Optimistic vs ZK Rollups: Fraud Proofs, Validity Proofs and the Seven-Day Question

An optimistic rollup is a Layer 2 that executes transactions off-chain, posts the results and the underlying data to Ethereum, and treats them as valid unless someone submits a fraud proof during a challenge window. A ZK rollup is a Layer 2 that does the same off-chain execution but attaches a validity proof to every batch, so Ethereum checks the math before the new state is accepted. Both inherit Ethereum's security and both cut fees by orders of magnitude; they differ in how they earn that security, how long it takes to withdraw, and what it costs to run.

What is the difference between optimistic and ZK rollups?

Every rollup batches transactions off-chain and settles on Ethereum. The Layer 1 vs Layer 2 guide covers why that architecture exists and the layer 2 scaling sector brief covers how rollups batch and settle. The split between the two types comes down to a single question. When the rollup tells Ethereum "here is the new state," how does Ethereum know it's telling the truth?

Fraud proofs. An optimistic rollup answers with a dare. It posts the new state root and opens a challenge window. Anyone running a node can check the batch, and if they find an invalid state transition they submit a fraud proof. On Arbitrum and the OP Stack the dispute is interactive: challenger and defender bisect the disputed execution step by step until one instruction remains, which Ethereum runs itself to settle the argument.^[1] The security assumption is that at least one honest party is watching and can get a challenge included on Ethereum within the window.

Validity proofs. A ZK rollup answers with a proof. A prover runs the batch and generates a SNARK or STARK that says, in effect, "these inputs and this program produce this output," and a verifier contract on Ethereum checks it in a few hundred thousand gas.^[2] If the proof verifies, the state is final. There's no window because there's nothing to dispute. The cryptography behind the proofs, SNARKs against STARKs and the trusted-setup question, is in the ZK proofs and rollups guide.

The "zero-knowledge" label is a historical accident: rollup validity proofs hide nothing, and what they borrow from ZK cryptography is succinctness, the ability to verify a huge computation by checking a small proof.

One caveat that matters more than the theory. For years the fraud proofs on the biggest optimistic rollups were either not deployed or limited to a whitelist of challengers, which meant the "anyone can challenge" story was aspirational. That has changed: OP Mainnet and Base shipped permissionless fault proofs in 2024 and Arbitrum followed with BoLD in 2025. L2BEAT's stage ratings remain the place to check how much of any rollup's security is actually enforced on-chain rather than promised.^[3]

Which is faster to withdraw from?

ZK rollups, and it isn't close.

On an optimistic rollup, a withdrawal through the native bridge can't complete until the batch containing it has survived the challenge window, which is typically about seven days on Arbitrum, OP Mainnet and Base. The length isn't arbitrary. It has to be long enough that a determined attacker couldn't censor every challenger's transaction on Ethereum for the whole period, and long enough for honest watchers to notice and respond. Shortening it weakens the dare.

Third-party bridges route around the wait. A liquidity provider fronts you the funds on Ethereum in minutes, takes a fee, and collects the slow withdrawal themselves a week later. That's convenient, but it swaps the rollup's security for the bridge's, and the bridges guide explains why that trade deserves attention.

On a ZK rollup, the withdrawal completes once the batch's proof has been verified on Ethereum. In practice that's minutes to a few hours, depending on how often the rollup posts proofs and whether the team has added a deliberate delay as a safety buffer against prover bugs. Some have. It's still hours rather than days.

For everything short of a withdrawal to Layer 1, the two feel identical. Both types run a sequencer that confirms your transaction in a second or two, and both are equally fast on the rollup itself. The gap only opens when you leave.

What does proving cost, and who pays?

Here the advantage flips.

An optimistic rollup does no proving in the normal case. It executes transactions, posts data and state roots, and waits. Fraud proofs cost something only when a dispute happens, which on the major networks has been almost never. The operating overhead beyond data posting is close to nothing.

A ZK rollup pays for every batch. Generating a validity proof means re-running the batch inside a proving system that's far more expensive than plain execution, typically on clusters of GPUs, with proof times measured in minutes per batch. Then the proof has to be verified on Ethereum, which costs gas regardless of how many transactions it covers. Both costs are amortized across the batch, so a busy ZK rollup spreads them thin, but a quiet one can't. That's why low-activity ZK rollups post proofs less often, and why their per-transaction fees carry a floor that optimistic rollups don't have.

The gap has closed fast. Prover costs fell by roughly an order of magnitude a year through 2023 to 2025, and by 2025 several teams had demonstrated proofs of full Ethereum blocks in under a block time on consumer GPU hardware. The remaining cost is real but shrinking, and it's the reason most new rollups launched since 2024 chose ZK designs.

How does EVM compatibility differ?

Optimistic rollups win here, and for a simple reason: they run Ethereum's own software. OP Stack chains run a lightly modified geth, Arbitrum Nitro wraps geth in its own execution layer, and in both cases existing smart contracts, tooling and developer habits carry over unchanged.

ZK rollups have to prove EVM execution, and the EVM was never designed to be proved. Every opcode, every hash and every storage access has to be expressed in a form a prover can handle, and some of Ethereum's choices (Keccak hashing, the Merkle Patricia trie) are painful in that form. The zkEVM types describe how much a rollup bends to accommodate that. Scroll, Linea and Polygon zkEVM aim for bytecode-level EVM equivalence, so Solidity contracts deploy as-is. zkSync Era compiles Solidity through its own compiler to a custom virtual machine, which runs most contracts fine but differs in low-level details. Starknet doesn't run the EVM at all; contracts are written in Cairo, a language built around what STARK provers do well.

The gap is closing here too. Provers that handle the unmodified EVM now exist, and the practical developer experience on the EVM-equivalent ZK rollups is close to the optimistic ones. But if you need exact parity with Ethereum today, including the edge cases, optimistic rollups remain the safe answer.

Data availability and blobs: the cost both types share

Whatever proof system a rollup uses, it has to publish enough data for anyone to reconstruct its state without trusting the operator. That's data availability, and it's what makes a rollup a rollup rather than a validium. It's also where most of the fee goes.

Until March 2024 rollups published that data as ordinary Ethereum calldata, competing with every other transaction for block space. The Dencun upgrade changed that with EIP-4844, which added blobs: chunks of roughly 128 KB attached to blocks, priced in their own fee market and pruned by nodes after about 18 days.^[4] Rollup fees fell from tens of cents to fractions of a cent almost overnight. Pectra raised the blob target and maximum per block in 2025, and later upgrades have kept adding capacity.

Blobs cost the same whether the batch comes with a fraud-proof dare or a validity proof, so on a busy day the data bill dominates and the proving cost is a rounding error. And when blob demand exceeds the target, the blob base fee rises the same way Ethereum's execution fee does, and every rollup's fees rise together. To see what a rollup transaction costs once exchange fees, spread and the network fee are added, the crypto fee calculator does the round-trip arithmetic.

Validiums sidestep the bill by keeping data off Ethereum entirely, in exchange for a weaker guarantee: if the off-chain data provider disappears, so does your ability to prove what you own. That's a ZK-only design choice and a different product from a rollup.

Who runs which, and what the label doesn't tell you

The optimistic side is where the users are. Arbitrum One has been the largest general-purpose rollup by value locked for most of the past three years. OP Mainnet is the reference chain for the OP Stack, the framework that Base, Coinbase's rollup, and dozens of other chains are built on. Base has grown into one of the busiest chains in crypto by transaction count.

The ZK side is where the engineering has been. zkSync Era, Starknet, Scroll and Linea each run their own prover stack and each took a different path through the EVM question. Polygon zkEVM is on the list too, although Polygon has tied its future to its AggLayer work rather than to the rollup as a standalone product, so check its status before assuming it's a live comparison.

Two things the label doesn't tell you. First, both camps run a single centralized sequencer, which is the operator that orders transactions and gives you your instant confirmation. That operator can't steal funds on either design, and both have forced-inclusion paths through Ethereum, but it can censor or delay, and its ordering power is the rollup's MEV position. Second, most rollups can still be upgraded by a multisig or security council, and an upgrade key that can change the proof system matters more than which proof system it currently is. The stage ratings on L2BEAT exist to grade exactly that.

The categories are also blurring. The OP Stack can already be run with ZK proofs in place of fraud proofs through projects like OP Succinct. Within a few years "optimistic vs ZK" may describe a rollup's history more than its present.

Which one for whom?

If you move assets in and out often. Withdrawal time is your cost. A ZK rollup returns funds to Ethereum in hours. On an optimistic rollup, budget for about seven days through the native bridge or accept third-party bridge risk and fees to skip the wait.

If you're deploying a contract. Optimistic rollups give you exact EVM behavior and the deepest tooling. The EVM-equivalent ZK rollups are close enough for most Solidity code; Starknet means learning Cairo. Pick by what you need to run, not by the proof system.

If you're judging where funds are safe. Look past the type. Check the rollup's L2BEAT stage, whether its proofs are permissionless, who holds the upgrade keys and how long the exit window is. A Stage 1 optimistic rollup with live fraud proofs is better guarded than a ZK rollup whose prover can be swapped out by a multisig tomorrow.

If you're weighing the tokens. ARB, OP, ZK and STRK are governance tokens whose value doesn't track the proof system underneath them. What moves them is activity, fee revenue, unlock schedules and the incentives their treasuries hand out. The proof type is a footnote in that analysis.

If you're reading Ethereum itself. The rollups are Ethereum's scaling plan, and both types settle to the same chain, post to the same blob market and pay fees in ETH. The Ethereum brief covers how that flow feeds back to the base asset.