Optimistic Rollups vs ZK Rollups
Optimistic rollups assume batches are valid and allow challenges; ZK rollups prove every batch. Compare withdrawals, costs, compatibility and the risks of each.
The key difference in optimistic vs ZK rollups is how Ethereum knows a batch of transactions is correct. Optimistic rollups assume it is and give anyone about a week to prove otherwise. ZK rollups attach a cryptographic proof that Ethereum checks right away. That choice drives withdrawal times, costs and how hard each system is to build.
Optimistic rollups: innocent until proven guilty
An optimistic rollup posts its batches to Ethereum without proving them. If someone believes a batch is wrong, they submit a fraud proof during the challenge window, roughly seven days. If the challenge succeeds, the bad batch is reverted and the party that posted it is penalized. Security therefore depends on at least one honest party watching and able to challenge.
ZK rollups: proven every time
A ZK rollup generates a validity proof, a short piece of cryptography that shows the batch followed the rules, and posts it with the data. Ethereum’s contract verifies the proof. If it checks out, the batch is final; there is nothing to challenge. Our guide to zero-knowledge proofs explains the underlying idea.
Figure: Why withdrawals through the official bridge take about a week on optimistic rollups but not on ZK rollups.
Side by side
| Optimistic rollups | ZK rollups | |
|---|---|---|
| How correctness is ensured | Fraud proofs during a challenge window | Validity proof checked on Ethereum |
| Withdrawal via official bridge | After about 7 days | Once the proof is verified |
| Cost per batch | Lower; no proof to generate | Higher computation to generate proofs |
| Smart-contract compatibility | Close to Ethereum’s, easy to port apps | Harder historically; improving |
| Main security assumption | At least one honest challenger | Correct proof system and circuits |
| Engineering complexity | Lower | Higher |
A withdrawal on each, compared
Suppose you want to move funds from a rollup back to Ethereum through its official bridge.
On an optimistic rollup, you start the withdrawal on the rollup, wait for the batch containing it to be posted to Ethereum, and then wait out the challenge window of about seven days before claiming the funds on Ethereum. The week exists so that anyone can dispute a fraudulent batch before money leaves.
On a ZK rollup, you start the withdrawal, wait for the batch to be proven and the proof to be verified on Ethereum, and then claim. The wait depends on how often the rollup generates proofs, typically hours rather than days, and once verified there is no further dispute period.
For users who rarely leave a rollup, the difference matters little. For businesses that move funds between layers often, it can decide which design they prefer.
Where the costs come from
The two designs pay for security in different places. An optimistic rollup avoids the heavy computation of generating proofs, so each batch is cheap to produce, but it must post enough data for challengers to recheck everything and must keep a challenge system running. A ZK rollup spends significant computing power generating each proof, but the proof lets it post less detailed data, and verification on Ethereum is relatively cheap. As proving hardware and software have become faster, the cost gap has narrowed.
When optimistic rollups fit better
Optimistic rollups reached the market first and ran existing Ethereum applications with few changes, which helped them build large user bases and deep liquidity. For users who rarely move funds back to Ethereum, the seven-day withdrawal matters little, and third-party bridges offer faster exits for a fee.
When ZK rollups fit better
ZK rollups suit uses where fast, final settlement on Ethereum matters, such as exchanges moving funds between layers or applications that need quick withdrawals. Their proofs can also compress data more aggressively, which helps as activity grows.
Is a ZK rollup always the safer choice?
“ZK rollups are more secure” is common, but a validity proof is only as good as the code that defines it. A bug in a proof circuit could let an invalid state through, and some ZK systems still rely on upgradeable contracts or limited provers. Meanwhile, an optimistic rollup with a working, permissionless fraud-proof system and active watchers can hold up well in practice. The maturity of each specific rollup matters more than its family.
Who watches an optimistic rollup?
The security of an optimistic rollup rests on someone actually checking its batches and challenging bad ones in time. In a mature design, anyone can run the software to recompute the rollup’s state and submit a fraud proof, so a single honest watcher is enough. In less mature designs, only approved parties can challenge, or the fraud-proof system is not yet live, which shifts trust back to the rollup’s team. Because watching costs money and most batches are honest, the incentives for independent watchers are an ongoing design question.
The designs are converging
The line between the two families is blurring. Some optimistic rollups are adding zero-knowledge proofs to shorten their withdrawal times, and some projects combine both approaches, using validity proofs where they are practical and fraud proofs as a fallback. ZK rollups, meanwhile, have become far more compatible with existing Ethereum applications than they were a few years ago. For users, the more useful question increasingly is not which family a rollup belongs to, but how mature its proof system is and how much control its team keeps.
How to tell which type you are using
A rollup’s documentation, and independent trackers that rate layer 2 networks, state which proof system it uses. A practical clue is the official withdrawal time: a delay of about a week points to an optimistic design, while a delay of hours suggests a ZK system. Trackers also show whether the proof system is fully live and permissionless, whether the team can upgrade contracts without delay and whether users can exit on their own, which together say more about safety than the label on the rollup.
The risks both share
Both types can run a single sequencer, both have contracts that teams can upgrade, and both depend on Ethereum for data. A rollup’s real security comes from the details: who can upgrade it, how quickly, and whether users can exit on their own if the operator disappears.
For the basics of how rollups work, read what Ethereum rollups are. For the wider scaling picture, see layer 1 vs layer 2 and what Ethereum is.
This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.
Frequently asked questions
Which type do most users actually use?
Both families host large, widely used networks. For everyday use, factors such as fees, supported applications and the maturity of each network’s controls usually matter more than its proof system.
Can a third-party bridge avoid the seven-day wait?
Yes. Liquidity providers will give you funds on Ethereum quickly in exchange for your claim on the rollup, charging a fee for the service. You then depend on that provider and its contracts instead of the official bridge.