Overview

There are two important layers of a blockchain network when understanding rollups: Layer 1 and Layer 2. Layer 1 (L1), often called the implementation layer, operates as the underlying main architecture of a blockchain. This layer includes Ethereum. Layer 2 (L2) architectures, on the other hand, provide improvements and solutions to preceding L1 networks. Hence, Layer 2 is often called the “scaling solution.” L2 protocols inherit Layer 1 properties that it builds on top of and expands the overall functionality and scalability of the system. Ultimately, both Layer 1 and 2 solutions aim to create a more secure and efficient system. By stacking layers, blockchain networks, such as Ethereum, combine each layer’s individual strengths and minimize weaknesses.

Rollups are one type of L2. Rollups combine transactions into a single transaction batch before processing and submitting this data to the Ethereum mainnet. All of the processing computation is done on the L2, where data is efficiently packaged, allowing minimal transaction data to be transferred to the L1 afterward. One way that rollups minimize costs and maximize rollup capacity is by transferring information from the rollup to the L1 In the form of calldata. Calldata, which is unmodifiable, isn’t stored in Ethereum’s state, making it cheaper for storing data on-chain. The added functionality of requests outside the L1 protocol increases the transaction speed and scalability of the L1.

This paper will discuss the two major types of rollups: Zero-knowledge rollups (ZK-rollups) and optimistic rollups. The primary distinction between the two rollups pertains to how each rollup determines the validity of a transaction. ZK-rollups use validity proofs and optimistic rollups use fraud proofs, both of which will be further discussed. With additional comparisons between the benefits and risks of the two types, we aim to highlight the inner workings behind both rollup technologies, the leading development for each rollup type, and concerns with the architectural implementations.

ZK-Rollups

zk rollup diagram — Source: Polygon Labs

The use of validity proofs is one of the key innovations of ZK-rollups. Transactions are executed on the rollup chain and batched together into a block. Then, a validity proof is created to verify the executions were done correctly. The proof is sent to the mainnet (Ethereum) where instead of re-executing every transaction in order to prove its correctness, the mainnet nodes simply need to verify the proof. This aggregation of off-chain transactions reduces the cost and time required to process them. The huge improvements to scalability come from the fact that no matter the number of transactions batched together, nodes on the mainnet need to only verify the proof.

On the Ethereum network, the ZK-rollup’s state is maintained by a smart contract. To update this state, a validity proof is required to finalize the changes to the state that would be the result of executing the batches of transactions. By compressing multiple transactions into a single transaction, ZK-rollups allow the blockchain to process more transactions at a lower cost. Moreover, validity proofs can help ensure users’ privacy without revealing the details of every transaction.

The economics of ZK-rollups is dependent upon their ability to incur fewer costs in comparison to fees when executing transactions on Ethereum. For example, the Ethereum Mainnet is only able to support 10-20 transactions per second, so any large-scale application could bottleneck the network and cause transaction fees to increase. ZK-rollups significantly reduce the transaction fee by bundling large batches of transactions off-chain in comparison to other layer 2 solutions. However, ZK-rollups require powerful hardware to participate in the chain, meaning that participants may be disincentivized due to the high expense associated.

Despite its economic advantages, ZK-rollups contain a potential censorship problem because it uses an operator to execute, batch, and submit the transactions to Layer 1. The reason ZK-rollups use this operator as a supernode is that it allows for efficiency gains over a decentralized network of thousands of nodes (L1). This means that a user's transaction can be censored by ZK-rollups operators, who can refuse to include certain transactions in batches. However, users can submit transactions to the smart contract to the mainnet and have it verified. Moreover, operators cannot corrupt the rollup state, so they cannot alter the funds transferred because every block is verified. The model of security used in ZK-rollups is achieved by replacing third parties, who could potentially become malicious, with cryptographic computations. In the worst case, users can exit from the rollup’s submission to Ethereum by themselves, so the operators cannot force users to submit transactions.

ZK-rollups are not inherently incompatible with the Ethereum Virtual Machine (EVM). In fact, ZK-rollups use the EVM as its execution environment, which allows it to benefit from the Ethereum network security but it has limited smart contract capabilities. However, ZK-rollups only support a subset of the EVM's functionalities. Certain complex smart contracts may not be able to run on ZK-rollups. This is because ZK-rollups rely on validity proofs to verify transactions, which can be difficult to generate for certain types of smart contracts. Moreover, ZK-rollups require a significant amount of computational resources to generate the validity proofs, which can be a bottleneck for applications that require real-time processing of large numbers of transactions. Some projects, like StarkWare, Loopring, and Hermez Network, are exploring ways to run certain computations off-chain in ZK-rollups and other computations on-chain in the EVM. This can allow for the best of both worlds: fast, efficient off-chain transactions with the security and decentralization of on-chain transactions.

Optimistic Rollups

Similar to ZK-rollups, optimistic rollups provide a solution to many scaling problems. Operators/validators bundle transactions in huge batches before sending them to the mainnet, lowering fixed costs. Various compression techniques are used to further reduce the amount of data sent, which increases transaction speed and reduces costs. These compression techniques, especially ones done on the signature of the transaction, are very effective. A transaction on ETH generates about 9-10x the data as on an optimistic rollup.

While ZK-rollups require validity proofs to ensure the legitimacy of bundled transactions, optimistic rollups process transactions off-chain and then “optimistically” send them onto the mainnet. All transactions are expected to be confirmed as long as they are valid, which is known as trustless finality. This characteristic makes optimistic rollups unique because they accept the off-chain transactions as valid without proof of validity. Another reason why optimistic rollups are unique from other side chains is that they publish transaction results on-chain, allowing for higher security.

The key advantage of optimistic rollups over ZK-rollups is the practicality of optimistic rollups. ZK-rollups involve more complex technology and obstacles surrounding their adoption, thus allowing Optimistic rollups to reign as the current solution until ZK rollups can be further developed.

How can optimistic rollups be so optimistic?

When a block (containing a bundle of transactions) is created and optimistically published on the mainnet, it is first categorized as an assertion for seven days. During this window of time, which is known as the challenge period, other users are allowed to submit fraud-proving challenges to the new block, which balances the trustless nature of optimistic rollups. Challenges often require a bond (a deposit) from the challenger, and both parties are required to respond within time windows, or else they forfeit the challenge. If the challenge is correct and the transaction is deemed invalid, the operator/validator loses part of their bond, and the invalid transactions will be reverted. Part of the bond goes to the challenger, while the rest is burned.

There are two types of challenges. The first challenge format is Multi-Round Interactive Fraud Proving. This is a back-and-forth protocol between the challenger and the asserter. Both parties keep dividing the block in half, which is known as the bisection protocol, until a single transaction is under evaluation. The other challenge format is Single Round Interactive Fraud Proving. The disputed transaction is transferred back to L1 and the processing of the transaction is emulated. This method incurs extra costs because the data needs to be published on chain again and the transaction needs to be replayed.

How do these proofs work?

The proofs for both ZK rollups and optimistic rollups rely on the use of Merkle trees. Merkle Trees are generated through multiple rounds of hashing. The initial data begins at the bottom (i.e. data_1, data_2) and is combined with the other data and hashed together to create the parent hash on the rung above (i.e. hash(d1)). These hashes are pooled (of the same size) and hashed again until a single (root) node remains. A Merkle tree's aim is to enable Merkle proofs, which prove a piece of data exists in the underlying dataset without requiring the broadcasting of the complete dataset. Merkle trees are a unique blockchain data structure that allows off-chain aggregation of transactions that were performed inside an Ethereum smart contract. This aggregation is done through a system involving two parts of the Merkle tree: the side-chain portion and the main-chain portion.

The main-chain portion involves the Merkle root, also known as the state root. This root is within a smart contract inside the main chain. The main chain contract holds the funds and the root, which is a cryptographic commitment to the transaction history of the funds. Through a hash algorithm that creates a single 64-character code, the Merkle root is created and represents a significant amount of transaction IDs.

The side-chain portion is the rest of the Merkle tree. This tree serves as a history of the accounts, balances, and the states being operated by users. With this history, the Merkle tree can be used to retrieve on-chain information using the Merkle root data. This allows for quick verification since users with a specific transaction in the Merkle tree can use the hashing algorithm and verify with the Merkle root if the transaction took place correctly on a certain block.

In short, the main-chain portion of the Merkle tree holds the data on the state of the rollup. The side-chain portion holds the data on the computation and storage of the transactions that led up to the rollup state saved by the Merkle root. And, the validity of this side-chain portion is proven using ZK-proofs.

The use of Merkle trees lets transactions be processed much faster on the mainnet. When a new batch of transactions has been processed on the main-chain, a new Merkle root is proposed that updates the Merkle tree and its related data on balances and transfers. The main-chain smart contract for the Merkle tree will then verify a snark proof included with the transaction batch before becoming the most recently updated state root of the main-chain tree contract.

This secure separation of main-chain and side-chain data allows for more seamless transaction output and verification. Since the transaction proofs are mathematically verifiable, the Ethereum network verifies the authenticity of the transaction batch without needing to check each individual transaction. For example in the diagram above, instead of needing data_1, data_2, data_3, and data_4 to verify the transaction from data_2, we only need data_2 and all the related hashing data up the tree to verify the transaction. The use of Merkle trees and rollups not only reduces transaction costs but also allows more than 1000 transactions per second to be processed, a large improvement considering Ethereum transaction speed is currently 10-20 transactions per second on mainnet.

An example of a Merkle tree is shown below that contains transactions A-H.

merkle tree2 — Image Source: Ethereum Foundation (MERKLE PROOFS FOR OFFLINE DATA INTEGRITY)

We can prove a certain value without having to prove all the hash transactions in the tree. For example, to prove C, we just need three things: D, hashing of A-B, and hashing of E-H.

merkle tree 3 — Image Source: Ethereum Foundation (MERKLE PROOFS FOR OFFLINE DATA INTEGRITY)

We can see that the way Merkle tree is hashed and structured in a way that allows us to use the Main root (HA-H in this case) as a single proof of all the nodes below it.

The following sections will give an overview of a leading optimistic rollup, and an example of a leading ZK-rollup.

Optimism

Optimism is a leading optimistic rollup Layer 2 solution on Ethereum. In 2019, it introduced the optimistic rollup, and in 2021, it launched its mainnet with EVM compatibility. Optimism’s value proposition is to provide a seamless experience for developers between the rollup and the mainnet. It does so with its Optimistic Virtual Machine, which allows developers to nearly copy and paste Solidity code from one platform to the other.

Optimism uses its Standard Bridge to move ETH and ERC-20s to and from Ethereum and Optimism at a 1:1 ratio. Going from L1 to L2, deposited ETH and ERC-20 tokens are locked up on Ethereum, and an equivalent amount can be redeemed for a variety of Optimism tokens. During a withdrawal, Optimism tokens are burned, and the locked tokens on Ethereum are released.

Centralization

Optimism plans to become a completely decentralized optimistic rollup with a decentralized network of permissionless sequencers and fraud proofs. However, it is currently in an early development stage that comes with considerable centralization vectors.

The primary issues in Optimism’s current implementation revolve around 2 issues: a sole sequencer controlled by the Optimism team and an upgrade key controlled by a trusted third party.

Running a sole operator/sequencer means that Optimism is very centralized. All transactions are run by one party, which is the same group that runs the protocol. This sole block producer can prevent transactions from being added onto blocks as no other validator is around to create blocks. This problem of centralization was further exacerbated when Optimism disabled challenges. Ideally, verifiers, also called “full nodes”, are able to submit challenges, but Optimism’s fault proof system has been shut down since their update to OVM 2.0 in November 2021.

Other potential problems result from the fact that Optimism has a sole validator. Funds are frozen if the sequence goes down or is offline. This threatens liquidity and the trust that ETH holders have in the rollup. In addition, as the sole validator, the sequencer has the power to take Maximum Extractable Value (MEV), which may lead to incentives that harm users and the rollup’s security.

On top of having just one validator, the centralization of the upgrade key is risky for the protocol. A trusted third-party is in charge of an upgrade key, which has unlimited access to upgrading or changing anything on the protocol. If upgrade keys are compromised, then all assets on the protocol are at risk, so Optimism needs to work to make the protocol trustless rather than trusted. This problem is not unique to Optimism since all other L2 chains also deal with the problem of a centralized upgrade key.

Roadmap

In June 2019, the Optimism Foundation launched optimistic rollups, one of the most groundbreaking concepts in the blockchain industry. The Optimism Foundation has been constantly working on enhancing the software to scale Ethereum. Through 2019, 2020, and 2021, it launched its EVM Compatible Testnet, Alpha Mainnet, and the EVM Equivalent Mainnet. In March 2022, it raised $150 million in a Series B funding round at a valuation of $1.65 billion, getting support from established institutions like Andreessen Horowitz (a16z) and Paradigm. A couple of months later in May 2022, it launched OP, its own native token, and had its first airdrop where 231,000 addresses were eligible to claim 214 million OP tokens. Those 214 million OP tokens account for only 5% of the total 4.29 billion supply tokens; the remaining 95% have not yet been released.

OP token allocation — Source: Optimism Foundation

Optimism’s next milestone is to release Bedrock during this current (first) quarter of 2023. Bedrock is expected to be the cheapest, fastest, and most advanced rollup architecture. Optimism said that Bedrock uses advanced calldata compression that will make Optimism consistently the cheapest L2. It is also promising faster execution as there will be no separation between your code and the EVM. The Foundation is also launching Cannon: a next-generation fault proof system that will be the only one capable of supporting multiple proof and client implementations, allowing for the removal of upgrade keys from rollup fault proofs. Moreover, it’s expected that Optimism nodes will sync up to 50x faster, and the deposit time will decrease from 10 minutes to 2.5 minutes. All these upgrades promise a substantial reduction in transaction fees as well.

Polygon

Polygon, formerly known as the MATIC network, is an interoperable scaling framework that is a side-chain for the Ethereum mainnet. This network provides a foundation with flexible customization for Ethereum-compatible blockchains to be built on top off, and it builds around the MATIC token that’s used in governance, staking, and gas fees. The company’s product has become a top 10 cryptocurrency because of its low fees and faster transactions.

Polygon’s four-layer system allows developers to create preset blockchain networks that can be tailored to their needs. The four layers include the Ethereum base layer, the security layer, the Polygon networks layer, and the execution layer.

The Ethereum base layer is a set of smart contracts implemented on the Ethereum mainchain that conduct transaction finality, staking, and communication between Ethereum and the blockchains built on the Polygon network.

The security layer, which runs next to Ethereum, gives Polygon chains the option to use a “validator-as-a-service” role within their own networks. This role is similar to Ethereum’s, in that the chain has specific infrastructure that solely runs validators so that others can stake their coins.

The networks layer is the ecosystem of blockchain networks built on Polygon. Each network community handles its own consensus and block-producing mechanisms. The last layer, the execution layer, is the Polygon Ethereum Virtual Machine (EVM) which is responsible for executing the smart contracts for the network ecosystem.

Polygon’s ZK-Rollup Development and Future Plans

Polygon currently has four major products that are based on ZK-rollups: Zero, Hermez, Miden, and Nightfall. Each of these products is developing ZK-rollup solutions that are designed to achieve specific goals.

Polygon Zero, for example, is a project aimed to reduce the computational cost of generating the ZK proofs. Although ZK-rollups can increase scalability, they are limited by the costly and time-intensive generation of ZK proofs. Zero aims to solve this problem using “recursive proofs,” which have been proven to be faster than the existing proof-generation processes. For existing proof-generating projects, the foundation for their algorithms is to generate proofs one transaction batch at a time. This, however, requires a lot of computational resources and time. Instead, the recursive approach aims to generate proofs simultaneously before aggregating multiple transaction proofs into one giant proof to be submitted on the Ethereum network. This mechanism reduces the effort required to generate reliable validity proofs for ZK-rollups.

This recursive approach builds off of Plonky2, a proving mechanism developed by the core team behind Mir Protocol (which was acquired by Polygon in 2021). As of today, Zero’s Plonky2 batches up to 3,000 transactions per block and generates a recursive proof in 0.17 seconds, making it arguably the fastest ZK-rollup proof generation mechanism. The Zero project is yet to go live.

Roadmap

Polygon has expressed great interest in scaling Ethereum ZK-rollups. It plans to invest over $1 billion in integrating zero-knowledge technology to their network. It has recently announced plans to launch a zero-knowledge EVM-compatible network. After three and a half months of “battle testing,” Polygon projects a beta launch of their zk-EVM mainnet on March 27th, 2023.

Loading...