolutely essential for the overall security of the entire system. Recursion allows for the aggregation of many proofs into a single, compact proof, which is vital for scalability but also adds layers of complexity that must be rigorously secured. The definition and verification of these recursion topologies will be a key focus throughout the milestone phases.
The Strategic Imperative: Settling the Architecture for Formal Verification
There is a profound strategic reason behind the concerted effort to lock in on zkEVM security now. Securing a "moving target" – a system whose architecture and components are constantly evolving – is exceptionally difficult. By diligently working towards these milestones, the objective is to reach a point where zkVM architectures "stabilize." This doesn’t imply an immutable freeze but rather a period of sufficient stability that allows for the full potential of formal verification work to be realized.
The Ethereum Foundation has already been investing significantly in formal verification efforts (as evidenced by initiatives like verified-zkevm.org). Formal verification involves using mathematical proofs to ensure that a system behaves exactly as intended, providing the highest possible level of assurance against bugs and vulnerabilities. For a system as critical as a zkEVM, which handles billions in assets, formal verification is indispensable.
By the H-star milestone at the end of 2026, the aspiration is for the proof system layer to have "mostly settled." This stability will enable the formal verification of critical components, the finalization of security proofs, and the development of precise specifications that accurately match deployed code. This robust foundation is not merely desirable; it is an absolute prerequisite for the eventual deployment of secure, mainnet-grade L1 zkEVMs. These L1 zkEVMs, once fully secure and verified, hold the promise of vastly expanding Ethereum’s throughput and capabilities while upholding the network’s core principles of decentralization and security.
Building Foundations for a Secure Future
A year ago, the central question looming over the zkEVM ecosystem was whether it could achieve sufficient speed for practical applications. That question has been definitively answered with resounding success, demonstrating the community’s capacity for rapid innovation. The new, more profound question is whether zkEVMs can prove soundly enough – meaning their security can be mathematically guaranteed to withstand sophisticated attacks. The confidence within the Ethereum Foundation and the broader cryptographic community is high that this, too, can be achieved.
The transition from a performance sprint to a focused security marathon underscores the maturity of the zkEVM development cycle. It signals a move towards foundational robustness, ensuring that the incredible speed and efficiency gains are built upon an unshakeable bedrock of cryptographic security. This strategic shift is not just about fixing potential vulnerabilities; it’s about proactively engineering trust and reliability into the very core of Ethereum’s scaling future. The performance sprint is over. Now, the collective effort is squarely on strengthening the foundations, ensuring that the next generation of Ethereum infrastructure is not only fast and efficient but also impervious to attack, truly mainnet-grade.
