The new strategy for Ethereum (i.e., rollup-centric roadmap) is to make Ethereum's layer 1 the ultimate data availability layer, while layer 2 serves as the computational layer. The incentive would be for (nearly) all computation to move to layer 2. This would make layer 2 protocols a dominant consumer of the layer 1 data availability layer, paying fees to L1 in exchange for data availability and security. To best approach this, Ethereum is in the process of adopting an ecosystem of L2 blockchains and following a modular blockchain architecture rather than a monolithic one.

In the near-term, actual sharding (not danksharding) is L1 scaling and still years away from being fully implemented. Sharding is far more complex and risky when compared to rollups because it alters the actual base layer. Meanwhile, rollups are available now and possibly even more powerful. Optimistic rollups are a promising existing scaling technology that can be incorporated (and expanded upon) quickly. They offer developers an easy way to migrate existing dApps to the rollup chain with a reasonable degree of security/scalability tradeoffs. This alleviates existing Ethereum congestion and high fees.

Additionally, the Ethereum community realized rollups can provide immediate value now and only improve once shardings is implemented. This means Ethereum scaling development is hyper-focused on rollups for scaling strategy in the immediate term.

Entities/roles in a rollup:

Ethereum mainnet: Provides data availability, security, and consensus for the rollup
User: Bridges funds onto the rollup and submits transactions on the rollup
Rollup operator: Runs the sequencer, does the computation, generates proofs, and batches transactions
- These operators/entities run sophisticated, high-performance hardware to do all these things. This is a real cost that the operator must bear. Therefore, they need to be economically incentivized by charging fees.

Optimistic Rollups TLDR

Users send transactions to sequencer
Sequencer creates L2 blocks
Sequencer "rolls up" transactions into batches and “notarizes” transactions with a hash
Sequencer submits all transactions to L1 as calldata
Validators check transactions from batches by re-executing them and comparing the resulting block hashes to the transactions submitted by the sequencer
If they don’t match, validators challenge the incorrect block hash via a fault proof

Zero-Knowledge Rollups TLDR

The process works as follows:

Highly-compressed batches of transactions are combined together with the current state root
The combination is sent to an off-chain Prover
Prover computes the transactions, generating a validity proof of the results
Prover sends this to an on-chain Verifier (Ethereum nodes)
Verifier confirms the validity proof
Smart contract on Ethereum’s L1 that maintains the state of the rollup is updated to the new state

Blockchain fees and block space

In the most straightforward way, Ether is digital money on the Ethereum network. It is required when a user interacts with the network to pay network fees in the form of “gas.”

Gas is the allocative internal pricing mechanism in Ethereum used in transactions and can reach exceptionally high price levels during periods of network congestion. Gas is a derivative of Ether designed to mitigate spam attacks on the network and efficiently allocate computational resources. Transactions on the network must have some cost. Otherwise, malicious actors could send millions of transactions a day for free, congesting the network.

Users pay different amounts of gas depending on the type of transactions they are looking to execute. The more complex the transaction, the more gas is required. Sending 1 ETH to a friend (an ETH transfer) is far simpler (computationally-speaking) than minting an NFT. Thus, minting an NFT requires more gas and is more expensive. Below is a monthly chart of ETH gas fees.

At present, Ethereum's pricing mechanism is governed by EIP-1559, which seeks to optimize the utilization of the network's resources by introducing elastic block sizes that target an average usage of 50%. Currently, there is only one gas limit and fee market (single-dimensional). This means that all users, whether they are operating on the L1 layer or a rollup, are competing directly for the same shared resources.

To address this issue, research is underway to develop a multi-dimensional version of EIP-1559 that can implement different fee markets for different resources. The proposed EIP-4844 (discussed more below) would implement a two-dimensional version of EIP-1559 that consists of an Execution Layer and a DA (Data Availability) Layer.

Until then, transaction fees don’t care whether a protocol is an L1 or L2. Fees are simply a function of demand for limited block space on a network. The higher the demand, the higher the transaction cost. Rollups have limited block space and transactional throughput, just much higher than traditional L1s.

rollup fees diagram — Block Demand on Ethereum

For example, if Ethereum had very little block demand (like now!), transactions would be extremely cheap. Typically, Ethereum is the most in-demand blockchain network, leading to significant costs for users when it comes to transactions.

L2 protocols help lower the block demand on Ethereum by off-loading it to L2, but when demand spikes on L2 networks, such asArbitrum, so does the cost of completing transactions. It all comes back to actual block demand on the network.

This ties back into the struggles of some alternative L1 blockchains attempting to compete with Ethereum. Many argue their own TPS and transaction throughput are far higher than Ethereum’s, pointing to testnets showcasing this. However, this means little compared to real-world demand. Any network can be cheap and fast without the demand that Ethereum faces. The same goes for L2 networks.

What aspects of the rollup-L1 relationship incur a cost?

Transaction execution (L2 fees): As previously mentioned, executing and batching transactions together, as a Sequencer does, costs compute power and real resources
Settlement/state transitions: A cost associated with settlement (i.e., updating account balances across all nodes when Alice sends 1 ETH to Bob)
Data availability: Ensures all relevant transactional data is available to anyone

Data availability is critical in this regard because it lets anyone, if they so choose, verify the data for themselves, preserving the trustlessness (via mitigating data-withholding attacks) and auditability tenants associated with blockchains. Additionally, as long as all of the execution data is made available on the mainnet, the chain doesn’t require every node to execute every transaction to validate transactions and reach consensus.

Because rollups can cryptographically guarantee (via a proof) that the transactions are valid, these transactions can now be executed by just a single node and posted to the L1 where it can be cross-checked by L1 nodes. All L1 nodes download the rollup’s data, but only a certain portion of them execute the transactions/construct the rollup state, thereby reducing overall resource consumption. Additionally, the data within a batch is highly compressed prior to being submitted to the L1, further decreasing the resource burden. This is how rollups help trustlessly scale a blockchain without requiring an increase in node resources.

However, a rollup’s TPS is dependent on the data capacity of their L1 for throughput. The more data availability on L1, the higher the (theoretical) throughput for rollups. Once an L1 runs out of data capacity for the rollup, the limit’s been reached and no additional transactions can be processed. Therefore, now the limiting factor for a blockchain’s scalability is its data availability.

As polynya’s tweet above illustrates, L1 data fees (data availability costs) make up the majority of the current cost. However, EIP-4844 offers a solution and could bring this cost down by 10-50x! This is discussed in detail in later sections.

Optimistic- vs. ZK-rollups

Gas cost to L1: With Optimistic rollups, no computation is actually done, so it costs less than ZKRs. ORs “optimistically” assume all state changes are valid and post the off-chain transactions (new state root and data) to Ethereum’s L1 as calldata. To counter any potentially fraudulent transactions, a challenge/dispute period is put in place for ~one week after posting to L1. During this time, any third party can publish a fraud proof to verify the transactions’ validity across L1 and L2. If the transactions are deemed invalid, the invalid transactions and all affected transactions will be reverted.

ZKRs are more expensive. When ZKRs submit a new batch on-chain, the validity proof must be verified, a computationally expensive process. ZK-SNARKs are expensive to compute (~ 25-1,000x times more expensive). However, from a scalability perspective, ZKRs are more performant than ORs because they compress data more efficiently, meaning they have a smaller “batch size” when submitting to L1. As of Q2 2022, the primary cost associated with a rollup is the cost to post calldata (discussed further below) to L1 Ethereum.

Frequency: Optimism posts all transaction data to the Ethereum L1 for every transaction. However, (some) ZKRs only post the state differences to mainnet. ZKRs can do this because the state difference in combination with the validity proof is sufficient to validate the batch. Because of this approach, ZKRs interact with L1 only ~20% as much as Optimism, equating to roughly 90% reduction in fees. Therefore, on a gas cost/transaction basis, ORs are more expensive, thanks to the requirement of posting all the data to L1 for every transaction.

Fixed vs. variable

Rollup costs can also be split into two separate categories: fixed and variable. Fixed costs are the rollup costs that must be paid, independent of how many transactions are included in the batch. Variable costs are the marginal costs that accumulate with each additional transaction.

rollup fixed and variable costs — Source

Fixed

Fixed costs include:

State commitments
Validity proofs (ZKRs)

ZKRs have a larger fixed cost (10x) than ORs due to the validity proof.

What’s not fixed is the cost of the validity proof, which is determined by whether it uses a SNARK or STARK.

SNARKs are cheaper, requiring ~500K – 1 million gas in the EVM, whereas STARKs cost ~1 million – 5 million gas depending on proof size. Because ORs only require proofs in the event of a dispute, they aren’t subject to this cost.

Want to learn more about zero-knowledge proofs and the various implementations? Click here.

Variable

Reducing the frequency of L1 interactions is one cost-saving method, but so, too, is batching more transactions into one block (the denominator in the image above) to “socialize” the L1 calldata cost. By socializing gas cost across bundled users and only posting calldata to mainnet, rollups can reduce transaction fees by 70-95%.

As rollup activity increases, the variable cost of transaction data becomes the primary factor influencing rollup transaction prices. The rollup submits transaction data to Ethereum in the form of calldata, which costs 16 gas per byte. In contrast to the fixed cost of calldata, the price per unit of gas varies based on the demand for block space. As more transactions are included in each batch, the rising overall cost is spread among all transactions.

This is due to the fact that the marginal cost of adding additional transactions to the batch is smaller than the average transaction cost. Note that the marginal cost consists solely of variable expenses, principally transaction data, as fixed costs are shared across the entire batch and are paid regardless.

In sharp contrast to monolithic blockchains that exclusively experience negative network effects—fees grow with each additional user–the phenomenon of decreasing fees while rising activity is characterized by decentralized blockchains. Rollups are the first type of blockchain that might incur positive network effects in terms of transaction costs.

As it stands in Q3 2022—the early days of ZKR adoption—ZKRs have minimal activity when compared to their future ambitions. Therefore, their ability to amortize the costs across many different users is limited. As activity increases, this becomes increasingly inconsequential. I would estimate anything greater than 100 TPS, whereas this is close to nil. This criterion is significantly lower for ORs at 10 TPS.

Despite being extremely nascent, rollups are already significantly reducing fees for many Ethereum users. l2fees.info frequently shows Optimism and Arbitrum providing fees ~10x lower than the Ethereum base layer itself. ZK-rollups, which have better data compression and can avoid including signatures, have fees ~40-100x lower than the base layer.

While rollup’s efficiency gains and cost reductions are impressive, it’s important to note that rollup’s potential scalability is constrained by the limitations of the L1. The primary factor in a rollup’s scalability is how much data the main chain can hold. This comes at a cost and means rollups can only offer linear scalability gains.

Calldata

As previously mentioned, rollups post their compressed L2 batched transactions as calldata onto mainnet Ethereum. But what does that mean, and what’s calldata?

Calldata is a specific form of read-only memory data used by smart contracts to call external functions. Once a rollup has batched enough transactions, it’s expected to post this state transition change in a compressed form to the L1 via calldata. Rollups currently use L1 calldata for data storage, which is limited to ~10KB per block. They do this so anyone can reconstruct the chain and verify the latest state.

Posting the calldata on-chain is what allows Ethereum and its robust, decentralized network of nodes to “check the work” done off-chain. Instead of doing the computation, the calldata lets the Ethereum mainnet quickly and easily verify that everything done off-chain was valid and accept the state changes, i.e., double-check the work. Additionally, data availability on the Ethereum L1 means any computation completed on a rollup can be redone by the Ethereum base layer if needed. Without sufficient data availability, transaction execution becomes opaque/a black box that can’t be audited by the L1.

This ability to reconstruct the chain is critical. It provides user security guarantees (don’t have to trust the Sequencer, check for yourself!) and removes catastrophic risk from Sequencer issues.

If a Sequencer suddenly disappeared, a new Sequencer could retrieve all of the L2 data from mainnet, reconstruct the latest rollup state, and continue processing transactions. This is because transactions are compressed to only the necessary components (the to/from addresses, transaction value, network fee, and nonce) for reconstruction.

However, the EVM isn’t optimized to process rollup data in a cost-efficient manner. This is because rollups weren’t even an idea when the EVM was built! Regardless, the EVM assumes data in a transaction will be processed by a smart contract and charges for it accordingly (more expensive). Unfortunately, this approach doesn’t do rollups any favors.

Currently, the cost of posting calldata to L1 Ethereum is 16 gas/byte. EIP-4488 proposed lowering the cost of calldata to 3 gas per byte, while EIP-4844 is a separate proposal to create a new data format specifically designed to lower the cost of posting data on Ethereum for rollups.

Reducing calldata costs

EIP-4488 is the simplest and quickest way to improve rollups and drive down costs. However, it also has the least amount of attention currently. So, what is it?

EIP-4488 attempts to reduce rollup costs (while mitigating storage bloat) through two primary factors:

Reduce calldata cost from 16 gas per byte to 3 gas per byte
A limit of 1 MB per block plus an extra 300 bytes per transaction (theoretical max: ~1.4 MB)

This change could be implemented in terms of months, not years, and could reduce rollup costs by ~80%!

EIP-4844 (Proto-danksharding or PDS)

Proto-danksharding (PDS) is an alternative to EIP-4488 but is still a temporary stepping stone to the ultimate goal of “full” danksharding. However, even PDS is quite complex. Rather than rollups using "calldata" storage (permanently on-chain), under PDS, rollups could post bundles under a new “blob” transaction type which is much cheaper.

Rollup transactions would have their own “channel,” operating through a novel data blob market that uses its own fee structure and floating gas limits. This means that even with heightened demand and activity from DeFi or NFTs, data costs won’t go up for rollups. This creates two different gas markets - one for general computation and one specifically for data availability (DA), making the overall economic model more efficient than it was previously.

Data blobs are an entirely new transaction format, and only the blob’s hash can be accessed via a new opcode. This guarantees the data content will never be accessed by the EVM, reducing the gas cost of posting the data compared to with calldata. Blob transactions can enable up to ~1MB average per block for data storage as opposed to the 10KB currently with calldata. It also has been proposed that they could be pruned (removed) from the L1 after a ~month to reduce storage overhead requirements.

To go even deeper and learn more about Ethereum's roadmap and how proto-danksharding fits in, check out this piece.

Loading...