Ethereum Foundation Pivots zkEVM Focus from Speed to 128-bit Provable Security as Mainnet Deployment Nears

The zkEVM ecosystem has successfully concluded its initial, rapid development phase, achieving significant breakthroughs in proving speed. After a year of intense innovation, the landscape of Zero-Knowledge Ethereum Virtual Machines (zkEVMs) has crossed a crucial threshold, enabling real-time proving capabilities. This pivotal achievement now sets the stage for the next critical phase: ensuring these nascent technologies meet the stringent security requirements necessary for robust, mainnet-grade deployment. The Ethereum Foundation (EF) cryptography team is spearheading this shift, articulating a clear roadmap to establish 128-bit provable security as the non-negotiable standard for all zkEVM implementations.

The Initial Sprint: Unprecedented Speed Achievements

For the past year, the development of zkEVMs has been characterized by a relentless pursuit of performance. The goal, as defined by a "north-star" vision published in July 2025, was to achieve real-time proving – a target that many considered ambitious. However, the collective efforts of the ecosystem have not only met but exceeded these expectations. In a remarkable nine-month period, proving latency, the time it takes to generate a cryptographic proof for a batch of transactions, dramatically plummeted from 16 minutes to a mere 16 seconds. This exponential improvement has been accompanied by a staggering 45-fold reduction in operational costs. Critically, zkVMs are now capable of proving 99% of all Ethereum blocks in under 10 seconds on their designated hardware, a testament to the efficiency gains realized through focused engineering and cryptographic innovation. These advancements are vital for the scalability of the Ethereum network, promising faster transaction finality and significantly reduced gas fees for users.

The New Imperative: Security as the Cornerstone of Mainnet Readiness

While the performance bottlenecks have largely been overcome, a more profound challenge has emerged: security. The EF cryptography team underscores that despite the impressive speed gains, the security posture of many current STARK-based zkEVMs remains a critical concern. Unlike traditional software vulnerabilities, a flaw in the cryptographic soundness of a zkEVM proof system carries catastrophic implications. A soundness issue would enable an attacker to forge valid proofs for invalid state transitions, effectively allowing them to mint tokens from nothing, rewrite the blockchain state, or steal funds with impunity. For an L1 zkEVM, which is designed to secure hundreds of billions of dollars in digital assets, such a vulnerability is an existential threat.

The Case for 128-bit Provable Security

The core of the security challenge lies in the reliance of many STARK-based zkEVMs on unproven mathematical conjectures to achieve their stated security targets. Over recent months, the foundational assumptions underlying STARK security have been rigorously scrutinized, with researchers mathematically disproving several key conjectures. Each disproven conjecture erodes the advertised "bits of security," meaning a system initially touted as 100-bit secure might, in reality, offer only 80 bits. This uncertainty is unacceptable for a public blockchain infrastructure.

The only viable path forward, as articulated by the EF cryptography team, is the adoption of "provable security." This approach relies on cryptographic constructions whose security can be mathematically proven under widely accepted assumptions, rather than speculative conjectures. The industry standard, and the new target for zkEVMs, is 128-bit security. This level is not arbitrary; it is the security level recommended by leading standardization bodies such as the National Institute of Standards and Technology (NIST) in its Special Publication 800-57 Part 1 Revision 5. Furthermore, it is a benchmark validated by real-world computational milestones, signifying a level of resilience against all known classical and even theoretical quantum attacks for the foreseeable future. Ethereum co-founder Vitalik Buterin has also previously emphasized the importance of high security levels for core blockchain infrastructure, aligning with this 128-bit target.

Charting the Course: Three Critical Milestones

Recognizing the inherent tension between achieving high security and maintaining compact proof sizes—essential for efficient propagation across Ethereum’s peer-to-peer network—the Ethereum Foundation has outlined three critical milestones for the zkEVM ecosystem:

1. Milestone 1: Soundcalc Integration (Deadline: End of February 2026)
   To ensure consistent and verifiable security assessments across diverse zkEVM implementations, the EF has developed soundcalc. This open-source tool is designed to estimate the security level of zkVMs based on the latest cryptographic security bounds and specific proof system parameters. It is a dynamic tool, continuously updated with new research and known attack vectors. By the end of February 2026, all participating zkEVM teams are required to integrate their proof system components and circuits with soundcalc. This integration will establish a standardized baseline for security measurement, enabling transparent and comparable assessments of cryptographic soundness. This step is foundational, providing the necessary data for subsequent security hardening efforts.

2. Milestone 2: Glamsterdam (Deadline: End of May 2026)
   Following the initial integration with soundcalc, the "Glamsterdam" milestone marks a critical phase for implementing foundational security upgrades and optimizing initial proof structures. While specific details of this milestone are reserved, it is understood to represent a comprehensive review and refinement period where zkEVM teams will apply the insights gained from soundcalc assessments. This period will likely involve addressing identified security weaknesses, optimizing cryptographic primitives for provable security, and beginning the process of streamlining proof generation to balance security with proof size efficiency. This milestone is anticipated to involve a significant push towards aligning designs with the 128-bit security target, laying the groundwork for more advanced security postures. It may also involve public forums or workshops to foster collaboration and knowledge sharing among the ecosystem’s leading cryptographic researchers and developers.

3. Milestone 3: H-star (Deadline: End of 2026)
   The final and most ambitious milestone, "H-star," is slated for the end of 2026. This phase represents the culmination of the security sprint, aiming for the full realization of robust, mainnet-grade architectures with confirmed 128-bit provable security. By this deadline, zkEVMs are expected to have refined their proof systems to a point where they are not only cryptographically sound but also structurally stable. This includes ensuring that complex recursive proof compositions—a cornerstone of modern zkEVM scalability—are meticulously documented and their soundness formally established. The H-star milestone is the ultimate checkpoint before these systems can be considered ready for widespread deployment as secure L1 zkEVMs, signifying a state of architectural maturity and verifiable security.

Leveraging Cutting-Edge Cryptography and Engineering

Achieving these ambitious security milestones is made tractable by recent breakthroughs in both cryptographic theory and engineering practices. Innovations such as compact polynomial commitment schemes like WHIR offer solutions for generating smaller, more efficient proofs without compromising security. Techniques like JaggedPCS contribute to further optimization, while a dedicated approach to "grinding" (a term referring to iterative refinement and optimization of cryptographic parameters) ensures maximum efficiency. Crucially, the development of a well-structured "recursion topology" is paramount. Modern zkEVMs rely heavily on recursion, where proofs of smaller computations are aggregated into a single, larger proof. This complex composition, often involving many custom circuits and intricate "glue logic," requires meticulous design and documentation to ensure the soundness of the entire system. Each team’s approach to recursion architecture and its provable soundness will be a key focus of the upcoming assessment phases.

The Strategic Vision: Stabilizing for Formal Verification

The strategic importance of locking in zkEVM security now cannot be overstated. Securing a continuously "moving target" – a system undergoing rapid architectural changes – is inherently challenging. By establishing these milestones and driving towards architectural stability, the Ethereum Foundation aims to create an environment conducive to formal verification. The work already underway by initiatives like verified-zkevm.org can then reach its full potential. By the H-star milestone, the proof system layer is expected to have largely "settled" – not frozen indefinitely, but stable enough to allow for the formal verification of critical components, the finalization of rigorous security proofs, and the development of specifications that precisely match deployed code. This robust foundation is an absolute prerequisite for the successful and secure deployment of L1 zkEVMs, underpinning the trust and integrity of the entire Ethereum ecosystem.

Implications for the Ethereum Ecosystem

This strategic pivot towards provable security for zkEVMs carries profound implications for the broader Ethereum ecosystem. It signifies a maturation of the scaling solution landscape, moving beyond raw performance metrics to prioritize the fundamental principle of cryptographic integrity. By establishing a clear 128-bit security standard and providing the tools and roadmap to achieve it, the Ethereum Foundation is fostering a more secure and trustworthy environment for decentralized applications and digital assets. This commitment to security will instill greater confidence among users, developers, and institutional investors, accelerating the adoption of zkEVMs and, by extension, the scalability and long-term viability of Ethereum itself. It sets a precedent for rigorous security standards in the burgeoning field of zero-knowledge technology, ensuring that innovation is always tethered to an unwavering commitment to safety.

Building Foundations for a Secure Future

A year ago, the primary question surrounding zkEVMs was whether they could achieve the necessary speed for practical application. That question has been resoundingly answered. Today, the focus shifts to a new, equally vital inquiry: can they prove soundly enough? The Ethereum Foundation’s cryptography team expresses strong confidence in the ecosystem’s ability to meet this challenge. The era of the performance sprint is over. Now, the collective effort is dedicated to strengthening the very foundations upon which the future of a scalable and secure Ethereum will be built.

The Ethereum Foundation cryptography team extends its gratitude to Arantxa Zapico, Benedikt Wagner, and Dmitry Khovratovich for their significant contributions to this initiative, and to Ladislaus, Kev, Alex, and Marius for their diligent review and invaluable feedback.