Hybrid rollups revisited: discover Metis, Aztec, Miden, Nightfall, and Ola

Crypto Education

Intermediate

Beginner

Expert

Alice Orlova

May 13, 2024

min read

Read this article in other languages

Hybrid rollups are a new class of Ethereum L2s that either combine optimistic and ZK technology or enable both public and private smart contracts. Discover the five main hybrid rollup projects in our updated guide.

What is a hybrid rollup?

Before we start, make sure you’ve read our previous articles on optimistic and zero-knowledge (ZK) rollups. Otherwise, this will be very confusing!

The term “hybrid rollup” can have two meanings:

1) an L2 scaling solution, mostly for Ethereum, that combines the scalability of optimistic rollups and the security of ZK rollups. The best examples are the rollups built by Metis DAO and Frax Finance.

2) an L2/L3 scaling solution that supports both public and private smart contracts and transactions. Uses who want privacy can execute contracts on their own devices, generate their own ZK proofs, and upload them to the rollup. These are very cost-efficient, because the rollup only needs to verify the proofs, not the transactions themselves.

To unpack both definitions, let’s first remember how the two basic rollup types work.

Optimistic vs. ZK-proof rollups

Rollups improve Ethereum’s high fees, and slow speed. Rollups are essentially separate chains that take a batch of transactions, process them quickly and cheaply, then packageand upload the results to the mainnet.

The main problem here is how to verify that all the transactions in a batch are valid. It’s here that optimistic and ZK (zero-knowledge) rollups differ.

An optimistic rollup, such as Optimism or Pontem’s own SuperLumio, presumes that all transactions are valid. It doesn’t do any serious checks and thus saves time and resources. The main advantages of optimistic rollups are scalability and fast confirmation.

However, when the batch is uploaded to Ethereum, there is a 7-day challenge window when any validator can contest a transaction that they believe to be fraudulent. This means regular users have to wait a week when bridging funds from Arbitrum or Optimism back to the Ethereum mainnet. This is the “real” finality time – and 7 days is extremely long, considering that the best L1s like Aptos boast sub-second finality.

Read our article on SuperLumio

A ZK rollup (such as zkSync Era) generates a special proof of validity and attaches it to the batch, so that everyone on Ethereum can be sure that transactions uploaded from the rollup are valid. Thus, ZK rollups do not need challenge windows, and have improved security and faster finality.

The power of ZK is that you can verify information is true without revealing it. ZK proofs can also be lightweight, though they take a lot of resources to calculate. On the rollup chain itself, confirmation time is slower for ZK than optimistic L2s..

Technical complexity and cost are the main reasons why it took longer for fully operative ZK solutions to appear on the market.

Read our article on zkEVM and zkSync

Hybrid Combinations of Optimistic and ZK: Metis, ZKM, and Nightfall

Metis and ZKM

Metis is an L2 for Ethereum that was created by forking Optimism (now called “OP Mainnet”) and optimized for advanced use cases like decentralized autonomous corporations (DAC). Metis can support many optimistic L2 chains, so that each DAC gets its own. For now, there is one such chain: Metis Andromeda, with a TVL of around 500 million as of May 2024 (this includes all natively minted and bridged tokens rather than the funds locked in DeFi protocols).

Metis DAO first announced it was working on a hybrid rollup in March 2023. The solution was supposed to reduce the time needed for withdrawing funds to Ethereum from 7 days to 4 hours.

With time, the plan has evolved: the new hybrid rollup is now a separate project, called ZKM. It is being built with the funding from the Metis Foundation and will start out as an EVM base chain at its core, but it will use ZK validity proofs. It will allow for instant crypto transfers between the L2 (Metis) and the L1 (Ethereum), without the 7-day challenge window, but users who wish to save money will also be able to choose cheaper but slower optimistic transfers.

The hybrid rollup is only the first stage, however. The next step is to switch to a zkVM - a virtual machine that is different from EVM. ZKM’s zkVM (now in alpha testnet) will be able to verify transactions on any blockchain and send them to Ethereum, making it the settlement layer for any chain. The ultimate goal is to secure non-blockchain networks, too, such as IoT.

ZKM should be able to support other L2s, such as Optimism, as well as alternative L1s, like Avalanche and Solana. This makes it similar to Lumio, which is designed as execution and settlement layer agnostic and can support various virtual machines (EVM, Move VM, Solana VM, etc.).

Polygon Nightfall

Polygon is also working on a hybrid optimistic & ZK rollup called Nightfall, built in collaboration with the Big Four company Ernst & Young. The latter envisioned Nightfall as a way to offer its clients private Ethereum transactions - which becomes possible with ZK proofs. While Nightfall is primarily a rollup for enterprises, it can also be used by Web3 platforms - private NFT marketplaces, for example.

Nightfall is a public (i.e. not permissioned) optimistic rollup, which solves the issue of trust that is present on permissioned blockchains. This makes it different from many chains aimed at enterprises, which are often private. At the same time, ZK proofs guarantee anonymous transactions for enterprises - meaning that nobody can view the sender, recipient, or amount of a transfer.

Nightfall has been in public mainnet beta since May 2022, with a major code update published in January 2023. And while Polygon hasn’t published news about Nightfall for a while, the GitHub repository is being regularly updated, and developers can run a local instance of the mainnet or even launch a Nightfall node using the explanations in GitBook.

A quick update on Fraxchain/Fraxtal

In the original version of this guide, we described one more hybrid rollup in this category: Fraxchain. However, while Frax Finance did launch a rollup, called Fraxtal, it doesn’t feature ZK proofs - therefore, we haven’t included it in the update.

Hybrid Combinations of Public and Private Contract Execution: Aztec, Ola and Polygon Miden

Public vs. private contracts

In this paradigm, a hybrid rollup is one that can support both public and private smart contracts and transactions.

With public contracts, any party can view how all other users interact with a contract, including both user inputs and outputs. Users send transaction requests to the contract, a validator approves them and the state of the blockchain is updated. All the “normal” dApps that we are used to, like Liquidswap, Compound, etc., run on public contracts.

With private contracts, transaction data is encrypted, and only authorized users can view the inputs and outputs. Even blockchain validators can’t see what’s in a transaction.

A hybrid rollup is one that allows a user to execute both types of transactions, public and private. With this technology, private smart contracts can even be executed locally, on the user’s own device.

Private contracts have many potential uses:

voter privacy for DAOs
AMM security, so that bots can’t see transactions submitted to the mempool;
private gaming tournaments within a public game
corporate security for institutional users.

Three main projects are developing public/private hybrid rollups: Aztec Network, Polygon Miden, and Ola. Let’s take a look:

Aztec Protocol

Aztec positions itself as “Ethereum, Encrypted,” and as the truly private ZK rollup. Users will be able to make encrypted transactions from their device, generate ZK proofs locally, and submit them to Aztec to be included in the batches that are sent to Ethereum.

Developers can already build with Aztec Sandbox (local testnet). Users can create local nodes and emulate Ethereum and Aztec, deploying contracts in Noir. None of the transactions go to a public blockchain, though; for this, devs need to wait for the public testnet,

Aztec’s best-known product so far is Aztec Connect, a privacy layer for Ethereum launched in July 2022. It allowed developers to build confidential DeFi dApps on Ethereum, the biggest being Aztec’s own (discontinued) zk.money protocol.

With the new Aztec rollup, you don’t need to send a transaction request to validators; instead, you send proof that the transaction was completed to the contract. Neither the L1 or the rollup will know the content of the transaction. In fact, each user account in Aztec is itself a smart contract and can define which transactions should be considered valid.

There is a lot of flexibility in terms of contract types and functions interacting with each other, too. For example, a user can deposit funds in a regular AMM pool in such a way that nobody will be able to view that liquidity transaction.

Very importantly, devs will be able to create dApps that are fully audited and compliant. They can customize viewing and interaction privileges for various entities.

Aztec isn’t compatible with EVM or Solidity. Instead, the team developed a new open-source programming language for private smart contracts called Noir. It’s based on Rust and should be easy for Ethereum developers to master. Teams on any other blockchain (presumably Aptos, too) will be able to incorporate ZK proofs using Noir.

Use cases for Aztec include corporate finance, private trading, AMMs that completely block front-running, confidential DAO voting, NFT auctions, games, and any other projects that call for keeping some information private. Privacy in Aztec is programmable: dApp creators can decide how much of it to include in their smart contracts.

Ola

Ola isn’t just a hybrid rollup: it’s a privacy-focused zkVM, a virtual machine that supports zero-knowledge proofs. It is developed by Sin7y Labs, whose team members previously worked for ZKSpace, Huobi, Qtum, and Accenture.

Note that Ola isn’t a zkEVM (such as zkSync), in that it’s not supposed to be equivalent to or compatible with Ethereum Virtual Machine (EVM). It will be possible to build and run any kind of dApps with Ola's virtual machine (OlaVM), but in order to migrate an Ethereum dApp to it you’ll have to re-code it in Ola-lang.

Among Ola’s most interesting features:

Programmable privacy: developers will be able to decide how much of it to build into their dApps.
A new coding language: Ola-lang. Both Ola-lang and Noir are based on Rust, but they belong to different types. Noir is a domain-specific language (DSL), created for writing smart contracts, while Ola-lang is a general-purpose language (GPL) and can be used in any domain. So theoretically even developers outside of Web3 could use it.
Compliance: special viewing permissions (viewing keys) can be given to third-parties for account monitoring.
Two blockchain states: public and private. These correspond to the two types of transactions and smart contracts.
Two privacy schemes: with untraceable and with traceable transactions. Users don’t always need their transactions to be untraceable - rather, they may want to be sure that nobody can use the information about their on-chain activities for criminal purposes or for profit. Traceable transactions on Ola will cost users less and will still provide privacy at the level of user data.
Developer-friendliness: the team created an Ola-lang plugin for Visual Studio Code, Microsoft’s code editor that is used by devs working with JavaScript, TypeScript, C, and other languages.

Ola’s ZK-ZKVM framework. Credit: White Paper V2

Polygon Miden

Polygon is betting strategically on the zero-knowledge tech: its zkEVM network is one of the major projects in the space and is available in mainnet beta. On the hybrid rollup front, Polygon has not one but two projects: Miden and Nightfall.

Miden testnet goes live on May 6

The brand-new hybrid ZK rollup Miden launched its first public testnet on May 6, 2024.

babe, wake up, it’s here: the Polygon Miden Alpha Testnet is live—a zk self-sovereign focused chain ready for pioneers who want to cook.

join the 👉🏽 brand new 👈🏽 alpha telegram to start the Miden journey rn: https://t.co/ZWOI7MQOWp

soo what can you do on this testnet anyway? 👀 pic.twitter.com/xwgg0pMTys
— Polygon | Aggregated (@0xPolygon) May 6, 2024

Miden is similar to Ola and Aztec in a few ways:

Users run private smart contracts, verify their own transactions, and generate ZK proofs (client-side proving);
Chain is split into public and private states;
Flexible compliance, so a private smart contract can be built in such a way that only regulating bodies can access the information in it;
Resource-efficient data verification.

On the testnet, developers can experiment with creating public and private accounts, deploying basic contracts that can send or mint tokens, and more. The next Builders testnet is scheduled for September 2024.

Resource-efficiency combined with privacy

Miden distinguishes between private transactions and private contracts:

Private transactions can be executed on public contracts, to hide a specific NFT trade, for example.
Private contracts have their code and state invisible to other users, but can also communicate with public contracts. For example, a privacy wallet built on Miden will be able to interact with a public AMM -- a great feature for liquidity providers or project teams that don’t want to reveal their operations to potential hackers.

With private smart contracts, all computations are done locally on the user’s device. This means no gas costs, and users can execute complex contracts cheaply.

Validators just need to check the ZK proofs, which is easy and cheap.

Client-side proving is possible only for transactions that don't affect the public blockchain state. For those transactions that require a change in the public state, Miden will also have the option of regular on-chain execution.

What makes Miden particularly interesting for us at Pontem Network is that in the future it aims to support the Move language for smart contract development, the same language as Aptos! In fact, the founder of Miden, the pseudonymous Bobbin Threadbare, used to work for Facebook’s Diem blockchain project which developed Move.

*Bobbin Threadbare is originally a character in Lucasfilm’s fantasy game, Loom. Credit: Bobbin Threadbare’s* *GitHub*

Another language Miden will support is Sway, developed by Fuel Labs, the startup behind the modular blockchain execution layer Fuel Network.

With the release of Miden’s Alpha Testnet, Aztec’s Sandbox, and ZKM’s zkVM alpha testnet, developers finally have a way to experiment with hybrid rollups first-hand. As it’s a fast-developing and exciting space, we will keep this article updated, so make sure to follow Pontem Network on Telegram and Discord so that you don’t miss the next installment!