An overview of two promising Layer 2 (L2) solutions for Ethereum.
Introduction
Decentralised Finance (or DeFi) and the yield farming craze have developed new use cases and brought in new players, with more smart contracts being deployed to the Ethereum network. With the launch of new DeFi applications and the growing popularity of Uniswap, external smart contract calls more than doubled between the start of 2020 and August.
Figure 1: External Smart Contract Calls on Ethereum
More attention garnered more on-chain activity, but as we’ve seen in the past few months, fees become expensive and the confirmation time of a transaction increases when Ethereum approaches the limit of ~15 transactions per second (tps). Larger fees increase the costs for people using ether (ETH) as a simple payment or even other Decentralised Apps (DApps), some of which may only operate at an optimal level with lower fees.
There are also considerations for decentralisation: if the chain grows too large, hardware requirements to run an Ethereum full node over time increases significantly, reducing decentralisation and raising the barrier to adoption. If it takes too long to set up a node or require expensive hardware, then few people will be incentivised to do so.
Ethereum fees are measured in units known as gas, which is independent of the cryptoasset ETH. A simple payment would be required to pay a lower amount of gas than a complicated smart contract, since it requires more computation for the latter. Users can also select a high gas price to increase the chances of getting their transactions confirmed quicker.
Figure 2: Ethereum’s Median Gas Price, 2020
Gas fees and confirmation times ballooned at the height of the yield farming craze. Higher fees affected the entire Ethereum ecosystem by pricing out smaller transactions. Figure 2 shows three spikes in Ethereum’s median gas price which reached successive highs: 259 Gwei on August 13th, 483 Gwei on September 2nd and at 544 Gwei on September 17th.
As usage grows, so does the size of the blockchain too, not only increasing the requirements to run a node but also making it more expensive for users. To support an ecosystem of DeFi applications that could reach its full potential, Ethereum needs to scale.
The rise of DeFi has illustrated one thing: the need for a scaling solution so that Ethereum can manage until the eventual arrival of ETH 2.0 (which isn’t expected to be fully complete until at least 2022).
As higher-value transactions took precedence over smaller players, the events that took place between August to October have resulted in some Ethereum-based apps to explore Layer 2 (L2) solutions, or to even shift to other blockchain platforms entirely.
Ethereum’s Layer 2 Scaling Solutions
The most promising L2 solutions for Ethereum are listed below:
- Plasma,
- Payment channels,
- Sidechains (such as Matic and xDai Stable Chain),
- ZK-Rollups,
- Optimistic Rollups,
- And L1 chains that are EVM-compatible (such as Avalanche, Polkadot, and Cosmos).
For each solution, there are different tradeoffs. Plasma was introduced in 2017, and in theory, is a nice idea. After further research, the scaling solution encountered various problems that needed to be solved, which resulted in different projects such as Plasma Cash and More Viable Plasma. Specifically, there were unanticipated hiccups with Plasma, with a major problem being that users need to be online most of the time and download loads of data (to challenge in a dispute). Another major drawback for both Plasma and payment channels is that they do not support open participation smart contracts, used by the most popular Ethereum application Uniswap.
Trade UNI-USDT perpetuals on Interdax with continuous settlement and up to 100x leverage: https://app.interdax.com/app/trade/UNI-PERP-USDT
Because of the security considerations of sidechains/L1 chains that are EVM-compatible (such as the risk associated newer consensus mechanisms for L1 chains), and the limitations of Plasma and slower than expected progress, two promising L2 solutions for Ethereum have gained more attention and popularity: Rollups.
Rollups come in two broad forms: Optimistic Rollups and ZK-Rollups. Ecosystem players beginning to explore these scaling solutions to increase transaction throughput, decrease network congestion, and contribute to Ethereum’s long-term growth.
What is a Rollup?
A Rollup is an off-chain aggregation of transactions inside an Ethereum smart contract, which reduces fees and congestion by increasing the throughput of the blockchain from its current 15 tps to more than 1,000 tps. Within the smart contract, users can transact with security guarantees their transactions will not be misused and they will settle to the main chain at some point in the future. It publishes just enough data on-chain so that any observer can reconstruct the state (i.e., account balances) and detect invalidity.
The concept of Rollups dates back to 2014, described as “shadow chains” by Ethereum co-founder Vitalik Buterin. The failures of solutions like Plasma and state channels led developers to revisit Buterin’s shadow chains — now known as Rollups. While Plasma and state channels can scale millions of transactions per second, they are not compatible with the smart contracts that power many of the DeFi applications which have surged in popularity.
Figure 3: Shadow Chain Concept
Figure 3 illustrates the concept of a shadow chain which is also comparable to a sidechain. Participants of a shadow chain do not verify blocks by default. Blocks are finalised after two weeks if there is no revert and the chain runs in parallel to the main chain, but does not shadow all the data. The main idea is to separate the data (which is relatively cheap to store) and the execution of smart contracts, which uses more gas.
Since there’s more complexity with smart contract, there’s a larger footprint on the blockchain. Reducing this footprint this would enable an improvement in throughput and the number of tps. The shadow chain concept takes all the computations occur off-chain while state transitions are committed back to the main chain. The state transitions are only applied automatically to the main chain if a block is unchallenged after a particular period of time (or number of blocks). A block is reverted if someone can successfully challenge it before being committed.
Rollups build on the shadow chains idea by taking execution of the state off-chain and only using the Ethereum blockchain for data availability. Rollups post blocks or state updates, only publishing some data to the main chain for each transaction via tx CALLDATA, providing an improvement in throughput and overcoming a major hurdle for sidechains: data withholding attacks.
Vitalik Buterin sees Rollups as the scaling strategy in mind for the near-term, a sentiment that has resonated with a lot of the Ethereum ecosystem with many of the top Dapps starting to make the switch.
Another benefit is that each Rollup chain can be thought of as a shard where each shard (or Rollup chain) can permit experimentation with different execution and data models with no hard forks. As shown by Figure 4, each Rollup chain may have a different execution model, but will use the Ethereum main chain for data validation.
Figure 4: Rollup Chains as Shards
The two broad approaches to Rollups (Optimistic Rollups and ZK-Rollups) differ in the way they ensure validity of the sidechain blocks. For Optimistic Rollups, validity is ensured by a fraud proof and the synchrony assumption, while for ZK-Rollups, validity is ensured by zero-knowledge proofs.
Optimistic Rollups can support both simple payments and complex smart contracts, where 80% of the Ethereum Virtual Machine (EVM) tooling can be transferred over. Given that most costs on Ethereum are for complicated, Optimistic Rollups are seen as an immediate solution. On the other hand, it is more difficult to port over smart contracts seamlessly from Ethereum’s main chain to ZK-Rollups.
As a result, ZK-Rollups are viewed as a much more promising solution over the long-term. Although this scaling technique does complement Optimistic Rollups right now for simple payments, there are already some Dapps using this technology (e.g., LoopRing) and there is progress being made towards achieving smart contract support.
What are ZK-Rollups?
In short, ZK-Rollup is an L2 scaling solution in which all funds are held by a smart contract on the main chain, while it performs computation and storage off-chain where validity of the side chains is ensured by zero-knowledge proofs.
Initially proposed by Barry Whitehat in 2018, ZK-Rollups have the same security guarantees as the underlying L1 (i.e., Ethereum), the potential to produce blocks in under a minute and increase throughput to as high as 2,000 tps. Projects working on ZK-Rollup implementations include Matter Labs and Starkware.
Instead of waiting two weeks for a block in the Shadow Chain to become finalised as outlined by Figure 3, ZK-Rollups replace fraud challenges with zero-knowledge proofs. Accounts and balances are represented by separate Merkle Trees. These Merkle Tree roots ensure no one can fake the data. The roots of each Merkle Tree (one for accounts, the other for balances) are both stored in a smart contract on Ethereum which provides a succinct representation of the state of the sidechain. All other data is stored off-chain.
Figure 5 illustrates a simplified version of these Merkle Trees.
What is a zero-knowledge proof?: A zero-knowledge proof simply demonstrates that you know some secret to someone else without revealing the secret itself. Through virtue of mathematics, the verifier can check that the prover knows the secret without it actually being revealed to them.
Figure 5: Merkle Tree
A ZK-Rollup is like talking to someone (known as a relayer) that builds blocks and state updates. The change in state is hashed, and this is an input of a SNARK (a type of zero-knowledge proof) which includes proof of validity for each transaction in a Rollup block.
ZK-SNARK stands for Zero Knowledge Succinct Non-Interactive Argument of Knowledge. A SNARK is a Succinct Non-Interactive Argument of Knowledge, which refers to a proof construction where one can prove possession of certain information (a secret key for example), without revealing that information, and without any interaction between the prover and verifier.
Transactions are aggregated together, then signed for and committed to the main chain with just the header. Therefore, the amount of data stored on the Ethereum chain is reduced. All signatures are replaced by a zero-knowledge proof known as ZK-SNARK, which enables the compression of the aggregated transactions.
Computation is also improved since the verification of each signature is replaced with a single SNARK. The only little bits of information that are added to the main chain are the two Merkle roots of the address book and balances/nonces, both of which are 32-byte fields, amounting to a small part of the transaction data that is published on-chain via CALLDATA.
Once the block or state update is submitted, users can check the zero-knowledge proof for validity. Scaling solutions like Optimistic Rollups and Plasma rely on a challenge to an incorrect state or root hash, where a challenging transaction tells the smart contract that some data is incorrect, and the block is invalidated as a result.
These challenges are replaced in ZK-Rollups with ZK-SNARKs, where it is impossible for the relayers to submit an invalid or incorrect state. The SNARK proves that the series of transactions were correctly signed by owners, and that the updates to the account balances were correct, leading from the old Merkle root to the new Merkle root. Consequently, it is impossible for the relayers to commit an invalid or manipulated state.
Source: vitalik.ca
The Rollup smart contract verifies each state transition before it becomes effective. Once a block proof is submitted to the main chain and verified by the Rollup smart contract, all transactions in the block are finalised and come with the same guarantees of security as transactions on Ethereum’s L1.
User funds are always guaranteed to be eventually retrievable after a block is verified, even if relayers refuse to cooperate, so users do not have to monitor the Rollup block. Also, since there no challenges are involved, funds can be withdrawn from the sidechain as soon as a proof is complete (which is estimated to be ~20 minutes for a block containing 1,000 transactions).
What are Optimistic Rollups?
The idea of Optimistic Rollups was first detailed by a post from John Adler in the Ethereum Foundation research forum in July 2019, and are much closer to the original outline of Shadow Chains in Figure 3. Teams working on Optimistic Rollups include Optimism, Fuel Labs, Arbitrum, and more.
Optimistic Rollups provide near-instant transactions, smart contracts, and they do not require gas (except for aggregator fees). The transaction speed enabled by Optimistic Rollups is approximately 100 transactions per second with existing ECDSA signatures. If it changes the signature method to BLS, it can increase this figure to 500 tps.
Secure autonomous smart contract are enabled on L2 through the use of fraud proofs and on-chain data availability, where execution is not performed on the chain in the optimal case. Since blockchain data is made available, without processing it on the main chain, a higher throughput and better UX becomes possible.
In Optimistic Rollups, there are two main players: aggregators (incentivised with network fees) and validators (incentivised in a similar way to full nodes in bitcoin).
When aggregators get sufficiently many state updates, they’ll put this in a block and register the block on the Rollup contract (shown in Figure 6). Aggregators put up a bond, so if they put an invalid transaction into a block, they will get slashed and lose their bond. If the bond is high enough, then the risk for the average user should be close to nothing.
These flavours of Rollups use game theory with a validation game to ensure data validation. All funds in a Rollup are held by a single smart contract, where an aggregator leaves a bond up for grabs called a fraud proof that can be seized if a sequencer commits any malicious acts such as sequencing transactions against prior rules. They operate under the assumption that everyone is acting ethically, but include a fallback in case a malicious party arrives, hence the name Optimistic Rollups.
Figure 6: Optimistic Rollup
The scaling benefit here is that L1 simply has to witness this data and the aggregators create a Merkle Tree of the rollup block to submit as a block on Ethereum. Since there’s a commitment to transactions and interdemiary state roots, validity of transactions can be proven in one step. Transactions are not executed on the main chain, as the computation is executed only on L2. Accordingly, the transaction data is published on the Ethereum chain as CALLDATA, and is not stored in the state.
Anyone can commit to a block on the Rollup chain, collecting fees from L2 and becoming responsible for fees on L1, by including the following three elements as a transaction to a contract on-chain (known as a commitment transaction):
- The block header (consisting of the previous block header hash, state root, transactions root),
- Block transaction data, and
- A bond.
All Rollup chain transaction data must be included as CALLDATA for a commitment transaction to be valid. In a similar way to ZK-Rollups, the contract will Merkleise the transactions and verify the resulting root against the transactions root in the block header supplied by the commitment transaction. However, Optimistic Rollups differ in that invalid commitment transactions (not possible in ZK-Rollups) result in the bond being burned.
As blocks are added to the Rollup chain, their transaction summaries are on the main chain. Participants can watch these summaries and apply them in sync with their local state. If incorrect updates are applied, users can challenge the update and get the bond.
Given that transaction data is only posted on-chain but not validated, any Rollup blocks that are not finalised may be potentially fraudulent. Within a certain number of blocks, any participant can submit a fraud proof for an invalid block to invalidate it and all of its descendants. Valid side chain blocks have the same finality guarantees as the main chain (i.e., they are as irreversible).
In Figure 6, the Rollup contract comprises three basic parts:
- Canonical Transaction Chain,
- State Commitment Chain, and
- Fraud Verification Contract.
The transaction goes to the Canonical Transaction Chain when users put their ETH on the Ethereum main chain. After transaction execution on L2, the results are posted to the State Commitment Chain.
In contrast to ZK-Rollups, Optimistic Rollups are assumed to be correct until someone proves it is wrong. Fraud proofs are used in place of succinct proofs, since aggregators are bonded. If you’re only concerned about your own money, then you can just watch your state transitions. If something goes wrong, you can generate a fraud proof and take the bond of the aggregator. The Fraud Verification Contract can recognise if there’s cheating and delete the state if it is incorrect. However, it will not touch the state commitment chain when the contract recognises there’s been no cheating.
Optimistic Rollups provide significant efficiency improvements, since smart contract execution is done off-chain so less gas is used and only headers are published to the main Ethereum chain. By only recording state roots and not state, bloat on the blockchain is reduced. They are also an improvement on scaling solutions like Plasma and ZK-Rollups; since these Rollups are easily extensible to general computation and generic EVM applications. Plasma and ZK-Rollups are only currently effective for payments and a few other use cases.
For Optimism’s implementation, there is the Optimistic Virtual Machine (OVM), which enables almost anything possible in Ethereum to be possible in the OVM, including the composability of smart contracts. If used in conjunction with the EVM, the OVM will support writing code in Solidity. Large parts of the existing codebase can be ported onto Optimistic Rollups with little effort. While full Solidity opcodes are available in Optimistic Rollups, there might be some nuances to deploying smart contracts on the Rollup chain as compared to the main chain.
One assumption made for the security model of Optimistic Rollups is that there are at least 1-of-N honest participants who execute all Rollup transactions and will submit a fraud proof in the event an invalid state transition is published. With a time window of 1–2 weeks to challenge any fraud and not too much capital at stake, Optimistic Rollups are envisioned to work fine. However, a problem may arise when the value stored in these Rollups becomes significant with issues such as aggregator/miner collusion.
These Rollups are only safe with a fraud proof challenge window. Until the fraud proof challenge window is over, no internal Rollup transactions or an exit are possible. Therefore, the quickest way for a user to check whether a transaction is final is by executing all transactions for the last challenge period.
Conclusion
Rollups hold a lot of potential for Ethereum, but there are still challenges to overcome. The challenge for Rollups lies in the composability of DeFi services. If there are different Dapps on different Rollup chains, communicating between them is going to become more difficult than it would be on the main Ethereum chain. To maintain composability, DeFi services will have to coordinate and create critical mass on a particular Rollup chain.
Although there are promising signs of Rollup adoption amongst Ethereum applications, the permissionless nature of the blockchain network means that not every user/service will move to these L2 solutions.
Some challenges for Optimistic Rollups in particular include:
- The more volume a single Rollup has, the less validators can run the full node, meaning that it is less secure to rely on the 1-of-N honest assumption.
- Also, it is not yet known with certainty what the ideal parameters are for the bond requirement and the window of time before blocks are finalised. For existing implementations, bond requirements vary between 1 ETH and 32 ETH. Some projects will use a delay of 1–2 weeks, while there’s also an argument for times as short as three hours. Improving capital efficiency will require a shorter window, leading to a tradeoff between capital efficiency and security.
- To get around this, there is scope to introduce market makers into Optimistic Rollups to provide liquidity for fast exits, where a user will pay a fee to finalise their transaction and exit the Rollup. But then this creates a two-tier system: faster settlement for those who are willing to pay for an exit, and slower settlement for those who stay on the Optimistic Rollup until a block is finalised.
The major challenge for ZK-Rollups is integrating smart contract functionality:
- Matter Labs’ ZK-Rollup implementation, zkSync, is working to make this possible so that developers can take any existing contract written in Solidity/Vyper and deploy it to zkSync with minimum modifications.
- Another challenge relates to computation. Currently, zero-knowledge proofs are quite computationally intense, but the goal for the future is to bring block confirmations from around 20 minutes to less than a minute.
- Another limitation of ZK-Rollups is the reliance on a trusted setup of ZK-SNARKs, which will be addressed in the future as work on ZK-STARKs progresses and as these proofs are made more efficient.
Despite these issues, Rollups have become the primary strategy for scaling Ethereum until ETH 2.0 is active. We’ve already seen the Curve Finance experiment with ZK-Rollups, in particular the zk-Sync testnet, while other DeFi projects are planning on running parallel on L2 with Optimistic Rollups. In September, it was revealed that the largest stablecoin, Tether USD, would be incorporating ZK-Rollups to reduce the pressure on Ethereum.
There are also crossovers between the two scaling solutions (such as Zero Knowledge Optimistic Rollups) that promise to improve the privacy of Optimistic Rollups, since not all data is kept off-chain. In the future, we could even see a ZK-Rollup between exchanges (which requires coordination between exchanges) but would enable more efficient arbitrage in cryptocurrency markets.
Please clap if you found the article useful. If you have any feedback or thoughts, leave a comment below!
About Interdax:
Interdax — level up your trading in our next-gen digital asset derivatives exchange.
Sign up and register today to receive a 5% margin bonus. Join our referral program and earn 20% commission.
Contact Us:
- [email protected]
- Telegram
- Medium
- Interdax Help Centre
