LazAI Explainer Challenge
Claim Layer3 rewards
The Metis Hybrid Rollup is now live on Devnet, marking a major step toward integrating validity proofs into Metis’s existing rollup architecture. By verifying execution results on-chain, this approach aims to reduce withdrawal delays.
The work started by combining optimistic execution with ZK validity proofs. It now extends to a larger question: how to scale Ethereum as it moves into the post-quantum era.
This is about more than resolving disputes through faster settlement. It is also about building a post-quantum path.
Beyond reducing withdrawal delays, Metis is working toward post-quantum security. The upgrade covers two components: Ziren's proof verification and DSeq's support for ML-DSA signatures.
Because costs differ by component, Metis is adopting cryptographic agility. Each component's cryptographic configuration can evolve through a phased upgrade, balancing security, performance and operational cost.
ZKM, the team building the proving technology behind this work, has published the research and technical background in a companion article: [link to ZKM article]. This article covers what Metis is deploying and where it stands.
Metis announced its Hybrid Rollup design at ETHDenver in March 2023. The proposal aimed to add validity proofs to Metis’s existing optimistic rollup architecture, so that execution results could be verified cryptographically.
The original proposal targeted a cut in the withdrawal waiting period from seven days to the range of hours, while keeping the existing sequencer, smart contracts, and user experience. Validity proofs would establish that execution was correct, with no need to redesign the chain.
Implementing the design required a zero-knowledge virtual machine (zkVM): a system that can prove a program ran correctly.For this integration, it had to prove execution of the chain’s software, and it needed sufficient performance, security review, and compatibility.
To address this, the research team behind the original design developed zkMIPS, which later became Ziren. Ziren is ZKM’s open-source, general-purpose zkVM.The development progressed through several milestones:
Ziren was then deployed on GOAT Network, a Bitcoin Layer 2, where it provides real-time validity proofs for the network’s global state transitions.
Metis, for its part, already has groundwork in place. In May 2025, the Andromeda upgrade activated fraud proofs on Metis mainnet. The fault-proof program behind them, published in the Metis repository, is a Cannon-style program compiled to MIPS. Metis’s fraud-proof system already runs on MIPS, the instruction set Ziren supports. That gives the two a shared foundation for integrating validity proofs, though compatibility still depends on the program’s execution semantics, system calls, and input/output conventions.
With the proving infrastructure now established, Metis is bringing this technology into its Hybrid Rollup architecture. But the industry evolved during those years, and so did the security requirements for blockchain infrastructure.
Adding validity proofs strengthens how execution results are verified, but it does not remove every cryptographic dependency in a rollup. Metis's post-quantum work focuses on two areas: the signatures used by its decentralized sequencer system, and the proofs used to verify execution.This is where Metis is taking its Hybrid Rollup further.
The concern is elliptic-curve cryptography. NIST notes that ECDSA, EdDSA, and RSA are vulnerable to Shor’s algorithm on a sufficiently powerful quantum computer. No such computer exists today, but migrating takes years.
Preparing for post-quantum cryptography reaches across the Ethereum ecosystem. Here is the timeline so far:
Metis's decentralized sequencer (DSeq) spreads sequencing across participating operators. A proof-of-stake coordination layer handles sequencer selection and rotation, and multiparty computation (MPC) lets participating nodes jointly sign batch submissions to Ethereum. This reduces reliance on a single operator. It does not, on its own, make the signatures quantum-resistant. That depends on the signature scheme underneath.
Metis is upgrading DSeq to support ML-DSA, a post-quantum digital signature scheme. The existing elliptic-curve signing path remains active today. This upgrade covers sequencer signing. Proof verification needs a separate set of changes.
On the proof side, Ziren supports hash-based proof verification on the Ethereum Virtual Machine (EVM), without an elliptic-curve wrapper. A Keccak-based compact shrink verifier for this path has been implemented and benchmarked locally. It gave Metis a concrete starting point for post-quantum proof verification.
Together, these changes are the starting point for post-quantum signature support and proof verification in the Hybrid Rollup. The next section explains how cryptographic agility lets Metis manage the security, performance and cost trade-offs of each component as it prepares for broader deployment.
Metis is adopting cryptographic agility: the ability to replace cryptographic schemes and verification components as security requirements evolve. This allows post-quantum capabilities to be introduced progressively, without requiring all components to transition simultaneously.
Activation is phased because the costs differ by component. Direct hash-based proof verification currently needs substantially more on-chain gas than the Groth16 path. For DSeq, adopting ML-DSA would introduce larger signatures, increasing bandwidth and storage requirements.Signing and verification performance also needs to be evaluated within the Metis implementation.
Devnet testing will measure total cost per finalized batch, proving latency and withdrawal waiting time. Those results are intended to inform the aggregation and verification settings used in later deployments.
Step 1: Support Both, Enable One. The codebase supports both conventional elliptic-curve cryptography (ECC) and post-quantum cryptography (PQC) pathways, while initially enabling only the ECC pathway. This lets the architecture accommodate both approaches without forcing an immediate transition.
Step 2: Switch to PQC Module by Module. The transition to PQC will take place progressively across individual components, rather than through a single network-wide cutover. This includes components within the proof system, such as memory-consistency verification and the final proof verification pathway.
This approach balances present-day performance and cost requirements with the need to prepare for future cryptographic security challenges.
The deployment of the Hybrid Rollup on Devnet marks the first major milestone in this phase of development.
Cryptographic agility allows Metis to change the cryptographic scheme used by an individual component without requiring a network-wide transition. Each upgrade can be evaluated against its security assumptions, compatibility requirements, and measured costs.
Devnet: Running now
Total verification gas includes the 21,000 transaction base gas and calldata costs. The direct verification path uses lossless transport compression and fits within the enforced 16,777,216-gas transaction limit. Deployment costs are reported separately and may span multiple transactions.Direct hash-based verification currently incurs substantially higher on-chain costs than Groth16 verification. Ziren is evaluating larger aggregation windows, verification optimizations and proof-size reductions to lower the cost per finalized batch. These options involve trade-offs in proving resources and withdrawal waiting time.
In this implementation, ML-DSA-65 verification was approximately 7.4 times faster than ECDSA (secp256k1) verification. Signing took approximately 4.3 times longer, and the commit signature payload for 20 validators was approximately 51.7 times larger. The main trade-offs are signing latency, bandwidth and storage.
These figures compare the two signature schemes. DSeq needs separate measurements, including any coordination overhead.
Testnet: Q1 2027
Mainnet: ECC first, then PQC
This phased approach lets Metis evaluate each stage before introducing post-quantum cryptography into the network.Because Mainnet launches on the ECC pathway first, it will not carry post-quantum guarantees at launch.
The Hybrid Rollup is one part of a broader effort to bring Metis closer to a standard EVM execution environment. A second part is a proposal, published as a public discussion draft, to convert the OVM Token into a native asset.
Today, this asset exists as an ERC-20 contract. Native assets behave the way EVM tooling expects: value moves with the transaction itself, with no approval step. The goal of the proposal is EVM equivalence, so that wallets, contracts and infrastructure need fewer Metis-specific exceptions.
In brief, the draft proposes:
This is a draft proposal and has not been approved by governance. The snapshot block and timeline are still to be determined. The full rules will be published in a separate announcement.
The Hybrid Rollup is part of a broader evolution of Metis infrastructure, advancing its Consensus Layer and Execution Layer architecture while building on its foundations within the Ethereum ecosystem.
It builds upon the existing Metis technology stack:
With the Hybrid Rollup now deployed on Devnet, Metis is moving closer to an architecture that combines flexible execution, cryptographic verification, and the ability to evolve alongside emerging security requirements.
First introduced in 2023, the Hybrid Rollup vision is now evolving into a broader effort to advance verifiable execution and prepare Metis for the post-quantum era.
This marks the next phase in Metis's infrastructure evolution.
