Backup and restore procedures for zkSync Era are not generic DevOps tasks; they are protocol-specific operational requirements driven by the node's unique state architecture. Unlike a simple stateless API, a zkSync Era node maintains a complex, high-velocity state database that includes L2 state trie data, Merkle tree proofs, transaction history, and critical cryptographic key material. A failure without a valid, tested backup can result in catastrophic data loss, requiring a full re-sync from genesis that may take days and cause extended service disruption for exchanges, RPC providers, and ZK Stack chain operators.

Backup and Restore Best Practices
Introduction
Defines the critical data assets, backup frequency, and restoration procedures required to ensure business continuity for zkSync Era node operators.
The operational surface area for backups must cover three distinct asset classes: the PostgreSQL database containing the canonical chain state, the node configuration files that define L1 interaction parameters and network identity, and the keystores securing the operator's block-producing or proof-submitting keys. Each asset class has a different change frequency and recovery time objective (RTO). The database, undergoing continuous state transitions, requires frequent, consistent snapshots using pg_dump or filesystem-level tools coordinated with a checkpoint. Configuration files change infrequently but a loss can cause misconfiguration on restart, while keystore loss is an irrecoverable security event that may permanently disable a validator or prover.
The most common operational failure mode is not the absence of backups, but the failure to test restoration procedures in a staging environment. A backup file that cannot be restored, or a snapshot that is silently corrupted, provides a false sense of security. Operators must validate the full restoration pipeline—snapshot import, configuration application, keystore decryption, and node startup to a healthy, syncing state—on a regular schedule. Chainscore Labs can audit backup strategies against the specific state growth patterns of zkSync Era, verify restoration integrity in isolated environments, and design automated recovery pipelines that minimize downtime for production infrastructure.
Backup Scope and Frequency at a Glance
A structured overview of the data, configuration, and secrets that must be backed up for zkSync Era infrastructure, with recommended frequencies and the primary actors responsible for each component.
| Area | What to back up | Who is affected | Recommended frequency |
|---|---|---|---|
PostgreSQL Database | Full state database dump (pg_dump or physical snapshot) | Main node and External Node operators | Daily, with continuous WAL archiving for point-in-time recovery |
Node Configuration |
| All node operators | On every change; version in git and back up the repository |
Prover Keys | Proving keys and setup-specific circuit artifacts | Prover operators and ZK Stack chain deployers | Once after generation; verify integrity on each prover release |
Validator Keystores | Encrypted consensus and attestation keys | Sequencer and validator operators | Once after creation; store offline with a tested restoration procedure |
L1 Contract Addresses | Deployed contract addresses for bridges, verifiers, and Diamond Proxy facets | Bridge operators and integration teams | On every protocol upgrade; verify against the canonical ZKsync deployment registry |
Snapshot Archives | Verified node snapshots used for bootstrapping | New node operators and disaster recovery teams | On each official snapshot release; verify checksums before use |
Monitoring and Alerting Rules | Prometheus recording rules, Grafana dashboards, and alerting thresholds | SRE and infrastructure teams | On every change; treat as code and back up the repository |
Database Migration Scripts | Custom SQL migration scripts and rollback procedures | Node operators performing manual upgrades | Before and after each upgrade execution; store alongside database backups |
What State Must Be Backed Up
A precise inventory of the persistent state that zkSync Era node operators must capture to guarantee a successful restore, including database volumes, configuration artifacts, and cryptographic key material.
For zkSync Era node operators, a backup strategy is only as good as its completeness. A successful restore requires capturing three distinct categories of state: the PostgreSQL database containing the chain's derived state and Merkle tree, the node's configuration files that define its operational parameters and L1 connection, and the cryptographic keystores that authorize block production or proof submission. Missing any one of these components renders a backup useless for recovery, turning a routine restore into a full re-sync from genesis that can take days.
The PostgreSQL database is the single largest and most critical asset. It stores the full L2 state, including account states, contract storage, and the Merkle tree data required for generating state proofs. Operators must perform pg_dump or file-system-level snapshots of the database volume, ensuring consistency by executing the backup while the node is paused or by using pg_basebackup for continuous archiving. The frequency of these backups should be aligned with the operator's Recovery Point Objective (RPO), noting that state diffs are published to L1, but reconstructing the full state from L1 calldata is computationally prohibitive and not a substitute for database backups.
Configuration files, often overlooked, define the node's identity and its connection to the L1 network. This includes the YAML or TOML configuration specifying the L1 RPC endpoint, contract addresses for the zkSync diamond proxy and bridge, and database connection strings. The keystores, typically JSON files or paths to Hardware Security Modules (HSMs), contain the private keys for the node's Ethereum address used for L1 transactions. Loss of these keys can permanently sever the node's ability to submit blocks or proofs, leading to operational failure. Chainscore Labs can audit an operator's backup scope and restore procedures, verifying that staging environment drills correctly reconstruct all three state categories without relying on implicit production assumptions.
Impact by Operator Type
Criticality: Mandatory
Main node operators must prioritize backing up the PostgreSQL database, which contains the full L2 state. A corrupted state can halt block production and finality. Backups must be atomic and consistent; using pg_dump on a live, high-throughput database without proper isolation can produce unusable snapshots.
Action Items:
- Implement continuous archiving and point-in-time recovery (PITR) using
pg_basebackupand WAL archiving. - Schedule daily full backups during low-throughput windows.
- Securely back up the
secretsdirectory containing the block producer's private key. Loss of this key is irrecoverable and will halt the sequencer. - Test restoration procedures in a staging environment quarterly to validate recovery time objectives (RTO).
Chainscore can audit your backup strategy, verify PITR configuration, and conduct controlled disaster recovery drills to ensure operational continuity.
Key Components of a Backup Strategy
A robust backup strategy for zkSync Era nodes must cover PostgreSQL databases, configuration files, and keystores to ensure rapid recovery from data corruption, failed upgrades, or chain halts.
Configuration and Environment Files
Back up all .env files, YAML configuration files, and systemd service definitions. These files contain critical operational parameters like L1 RPC endpoints, database connection strings, gas price floors, and sequencer API keys. A node restored from a database snapshot is useless without its exact operational context. Store these configuration backups in a separate, secure version-control system to track changes and enable rapid redeployment of a node with identical settings.
Keystore and Key Material Backup
The keystore containing the private key for the node's Ethereum address is the most sensitive asset. This key is used for submitting proofs or, for a sequencer, signing blocks. Loss is catastrophic and irreversible. Backups must be encrypted and stored offline in geographically separate hardware security modules (HSMs) or secure cold storage. Implement a strict access control policy and regularly test the decryption and key-import procedure to ensure it works when needed.
Prover-Specific State Backup
For prover operators, the backup scope extends beyond the database to include circuit-specific setup files and intermediate proof artifacts. These large files are computationally expensive to regenerate. A backup strategy should include the prover's working directories to avoid days of recomputation after a hardware failure. Coordinate prover backups with database snapshots to ensure a consistent recovery point where the node's state and the prover's progress are synchronized.
Automated Restoration Drills
A backup is only valid if it can be restored. Implement automated, periodic restoration drills in a staging environment that mirror the production setup. The drill should cover the full procedure: provisioning new infrastructure, decrypting keystores, restoring the latest database snapshot, applying configuration, and verifying the node syncs to the network tip. This practice validates backup integrity, measures recovery time objective (RTO), and ensures the operations team is proficient in the disaster recovery runbook.
Failure Mode and Risk Matrix
Identifies critical failure scenarios during backup and restore operations for zkSync Era infrastructure, assessing impact on node operators, RPC providers, and prover operators.
| Risk Area | Failure Mode | Severity | Affected Actors | Mitigation |
|---|---|---|---|---|
Incomplete Database Snapshot | Backup captures a partial or inconsistent database state due to node activity during the dump, leading to a corrupted restore. | High | Node Operators, RPC Providers | Use |
Missing Configuration Files | Node configuration, env files, or systemd definitions are not included in the backup scope, preventing service restart after a restore. | Medium | Node Operators, Prover Operators | Version-control all configuration in a separate repository. Automate backup of |
Private Key Loss or Omission | Operator, sequencer, or prover keys stored outside a dedicated keystore are not backed up, resulting in permanent loss of signing capability. | Critical | Sequencer Operators, Prover Operators | Enforce a strict key management policy using HSMs or remote signers. Backup keystore files and encryption metadata separately with strict access controls. |
Unverified Restore Procedure | A backup is taken but the restoration procedure is never tested, leading to extended downtime when a real disaster occurs due to undocumented steps or version incompatibilities. | High | Node Operators, Exchanges | Conduct scheduled disaster recovery drills in a staging environment. Document and validate the exact restore command sequence for the current node version. |
Snapshot Format Incompatibility | A node upgrade changes the internal database schema, making older backup snapshots incompatible with the new node binary. | Medium | Node Operators | Always capture a new full snapshot immediately after a successful database migration. Maintain a version matrix of node binaries and compatible snapshot schemas. |
Restore from a Compromised Backup | A backup containing malware or a corrupted state is restored, replicating the compromise into the production environment. | Critical | Node Operators, RPC Providers | Store backups in an immutable, air-gapped location. Scan snapshots for anomalies before restoration. Verify state root against a trusted public source. |
Prover State Desynchronization | A prover is restored from a stale backup and submits proofs for an already-finalized batch, causing L1 transaction failures and wasted gas. | Medium | Prover Operators | Implement a pre-submission check that queries the main node for the latest proven batch number. Ensure the prover's restore procedure includes a forced re-sync step. |
Backup and Restore Operational Checklist
A structured checklist for zkSync Era node operators to validate their backup and restore procedures. This ensures rapid recovery from database corruption, failed upgrades, or operational mistakes, minimizing downtime and preventing state loss. Each item defines what to check, why it matters, and the signal that confirms readiness.
What to check: Confirm that the backup process captures the full state directory, including the PostgreSQL database, the Merkle tree data, and the node's configuration files (.env, *.yaml). Verify that keystores used for block production or proof submission are backed up separately in a secure, encrypted format.
Why it matters: An incomplete backup is useless during a disaster. Missing the Merkle tree data or a specific configuration flag can prevent a node from syncing or cause it to fork. Keystore loss is catastrophic and irreversible.
Readiness signal: A documented, machine-readable manifest of all backup artifacts is generated with each backup cycle, and a test restoration has successfully started a node from these exact artifacts.
Source Resources
Use these resources to verify backup scope, restore procedures, version compatibility, and incident context before changing production zkSync Era or ZK Stack infrastructure.
Internal Restore Evidence Pack
Maintain an internal evidence pack for each tested zkSync Era restore: backup timestamp, node role, software version, database checksum or object-store manifest, configuration hash, keystore custody record, snapshot source, restore duration, sync catch-up result, and post-restore RPC validation. This resource should be updated after every drill or production incident. Chainscore Labs can review the evidence pack to identify missing controls, unsafe rollback assumptions, and gaps between documented RPO/RTO targets and actual recovery behavior.
Looking to build on a specific blockchain?
We build smart contracts, DeFi applications, wallets, tokenization platforms, and blockchain infrastructure across the major ecosystems teams choose today. That includes Ethereum, Arbitrum, Optimism, Polygon, Avalanche, Solana, Sui, Aptos, Hedera, Stellar, and NEAR, with support for additional EVM and non-EVM networks based on your product requirements.
EVM ecosystems
- Ethereum
- Arbitrum
- Optimism
- Polygon
- Avalanche
- Cronos

Non-EVM ecosystems
- Solana
- Sui
- Aptos
- Hedera
- Stellar
- NEAR
Additional ecosystems
- Polkadot
- Cosmos
- TON
- Cardano
- Algorand
- Tempo
Also available for Base, appchains, custom EVM networks, and cross-chain product architecture.
Frequently Asked Questions
Operational questions for teams managing zkSync Era node backups, covering what to protect, how often to snapshot, and how to validate recovery procedures.
A complete backup must include the PostgreSQL database, node configuration files, and all operational keystores.
- PostgreSQL database: Contains the full L2 state, transaction history, and Merkle tree data. This is the critical path for recovery.
- Configuration files: Includes
envfiles, YAML configs, and any environment-specific overrides for L1 WebSocket URLs, gas price floors, and batch size limits. - Keystores: Private keys used for block production or proof submission. Loss of these keys can result in permanent inability to produce blocks or submit proofs.
Operators should verify that backup tooling captures all three categories atomically to avoid inconsistent recovery states.
Delivering blockchain solutions for 5+ years.
We have partnered with 50+ leading DeFi protocols, NFT ecosystems, and fintech innovators to build secure, scalable, and capital-efficient blockchain products.
Selected Partners & Clients
“I've been working with Chainscore Labs for last 3+ years, they've consistently delivered with strong ownership across multiple projects. The team is reliable and detail-oriented.”
How to get started?
If you're looking for blockchain integration, ChainScore Labs has 5+ years of experience helping teams build and integrate exchanges, wallets, smart contracts, tokenization solutions, and protocol-connected products, we can help you choose the right path, integrate securely, and get to production faster. Our team consists of experienced blockchain developers and architects who can help you with your blockchain integration needs.
Exploration & Strategy
Define your product goals and choose the right blockchain architecture for your use case.
Architecture & Design
Design the smart contracts, tokenomics, and security parameters of your system.
Development & Integration
Build and integrate with wallets, oracles, and front-end dApps for a seamless experience.
Security & Launch
Comprehensive audits followed by a risk-managed mainnet deployment to protect your users.
Discover our
blockchain development services.
We build production-grade blockchain solutions for top-tier projects across DeFi and Web3.
Need a blockchain engineering team?
Send the project context and we will respond with next steps, scope questions, and a practical path to delivery.


