Rollups, driving scaling innovation

The most sophisticated and promising L2 scaling technology supporting general purpose EVM code to date is that of rollups. A rollup off-chain bundles transactions which reduces fees and network congestion and sends them towards an Ethereum smart contract, where users transact with security guarantees settling on L1. Rollups are designed to publish enough data to L1 in order to enable anyone to reconstruct the correct state. The data is handled by sequencers and validators, who submit bundles of compressed transaction data back to L1. The scalability and transaction cost benefit are realized by executing transaction bundles off-chain before submitting the compressed data to L1. As Illustration 2 showcases, transacting on rollups is already a magnitude cheaper than on Ethereum L1. In certain scenarios, they also manage to outcompete newer L1 such as Avalanche or Cardano.

Despite promising transaction cost at the current state, rollups are not optimized yet as most of the early projects were just forked off Ethereum. For instance, Aave V3 managed to drop fees by about 10x optimizing via rollup specific APIs to achieve a massive decrease in call data size. Other upcoming optimizations for optimistic rollups such as aggregating or compressing signatures and more sophisticated call data compression will lead to yet another increase in scalability. As a result of higher computational complexity, zk rollups come with a higher fixed cost than optimistic rollups. Currently though, they are still cheaper because the non-optimized call data costs on optimistic rollups exceed the fixed costs.

Along with several successful application specific rollups that are streamlined towards a certain use case and are able to scale up massively, such as dYdX, Loopring or Immutable X, some general purpose optimistic rollups such as Arbitrum or Optimism are getting significant traction recently. The TVL both in optimistic and zk rollups, as shown in Illustration 3, continued to outperform other off-chain scaling solutions starting in late August 2021 and is now hovering above $6.7b in TVL, $3.58b on Arbitrum alone. For comparison at the time of writing, Fantom captured $6.34b, Solana $5.88b or Polygon PoS $5.21b in TVL.

Adoption might get another push as, according to Matter Labs, the first EVM-compatible zk rollup on Ethereum’s testnet zkSync2.0 was launched end of February. Starkware with StarkEx and StarkNet is joining the race for general-purpose zk rollups that offer the benefits of zk rollups along with EVM compatibility.

Besides the growing TVL, there are also other indicators present pointing towards rollup adoption. For instance, the Arbitrum sequencer is constantly among the top gas spender on Ethereum. Rollups are already paying up to $160,000 for Ethereum’s security every day. Given further adoption of L2s, sequencer of different rollups might soon be the tenants paying the highest rent to get their data stored on L1.

Rollup types

As already mentioned, there are two types of rollup designs that currently drive innovation and adoption. Let’s have a closer look at their design principles and their most renowned representatives.

Optimistic rollups

offer improvements in scalability by assuming that all transactions are valid by default and propose a new state, executing transactions off-chain and submitting statements that are secured by fraud-proofs. Anytime the rollups publish a bundle of state transitions there is a Dispute Time Delay (DTD) where any party can publish a fraud proof indicating that one of the state transitions was invalid. As a result of this DTD, optimistic rollups face long withdrawal times. Sequencers are required to stake ETH for staking rewards to incentivize legitimate transaction data and face slashing for fraudulent activities. Only if an invalid state transition is published to the rollup smart contract, a fraud proof can be generated that includes compressed rollup transaction data, the pre-state root hash, and the post-state root hash. Since the transactions are only processed if they are challenged by users, the validation strain is placed on the community, rather than the technology. A big advantage of optimistic rollups is that they are capable of executing smart contracts easily.

Optimism a general purpose optimistic rollup that uses a modified GETH was initially supposed to be the first to launch on the Ethereum mainnet. However, a delay lead to Arbitrum launching first. The project continues to attract TVL and even secured funding from a16z. Optimism uses a smart contract to relay transaction data from L1 to the rollup, where a sequencer bundles transactions into a batch and submits them back to L1. In an optimistic fashion, sequencers perform these assuming that all transactions are valid. The DTD to challenge these is 7 days and a fraud proof is generated by executing the transactions on L1 if any inconsistency is found. Optimism only supports Solidity and has no native token, hence, transaction costs are settled in ETH.

Arbitrum currently locking the highest TVL, is very similar to Optimism with the main difference being the fraud proof generation. Instead of executing the whole L2 transaction on L1, Arbitrum takes a multi-round approach executing small bundles until it finds inconsistency. This leads to higher transaction capacity, yet fraud proof periods might take up to two weeks. Arbitrum supports all EVM languages. Like Optimism, Arbitrum uses ETH for payments and has no native token yet. Optimism and Arbitrum come with a battle-tested codebase as a result of being based around EVM clients.

zk Rollups

execute transactions off-chain and submit validity proofs instead of relying on fraud proofs. To realize this, the zk bundles include an additional part: a zk-SNARK (succinct non-interactive argument of knowledge) or a zk-STARK (scalable transparent argument of knowledge), that cryptographically proves that the post-state root is the correct result of executing the transaction bundle and therefore verifies the transactions. By verifying the proof on-chain, zk rollups have no DTD challenging periods and offer great optimization potential to further increase scalability. One disadvantage is the validity proof that comes with more computation complexity as well as the high barrier to execute smart contracts. Validity proofs offer three advantages over fraud proof solutions: time to finality, mathematically enforced L1 security, and cost effectiveness for rich-data decentralized applications (dapps).

zkSync is a smart contract scaling and privacy engine using SNARKs that supports token swaps and NFT minting. ZkSync supports most opcodes in Ethereum.

StarkEx is a Layer 2 scaling and payment protocol developed by StarkWare and uses STARKs. STARKs do not require a trusted setup or a multiparty ceremony to generate keys in order to verify proofs by leveraging the Turing-complete language Cairo. Another difference between these validity proofs is that SNARKs are based on elliptic curve cryptography while STARKs rely on hash functions that offer benefits like quantum resistance but come with bigger proof size and are therefore more expensive.

Polygon Polygon offers a portfolio of solutions dedicated to scaling Ethereum. In particular, Polygon already has 4 public zk solutions (Nightfall, Hermes, Maiden and Zero) and is developing a modular blockchain solution known as Avail.

Table 1 outlines that Rollups give us improved scalability without sacrificing decentralization, security, and generalizability by outsourcing execution and bundling transactions to L1.

Challenges and risks

As Rollups move computation off-chain but store the data on-chain, they still have to store compressed data on-chain and as such facing the bottleneck that is Ethereum’s storage capacity and its block gas limit of 12.5 million gas. According to some calculations of Vitalik Buterin, this could yield a max scalability gain of 77x for optimistic rollups and 570x for zk rollups, which is not even close to e.g. Visa’s throughput. However, data sharding along with randomly sampled committees and data availability sampling (DAS) provides a feasible solution to the problem.

Due to the young nature of rollups, they also face some centralization issues and other concerns, see Table 2. For instance, the sequencer, a node that batches transactions and posts the result to the on-chain rollup contract, of Arbitrum, Optimism, zkSync and StarkNet is a single node that the developing company runs and is therefore highly centralized. Furthermore, funds might be stolen or frozen in certain scenarios, where the upgradeability is maliciously triggered, or the validator fails. For detailed information on any of these aspects, we refer to L2BEAT.

Moreover, the most significant challenges facing further adoption are:

For optimistic rollups:

• increased volume leads to a decreased validator amount that can run full nodes and therefore decreased security
• ideal parameters for the window of time before blocks are finalized
• ideal parameters for bond requirements

For zk rollups:

• integrating general purpose smart contract functionality
• computational complexity of zero-knowledge proofs
• reliance on a trusted setup of ZK-SNARKs (to be addressed moving on)

Aside from technical challenges and developments, these scaling solutions are also competing on the adoption front. The various implementations and nuances are difficult to grasp from a user perspective, less wallets are available and lower dapp selection present than on other L1s. Moreover, this competition among L2s and more specifically rollups comes with composability and liquidity fragmentation concerns. If there is no single winning rollup, the different rollups will bring fragmentation. Composability means that protocols can interact and interlock with each other, leverage synergies and combine functionalities of different dapps. Composability is therefore significantly reduced as the money legos known from Ethereum don’t fit to each other anymore. To challenge this, rollups need to agree on a communication standard framework that is yet to be developed. Liquidity fragmentation also results from various rollups being used as liquidity is split among different rollup implementations. As soon as communications is solved though, these issues should resolve as there are already ideas such as DeFi pooling or distributed AMM (dAMM).

Conclusion and Outlook

Limited blockspace along with accelerated crypto adoption pushes for on-chain and off-chain scaling solutions. Among the off-chain scaling solutions, optimistic and zk rollups are the breeding ground for innovation and adoption as they offer unique benefits while preserving L1 security. The TVL on rollups underpins an organic growth induced by economic incentives such as low transaction cost. Launching a rollup specific token to incentivize users and subsidize the ecosystem might boost adoption even further. It remains to be seen, which type of rollup will catch the most TVL and therefore network effects competing in a very dynamic and diversified solution environment as each of the rollups comes with its pros and cons. While application specific zk rollups and general purpose smart contract optimistic rollups already run well, rather complex general purpose EVM based zk rollups are expected to hit production readiness soon. However, as the technology is still overall new, there are some risks and trust assumptions such as upgradeability, sequencer failure or validator failure that must be mitigated going forward. Moreover, composability and liquidity fragmentation are issues that have to be taken seriously with accelerating adoption. Aside from that, facing the data availability bottleneck is being challenged by data sharding along with DAS. Overall, rollups are considered to be a key part of further crypto adoption as they are expected to significantly enhance speed and cost. In doing so and by abstracting away complexity via improved user interfaces, an overall better user experience is achieved.

The author thanks Marcus Dapp for fruitful discussions and valuable input.