From Speed to Security: The zkEVM Ecosystem’s Critical Pivot Towards 128-bit Provable Soundness

The Ethereum Foundation’s cryptography team, buoyed by the invaluable contributions of Arantxa Zapico, Benedikt Wagner, and Dmitry Khovratovich, and the meticulous review and feedback from Ladislaus, Kev, Alex, and Marius, has announced a significant strategic shift within the zero-knowledge Ethereum Virtual Machine (zkEVM) ecosystem. After a year of intense development focused on optimizing proving speed, the community has successfully crossed the finish line for real-time proving. The immediate future now mandates a rigorous pivot towards building mainnet-grade security, with an explicit focus on achieving 128-bit provable soundness. This transition marks the dawn of a new, crucial phase where robustness and cryptographic integrity take precedence over performance benchmarks.

The Genesis of zkEVMs and the Race for Real-Time Proving

The concept of zkEVMs emerged as a transformative solution to Ethereum’s scalability challenges. By leveraging zero-knowledge proofs, zkEVMs allow for the off-chain execution of transactions and computations, with only a cryptographic proof of their correctness submitted to the main Ethereum blockchain. This dramatically reduces the on-chain data load and processing requirements, promising a future of high-throughput, low-cost decentralized applications. However, the initial hurdle was the inherent computational intensity of generating these zero-knowledge proofs. Proving a block’s validity could take minutes, even hours, rendering real-time applications impractical.

Recognizing this bottleneck, the Ethereum Foundation, in July of the preceding year, established a "north-star definition" for real-time proving. This ambitious target galvanized the zkEVM ecosystem, initiating a sprint to optimize proof generation. The results have been nothing short of revolutionary. In just nine months, the collective efforts of various zkEVM teams have yielded astonishing improvements. Proving latency, once a cumbersome 16 minutes, has plummeted to an impressive 16 seconds. Concurrently, the associated costs have seen a staggering collapse of 45-fold, making the technology significantly more economically viable. Today, zkVMs are capable of proving 99% of all Ethereum blocks in under 10 seconds on target hardware, effectively meeting and exceeding the real-time proving goal. This remarkable achievement has cleared major performance bottlenecks, setting the stage for the next, even more critical, phase of development.

The Critical Pivot: From Performance to Unassailable Security

With the speed challenge largely overcome, the "elephant in the room" has become security. While high-speed proving is essential for usability and scalability, it is meaningless without an ironclad guarantee of correctness and integrity. The current landscape reveals that many STARK-based zkEVMs—Scalable Transparent ARguments of Knowledge, a class of zero-knowledge proofs—still rely on unproven mathematical conjectures to meet their stated security targets. This reliance has become a growing concern within the cryptographic community.

Over the past several months, the foundational security assumptions underlying some STARK implementations have faced intense scrutiny. Researchers have mathematically disproven several long-held conjectures, revealing vulnerabilities where none were previously confirmed. Each such disproof effectively erodes the advertised security level; what was initially presented as 100 bits of security might, in reality, be closer to 80 bits. This degradation is not merely an academic point of interest but a critical risk for systems designed to secure vast amounts of digital assets.

Defining "Provable Security": The 128-bit Standard

In light of these developments, the path forward for mainnet-grade zkEVMs is unequivocally clear: a commitment to provable security. This means constructing cryptographic systems whose security properties can be rigorously demonstrated and mathematically proven, rather than relying on unverified assumptions. The target for this provable security has been set at 128 bits.

The 128-bit security level is not an arbitrary figure. It is the widely accepted industry standard, recommended by leading standardization bodies such as the National Institute of Standards and Technology (NIST) in publications like NIST SP 800-57pt1r5. This level of security is considered robust enough to withstand attacks from even the most powerful computational adversaries, including those employing advanced supercomputing clusters, for the foreseeable future. Its validity has been reinforced by real-world computational milestones and endorsed by prominent figures in the blockchain space, including Ethereum co-founder Vitalik Buterin, who has consistently advocated for robust cryptographic guarantees.

For zkEVMs, particularly those aspiring to function as Layer 1 (L1) solutions or secure high-value Layer 2 (L2) networks, a soundness issue represents an existential threat. Unlike other security flaws, a vulnerability in the soundness of a zero-knowledge proof system is catastrophic. If an attacker can forge a proof—meaning they can generate a valid-looking proof for an invalid computation—they can manipulate the system at will. This includes the ability to mint tokens from nothing, arbitrarily rewrite the blockchain’s state, or outright steal funds. For an L1 zkEVM that could potentially secure hundreds of billions of dollars in value, the security margin is not merely desirable; it is absolutely non-negotiable. Compromising on 128-bit provable security would undermine the very trust model upon which decentralized finance and the broader web3 ecosystem are built.

Navigating the Trade-off: Security vs. Proof Size

The pursuit of heightened security, however, introduces a delicate tension with another critical design parameter: proof size. Generally, increasing the security level of a cryptographic proof system tends to result in larger proofs. While essential for integrity, excessively large proofs pose their own set of challenges. They must remain compact enough to propagate efficiently across Ethereum’s peer-to-peer (P2P) network within acceptable timeframes. If proofs become too large, they can clog the network, delay block finalization, and ultimately negate the performance gains achieved in proving speed. Therefore, the challenge lies in enhancing security to the 128-bit provable standard while simultaneously keeping proof sizes manageable and network-friendly.

To address this intricate balance, the Ethereum Foundation has outlined three strategic milestones, each designed to systematically guide the zkEVM ecosystem towards achieving this dual objective:

Three Strategic Milestones for zkEVM Security

1. Milestone 1: Soundcalc Integration

   • Deadline: End of February 2026
   • To establish a consistent and objective measure of security across diverse zkEVM implementations, the Ethereum Foundation has developed soundcalc. This open-source tool is designed to estimate the security level of a zkVM based on the latest cryptographic security bounds and the specific parameters of its proof system. soundcalc is a dynamic tool, continuously updated to integrate the newest research findings and known attack vectors.
   • By the February 2026 deadline, all participating zkEVM teams are expected to integrate their proof system components and all their circuits with soundcalc. This collective integration will provide a standardized baseline for security assessments, fostering transparency and comparability across the ecosystem. Past integration examples, such as those documented in ethereum/soundcalc/issues/18 and ethereum/soundcalc/pull/21, serve as practical guides for teams. This milestone is foundational, ensuring that all security discussions and advancements are grounded in a common, verifiable metric. It encourages a data-driven approach to security, moving away from subjective claims towards quantifiable assurances.

2. Milestone 2: Glamsterdam

   • Deadline: End of May 2026
   • While the specific details of "Glamsterdam" have not been fully disclosed in the public announcement, it is understood to represent a critical phase in the security roadmap. This milestone is anticipated to focus on the implementation and validation of advanced cryptographic techniques and architectural refinements necessary to meet the 128-bit security target while maintaining proof efficiency. It likely involves rigorous testing, community-wide audits, and possibly the adoption of specific, battle-tested cryptographic primitives or proof constructions. Given the context, Glamsterdam could entail the initial deployment or extensive testing of a new generation of proof systems that inherently offer stronger, provable security guarantees without significant proof size overhead. This phase will likely emphasize collaboration among zkEVM teams to share best practices and collectively overcome complex cryptographic engineering challenges, moving beyond theoretical discussions to practical, verified implementations.

3. Milestone 3: H-star

   • Deadline: End of 2026
   • "H-star" represents the culmination of these security efforts, marking the point where zkEVM architectures are expected to achieve comprehensive 128-bit provable security with optimized proof sizes, ready for widespread mainnet deployment. This milestone will likely involve a final round of security audits, formal verification efforts, and the solidification of design choices that ensure long-term stability and resilience against future cryptographic advancements or attack methods. It signifies the ecosystem’s readiness to deliver a truly robust and trustworthy scaling solution for Ethereum. The achievement of H-star will be a testament to the collective engineering and cryptographic prowess of the community, signaling a mature and secure foundation for the next generation of decentralized applications.

Leveraging Cutting-Edge Cryptography for Security and Efficiency

The ambitious nature of these milestones is tempered by recent breakthroughs in both cryptographic theory and engineering. Several innovative techniques and schemes are poised to make achieving these goals tractable:

• Compact Polynomial Commitment Schemes: Technologies like WHIR (as detailed in eprint.iacr.org/2024/1586.pdf) offer significantly more compact polynomial commitments. These schemes are crucial for reducing the overall size of zero-knowledge proofs without compromising security, directly addressing the tension between security and proof size.
• Advanced Techniques: Methods such as JaggedPCS (eprint.iacr.org/2025/917) further contribute to efficient proof construction, offering new avenues for optimizing proof generation and verification processes.
• Cryptographic Grinding: The concept of "grinding" (eprint.iacr.org/2021/582.pdf#page=47) refers to techniques that increase the security of cryptographic primitives by requiring a certain amount of computational effort from an attacker, effectively raising the bar for successful exploits.
• Well-Structured Recursion Topology: Modern zkEVMs are inherently complex, often involving multiple circuits composed through recursive proofs in custom ways, with "glue" logic connecting different components. Each development team currently implements this recursion differently. A well-structured recursion topology, as exemplified by configurations like soundcalc/zkvms/pico/pico.toml, is vital. It provides a clear, documented architecture for how proofs are aggregated and verified, making the entire system more auditable and sound. Documenting this architecture and its soundness properties is absolutely essential for the overall security of these intricate systems. This standardization and clarity in recursion are critical for formal verification efforts.

The Long-Term Vision: Formal Verification and Architectural Stability

The strategic timing of this focused push for zkEVM security is deliberate. Securing a "moving target" – an architecture that is constantly evolving and undergoing fundamental changes – is incredibly difficult and prone to oversight. By focusing on stabilizing zkVM architectures and locking in these security targets now, the ecosystem paves the way for the full potential of formal verification work, an area where the Ethereum Foundation has been significantly investing through initiatives like verified-zkevm.org.

Formal verification involves using mathematical proofs to demonstrate that a system’s design and implementation adhere to its specifications, providing the highest possible assurance of correctness and security. This labor-intensive process is most effective when applied to stable, well-defined systems. The goal is that by the H-star milestone, the proof system layer of zkEVMs will have largely "settled." While not expected to be frozen forever, it will be stable enough to enable rigorous formal verification of critical components, finalize security proofs with mathematical precision, and write comprehensive specifications that accurately match deployed code. This stability is the fundamental requirement for achieving truly secure L1 zkEVMs, capable of supporting a global, trustless financial infrastructure.

Implications for the Ethereum Ecosystem

The successful transition to 128-bit provable security will have profound implications for the entire Ethereum ecosystem. It will solidify trust in zkEVMs as reliable and secure scaling solutions, encouraging broader adoption by developers and users. This enhanced security posture will de-risk significant capital flows into L2 networks and decentralized applications, fostering innovation and economic growth. Furthermore, it sets a precedent for cryptographic rigor within the blockchain space, promoting best practices and raising the bar for security standards across the industry. The collaborative effort required to achieve these milestones will also strengthen the community, fostering knowledge sharing and collective problem-solving.

A year ago, the central question hovering over zkEVMs was whether they could prove fast enough to be practical. That question has been answered with resounding success. Today, the new, paramount question is whether they can prove soundly enough to be trusted with mainnet-grade assets and computations. The Ethereum Foundation and the broader zkEVM community express confidence that this can and will be achieved. The journey ahead involves rigorous development, collaborative verification, and an unwavering commitment to cryptographic integrity. The performance sprint is over. Now, the collective effort shifts to strengthening the very foundations upon which the future of scalable, secure decentralized computing will be built.