Darwin Upgrade

Overview

This upgrade will reduce gas fees by 34% by using a single aggregated proof for multiple batches, eliminating the need to finalize each batch individually.

• Darwin uses a new V3 batch codec.

• In addition to the previous notions of chunk and batch, we have introduced a new concept called bundle.

  • Chunk: A unit of zkEVM proving, consisting of a list of L2 blocks.
  • Batch: A collection of chunks encoded into one EIP-4844 blob, serving as the unit of Data Availability.
  • Bundle: A series of batches that functions as the unit of finalization.

  The main difference compared to Curie is that Scroll will now finalize multiple batches using a single aggregated bundle proof.

• The on-chain bundle proof verifier uses a new public input layout.

Timeline

• Scroll Sepolia
  • Network Upgrade: August 14th, 2024
• Scroll Mainnet
  • Upgrade Initiation: August 5th, 2024
  • Timelock Completion & Upgrade: August 21st, 2024

Technical Details

Contract Changes

Note: Since the previous Curie upgrade, we have migrated the Scroll contracts to a new repo at scroll-contracts.

The code changes for this upgrade are implemented in this PR. The key changes are as follows:

• We have introduced a new BatchHeaderV3Codec.
• We have changed how messages are processed in the L1MessageQueue contract. Prior to Darwin, we would process messages when a batch is finalized. After Darwin, most of this processing is moved to the commit step.
• We have introduced a new public input format for bundle proofs. This is implemented in a new contract IZkEvmVerifierV2, which is in turn added to MultipleVersionRollupVerifier.
• In the ScrollChain contract version=3 batches will now be committed through a new function called commitBatchWithBlobProof. Bundles will be finalized using a new function called finalizeBundleWithProof.

See the contract release notes for more information.

Node Changes

The new node version is v5.6.0. See the release notes for more information.

The main changes are:

• Implementation of timestamp-based hard forks.
• Processing V3 batch codec in rollup-verifier.

zkEVM circuit changes

The new version of zkevm circuits is v0.12.0. See here for the release log.

We have introduced a RecursionCircuit that will bundle multiple sequential batches by recursively aggregating the SNARKs from the BatchCircuit (previously AggregationCircuit). The previously 5 layer proving system is now 7 layers as we introduce:

• 6th Layer (layer5): RecursionCircuit that recursively aggregates BatchCircuit SNARKs.
• 7th Layer (layer6): CompressionCircuit that compresses the RecursionCircuit SNARK and produce an EVM-verifiable validity proof.

The public input to the BatchCircuit is now context-aware of the “previous” batch, which allows us to implement the recursion scheme we adopted (described here in-depth).

Audits

• TrailofBits: coming soon!

Compatibility

Sequencer and Follower Nodes (l2geth)

This upgrade does not alter the state transition function and is therefore backward-compatible. However, we strongly recommend node operators to upgrade to v5.6.0.

Dapps and Indexers

There are some major changes to how we commit and finalize batches after Darwin.

• Batches will be encoded using the new V3 batch codec. This version adds two new fields:

  1. lastBlockTimestamp (the timestamp of the last block in this batch).
  2. blobDataProof (the KZG challenge point evaluation proof).

  This version removes skippedL1MessageBitmap. There will be no changes to how the blob data is encoded and compressed.

• Batches will be committed using the commitBatchWithBlobProof function (instead of the previous commitBatch).

  New function signature:

  function commitBatchWithBlobProof(uint8 _version, bytes calldata _parentBatchHeader, bytes[] memory _chunks, bytes calldata _skippedL1MessageBitmap, bytes calldata _blobDataProof)

• Batches will be finalized using the finalizeBundleWithProof function (instead of the previous finalizeBatchWithProof4844).

  New function signature:

  function finalizeBundleWithProof(bytes calldata _batchHeader, bytes32 _postStateRoot, bytes32 _withdrawRoot, bytes calldata _aggrProof)

• The semantics of the FinalizeBatch event will change: It will now mean that all batches between the last finalized batch and the event’s _batchIndex have been finalized. The event’s stateRoot and withdrawRoot values belong to the last finalized batch in the bundle. Finalized roots for intermediate batches are no longer available.

  The semantics of the CommitBatch and RevertBatch events will not change.

Recommendations:

• Indexers that decode committed batch data should be adjusted to use the new codec and the new function signature.
• Indexers that track batch finalization status should be adjusted to consider the new event semantics.