ZeroSwap Whitepaper: a Layer-2 Token Swap Protocol based on ZK-Rollup


Since 2019, the blockchain industry has undergone breathtaking changes. Decentralized finance — DeFi — continues to grow at an exponential rate. The Total Value Locked in different DeFi protocols has exceeded 10 billion U.S. dollars. With the continuous development of numerous on-chain assets and off-chain assets going on-chain, we believe that the Total Value Locked in DeFi protocols will soon exceed 100 billion U.S. dollars. These on-chain assets require fast, frictionless, trust-free, and real-time exchange services, which has led to the rise of new decentralized exchange(DEX) protocols such as Uniswap.

Although the new DEX model spearheaded by Uniswap has achieved significant development, it still has obvious drawbacks. First, the high gas fee of dozens of dollars per transaction hinders new users to entry; second, every transaction and every execution needs to wait for at least one block to confirm, which gives an unsatisfactory experience; and third, subject to the limiting TPS of Ethereum, Uniswap has a clear bottleneck in transaction numbers and transaction capacity per second. Those drawbacks are not unique on Uniswap. They are common issues faced by all DEXes.

ZK-Rollup is a new type of Layer-2 scalability solution. Compared with other Layer-2 scalability solutions such as Plasma, ZK-Rollup has considerable advantages in terms of security, cost, TPS, and usability. It is especially suitable for building a Layer-2 decentralized exchange.

ZeroSwap (a ZK-Rollups-based Swap protocol) is a brand-new exchange protocol based on ZK-Rollups technology. Through Zk-Rollups technology, all ERC20 tokens are transferred to Layer2, and the consistent state of Layer1 and Layer2 is guaranteed based on continuously generated zero-knowledge proofs. This solution allows all exchanges to execute on Layer 2, achieving real-time swap with zero gas fees, unlimited scalability, removing the constraint from the Ethereum’s TPS, and block confirmation time. The user no longer has to wait for the one-block confirmation time for each transaction. ZeroSwap enables a DEX to provide the smooth user experience of a centralized exchange(CEX) while allowing the users to have full custody over their funds. We believe that ZeroSwap is the future form of trading. It will trigger a significant evolution of all existing DEX and CEX.

At present, the ZeroSwap team has finished most of the development work. We will release the ZeroSwap exchange protocol in early October. In the future, we will promote the DEX exchange standard on Layer-2, so that all existing DEXes can seamlessly access and use the ZeroSwap exchange protocol.

Technical Overview

Uniswap V1

Uniswap is an automated liquidity protocol powered by a constant product formula and implemented in non-upgradeable smart contracts on the Ethereum blockchain. Users can create a liquidity pool by providing a certain percentage of ETH and any other ERC20 asset. One liquidity pool reserves ERC20 tokens and provides liquidity for the transactions between these two assets. In return, all liquidity providers will split the 0.3% of the transaction volume as a liquidity provider fee. In Uniswap, the first liquidity provider needs to set the two assets’ ratio. The automated market maker algorithm will ensure that the product of the two assets before and after each transaction remains constant. The following is a brief introduction to the key concepts of Uniswap to help users understand related concepts coming up next.

Create a Liquidity Pool

In Uniswap, each trading pair has only one liquidity pool, which is generally created by the first liquidity provider. For example, a liquidity provider creates an ETH-ZKS liquidity pool and then adds liquidity. The initial amount of ETH deposited is x0, the number of ZKS stored is y0, and x0*y0 = c0. Here ZKS can be any ERC-20 token.

Liquidity Token

Liquidity Provider (LP) will obtain the Liquidity Provider Token (LP Token or LT), which is used to represent the share of LP in the current liquidity pool. LP Token is an ERC-20 token that can be transferred without removing the liquidity of the liquidity pool. Each liquidity pool has a corresponding LP Token.

The above-mentioned initial LP will receive n0 = sqrt (x0 * y0) — MIN_LIQUIDITY number of LP Tokens. Among them, since the total amount of LP Token will be used as the denominator in subsequent calculations, when adding liquidity for the first time, the system will set MIN_LIQUIDITY, as the minimum reserved amount of LP Token, send it to address 0x0 to prevent the total amount of LP Token from becoming zero.

The following assumes that at any time i, there are xi ETH and yi ZKS in the liquidity pool, their product constant is ci = xi * yi, and the total amount of LT issued is ni. Among them, i = 0, 1, 2, …

Create Liquidity

When adding liquidity to an existing pool, users must deposit pair tokens proportional to the current ratio. Suppose a new LP deposits X ETH and Y ZKS to the liquidity pool, the LP must ensure that X/Y = xi/yi. The LP will, in turn, receive the newly minted N = ni*X/xi number of LP Tokens. After adding liquidity, the reserve of the liquidity pool will be xi+1*yi+1 = (xi+X)*(yi+Y) = ci+1. The total amount of LP Token is ni+1 = ni + N.

Remove Liquidity

LP can remove liquidity by burning their LT in the liquidity pool contract to withdraw their share of ETH and ZKS tokens from the pool. Assuming that the amount of LT burned by LP is N’, the amount of ETH that LP can withdraw is X’= xi*N’/ni, and the amount of ZKS tokens is Y’= yi*N’/ni. After the liquidity is removed, the reserve of the liquidity pool will be updated to xi+1*yi+1 = (xi-X’)*(yi-Y’) = ci+1. The total LT is updated to ni+1 = ni-N’. Please note that the reserves of the liquidity pool might be different at the time when the LP deposits and when they withdraw; therefore, the number and the ratio of tokens the LP can withdraw might change accordingly.

Swap Transaction

After the liquidity pool is created, and liquidity is injected, users who hold ETH or ZKS can swap in the liquidity pool. Here we use exchanging ETH for ZKS as an example. The user transfers m ETH to the liquidity pool, and the ETH in the liquidity pool will become xi+1 = xi + m, and the user, in turn, receives yi+1 ZKS tokens. According to the AMM algorithm in Uniswap, after deducting the 0.003*m fee, the remaining ZKS token amount should be (xi+1–0.003m)*yi+1 = xi*yi. Therefore, the user will get yi+1 = (xi*yi)/(xi+1–0.003m) ZKS tokens. The liquidity provider fee will be automatically added to the liquidity pool after the transaction reserve, so after the transaction, the reserve of the entire liquidity pool becomes xi+1*yi+1 = ci+1> ci. Since there is no other LP Token minted or burned at the moment, the total amount of LP Token remains unchanged, that is, ni+1 = ni. This means that all LPs’ ratios remain the same, but each unit share now corresponds to more amount of the liquidity pool reserve.

Uniswap V2

Uniswap V1 implements basic AMM exchange functions, but there were also some issues. Since its contract is not upgradeable, to fix this problem, the development team re-implemented Uniswap V2, with basic functions the same as Uniswap v1 and some new features, including:

These new features increase the usability of Uniswap. For the exchange functionality, ZeroSwap remains the same as Uniswap V2.

ZK-Rollup and zkSync

ZK-Rollups is a popular Layer 2 scalability solution. Its basic idea is to aggregate a large number of transactions then verify the proof on-chain. ZK-Rollups analyzes and verifies these aggregated transactions through smart contracts and uses zero-knowledge proof technology to put the proof of aggregate transactions on-chain, thereby reducing the data that needs to be stored on-chain. All funds are locked in the smart contract, and most of the calculations and storage are done off-chain.

zkSync is one implementation of ZK-Rollups, and its v1 version is currently deployed on the Ethereum mainnet. Its basic working principle is as follows:

Since the gas for SNARK proof is much less than the sum of gas to verify a large number of individual transactions and to store the full state off-chain is also much cheaper than storing it on-chain. Therefore, ZK-Rollup can theoretically achieve 100~200 times more scalability than the Ethereum mainnet while significantly reducing gas consumption.

The security of ZK-Rollup is almost the same as that of the corresponding Layer 1, because:

zkSync currently supports three operations:

ZeroSwap Decentralized Swap Protocol

This white paper implements a Layer 2 AMM decentralized transaction protocol ZeroSwap. Based on ZK-Rollup technology, ZeroSwap executes the full functionality of Uniswap on Layer 2, while ensuring the core value of decentralized exchange, ZeroSwap increases the TPS by multiple orders of magnitude compared to Uniswap, and transaction processing hardly consumes any gas fees.

ZeroSwap System Framework

ZeroSwap System Framework

The ZeroSwap system consists of on-chain smart contracts, off-chain ZeroSwap Server, the zero-knowledge proof system, and front-end user interface.

ZeroSwap Smart Contract

ZeroSwap will deploy a series of smart contracts on the Ethereum blockchain to store the tokens deposited by users while recording and verifying Layer 2 status updates and related proof. Those smart contracts are the key hub connecting on-chain and off-chain.

ZeroSwap Layer 2 Server

The ZeroSwap server is the module that processes all transactions off-chain. The ZeroSwap server can use the WebSocket to interact with the user and monitor transactions on the Ethereum blockchain. All valid transaction requests will be put into the ZeroSwap mem pool and processed by the Swap Engine. The transaction types in the mem pool are the same as the transaction types of Uniswap. The Block Proposer will roll up the transactions and generate a new block. The State Keeper will update the status of all tokens on Layer 2. The State Keeper will send the state to the Commiter, which is responsible for communicating with the Prove Server, obtain the proof of the corresponding transaction, and finally send the state and the corresponding SNARK proof via Ethereum sender to the ZeroSwap smart contract on-chain.

Plonk Zero-knowledge Proof System

ZeroSwap’s zero-knowledge proof system adopts a distributed architecture and uses the latest zero-knowledge proof algorithm PLONK to generate proofs. The Prove Server supports multiple Provers. Multiple Provers actively query the proof tasks in the Prove Server’s proof tasks and send them back to the Prover Server after generating the proof. PLONK’s global trust setup only needs to be generated once, and the circuit can be reused within a certain range, reducing the threshold for using zero-knowledge proofs.

ZeroSwap State Tree

The status tree of the ZeroSwap system records the balance of all accounts in the current system. The state tree of ZeroSwap is a Merkel tree with a height of 34. The child nodes of the Root are all account nodes (24 levels) in the system. There are two types of account nodes:

ZeroSwap State Tree


Deposit refers to the process where users deposit Ethereum and ERC20 tokens into the ZeroSwap contract to use those tokens on Layer 2. The Deposit process is initiated by the user on-chain. When ZeroSwap Server monitors the user transfers tokens to the ZeroSwap smart contract, it will update the Status Tree according to the transaction details. First, it will find the corresponding Account to which the transaction belongs, then update the corresponding Token status under that Account based on the Deposited amount. If there is no leaf node corresponding to the Token under this Account, then first create the leaf node corresponding to the Token, and then update the status. When the leaf node’s status is updated, the root node’s hash will be updated accordingly.

The updated hash of the state tree’s root node and the SNARK proof of the Deposit transaction will be sent to the ZeroSwap contract on-chain.


Withdraw means that the user withdraws the Token from Layer 2, unlocks it from the ZeroSwap contract, and sends it to the corresponding Layer 1 account. The Withdraw process is initiated by the user from Layer 2. When the ZeroSwap Server receives the user’s withdrawal request, it will update the corresponding Token status under the corresponding account. Anc it will send the updated root node hash and the proof of the Withdraw process to the ZeroSwap contract on-chain. After the smart contract verifies it as valid, the contract will unlock the corresponding Token and send it to the account on the corresponding chain.


Transfer refers to the process where one user sends a certain token to another user in ZeroSwap Layer 2. The Transfer process is initiated by the user on Layer 2. When the ZeroSwap Server receives the Transfer request, it will find the corresponding sending and receiving accounts according to the request details.
And it will update the status of the Token under the accounts of the sender and receiver according to the sent amount. The hash of the state tree’s root node will be updated accordingly. Together with the SNARK proof corresponding to the Transfer operation, it will be sent to the contract on the ZeroSwap smart contract on-chain. Transfer does not change the token’s on-chain status because the token is still locked in the ZeroSwap contract and has not been transferred on-chain.

Create Liquidity

Create liquidity refers to the process where the user creates a liquidity pool or adds liquidity to an existing pool on Layer 2. The definition remains the same as that in Uniswap.
Create Liquidity is initiated by the user on Layer 2. When the ZeroSwap Server receives the user’s request to create liquidity for a pair of assets, it first needs to find the initiator’s Account and the Pair Account of the pair of tokens (If the Pair Account does not exist, the user needs to create a Pair liquidity pool first); then, transfer the two Tokens are calculated according to the AMM algorithm.
to the Pair Account proportionately; at the same time, the system will calculate the number of LP Tokens the user will receive and update the corresponding LP Token status under the liquidity provider Account. After all status updates are completed, the status tree root node’s hash and the proof of Create Liquidity will be sent to the ZeroSwap smart contract on-chain. The initial minted LP token will need to be done by the ZeroSwap Contract to deploy the corresponding LP Token contract on-chain.

Remove Liquidity

Remove Liquidity refers to the process where the user burns the LP Token from a certain Pair liquidity pool on Layer 2 and withdraws the two tokens from the pool reserve. Remove Liquidity is initiated by the user on Layer 2. When ZeroSwap Server receives a user’s Remove Liquidity request, it will first find the corresponding Account and burn the corresponding amount of Liquidity Tokens; then the two Tokens under the Pair Account corresponding to Liquidity Token will be proportionately transferred to the Account which has just burned its Liquidity Tokens. After the process is completed, the state tree will be updated accordingly, and the root node hash and the proof of the corresponding Remove Liquidity operation will be sent to the ZeroSwap contract on-chain.


Swap refers to the process where users complete transactions in the Layer 2 liquidity pools. Suppose the user needs to swap in the pool that contains TokenA -TokenB ​Pair Token. ​The user first sends TokenA from his account on Layer 2 to the corresponding Pair Account. Then ZeroSwap will calculate the number of TokenB for the user according to the AMM algorithm and send it to the user. The state tree is updated accordingly. The ZeroSwap Server will update the root node hash of the state tree. The hash and the swap proof will be sent to the ZeroSwap contract on-chain. Swap transactions will not change the status of the token on-chain, because the token itself is still locked in the ZeroSwap contract.

Withdraw Liquidity

Withdraw Liquidity refers to the process where the user withdraws the Liquidity Token from the Layer 2 account to Layer 1. Withdraw Liquidity’s initiation process, and status update on Layer 2 are the same as the above-mentioned ordinary Withdraw, but it produces different results on Layer 1. After the ZeroSwap contract receives the Withdraw Liquidity request, it will automatically trigger Liquidity Token minting to mint additional Liquidity Tokens on Layer 1 and send it to the designated account.

Token utility

Trading Fee

The trade fee paid out to liquidity providers is 0.3% per trade.

Listing Fee

ZeroSwap charges a Listing Fee every time a new token is listed.


ZRS holders will use ZRS vote on proposals on ZeroSwap platform to manage ZeroSwap by themselves.

Token Distribution

ZRS token total supply:10 Million.

Liquidity Ming:To encourage users to provide liquidity on the platform, Zeroswap will offer a 30% ZRS token to users who provide liquidity.

The initial set of available pools:

· CeFi Stablecoins: USDT-ETH, USDC-ETH

· DeFi Stablecoins: DAI-ETH, sUSD-ETH

· Lending Protocols: COMP-ETH, AAVE-ETH

· Synthetic Assets: SNX-ETH, UMA-ETH


· Ponzinomics: AMPL-ETH, YFI-ETH

· Decentralized Exchange:UNI-ETH, SUSHI-ETH

· ZeroSwap (2x reward): ZRS-ETH,ZRS-USDT

Trade Ming:To encourage users to trade on the platform, Zeroswap offers a 30% ZRS reward to early users who trade on the platform.

Community:10%.To develop the project community,airdrop,etc.

Team & Development:ensure the long-term viability and sustainability of the project.15% of ZRS distribution is set aside for team & developers.

Marketing & liquidity:15%.To promote project and provide liquidity on DEX.

DEX Protocol Comparison

Summary and Outlook

ZeroSwap uses ZK-Rollup technology to realize the complete function of Uniswap in Layer-2. It is a set of decentralized Layer-2 token AMM (Automated Market Maker) Swap protocol, with infinite scalability and high TPS. Liquidity providers and users do not need to pay high gas fees and always have real-time transactions. Users no longer need to wait for block confirmations to complete transactions on Layer 2, which dramatically reduces the threshold for using DEX and brings significant changes to all current DEX and CEX.

We will be committed to making ZeroSwap the most useful product in DEX. When the time is right, we will also launch a liquid mining plan, and DAO plans to help the rise of distributed financial DeFi and lead the paradigm change of blockchain applications.




1.Uniswap is a decentralized protocol for automated liquidity provision on ethereum.


3.Alex Gluchowski. Zk rollup: scaling with zero-knowledge proofs. https:// pdf.

4.Uniswap v1.

5.Uniswap v2 github.

6.zksync is a fully trustless, secure, user-centric protocol for scaling payments and smart contracts on ethereum.

Ariel Gabizon, Zachary J. Williamson, and Oana Ciobotaru. Plonk: Permutations

over lagrange-bases for oecumenical noninteractive arguments of knowledge. Cryp- tology ePrint Archive, Report 2019/953, 2019. 953.

7. Zero-knowledge_proof.