Taiko: the King of ZK-Rollups?
How Taiko is the most EVM-equivalent zk rollup
Taiko stands out as a decentralized EVM-equivalent ZK-rollup.
Given the varying compatibility levels of zk-rollups with the Ethereum Virtual Machine (EVM), this makes Taiko especially enticing to developers.
As a fully EVM-compatible platform, Taiko is categorized as a Type 1 zk-evm, which means to be “Ethereum-equivalent”.
For instance, the Taiko client is currently based on the battle-hardened Go-Ethereum client. This doesn't only ensure perfect VM compatibility but also compatibility in terms of hashing algorithm, signature scheme, and storage data structures.
In essence, Taiko is architecturally identical to Ethereum.
The core advantage of a Type 1 zk-rollup is full compatibility with EVM tooling and ecosystem without requiring any upfront costs for developers.
Furthermore, being a Type 1 rollup also means that Taiko will continually mirror future Ethereum developments.
Taiko Architecture
Taiko is built on three pillars:
zk-evm circuits for proof generation
The L2 rollup node, managing the rollup chain
The protocol smart contract on L1, connecting the two to verify the rollup protocol
1. ZK-EVM
Taiko zk-evm proves the “correctness of the EVM computation on the rollup using validity proofs”.
Thanks to EVM equivalence, developers can smoothly transfer their smart contracts to Taiko, ensuring a frictionless and cost-free experience. All EVM opcodes are supported by the zk-evm, which produces validity proofs.
Additionally, the EVM-equivalence also saves Taiko from additional risks from compiling smart contracts in other languages.
2. L2 Rollup Node
The L2 nodes oversee the rollup chain; currently Taiko employs a fork of Geth, a widely-used Ethereum client. Taiko L2 nodes work as follows:
Get transaction data from Ethereum
Execute transactions on L2 updating the state of the chain according to the transactions executed
3. Taiko Protocol Smart Contract
Deployed on Ethereum L1, this contract serves dual purposes:
Data Availability
ZK-SNARK proof verification
This contract also defines and enforces the rollup rules, upholding the core principles of Taiko:
Security
Decentralization
Being permissionless
Within this defined architecture, there are three main network participants:
Proposers: construct rollup blocks from transactions on L2 and propose them to L1. Taiko allows anyone to perform the function of proposing blocks.
Provers: generate ZK-SNARK proofs, for the validity of L2 transactions and blocks once they are generated by the Proposers (this function is also open to any participant in the network)
Node Runners: execute transactions from on-chain data (from L1) to transition the state of the chain. Both Proposers and Provers need to run nodes, but Taiko nodes are open to anyone.
A Based Rollup
Taiko is a so-called based rollup, that wants to maximize its level of decentralization by using Ethereum L1 validators to propose blocks.
One of the classic debates with rollup is about the decentralization of the sequencer: this does not apply to Taiko, as it has no sequencer.
It’s always L1 validators who will decide the sequencing of blocks and transactions on Taiko (no proposer consensus).
Going forward Taiko can also leverage tools such as EigenLayer to use Restaking to incentivize L1 validators to build Taiko blocks.
Slots for proposed blocks are managed by the Taiko protocol contract deployed on L1. Blocks take the form of a “ring buffer” and not a queue, so that slots can be re-used to lower gas costs. Taiko blocks cost about 30k in gas.
Nonetheless, given the absence of consensus, what happens when blocks are proposed by different proposers without knowing each other and transactions in the blocks are repeated or conflicting?
Taiko defines a set of rules to map a proposed block into an L2 block deterministically after a block has been proposed.
In this way, any block proposed in the ring buffer is finalized, and all the transactions will either be deemed valid or invalid — if challenged. Once proposed the transactions within the block are not revertible.
In a worst-case scenario, all transactions will be invalid (e.g. included in the previous block) and in this case, the block will be empty.
For every proposed block you can always derive a valid Taiko block on L2.
Taiko is also referred to as a “sovereign rollup”: where you have consensus among L2 nodes about the state of the network after each block.
This makes Taiko a functional layer 2 as a blockchain, where all the nodes know what’s going on.
However, it’s quite hard to convince the L1 about the correct state, since Ethereum doesn’t know anything about the Taiko state (which makes it harder to do cross-chain communication).
Taiko state transitions are proven to Ethereum using zk proofs.
Different people can provide different proofs, even for the same block if they believe in different transitions.
But.. How does this process work?
In Taiko, blocks are made up of transactions executed subsequently.
New blocks are added, updating the state of the chain.
How are blocks submitted within Taiko?
Block Proposal: a block is proposed and published on Ethereum (appended to the list of proposed blocks in the TaikoL1 contract). At this point, the block is immutable, so anyone can calculate the state transition of the chain. As multiple blocks are proposed simultaneously, there may be some invalid transactions that Taiko L2 nodes will skip over.
Block Verification: as all blocks are deterministic, they can be proven in parallel (all intermediate states and parents of the blocks are known). In fact, once a proof is verified and the parent block is (on-chain) finalized, then the block itself is marked as finalized.
All the data necessary to reconstruct the last state of Taiko is publicly available on Ethereum, contributing to the decentralization of Taiko.
Who will prove blocks?
Before proposing a block, you need to talk to a lot of potential provers (how much is the prover charging me?). Similar to a Flashbot approach you can select the most efficient one according to your criteria.
The prover then becomes that block’s “assigned prover”, entering a social contract:
Proposer immediately pays Prover some ETH as proving fee
The Prover places a TKO token bond (as “collateral”) and is committed to proving a state transition within a certain time window.
If successful: prover receives his bond back + fees
If failure: the bond will be used to reward the actual prover (slashed), and any remaining bond will be burned
What if the prover fails to prove a block?
In case an assigned Prover fails to prove a block, it then becomes “open” after 90 minutes and any Prover (even without bond) is able to prove it — on a first come first serve basis.
Do we need ZK proofs for every block?
Since Taiko targets Type-1, it prioritizes EVM-equivalence over ZKP generation speed, which makes it disadvantageous in terms of ZKP generation time and cost compared to other ZK rollups. State transitions then become computationally expensive. In a negative flywheel, when the performance of ZKP generation deteriorates, it takes a longer time to achieve finality
Nonetheless, Taiko protocol design aims to mitigate the drawbacks of slow proving.
Taiko avoids using zk proofs for every block by allowing users to deposit a TKO bond when they believe a block is valid and are ready to be challenged.
If there’s no challenge (within a timeframe) to this assertion, this transition can be used to verify a block.
Only if there’s a challenge on the validity of the block, then Taiko resorts to a zk proof, which is more expensive but more trustworthy.
Challengers are required to put a bond at stake - and whoever is right will get the tokens back + extra rewards.
Contrary to Optimistic Rollups, which use Fraud Proofs to prove some calculations wrong, Taiko uses this system to prove that blocks are correct.
With the current design, Taiko estimates that only 1% of blocks will need zk proofs.
In this way, they can minimize the necessary computation by leveraging a "multi-proofs” system:
“Optimistic Proofs” with a token bond: cheaper, using token bonds, less trustworthy
Zk-proofs: more expensive, no bond, more trustworthy
With such a large codebase and the assumption that zk-proofs are not bug-free, Taiko is also implementing multi zk-proofs.
In this way, dApps will be able to configure the necessary trust assumptions according to their specific requirements.
Roadmap & Food for Thought
Taiko mainnet is expected in early 2014.
Currently, they have released a few Alpha Testnets.
Taiko’s approach focuses on decentralization and maximum EVM compatibility. In this way, they are aligned with Ethereum and its broader roadmap.
Their commitment to decentralization is also proven by the gradual decentralization of governance powers in the hands of the Taiko DAO.
Not all zk-rollups are made the same.
By having a higher EVM equivalence Taiko sacrifices some speed in generating zk-proofs. However, their ingenious design leveraging a multi-proof system is expected to only use zk-proofs for 1% of the blocks.
The mechanism design relies on the use of token bonds to prevent spammers from challenging every transaction. Nonetheless, what happens if more than 1% of the blocks require zk-proofs? Would the network be too expensive to transact?
As most of these promising zk-rollups go live, we’ll soon learn more about their feasibility and usability, moving from airdrop playgrounds to the much-awaited next paradigm.
Great article!