Scroll is a ZK rollup built on Ethereum that achieves bytecode-level compatibility with the Ethereum Virtual Machine. Transactions batch onchain on Ethereum mainnet as validity proofs, cutting fees to cents while inheriting Ethereum's security guarantees. The project was founded in 2021 and launched its mainnet in October 2023. Read Scroll's mainnet launch post.
​

To understand the broader rollup landscape before diving in, see What Is a Rollup: Optimistic vs ZK Rollups.
​

The team behind Scroll set out to solve a specific problem: most early ZK rollups required developers to rewrite their contracts in custom languages or accept partial EVM support. Scroll took the opposite bet, building a circuit layer that mirrors the EVM opcode by opcode so that any Solidity or Vyper contract deploys without modification. That design choice has tradeoffs, explored below, but it is the foundation of Scroll's identity as a network.
​

Scroll is not a venture-backed protocol with a single controlling entity in the traditional sense. The core team operates as a research-focused organization, and a substantial portion of early funding came from ecosystem grants and private rounds that emphasized the open-source proving infrastructure. The codebase, including the zkEVM circuits, is publicly available on GitHub under scroll-tech.
​

Scroll generates a ZK proof for every batch of transactions by encoding EVM execution as arithmetic circuits. Each opcode in the EVM, from simple additions to complex storage reads, is translated into a set of polynomial constraints. A prover then generates a proof that those constraints are satisfied, which Ethereum mainnet verifies in a single onchain check. This is what makes Scroll a ZK rollup rather than an optimistic rollup: correctness is proven mathematically, not assumed and challenged. For a primer on the underlying proof concepts, see What Is a Cryptographic Proof: ZK Proofs and Blockchain Verification.
​

Scroll operates at what the ZK community calls Type 2 EVM equivalence, a classification defined by Vitalik Buterin in his ZK-EVM types post. Type 2 means Scroll is fully bytecode compatible: you compile a contract once, deploy the same bytecode on Scroll, and it runs identically. The one caveat is that Scroll makes minor changes to how certain data structures are hashed to make ZK proving more efficient. Those changes are invisible at the application layer but mean Scroll is not a perfect replica of Ethereum's state model at the hash level.
​

The proving pipeline works in stages. When a sequencer orders transactions and produces a block, it sends execution traces to a set of provers. Those provers run the halo2 proving system (described in more detail in its own section below) to generate a chunk proof covering a subset of transactions, then aggregate chunk proofs into a batch proof, and finally compress the batch proof into a single succinct proof submitted to the Scroll rollup contract on Ethereum Layer 1. The L1 verifier contract checks the proof and updates the canonical state root.
​

Proving time was one of the earliest criticisms of ZK-EVMs: generating a proof for a complex block could take minutes on commodity hardware. Scroll has reduced this through parallelized proving across multiple machines and optimized circuit design. As of mainnet operation, typical finality for a transaction (from submission to an accepted L1 proof) runs in the range of minutes rather than the hours associated with optimistic rollup challenge windows. L2Beat's Scroll profile tracks live proof submission latency and other risk parameters.
​

Three major ZK-EVM networks compete for developer mindshare: Scroll, zkSync Era, and Linea. They share the same goal, proving EVM execution with ZK proofs, but differ in proof system choice, EVM compatibility philosophy, native account abstraction support, and ecosystem maturity. The table below compares key dimensions as of mainnet operation in 2024-2025. For a detailed look at one competitor, see What Is zkSync: Ethereum's ZK Rollup Explained.
​

The biggest practical difference for developers is the EVM compatibility level. zkSync Era uses a compiler that transpiles Solidity to its own intermediate representation, which means some edge cases in bytecode-level behavior differ. Scroll and Linea both target bytecode compatibility, so contracts that depend on CREATE2 address derivation or EXTCODEHASH work identically. The tradeoff is proving cost: bytecode compatibility requires more complex circuits, which historically meant slower proof generation than Type 4 approaches.
​

Scroll uses halo2, a ZK proving system originally developed by the Zcash Electric Coin Company and later extended by the Scroll team. halo2 is notable because it does not require a trusted setup ceremony per circuit, relying instead on a universal structured reference string. This matters for trust assumptions: a compromised trusted setup can allow fake proofs; halo2 removes that per-circuit risk entirely. Scroll's proof generation post covers the architecture in depth.
​

The proving system is structured in layers. At the base level, individual EVM opcodes map to custom gates in halo2 circuits. Scroll organizes these into a "super circuit" that handles the full EVM execution trace, and separate sub-circuits handle memory, stack, bytecode, and storage operations. These sub-circuits are then aggregated using a recursive proof scheme so that one compact proof represents the entire batch.
​

Hardware requirements for running a prover are significant. Generating proofs for a full Ethereum-equivalent block requires substantial CPU and memory resources, and competitive proving times require either high-end multi-core machines or GPU acceleration. Scroll has been working on GPU proving to make the economics of running a prover more accessible, which is a prerequisite for the decentralized prover market described in its roadmap.
​

The decentralized prover network is one of Scroll's most discussed future milestones. In the current architecture, Scroll operates the provers centrally, meaning proof generation is not permissionless. The roadmap calls for opening this to a competitive market where third-party provers bid to generate proofs, earn fees, and compete on latency. This model requires that the proof system be efficient enough for commodity proving hardware to be viable, which is why GPU proving optimizations are a prerequisite. L2Beat's permissions section documents the current trust assumptions in detail.
​

Scroll has attracted a range of DeFi protocols since mainnet launch, with total value locked growing as major applications deployed on the network. The ecosystem includes AMMs, lending markets, liquid staking wrappers, and perpetuals platforms. USDC and USDT are both available natively on Scroll via their respective canonical bridges, making stablecoin-denominated DeFi accessible without wrapping. For background on how DeFi works across L2 networks, see What Is DeFi: How Decentralized Finance Works.
​

Key DeFi protocols live on Scroll include:

Scroll ran a points program called Scroll Marks in 2024 designed to reward early users and liquidity providers. Marks were accrued by holding eligible assets in Scroll wallets and by providing liquidity to qualified DeFi pools. The program was a precursor to a potential token distribution, though Scroll had not announced a formal token at the time of this article. Points programs of this type are common among L2 networks as a way to bootstrap liquidity before a token launch. Scroll's ecosystem page lists current protocols and integrations.
​

TVL figures for Scroll can be tracked in real time on DeFiLlama and L2Beat. As with all L2 ecosystems, TVL fluctuates with ETH price, points program incentives, and broader market conditions. Comparing TVL across ZK-EVMs is useful for gauging relative ecosystem depth, but a single snapshot number can be misleading given how incentive programs temporarily inflate locked value.
​

Moving assets to and from Scroll uses a different mechanism than optimistic rollups, and the timing works in Scroll's favor. The canonical Scroll bridge at scroll.io/bridge handles deposits and withdrawals between Ethereum mainnet and Scroll. Deposits from L1 to Scroll typically confirm within minutes. Withdrawals from Scroll to Ethereum mainnet require waiting for a ZK proof to be generated and accepted on L1, which typically takes under an hour in normal network conditions.
​

This is a meaningful advantage over optimistic rollups, which impose a 7-day challenge window on withdrawals. The 7-day period exists because optimistic rollups assume transactions are valid and allow time for fraud proofs to be submitted. ZK rollups prove validity upfront, so once the proof is on L1, the withdrawal is final. There is no waiting period beyond proof generation time. For context on the broader interoperability question, see What Is Blockchain Interoperability: Cross-Chain Communication Explained.
​

Third-party bridges offer faster liquidity for users who do not want to wait for the canonical proof cycle. Protocols like Orbiter Finance, Hop Protocol, and various cross-chain liquidity networks support Scroll as a destination. These bridges work by having liquidity providers on the destination chain front the funds immediately, with the provider reclaiming their capital once the canonical proof settles. The tradeoff is that third-party bridges carry smart contract risk and sometimes charge higher fees than the canonical bridge.
​

For ERC-20 tokens, the Scroll bridge handles the lock-and-mint pattern: the token is locked in a bridge contract on L1 and a corresponding wrapped representation is minted on Scroll. Native USDC on Scroll uses Circle's Cross-Chain Transfer Protocol so that USDC burned on Scroll is redeemed as native USDC on L1 without a wrapped intermediary, reducing trust assumptions for stablecoin transfers.
​

Scroll's published roadmap focuses on three major tracks: sequencer decentralization, prover decentralization, and proof recursion improvements. Each track has distinct technical prerequisites and timelines. The overarching goal is to move Scroll from a network where the core team operates critical infrastructure to one where those roles are open to permissionless participants. Scroll's security and roadmap post outlines the phased approach.
​

Sequencer decentralization means replacing the single Scroll-operated sequencer with a set of validators that can take turns proposing blocks. This requires a consensus mechanism at the L2 level and adds complexity to the overall protocol, since the ZK proving system needs to handle blocks produced by untrusted sequencers. Scroll has referenced a based rollup model, where Ethereum L1 validators sequence L2 transactions directly, as a potential architecture for achieving this without adding a separate consensus layer.
​

Prover decentralization, as noted above, opens proof generation to a competitive market. The economic design of this market is still being worked out. Provers need to be compensated for the compute cost of generating proofs, and the fee structure needs to prevent scenarios where no prover is willing to generate a proof (liveness failure) or where provers collude to extract excessive fees.
​

Proof recursion improvements aim to reduce the L1 gas cost of verifying Scroll proofs. Each batch proof submitted to Ethereum mainnet consumes gas for the on-chain verification step. Advances in proof aggregation and recursion let Scroll combine more transaction data into a single L1 calldata submission, spreading the fixed verification cost over more transactions and lowering the per-transaction gas overhead.
​

The Scroll SDK is a longer-horizon initiative to let other projects use Scroll's ZK proving stack to deploy their own application-specific ZK chains. This positions Scroll as infrastructure rather than just a single network. Similar SDK strategies are being pursued by other ZK stack providers, suggesting the market is moving toward a model where ZK proving is a shared utility across many specialized chains.
​

No. Scroll and zkSync Era are separate ZK rollup networks built by different teams with different proof systems. Scroll uses halo2 and targets bytecode-level EVM compatibility (Type 2). zkSync Era uses a custom STARK-based prover and a compiler-based compatibility approach (Type 4). Contracts written for one do not automatically work on the other without review.
​

Withdrawals from Scroll to Ethereum mainnet typically finalize within one hour under normal network conditions, once a ZK validity proof for the batch containing your transaction is submitted and accepted on Ethereum L1. This is far shorter than the 7-day challenge window on optimistic rollups. Third-party bridges can settle faster by using liquidity providers on the destination chain.
​

As of this writing, Scroll had not launched a native protocol token. The network ran a Scroll Marks points program in 2024 as a mechanism for recognizing early participants. Whether those marks convert to a token and under what terms has not been formally announced. Follow Scroll's official channels at scroll.io for any token-related announcements before making financial decisions.
​

Yes, with narrow exceptions. Scroll's bytecode-level EVM compatibility means almost all Solidity and Vyper contracts deploy without modification. A small number of edge cases involving specific precompiles or opcodes may behave differently at the hash level due to Scroll's state-tree changes, but the vast majority of deployed Ethereum DeFi contracts run identically on Scroll without a recompile or audit for compatibility.
​

Scroll transaction fees are substantially lower than Ethereum mainnet, typically ranging from a few cents to under a dollar for standard operations. Fees consist of two components: an L2 execution fee and an L1 data fee that reflects the cost of submitting batch calldata to Ethereum mainnet. During periods of high Ethereum L1 gas prices, the L1 data component rises; during low-gas periods, total costs drop to a few cents per transaction.
​

Methodology and sources: This article draws on Scroll's official documentation at scroll.io, L2Beat's independent risk analysis at l2beat.com, Vitalik Buterin's ZK-EVM type classifications, and Scroll's public GitHub repositories. TVL figures and protocol listings reflect conditions as of early 2025 and should be verified against current data before making decisions.
​