Search

Search for projects by name

Scroll logoScroll

Badges

About

Scroll is ZK Rollup that extends Ethereum’s capabilities through ZK tech and EVM compatibility.


Value secured
$208.54 M1.72%
Canonically Bridged
$79.50 M
Natively Minted
$62.39 M
Externally Bridged
$66.64 M

  • Tokens
  • Past day UOPS
    0.4531.9%
  • 30D ops count
    1.18 M
  • Gas token
    ETH

  • Stage
  • Type
    ZK Rollup
  • Purpose
    Universal
  • Sequencer failureState validationData availabilityExit windowProposer failure

    Badges

    About

    Scroll is ZK Rollup that extends Ethereum’s capabilities through ZK tech and EVM compatibility.

    Stages changes

    86d
    21h
    46m
    09s
    The project will be downgraded to
    Stage 0
    because it does not satisfy an upcoming Stage 1 principle.

    The project will move to Stage 0 because:

    Compromising ≥75% of the Security Council should be the only way (other than bugs) for a rollup to indefinitely block an L2→L1 message (e.g. a withdrawal) or push an invalid L2→L1 message (e.g. an invalid withdrawal).
    Learn more about the new requirements
    Value Secured

    2024 May 02 — 2025 May 02


    Total value securedTotal
    $208.54 M1.72%
    Canonically BridgedCanonically Bridged ValueCanonical
    $79.50 M1.69%
    Natively MintedNatively Minted TokensNative
    $62.39 M6.81%
    Externally BridgedExternally Bridged ValueExternal
    $66.64 M2.58%
    Activity

    2024 May 03 — 2025 May 02

    Onchain costs

    The section shows the operating costs that L2s pay to Ethereum.


    2024 May 03 — 2025 May 02


    1 year total cost
    $2.62 M
    Avg cost per L2 UOP
    $0.036798
    1 year data posted
    928.88 MiB
    Avg size per L2 UOP
    166.08 B

    Milestones & Incidents

    Scroll Euclid upgrade

    2025 Apr 24th

    Scroll becomes Stage 1 by improving permissions and introducing enforced batch mode.

    Learn more

    SCR token launch

    2024 Oct 19th

    Scroll launches its SCR token.

    Learn more
    Risk summary
    Risk analysis
    Sequencer failureState validationData availabilityExit windowProposer failure
    Sequencer failure
    Self sequence

    In the event of a sequencer failure, users can force transactions to be included in the project’s chain by sending them to L1. There can be up to a 7d delay on this operation. Proposing new blocks requires creating ZK proofs.

    State validation
    ZK proofs (SN)

    SNARKs are zero knowledge proofs that ensure state correctness, but require trusted setup.

    Data availability
    Onchain

    All of the data needed for proof construction is published on Ethereum L1.

    Exit window
    None

    There is no window for users to exit in case of an unwanted regular upgrade since contracts are instantly upgradable.

    Proposer failure
    Self propose

    If the Proposer fails, users can leverage the source available prover to submit proofs to the L1 bridge.

    Rollup stageScrollScroll is a
    Stage 1
    ZK Rollup.

    New requirements coming soon

    86d
    21h
    46m
    09s
    The project will be downgraded to
    Stage 0
    because it does not satisfy an upcoming Stage 1 principle.
    Compromising ≥75% of the Security Council should be the only way (other than bugs) for a rollup to indefinitely block an L2→L1 message (e.g. a withdrawal) or push an invalid L2→L1 message (e.g. an invalid withdrawal).
    Learn more about the new requirements

    Learn more about Rollup stages
    Please keep in mind that these stages do not reflect rollup security, this is an opinionated assessment of rollup maturity based on subjective criteria, created with a goal of incentivizing projects to push toward better decentralization. Each team may have taken different paths to achieve this goal.
    Data availability

    All data required for proofs is published on chain

    All the data that is used to construct the system state is published on chain in the form of cheap blobs or calldata. This ensures that it will be available for enough time.

    1. ScrollChain.sol - Etherscan source code commitBatch() and commitBatchWithBlobProof() functions
    Learn more about the DA layer here: Ethereum logoEthereum
    State derivation
    Node software

    The node software to reconstruct the state is available here. Note that it uses the L2 p2p network to fetch blocks, and not the L1 network. The consistency with L1 data can be checked by running the scroll-geth node with the --rollup.verify flag.

    Compression scheme

    Data batches are compressed using the zlib algorithm with best compression level.

    Genesis state

    The genesis file can be found here, which contains two prefunded addresses and five predeployed contracts.

    Data format

    Blocks are grouped into chunks, chunks are grouped into batches, and batches are grouped into bundles. Chunk encoding format can be found here, and batch encoding format can be found here.

    State validation

    Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract.


    Prover Architecture

    The prover code can be found here.

    ZK Circuits

    Scroll circuits are openvm based Guest Programs based on the Halo2 proof system. The source code of the base circuits can be found here.

    Verification Keys Generation

    SNARK verification keys can be generated and checked against Ethereum verifier contract using this guide. The system requires a trusted setup.

    Validity proofs

    Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract.

    1. ScrollChain.sol - Etherscan source code, verifyAggregateProof() and verifyBundleProof() calls
    Operator

    The system has a centralized sequencer

    While forcing transaction is open to anyone the system employs a privileged sequencer that has priority for submitting transaction batches and ordering transactions.

    • MEV can be extracted if the operator exploits their centralized position and frontruns user transactions.

    1. ScrollChain.sol - Etherscan source code, finalizeBundlePostEuclidV2() function modifier

    Users can force any transaction

    Because the state of the system is based on transactions submitted on the underlying host chain and anyone can submit their transactions there it allows the users to circumvent censorship by interacting with the smart contract on the host chain directly. The enforced liveness mechanism is activated if either an L1 message has not been finalized for more than 7d or a batch has not been finalized for more than 7d. When activated, transactions that were directly posted to the smart contract can be forcefully included by anyone on the host chain, which finalizes their ordering.

    1. EnforcedTxGateway.sol - Etherscan source code
    2. L1MessageQueueV2 - Etherscan proxy contract
    Withdrawals

    Regular messaging

    The user initiates L2->L1 messages by submitting a regular transaction on this chain. When the block containing that transaction is settled, the message becomes available for processing on L1. ZK proofs are required to settle blocks.

    1. L1ETHGateway.sol - Etherscan source code, finalizeWithdrawETH function
    Upgrades & Governance
    A diagram of the upgrades and governance
    A diagram of the upgrades and governance

    All core contracts in the Scroll protocol are upgradable by the ProxyAdmin, which is controlled by the Security Council through the ScrollOwner contract. The ScrollOwner is a central governance contract controlled by four distinct Timelocks: two governed by the Security Council multisig and two by the Scroll team multisigs. Each multisig can initiate specific types of changes with differing delay guarantees. The team can change parameters that affect L1->L2 messaging and the activation of permissionless sequencing (i.e., enforcedBatchMode), such as by calling the updateMessageQueueParameters and updateEnforcedBatchParameters functions through the TimelockFast, or by pausing the EnforcedTXGateway through the TimelockEmergency. It also has authority to revert unfinalized batches and add or remove sequencers and provers while sequencing is in permissioned mode. As the ScrollOwner admin, the Security Council can revert the team actions by revoking the team roles in the ScrollOwner contract (through the TimelockSCSlow) and upgrading the affected contracts. SCR token holders perform onchain voting on governance proposal through the AgoraGovernor contract on L2. However, upgrades are not triggered automatically, the Security Council is in charge of executing upgrades.

    Permissions

    Ethereum

    Actors:

    Scroll Security Council 0x1a37…24DD
    • A Multisig with 9/12 threshold.
    • Can act on behalf of TimelockSCEmergency.
    • Can act on behalf of TimelockSCSlow with 3d delay.
    • Is allowed to interact with TimelockSCEmergency, TimelockSCSlow - cancel queued transactions.
    • Is allowed to interact with TimelockSCEmergency, TimelockSCSlow - execute transactions that are ready.
    • Is allowed to interact with TimelockSCEmergency, TimelockSCSlow - propose transactions.
    • Is allowed to interact with TimelockSCEmergency - update the minimum delay and manage all access control roles of the timelock - acting via TimelockSCEmergency.
    • Is allowed to interact with TimelockSCEmergency, TimelockSCSlow - update the minimum delay and manage all access control roles of the timelock.
    • Is allowed to interact with TimelockSCSlow - update the minimum delay and manage all access control roles of the timelock - acting via TimelockSCSlow with 3d delay.
    • Is allowed to interact with ScrollOwner - disable enforced batch mode - acting via TimelockSCEmergency.
    • Is allowed to interact with ScrollOwner - update ScrollChain zk proof verifier - acting via TimelockSCEmergency.
    • Is allowed to interact with ScrollOwner - upgrade all core contracts of the system - acting via TimelockSCEmergency.
    1. Security Council members - Scroll Docs
    Scroll Multisig 3 0xEfc9…4dbe
    • A Multisig with 3/5 threshold.
    • Can act on behalf of TimelockFast with 1d delay.
    • Is allowed to interact with TimelockFast - cancel queued transactions.
    • Is allowed to interact with TimelockFast - propose transactions.
    • Is allowed to interact with TimelockFast - update the minimum delay and manage all access control roles of the timelock - acting via TimelockFast with 1d delay.
    • Is allowed to interact with TimelockFast - update the minimum delay and manage all access control roles of the timelock.
    • Is allowed to interact with ScrollOwner - add permissioned batchers and provers to the whitelist - acting via TimelockFast with 1d delay.
    • Is allowed to interact with ScrollOwner - set ERC20 gateways in the L1GatewayRouter - acting via TimelockFast with 1d delay.
    • Is allowed to interact with ScrollOwner - update the L1ScrollMessenger fee vault address - acting via TimelockFast with 1d delay.
    • Is allowed to interact with ScrollOwner - update the minimum delay message queue parameters and enforced mode parameters - acting via TimelockFast with 1d delay.
    Scroll Multisig 2 0xbdA1…0cBc
    • A Multisig with 2/4 threshold.
    • Can act on behalf of TimelockEmergency.
    • Is allowed to interact with ScrollOwner - pause the L1 -> L2 messenger and enforced transaction mode - acting via TimelockEmergency.
    • Is allowed to interact with ScrollOwner - remove permissioned batchers and provers to the whitelist, and update the sequencer address - acting via TimelockEmergency.
    • Is allowed to interact with ScrollOwner - revert unfinalized batches - acting via TimelockEmergency.
    • Is allowed to interact with TimelockEmergency - cancel queued transactions.
    • Is allowed to interact with TimelockEmergency - propose transactions.
    • Is allowed to interact with TimelockEmergency - update the minimum delay and manage all access control roles of the timelock - acting via TimelockEmergency.
    • Is allowed to interact with TimelockEmergency - update the minimum delay and manage all access control roles of the timelock.

    Participants (4):

    EOA 1EOA 3EOA 4EOA 2
    Scroll Multisig 1 0x1FF1…236f
    • A Multisig with 1/4 threshold.
    • Can be used to interact with TimelockSCEmergency, TimelockFast, TimelockSCSlow, TimelockEmergency - execute transactions that are ready.

    Participants (4):

    EOA 3EOA 4EOA 1EOA 2
    • Member of Scroll Multisig 1, Scroll Multisig 4, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockSCSlow, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.
    • Member of Scroll Multisig 1, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockSCSlow, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.
    • Member of Scroll Multisig 1, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockSCSlow, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.
    • Member of Scroll Multisig 1, Scroll Multisig 4, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockSCSlow, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.

    Scroll

    Actors:

    Scroll Security Council 0x1a37…24DD
    • A Multisig with 9/12 threshold.
    • Can act on behalf of TimelockSCEmergency.
    • Can act on behalf of TimelockSCSlow with 3d delay.
    • Is allowed to interact with ScrollOwner - disable enforced batch mode - acting via TimelockSCEmergency.
    • Is allowed to interact with ScrollOwner - update ScrollChain zk proof verifier - acting via TimelockSCEmergency.
    • Is allowed to interact with ScrollOwner - upgrade all core contracts of the system - acting via TimelockSCEmergency.
    • Is allowed to interact with TimelockSCEmergency - cancel queued transactions.
    • Is allowed to interact with TimelockSCEmergency - execute transactions that are ready.
    • Is allowed to interact with TimelockSCEmergency - propose transactions.
    • Is allowed to interact with TimelockSCEmergency - update the minimum delay and manage all access control roles of the timelock - acting via TimelockSCEmergency.
    • Is allowed to interact with TimelockSCEmergency - update the minimum delay and manage all access control roles of the timelock.
    • Is allowed to interact with AgoraGovernor - can configure contract settings such as voting delay, quorum, contract manager - acting via TimelockSCSlow with 3d delay.
    Scroll Multisig 2 0xbdA1…0cBc
    • A Multisig with 2/4 threshold.
    • Can act on behalf of TimelockEmergency.
    • Is allowed to interact with TimelockEmergency - cancel queued transactions.
    • Is allowed to interact with TimelockEmergency - propose transactions.
    • Is allowed to interact with TimelockEmergency - update the minimum delay and manage all access control roles of the timelock - acting via TimelockEmergency.
    • Is allowed to interact with TimelockEmergency - update the minimum delay and manage all access control roles of the timelock.

    Participants (4):

    EOA 1EOA 3EOA 4EOA 2
    Scroll Multisig 3 0xEfc9…4dbe
    • A Multisig with 3/5 threshold.
    • Can act on behalf of TimelockFast with 1d delay.
    • Is allowed to interact with TimelockFast - cancel queued transactions.
    • Is allowed to interact with TimelockFast - propose transactions.
    • Is allowed to interact with TimelockFast - update the minimum delay and manage all access control roles of the timelock - acting via TimelockFast with 1d delay.
    • Is allowed to interact with TimelockFast - update the minimum delay and manage all access control roles of the timelock.
    GnosisSafeL2 0x2B2A…4351
    • A Multisig with 2/3 threshold.
    • Is allowed to interact with AgoraGovernor - can propose new onchain governance proposals without the required threshold of votes.
    Scroll Multisig 1 0x1FF1…236f
    • A Multisig with 1/4 threshold.
    • Can be used to interact with TimelockSCEmergency, TimelockFast, TimelockEmergency - execute transactions that are ready.

    Participants (4):

    EOA 3EOA 4EOA 1EOA 2
    • Member of Scroll Multisig 1, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.
    • Member of Scroll Multisig 1, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.
    • Member of Scroll Multisig 1, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.
    • Member of Scroll Multisig 1, Scroll Multisig 2.
    • Is allowed to interact with TimelockSCEmergency, TimelockFast, TimelockEmergency - execute transactions that are ready - acting via Scroll Multisig 1.
    Smart contracts
    A diagram of the smart contract architecture
    A diagram of the smart contract architecture

    Ethereum

    MultipleVersionRollupVerifier 0x4CEA…ad3F

    Contract used to update the verifier and keep track of current and old versions.

    Contains the array of queued L1 -> L2 messages, either appended using the L1ScrollMessenger or the EnforcedTxGateway.

    Contract used to send L1 -> L2 and relay messages from L2. It allows to replay failed messages and to drop skipped messages. L1 -> L2 messages sent using this contract pay for L2 gas on L1 and will have the aliased address of this contract as the sender. This contract stores the following tokens: ETH.

    Contracts to force L1 -> L2 messages with the proper sender.

    ScrollOwner 0x7985…26a6
    • Owner of all contracts in the system. It implements an extension of AccessControl that manages roles and functions allowed to be called by each role.
    • Can act on behalf of ProxyAdmin.
    • Can be used to interact with SystemConfig - update the minimum delay message queue parameters and enforced mode parameters.

    System configuration contract for Scroll, contains enforcedBatchParameters and messageQueueParameters determining permissionless mode.

    The main contract of the Scroll chain. Allows to post transaction data and state roots, along with proofs. Sequencing and proposing are behind a whitelist unless enforcedBatchMode is activated.

    TimelockSCEmergency 0x0CD4…CA44
    • A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.
    • Can be used to interact with TimelockSCEmergency - update the minimum delay and manage all access control roles of the timelock.
    • Can be used to interact with ScrollOwner - disable enforced batch mode.
    • Can be used to interact with ScrollOwner - update ScrollChain zk proof verifier.
    • Can be used to interact with ScrollOwner - upgrade all core contracts of the system.
    TimelockFast 0x0e58…C4F4
    • A timelock with access control. The current minimum delay is 1d. Proposals that passed their minimum delay can be executed by the anyone.
    • Can be used to interact with TimelockFast - update the minimum delay and manage all access control roles of the timelock.
    • Can be used to interact with ScrollOwner - add permissioned batchers and provers to the whitelist.
    • Can be used to interact with ScrollOwner - set ERC20 gateways in the L1GatewayRouter.
    • Can be used to interact with ScrollOwner - update the L1ScrollMessenger fee vault address.
    • Can be used to interact with ScrollOwner - update the minimum delay message queue parameters and enforced mode parameters.
    TimelockSCSlow 0x3f90…a9fd
    • A timelock with access control. The current minimum delay is 3d. Proposals that passed their minimum delay can be executed by the anyone.
    • Can be used to interact with TimelockSCSlow - update the minimum delay and manage all access control roles of the timelock.
    TimelockEmergency 0x8267…216b
    • A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.
    • Can be used to interact with ScrollOwner - pause the L1 -> L2 messenger and enforced transaction mode.
    • Can be used to interact with ScrollOwner - remove permissioned batchers and provers to the whitelist, and update the sequencer address.
    • Can be used to interact with ScrollOwner - revert unfinalized batches.
    • Can be used to interact with TimelockEmergency - update the minimum delay and manage all access control roles of the timelock.

    Contract used to bridge ERC721 tokens from L1 to L2.

    Contract used to bridge ETH from L1 to L2.

    Contract used to bridge ERC20 tokens from L1 to L2. It allows to change the token mappings. This contract stores the following tokens: pufETH.

    Contract used to bridge ERC20 tokens from L1 to L2. It allows to change the token mappings. This contract can store any token.

    Contract used to bridge ERC1155 tokens from L1 to L2.

    Contract used to bridge ERC20 tokens from L1 to L2. It uses a fixed token list. This contract can store any token.

    Main entry point for depositing ETH and ERC20 tokens, which are then forwarded to the correct gateway.

    This contract stores the following tokens: wstETH.

    This contract stores the following tokens: DAI.

    Contract used to bridge WETH from L1 to L2.

    Contract used to bridge USDC tokens from L1 to L2. This contract stores the following tokens: USDC.

    ZkEvmVerifierPostEuclid 0x3399…0828

    Contract used to verify zk proofs given the aggregate proof and the public input hash.

    PlonkVerifierPostEuclid-2 0x9F66…f79a
    1. Source Code
    ProxyAdmin 0xEB80…d072

    Can be used to upgrade implementation of L1MessageQueueV2, L1ERC721Gateway, DaiEscrow, L1ScrollMessenger, EnforcedTxGateway, L1WETHGateway, L1ETHGateway, SystemConfig, ScrollChain, L1CustomERC20Gateway, L1ERC1155Gateway, L1StandardERC20Gateway, L1USDCGateway, L1GatewayRouter.

    Scroll

    ScrollOwner 0x13D2…437B
    • Owner of all contracts in the system. It implements an extension of AccessControl that manages roles and functions allowed to be called by each role.
    • Can act on behalf of ProxyAdmin, ProxyAdmin, ProxyAdmin.

    Contract used to withdraw ERC20 tokens on L2 and finalize deposit the tokens from L1.

    TimelockSCEmergency 0x1f80…78b4
    • A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.
    • Can be used to interact with ScrollOwner - disable enforced batch mode.
    • Can be used to interact with ScrollOwner - update ScrollChain zk proof verifier.
    • Can be used to interact with ScrollOwner - upgrade all core contracts of the system.
    • Can be used to interact with TimelockSCEmergency - update the minimum delay and manage all access control roles of the timelock.
    TimelockFast 0x2b14…d376
    • A timelock with access control. The current minimum delay is 1d. Proposals that passed their minimum delay can be executed by the anyone.
    • Can be used to interact with TimelockFast - update the minimum delay and manage all access control roles of the timelock.

    Used to propose and manage onchain governance proposals.

    TimelockEmergency 0xA77D…734f
    • A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.
    • Can be used to interact with TimelockEmergency - update the minimum delay and manage all access control roles of the timelock.

    Contract of the USDC token on Scroll.

    Counterpart to the L1GatewayRouter contract.

    L2MessageQueue 0x5300…0000

    Used to append messages to the L2MessageQueue from the L2ScrollMessenger.

    Counterpart to the L1ERC1155Gateway contract.

    Counterpart to the L1CustomERC20Gateway contract.

    ScrollStandardERC20Factory 0x66e5…1484

    Contract used to deploy ScrollStandardERC20 tokens for L2StandardERC20Gateway.

    Contract of the L2ScrollMessenger contract.

    ETH is pre-minted to this contract in the genesis block and released on Scroll whenever corresponding deposits are made on Ethereum.

    TimelockSCSlow 0x79D8…CC14
    • Can act on behalf of TimelockSCSlow with 3d delay.
    • Can be used to interact with AgoraGovernor - can configure contract settings such as voting delay, quorum, contract manager.

    Counterpart to the L1ERC721Gateway contract.

    ProxyAdmin 0x82e5…bC81

    Can be used to upgrade implementation of AgoraGovernor.

    ProxyAdmin 0xA76a…d026

    Can be used to upgrade implementation of Scroll USDC, L2GatewayRouter, L2ERC1155Gateway, L2CustomERC20Gateway, L2ETHGateway, L2ScrollMessenger, L2ERC721Gateway, L2GatewayRouter.

    MasterMinter 0xb5cE…e4BE

    Manager contract for minter management [sic].

    ScrollStandardERC20 0xC7d8…3f69

    Contract of the ERC20 standard token used by the ERC20 factory.

    ProxyAdmin 0xde49…5F1e

    Can be used to upgrade implementation of SCRToken.

    Value Secured is calculated based on these smart contracts and tokens:

    Custom token escrow with third-party governance, using the canonical bridge only for messaging.

    Custom token escrow with third-party governance, using the canonical bridge only for messaging.

    The current deployment carries some associated risks:

    • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).