Zero-knowledge Rollup

Blockchain State

A blockchain can be modeled as a simple state machine: given a current state and a batch of transactions, a state transition function (STF) produces a new state. Every full node re-executes every transaction to independently verify the chain's state.

Running a high-throughput orderbook on a general-purpose L1 is impractical as the throughput and latency requirements of a matching engine far exceed what shared blockspace can provide. A single centralized server could handle the load, but would require users to trust the operator entirely. Zero-knowledge proofs offer a way to get both: the performance of a dedicated execution environment with the verifiability of a public blockchain.

zkVM

The CLOB's entire state transition function, including the matching engine, margin system, liquidation logic, and funding calculations, is written in Rust. This same code compiles to run natively for sequencing and full node execution, or cross-compiles to a RISC-V target for execution inside a zkVM.

When run inside the zkVM, the prover produces a cryptographic proof that the state transition was computed correctly without revealing anything beyond the correctness of the result.

When a batch of transactions is processed, the zkVM executes the STF inside a sandboxed RISC-V environment and produces a cryptographic proof that the state transition was computed correctly. Anyone can verify this proof without re-executing the transactions themselves. The proof confirms that the new state root follows deterministically from the previous state and the input transactions with no trust in the matching-engine required.

Transaction data is posted to the data availability layer, ensuring that the inputs to every state transition are publicly available and cannot be withheld.

Speed

This architecture cleanly separates execution, proving, and data availability. The sequencer provides soft confirmations with low latency for traders, while the proving pipeline runs asynchronously to produce verifiable proofs. A light client can sync the chain by verifying a single aggregated proof rather than replaying the full transaction history.