Rollups: Proof of Bundling

Mar 30, 2022

Spoilt for choice – addressing the blockchain trilemma

With increasing adoption, Layer1 (L1) blockchains like Ethereum run into capacity limitations, driving up transaction costs due to limited blockspace and creating demand for scalability solutions. Therefore, blockchains are desperately trying to solve the blockchain trilemma, a trade-off between Decentralization, Security and Scalability, to achieve better user experience and mainstream adoption. The blockchain trilemma claims that by using ‘simple’ techniques, you can only optimize for two of the three properties as outlined below:

  • Scalability: Data throughput of the system measured in transactions per second (TPS), Latency and Finality
  • Decentralization: Maximize the number of trustless nodes across the world — minimize centralized trusted nodes
  • Security: Attack resistance

A L1 blockchain can either be decentralized and secure (e.g. Bitcoin or Ethereum), secure and scalable (e.g. Solana or BSC) or scalable and decentralized (e.g. multichain ecosystems such as Cosmos, Polkadot or Avalanche). These essential properties of a blockchain are enabled by components that can be modularized to unload L1 and achieve i.a. enhanced scalability. Among these components are:

  • Consensus: Defines the true state of the blockchain that the majority of nodes agree on. Part of the consensus mechanism are sybil control mechanisms such as Proof of Work (PoW) or Proof of Stake (PoS)
  • Execution: Computation required to update the state of the blockchain by adding new transactions
  • Data Availability: Data available to be referenced which is ensured by L1. Since all nodes host this data, it is very limited and expensive

Blockchains try to offer consensus, execution, and data availability under one hood, and in doing so run, into the blockchain trilemma. By untangling certain components on Layer2 (L2) or off-chain scaling solutions that move transactions off L1 into a separate layer and do not require changes to the core code of the L1, optimization is enabled. For instance, rollups can process transactions faster than on L1 since they lack the burden of consensus and data availability by creating an execution environment isolated from Ethereum where transactions are bundled before updating the state. By performing operations off-chain, the data stored on-chain is significantly reduced, which leads to cheaper and potentially faster transactions.

Overall, off-chain scalability solutions aim to achieve faster finality, TPS and latency without sacrificing decentralization or security. Some of these scaling approaches derive their security directly from L1, such as rollups or state channels. Other approaches such as sidechains or Plasma create new chains that derive their security separately from L1. Before arriving at rollups, Ethereum was exploring a variety of different off-chain scaling solutions, that we introduce subsequently:

Sidechains are standalone EVM compatible blockchains representing external execution layers that run in parallel to L1 and can rely on L1 security, while also employing its own security properties and consensus mechanism to process transactions. These chains are accessible via bridges.

State channels utilize multisig contracts (multiple signers review and agree on an action) for bi-directional payment channels to transact quickly off-chain but settle finality on L1. Thus, they minimize network congestion and fees.

Plasma is a separate blockchain anchored to the Ethereum mainnet, also referred to as ‘child’ chains that are essentially smaller copies of Ethereum. Child chains periodically report back to L1 and use it to settle disputes. Like optimistic rollups, Plasma uses fraud proofs to arbitrate disputes, yet maintains data availability and computation off-chain. Plasma’s technology is based on Merkle trees and smart contracts. Plasma initially intended to enable trustless sidechains but faced the data availability problem as all transaction data is stored off-chain.

Validium is like Plasma as data and computation are moved off-chain. Instead of fraud proofs, it uses validity proofs, also leveraged in zk rollups, for new state commitments and therefore removes long withdrawal delays based on Dispute Time Delays (DTD) that are known from fraud proofs. Having the data off-chain makes Validium highly performant by bundling more transactions but also more centralized and less secure.

Illustration 1 gives an overview of the different off-chain scaling solutions by comparing important metrics such as:

Security: Where does the scaling solution source its security?

Proof: What type of cryptographic proof is used?

Data: Where is execution call data and state handled? Data availability on/off-chain?

Illustration 1: Off-chain scaling landscape
SOURCE: BITCOIN SUISSE RESEARCH
Rollups, driving scaling innovation

The most sophisticated and promising L2 scaling technology supporting general purpose EVM code to date is that of rollups. A rollup off-chain bundles transactions which reduces fees and network congestion and sends them towards an Ethereum smart contract, where users transact with security guarantees settling on L1. Rollups are designed to publish enough data to L1 in order to enable anyone to reconstruct the correct state. The data is handled by sequencers and validators, who submit bundles of compressed transaction data back to L1. The scalability and transaction cost benefit are realized by executing transaction bundles off-chain before submitting the compressed data to L1. As Illustration 2 showcases, transacting on rollups is already a magnitude cheaper than on Ethereum L1. In certain scenarios, they also manage to outcompete newer L1 such as Avalanche or Cardano.

Illustration 2: Automated Market Maker (AMM) swap costs for selected L1 and L2 protocols
SOURCE: L2 Fees, BITCOIN SUISSE RESEARCH (DATA FROM 28.03.2022)

Despite promising transaction cost at the current state, rollups are not optimized yet as most of the early projects were just forked off Ethereum. For instance, Aave V3 managed to drop fees by about 10x optimizing via rollup specific APIs to achieve a massive decrease in call data size. Other upcoming optimizations for optimistic rollups such as aggregating or compressing signatures and more sophisticated call data compression will lead to yet another increase in scalability. As a result of higher computational complexity, zk rollups come with a higher fixed cost than optimistic rollups. Currently though, they are still cheaper because the non-optimized call data costs on optimistic rollups exceed the fixed costs.

Along with several successful application specific rollups that are streamlined towards a certain use case and are able to scale up massively, such as dYdX, Loopring or Immutable X, some general purpose optimistic rollups such as Arbitrum or Optimism are getting significant traction recently. The TVL both in optimistic and zk rollups, as shown in Illustration 3, continued to outperform other off-chain scaling solutions starting in late August 2021 and is now hovering above $6.7b in TVL, $3.58b on Arbitrum alone. For comparison at the time of writing, Fantom captured $6.34b, Solana $5.88b or Polygon PoS $5.21b in TVL.

Adoption might get another push as, according to Matter Labs, the first EVM-compatible zk rollup on Ethereum’s testnet zkSync2.0 was launched end of February. Starkware with StarkEx and StarkNet is joining the race for general-purpose zk rollups that offer the benefits of zk rollups along with EVM compatibility.

Illustration 3: TVL according to different off-chain scaling solutions
SOURCE: The Block, BITCOIN SUISSE RESEARCH

Besides the growing TVL, there are also other indicators present pointing towards rollup adoption. For instance, the Arbitrum sequencer is constantly among the top gas spender on Ethereum. Rollups are already paying up to $160,000 for Ethereum’s security every day. Given further adoption of L2s, sequencer of different rollups might soon be the tenants paying the highest rent to get their data stored on L1.

Rollup types

As already mentioned, there are two types of rollup designs that currently drive innovation and adoption. Let’s have a closer look at their design principles and their most renowned representatives.

Optimistic rollups

offer improvements in scalability by assuming that all transactions are valid by default and propose a new state, executing transactions off-chain and submitting statements that are secured by fraud-proofs. Anytime the rollups publish a bundle of state transitions there is a Dispute Time Delay (DTD) where any party can publish a fraud proof indicating that one of the state transitions was invalid. As a result of this DTD, optimistic rollups face long withdrawal times. Sequencers are required to stake ETH for staking rewards to incentivize legitimate transaction data and face slashing for fraudulent activities. Only if an invalid state transition is published to the rollup smart contract, a fraud proof can be generated that includes compressed rollup transaction data, the pre-state root hash, and the post-state root hash. Since the transactions are only processed if they are challenged by users, the validation strain is placed on the community, rather than the technology. A big advantage of optimistic rollups is that they are capable of executing smart contracts easily.

Optimism a general purpose optimistic rollup that uses a modified GETH was initially supposed to be the first to launch on the Ethereum mainnet. However, a delay lead to Arbitrum launching first. The project continues to attract TVL and even secured funding from a16z. Optimism uses a smart contract to relay transaction data from L1 to the rollup, where a sequencer bundles transactions into a batch and submits them back to L1. In an optimistic fashion, sequencers perform these assuming that all transactions are valid. The DTD to challenge these is 7 days and a fraud proof is generated by executing the transactions on L1 if any inconsistency is found. Optimism only supports Solidity and has no native token, hence, transaction costs are settled in ETH.

Arbitrum currently locking the highest TVL, is very similar to Optimism with the main difference being the fraud proof generation. Instead of executing the whole L2 transaction on L1, Arbitrum takes a multi-round approach executing small bundles until it finds inconsistency. This leads to higher transaction capacity, yet fraud proof periods might take up to two weeks. Arbitrum supports all EVM languages. Like Optimism, Arbitrum uses ETH for payments and has no native token yet. Optimism and Arbitrum come with a battle-tested codebase as a result of being based around EVM clients.

zk Rollups

execute transactions off-chain and submit validity proofs instead of relying on fraud proofs. To realize this, the zk bundles include an additional part: a zk-SNARK (succinct non-interactive argument of knowledge) or a zk-STARK (scalable transparent argument of knowledge), that cryptographically proves that the post-state root is the correct result of executing the transaction bundle and therefore verifies the transactions. By verifying the proof on-chain, zk rollups have no DTD challenging periods and offer great optimization potential to further increase scalability. One disadvantage is the validity proof that comes with more computation complexity as well as the high barrier to execute smart contracts. Validity proofs offer three advantages over fraud proof solutions: time to finality, mathematically enforced L1 security, and cost effectiveness for rich-data decentralized applications (dapps).

zkSync is a smart contract scaling and privacy engine using SNARKs that supports token swaps and NFT minting. ZkSync supports most opcodes in Ethereum.

StarkEx is a Layer 2 scaling and payment protocol developed by StarkWare and uses STARKs. STARKs do not require a trusted setup or a multiparty ceremony to generate keys in order to verify proofs by leveraging the Turing-complete language Cairo. Another difference between these validity proofs is that SNARKs are based on elliptic curve cryptography while STARKs rely on hash functions that offer benefits like quantum resistance but come with bigger proof size and are therefore more expensive.

Polygon Polygon offers a portfolio of solutions dedicated to scaling Ethereum. In particular, Polygon already has 4 public zk solutions (Nightfall, Hermes, Maiden and Zero) and is developing a modular blockchain solution known as Avail.

Table 1 outlines that Rollups give us improved scalability without sacrificing decentralization, security, and generalizability by outsourcing execution and bundling transactions to L1.

Table 1: Comparison between Optimistic and zk rollups
SOURCE: Vitalik Buterin, Block360, BITCOIN SUISSE RESEARCH
Challenges and risks

As Rollups move computation off-chain but store the data on-chain, they still have to store compressed data on-chain and as such facing the bottleneck that is Ethereum’s storage capacity and its block gas limit of 12.5 million gas. According to some calculations of Vitalik Buterin, this could yield a max scalability gain of 77x for optimistic rollups and 570x for zk rollups, which is not even close to e.g. Visa’s throughput. However, data sharding along with randomly sampled committees and data availability sampling (DAS) provides a feasible solution to the problem.

Due to the young nature of rollups, they also face some centralization issues and other concerns, see Table 2. For instance, the sequencer, a node that batches transactions and posts the result to the on-chain rollup contract, of Arbitrum, Optimism, zkSync and StarkNet is a single node that the developing company runs and is therefore highly centralized. Furthermore, funds might be stolen or frozen in certain scenarios, where the upgradeability is maliciously triggered, or the validator fails. For detailed information on any of these aspects, we refer to L2BEAT.

Table 2: Main risks for general purpose rollups (major risks indicated in red, minor risks indicated in yellow)
SOURCE: L2BEAT, BITCOIN SUISSE RESEARCH

Moreover, the most significant challenges facing further adoption are:

For optimistic rollups:

  • increased volume leads to a decreased validator amount that can run full nodes and therefore decreased security
  • ideal parameters for the window of time before blocks are finalized
  • ideal parameters for bond requirements

For zk rollups:

  • integrating general purpose smart contract functionality
  • computational complexity of zero-knowledge proofs
  • reliance on a trusted setup of ZK-SNARKs (to be addressed moving on)

Aside from technical challenges and developments, these scaling solutions are also competing on the adoption front. The various implementations and nuances are difficult to grasp from a user perspective, less wallets are available and lower dapp selection present than on other L1s. Moreover, this competition among L2s and more specifically rollups comes with composability and liquidity fragmentation concerns. If there is no single winning rollup, the different rollups will bring fragmentation. Composability means that protocols can interact and interlock with each other, leverage synergies and combine functionalities of different dapps. Composability is therefore significantly reduced as the money legos known from Ethereum don’t fit to each other anymore. To challenge this, rollups need to agree on a communication standard framework that is yet to be developed. Liquidity fragmentation also results from various rollups being used as liquidity is split among different rollup implementations. As soon as communications is solved though, these issues should resolve as there are already ideas such as DeFi pooling or distributed AMM (dAMM).

Conclusion and Outlook

Limited blockspace along with accelerated crypto adoption pushes for on-chain and off-chain scaling solutions. Among the off-chain scaling solutions, optimistic and zk rollups are the breeding ground for innovation and adoption as they offer unique benefits while preserving L1 security. The TVL on rollups underpins an organic growth induced by economic incentives such as low transaction cost. Launching a rollup specific token to incentivize users and subsidize the ecosystem might boost adoption even further. It remains to be seen, which type of rollup will catch the most TVL and therefore network effects competing in a very dynamic and diversified solution environment as each of the rollups comes with its pros and cons. While application specific zk rollups and general purpose smart contract optimistic rollups already run well, rather complex general purpose EVM based zk rollups are expected to hit production readiness soon. However, as the technology is still overall new, there are some risks and trust assumptions such as upgradeability, sequencer failure or validator failure that must be mitigated going forward. Moreover, composability and liquidity fragmentation are issues that have to be taken seriously with accelerating adoption. Aside from that, facing the data availability bottleneck is being challenged by data sharding along with DAS. Overall, rollups are considered to be a key part of further crypto adoption as they are expected to significantly enhance speed and cost. In doing so and by abstracting away complexity via improved user interfaces, an overall better user experience is achieved.

The author thanks Marcus Dapp for fruitful discussions and valuable input.

Bitcoin Suisse