Ethereum’s Verkle Trees: The Math Behind Smaller Proofs

Ethereum’s execution layer has relied on Merkle Patricia Tries for state storage since the genesis block. These structures are battle-tested but produce large witnesses, requiring every sibling hash along the path from root to leaf to prove a single storage slot exists. This logarithmic scaling creates a hard bandwidth ceiling for stateless clients, where witness sizes can exceed 20 MB for a full block. I view this as an existential requirement rather than a simple optimization; without smaller proofs, light nodes cannot verify blocks within the 2-second slot time. The migration to Verkle trees is the central enabling piece for this shift, replacing hash-based commitments with polynomial commitments built on Kate-Zaverucha-Goldberg schemes.

From Hashes to Polynomial Commitments

The structural difference is stark. A Merkle Patricia Trie uses a branching factor of 16, meaning the worst-case path length is 64 nodes. In contrast, the current Ethereum specification uses a width-256 Verkle tree. This higher arity allows proofs for multiple leaves under the same subtree to aggregate into a single proof whose size is sublinear in the number of leaves accessed. For a block touching thousands of storage slots, the witness size difference is roughly an order of magnitude. Specifically, a hexary Merkle tree requires about 3 kB per witness, totaling approximately 47 MB for a standard block. A binary Merkle tree drops that to 8 MB, while a width-256 Verkle tree reduces it to just 1.5 MB.

I find the "conversion overlay" approach particularly elegant. Instead of a flag-day switch, the Merkle Patricia Trie continues to exist, but newly written or modified state goes into a Verkle overlay sitting on top. Reads check the overlay first, consulting the old trie only for entries not yet migrated. Over time, state migrates naturally as it is touched. Cold state, which includes accounts and storage slots not accessed in years, requires a background conversion process running across multiple blocks to avoid gas spikes. This design avoids the massive computational burden of a one-time rewrite. However, the implementation complexity remains high. Consensus on stem and extension node encoding was reached in late 2025, but a mainnet activation date has not been announced. Devnets like Kaustinen are currently testing the logic, suggesting a long-lived public testnet deployment is the next milestone.

The math holds up clearly here. By using vector commitments, a single constant-size proof attests to multiple leaf values simultaneously. This collapses the witness from megabytes to kilobytes, making network propagation feasible before the next slot. Does this mean we will never need to store local state again? That question remains open as the protocol evolves toward history expiry schemes.