Zero-knowledge computing is entering a new phase, one defined not just by possibility, but also by performance.
With the release of R0VM 2.0, developers can now prove faster, build bigger, and trust every result. It’s our fastest, most secure zkVM yet, and marks the beginning of the real-time era.
The Next Evolution of ZK
Zero-knowledge computing has evolved through three distinct eras, and we’ve been at the forefront of each one.
The ZK Stone Age: Cryptographers built ZK apps by writing low-level circuits. Tooling was minimal, and ZK was out of reach for most people.
R0VM 1.0 - From PhDs to Developers: With the first general-purpose zkVM, we made ZK accessible to developers. You could now write Rust, generate proofs, and verify them on any chain.
R0VM 2.0 - The Real-Time Era: Now, performance arrives. ZK is not just accessible, but also fast and efficient enough to power modern blockchain applications.
R0VM 2.0 marks the next evolution of zkVMs. It’s our fastest, most secure zkVM yet, purpose-built for the applications developers want to build today.
Faster Than Ever
Since R0VM 1.0, we’ve gone from 35 minutes to just 44 seconds to prove an ethereum block (including execution). And we’re not slowing down.
5x Cheaper Proofs for OP Chains
Proving costs have historically been one of the biggest limitations for using ZK in production. With R0VM 2.0, proving costs are no longer a barrier but an afterthought.
In recent OP Kailua benchmarks on Base, we’ve observed up to a 5x cost reduction for validity proofs, dropping from $1.355 to $0.2747 per block (for batch size of 25). We’ve seen transaction costs as low as $0.0012 with larger batches.
As proving costs continue to drop and latency improves, ZK Rollups become a practical default for a growing number of teams.
Note: This reflects updated numbers from our earlier 10x estimate. We’ve updated the table with corrected numbers after re-running the benchmarks with consistent methodology.
Additionally, R0VM 2.0 enables teams to prove massive batches to unlock lower proving costs.
More Memory, More Possibilities
R0VM 2.0 introduces 3GB of user memory, a 15x increase over our previous release. This unlocks more advanced workloads and reduces overhead for memory-bound applications.
This unlocks more complex applications, such as:
EVM proofs at scale. We've proven thousands of EVM blocks at once using OP Kailua, with potential to scale to tens of thousands in a single batch.
Gaming applications. Previously, we’ve seen Doom proofs & Gameboy proofs.
All The Precompiles You Need
R0VM 2.0 ships with two major precompile additions:
BN254: Used in Ethereum block proving and Groth16 aggregation
BLS12-381: Used in light clients and signature verification for interop products.
These unlock substantial performance gains, up to 13x reduction in costs for pairing-heavy workflows.
With these additions, R0VM now supports all major Ethereum precompiles used for proving EVM execution and Ethereum consensus. Developers can now integrate ZK into rollups and applications without custom low-level workarounds.
Real-time Proving by July
Modern applications demand real-time performance. As ZK becomes widely adopted, proving speed becomes the driving force behind adoption. The faster we can prove, the more use cases unlock, and more users we reach.
The holy grail is real-time proving. that means generating a ZK proof for a block in under 12 seconds.
We’re targeting this in July 2025, and we have a clear plan to get there.
Until recently, our focus has been on reducing costs, and our Amdahl’s Analysis for costs has been pointing us toward building precompiles & optimizing our RISC-V circuit. Now that we have 2.0 out the door, including a full suite of precompiles, we’re turning our engineering attention toward real-time proving.
Oversimplifying a bit, with a decently-sized GPU cluster, we can describe our proving latency as:
In the formula above, we have three terms, which correspond to the three phases of STARK proving described in our previous blogpost on Designing High-Performance zkVMs. Since we’re able to start proving while the executor is still running, we’ve already been able to remove the bulk of the RISC-V proving from our walltime analysis for block proving. So, the middle term here is already quite small, and not a real barrier to real-time proving. For the other two terms, a 2x improvement would bring that term under 12 seconds. A 4x improvement on these two terms would bring us to the precipice of real-time proving.
In addition to targeted optimization efforts on our Executor and Join (i.e., 2-to-1 STARK aggregation), we’re also looking forward to major leaps forward later this year, as we roll-out the custom hardware that Fabric has been cooking up for us, and the new Binius zkVM we’ve been cooking with the Irreducible team.
Real-time proving is no longer a theoretical goal. It’s a concrete milestone, and we’re on track to reach it.
R0VM 2.0 is Our Most Secure zkVM Yet
Speed means nothing without security. At RISC Zero, we invest in both. Everything we ship is matched by a commitment to security, because developers shouldn’t have to choose between performance and peace of mind.
As ZK adoption grows and more capital enters the space, the risks grow with it. That’s why every performance upgrade we ship is matched by a deeper commitment to security, transparency, and trust minimization.
That’s why formal verification is the core focus of R0VM 2.0.
We’ve partnered with Veridise and integrated Picus to begin formally verifying determinism across our circuits. This process targets undercontrained bugs, an issue that accounts for nearly 97% of ZK circuit bugs.
We’ve already made progress:
Proven full determinism of our Keccak circuit
Proven 122 of the 123 components for core RISC-V functionality in our v2 circuit are deterministic
And we’re not stopping there. This process is now baked into our development pipeline, enabling continuous formal verification as R0VM evolves. We believe that formal verification is the only responsible path forward as ZK systems become adopted, and we feel confident that R0VM will be the first fully formally-verified RISC-V based zkVM.
R0VM 2.0 isn’t just incredibly fast, it’s built on a security philosophy rooted in proof, not promises. And unlike other systems, our prover set is fully open using Boundless, eliminating centralization risks. Read more about our approach to formal verification.
Start using R0VM 2.0 Today
With R0VM 2.0, we’re setting a new standard for zkVMs, blending performance, security, and a clear path to real-time proving.
You can get started today using:
RISC Zero’s Private Prover: Centralized proving service for stronger privacy
Boundless: The Universal ZK Protocol for decentralized proof generation and strong liveness guarantees.
.png%3Ftable%3Dblock%26cache%3Dv2%26id%3D1d1051eb-c1b5-809f-84d4-d3dc1f9c2dd7&w=2048&q=80)
.png?table=block&id=1d1051eb-c1b5-8065-93bb-e2fd855713a6&cache=v2)
.png?table=block&id=1d1051eb-c1b5-8007-9de9-cbe570df88ab&cache=v2)
.png?table=block&id=1d1051eb-c1b5-8008-a77e-d1e46e57bd73&cache=v2)
.png?table=block&id=1d1051eb-c1b5-809e-ac92-f13f9d576e05&cache=v2)
.png?table=block&id=1d1051eb-c1b5-8098-9e4c-eac31f310574&cache=v2)
.png%3Ftable%3Dblock%26cache%3Dv2%26id%3D1c1051eb-c1b5-80af-8496-f7ab4fc5efdc&w=640&q=75)