Shipping an L1 zkEVM #2: The Security Foundations
The Quest for Secure L1 zkEVMs: Building Foundations for a Trustworthy Future
As the zkEVM ecosystem continues to sprint towards a more secure and efficient future, the performance bottlenecks have been largely cleared. Proving latency has dropped from 16 minutes to 16 seconds, costs have collapsed 45×, and zkVMs now prove 99% of all Ethereum blocks in under 10 seconds on target hardware. However, security remains the elephant in the room, and it's time to address this critical issue head-on.
The Case for 128-bit Provable Security
Many STARK-based zkEVMs today rely on unproven mathematical conjectures to hit their security targets. Over the past months, STARK security has been going through a lot, with foundational conjectures getting mathematically disproven by researchers. Each conjecture that falls takes bits of security with it: what was advertised as 100 bits might actually be 80. The only reasonable path forward is provable security, and 128 bits remains the target. It's the security level recommended by standardization bodies and validated by real-world computational milestones.
For zkEVMs, this isn't academic. A soundness issue is not like other security issues. If an attacker can forge a proof, they can forge anything: mint tokens from nothing, rewrite state, steal funds. For an L1 zkEVM securing hundreds of billions of dollars, the security margin is not negotiable.
Three Milestones
To reach the goal of 128-bit provable security, we've set three critical milestones:
Milestone 1: Soundcalc Integration
Deadline: End of February 2026
To measure security consistently, we created soundcalc: a tool that estimates zkVM security based on the latest cryptographic security bounds and proof system parameters. It's a living tool and we plan to keep integrating the latest research and known attacks. By this deadline, participating zkEVM teams should have their proof system components and all of their circuits integrated with soundcalc. This gives us a common ground for the security assessments that follow.
Milestone 2: Glamsterdam
Deadline: End of May 2026
100-bit provable security (as estimated by soundcalc)
Final proof size ≤ 600 KiB
Compact description of recursion architecture and sketch of its soundness
Milestone 3: H-star
Deadline: End of 2026
128-bit provable security (as estimated by soundcalc)
Final proof size ≤ 300 KiB
Formal security argument for the soundness of the recursion architecture
Recent Advances and the Path Forward
Recent cryptographic and engineering advances make hitting the above milestones tractable: compact polynomial commitment schemes like WHIR, techniques like JaggedPCS, a bit of grinding, and a well-structured recursion topology can all contribute to a viable path forward. Recursion is particularly worth highlighting. Modern zkEVMs involve many circuits composed with recursion in custom ways, with lots of glue in between. Each team does it differently. Documenting this architecture and its soundness is essential for the security of the entire system.
The Strategic Reason to Lock in on zkEVM Security Now
Securing a moving target is hard. Once teams have hit these targets and zkVM architectures stabilize, the formal verification work we've been investing in can reach its full potential. By H-star, we hope the proof system layer will have mostly settled. Not frozen forever, but stable enough to formally verify critical components, finalize security proofs, and write specifications that match deployed code.
Building Foundations
A year ago, the question was whether zkEVMs could prove fast enough. That question is answered. The new question is whether they can prove soundly enough. We are confident they can. On our end:
- In January, we'll publish a post clarifying and formalizing the milestones above.
- We will follow up with a technical post outlining proof system techniques for reaching the security and proof size targets.
- At the same time, we will be updating Ethproofs to reflect this shift: highlighting security alongside performance.
Conclusion
The performance sprint is over. Now let's strengthen the foundations. With the three milestones set and recent advances in place, we're confident that we can reach the goal of 128-bit provable security. This is the foundation that is required to get to secure L1 zkEVMs. We're here to help throughout this process. Reach out to the EF cryptography team.
Source: https://blog.ethereum.org/en/2025/12/18/zkevm-security-foundations
