ZK Rollup vs Optimistic Rollup: What Each One Trusts

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Not automatically. A ZK rollup trusts its circuits and verifier; an optimistic rollup trusts one honest, funded challenger to act in time. On both, whoever holds the upgrade keys can override the proofs, so check those first.

Watch: ZK Rollup vs Optimistic Rollup: What Each One Trusts 1:42

Video transcript

Are ZK rollups more secure than optimistic rollups? Not automatically. They trust different things, and upgrade keys can override both.

Both kinds settle on Ethereum, but stop a false state root differently. ETHBEAT lists 22 rollups, and the three largest are optimistic.

An optimistic rollup trusts one honest, funded challenger to act in time. That depends on who can challenge, how long, the cost, and the dispute code.

A ZK rollup trusts its circuits and verifier. One missing constraint lets a prover prove a false state change. That bug class has hit major ZK systems.

If the operator stops or censors you, check the exits. Arbitrum One, OP Mainnet and Base allow forced inclusion. Starknet and ZKsync Era do not, and use a whitelisted proposer.

On both kinds, an upgrade can replace the verifier, the bridge or the rules. So check the upgrade keys first.

All five can upgrade in an emergency without delay. After the Kelp DAO exploit, Arbitrum's council recovered about 30,766 ETH. That protected users, and it is also a trust assumption.

Open the rollup on ETHBEAT and note the date. Read the proof system. Check the challenge window or the circuit audits. Then check forced inclusion and the emergency upgrade path.

Guardian reviews the code rollup users rely on, including Citrea's Stablecoin Bridge. Read the full article, or talk to Guardian at guardian.security.

Most comparisons of ZK and optimistic rollups stop at speed and fees. If you hold assets on one, ask instead: what must stay correct, honest and online for you to withdraw?

Both kinds post their data to Ethereum and settle there. They differ in how a false state root gets stopped.

We used ETHBEAT (formerly L2BEAT) data read on November 6, 2026, and bugs disclosed on both sides. For what each stage requires, see our rollup stages explainer.

How Each Proves State

An optimistic rollup posts a state root and assumes it is valid. Challengers get a fixed window to prove fraud, and withdrawals wait until it closes.

A ZK rollup, or validity rollup, posts a proof with each update. A verifier contract on Ethereum checks it before accepting the new root.

ETHBEAT lists 22 rollups: 10 with fraud proofs and 12 with validity proofs. The three largest by value secured, Base, Arbitrum One and OP Mainnet, are optimistic.

The line is blurring. On May 26, 2026, Base added TEE attestations and SP1 ZK proofs. When both back a proposal, its 5-day window drops to 1 day.

Where Fraud Proofs Fail

An optimistic rollup is only as safe as its challengers. Someone honest must spot a bad root, fund a dispute and act before the window closes.

Who can challenge. Stage 0 needs 5 or more external fraud provers. Stage 2 lets anyone submit them.
How long. Stage 1 needs a challenge period of at least 5 days, cut from 7 on April 30, 2026.
What it costs. A full-depth dispute on OP Mainnet involves 691.23 ETH in cumulative bonds, ETHBEAT calculates.
Whether the code works. The dispute game is software, and software has bugs.

The large rollups now let anyone challenge. Arbitrum One has run BoLD, a permissionless system, since February 15, 2025; OP Mainnet and Base are open too.

Arbitrum One's challenge period is 6 days 8 hours, plus 2 days if a claim is challenged. OP Mainnet's is 3 days 12 hours, plus an equal execution delay.

The Stages spec counts execution delays toward its 5-day minimum, so OP Mainnet's 7 days qualify.

The last risk has happened. In August 2024, a bug led OP Mainnet to disable fraud proofs for 26 days and use permissioned proposals, ETHBEAT records.

Until the Granite upgrade restored them, withdrawals rested on a permissioned proposer.

Where Validity Proofs Fail

A ZK rollup is only as safe as its circuits and verifier. If a constraint is missing, a prover can prove a false state change, and Ethereum will accept it.

That bug class is the underconstrained circuit. It has turned up in major zkEVMs, before and after launch:

System	Disclosed	What it allowed
PSE and Scroll zkEVM	December 2022, GitHub issue	Prove a false modulo result
Polygon zkEVM	Hexens audit, February 2023	Fake state tree entries; credit the sequencer arbitrary ether
ZKsync Era	ChainLight, November 2023	A soundness bug; Cointelegraph put $1.9B at risk
ZKsync Era	Reported July 27, 2025	Make invalid EcPairing inputs verify as valid

Hexens rated four Polygon zkEVM findings Critical. Per the 0xPARC bug tracker, the sequencer bug let an attacker claim all the ether held by the bridge.

Hexens says it validated every Polygon fix. The PSE issue closed ten days after it opened.

The 2025 response shows the backstop. Matter Labs stopped producing proofs to delay finalization, then shipped a fix by emergency upgrade on August 1, with Security Council approval.

It says only a malicious operator could have exploited the bug, no chain was attacked and no funds were lost.

Escape Hatches

Next, what happens if the operator stops or censors you. Two exits matter: forcing a transaction in through Ethereum, and posting state yourself.

Arbitrum One: force inclusion within 1 day. Anyone with enough stake can propose.
OP Mainnet and Base: force inclusion within 12 hours. Anyone can propose.
Starknet: an Ethereum queue, but no forced inclusion. Whitelisted proposer only.
ZKsync Era: also a queue without forced inclusion, and a whitelisted proposer.

If the proposer fails on Starknet or ZKsync Era, withdrawals freeze, ETHBEAT says. Starknet's fallback is a 3-of-12 council minority.

ZKsync Era's Chain Admin can also pause the Ethereum queue and filter its messages without delay.

So among these five, the validity-proof rollups have the weaker exits. Proof type alone does not settle the question.

Upgrade Keys Override Both

An upgrade can replace the verifier, the bridge or the rules. Whoever holds that key outranks the proofs.

The Stages framework draws its line there. At Stage 1, blocking or forging a withdrawal must require compromising 75% of a Security Council of 8 or more.

Rollup	Proofs	Stage	Emergency upgrade	Exit window (regular)
Arbitrum One	Fraud	1	9 of 12 council, instant	10 days
OP Mainnet	Fraud	1	Council and Foundation, instant	None
Base	Fraud, multiproof	1	Regular path, no delay	None
Starknet	Validity	1	9 of 12 council, instant	7 days
ZKsync Era	Validity	0	Council, Guardians and Foundation, instant	5 days

Base upgrades need its Security Council (8 of 11) and a coordinator multisig (3 of 6), and take effect once both sign.

ZKsync Era is Stage 0 partly because a compromised blocking minority of its council could stop users exiting, ETHBEAT says.

Councils do act. After the Kelp DAO exploit in April 2026, Arbitrum's council recovered about 30,766 ETH from the attacker, ETHBEAT records. That protected users, and it is also a trust assumption.

Side-by-Side Comparison

	Optimistic rollup	ZK rollup
Correctness rests on	One honest, funded challenger	Sound circuits, prover and verifier
Main proof failure	No timely challenge, or a dispute game bug	A missing constraint or verifier bug
Withdrawal to Ethereum	After the challenge window, in days	After the proof and any set delay
Who posts state (examples above)	Anyone	A whitelisted proposer
Forced inclusion (examples above)	12 hours to 1 day	None; queue only
Upgrade keys	Can override the proofs	Can override the proofs

How to check a rollup

Open it on ethbeat.org and note the date.
Read the proof system: fraud or validity, and who can submit.
Optimistic: check the challenge window and the bond a challenger needs.
ZK: ask for circuit and verifier audits, and check any execution delay.
Check forced inclusion, and what happens if the proposer stops.
Find the emergency upgrade path, council threshold and exit window.

For when a rollup deposit counts as final, see our guide to blockchain finality by chain.

Where Guardian Fits

Guardian reviews the code rollup users rely on. In 2025 it reviewed the Stablecoin Bridge for Citrea, a zero-knowledge rollup on Bitcoin, deployment scripts included.

For onchain teams, a Guardian audit pairs two competing review teams with invariant fuzzing beneath both.

Managed Security then monitors your contracts for upgrades and role changes, and checks deployed addresses and configuration against the review.

Frequently Asked Questions

Are ZK rollups more secure than optimistic rollups?

Not by default. Proofs replace the challenge window, but a circuit or verifier bug can still accept a false state. Many ZK rollups also restrict who posts state. On either kind, upgrade keys can override the proofs.

What is the difference between a ZK rollup and an optimistic rollup?

An optimistic rollup assumes each update is valid unless someone proves fraud within a challenge window. A ZK rollup attaches a validity proof to every update, which Ethereum checks before accepting it.

Why do optimistic rollup withdrawals take days?

They wait for the challenge window, so a bad state root can be disputed first. Arbitrum One's is 6 days 8 hours, plus 2 days if challenged; OP Mainnet's is 3 days 12 hours, plus an equal delay.

Have ZK rollups had soundness bugs?

Yes. Hexens found missing constraints in Polygon zkEVM in a 2023 audit, and an EcPairing circuit flaw in ZKsync Era was reported in July 2025. Both were fixed; Matter Labs says no funds were lost.

Sources

Know who can override your rollup

Guardian reviews the contracts, bridges and upgrade paths your users depend on, then tracks every change after launch.

Talk to Guardian Explore security for onchain teams