By Stephen Golzari — Completed on 28th of March, 2022

In this article I am going to talk about rollups on Ethereum, why they were initially introduced as a solution to Ethereum scalability problems, what their potential issues are, and what their future beholds

The blockchain trilemma is a problem where out of scalability, security, and decentralization only two can be maximized simultaneously. Ethereum is a blockchain that maximizes both security and decentralization, but lacks scalability. This results in low TPS (transactions per second) — approximately 15 TPS — which, in its turn, has led to abnormally high gas prices. Generally, two possible ways were proposed to solve the scalability problem: by updating Layer 1 (Ethereum itself) or introducing Layer 2s (solutions above Ethereum that would have scalability benefits).

L1 possible solutions involve:

• Change in the consensus mechanism (on Ethereum — switch to PoS);

• Sharding (dividing blockchain into smaller subsections);

• Increase in the number of transactions that can be processed in one block (will lead to a rise in difficulty and, hence, an increase in centralization) or allow usage of best hardware only (results in centralization due to the monetary restrictions);

Introducing L2s on a blockchain is a great way to increase scalability. Primarily, if some issue arises on Layer 2, Layer 1 will not be affected. Secondly, Layer 2 increases in scalability by moving computation to either Sidechains or moving hard computation off the Ethereum Mainnet by introducing rollups that we are going to discuss next.

Rollups are one of the forms of L2s, where computation is moved off-chain and some transaction information is left on chain. This leads to major data compression per transaction, hence, less gas is needed per transaction. Primarily, there are two types of rollups: Optimistic and zero-knowledge rollups.

Optimistic rollups

Optimistic rollups use fraud proof. The name ‘Optimistic’ comes from the proof mechanism this type of rollup has: firstly, it is optimistically assumed that all transactions are valid. After withdrawals, a period starts where anyone can verify whether some batch (a large amount of highly-compressed off-chain transactions) had an incorrect post-state root. If there was a violation, a whistleblower will have to mathematically prove that a violation occurred. In Optimistic Rollups there exists information about the whole rollup. If somebody publishes an invalid batch, then several steps must be taken in order to run the whole fraud proof (more here):

• Primarily, the user (whistleblower) needs to identify the pre-state root and the transaction disputed and upload all the transactions pre-state, involving merkle proofs for each state;

• Secondly, a re-execution of the state transition on-chain is provided;

• Thirdly, the user is rewarded for the dispute, the harmful sequencer is punished, the invalid roots are pruned and the whole process moves on.

It is important to emphasize the benefits the whistleblower gets for computing the fraud proof: a percentage of the sum of the transaction that was fraudulent is burned, while the remaining is distributed between users that committed the valid proof.

Now when we know how fraud proof works, we can elaborate on pros and cons of Optimistic rollups.

Pros

• The general purpose of both rollups is to increase scalability and, hence, reduce transaction costs. In this rollup the increase in scalability can reach ~2000 TPS;

• Another benefit is the low complexity of technology — the concept of fraud proof is relatively easy;

• All data is available on-chain;

• Computationally less expensive than ZK.

Cons

• The 7 day withdrawal period might be an extremely long period for general usage;

• Reliance on “watchers” rather than mathematically-certain security;

• Susceptible to 51% attack.

ZK rollups

ZK rollups use validity proof, where a computationally hard cryptographic proof called a ZK-SNARK is used, while the transactions themselves are easily verifiable. Validity of transactions here is proved every time a new batch is submitted: transactions are final once they are validated. As a result, validity proofs lead to a much faster period of verification than fraud proof.

In zero knowledge rollups scalability is improved by even greater reduction of amount of data held per transaction than in optimistic ones— information about the part of a transaction that is used for verification, but not for change of state, can be left off-chain, since SNARK proves the batch is correct. To incentivize honesty, relayers (those who are responsible for collecting transactions and proves) must first stake their cryptocurrency in a smart contract.  If a prover tries to insert fraudulent transactions, an invalid zero knowledge proof will be generated and, hence, it will be rejected by the Layer 1 smart contract, since the smart contract can check the whole computation without peeking into each individual piece of the computation (more here).

Overall, the process of transaction submission and validity proof can be described in the next steps:

• Transactors post their transactions data that is batched together into a single batch, combined with the current state root;

• The batch is sent to a prover, who creates a SNARK, that represents the delta of the blockchain state;

• A prover forwards the result to the mainchain in a verifiable hash;

• Verifiers check the proof;

• The smart contract on Ethereum L1 that maintains the state of a Rollup is updated to a new state.

While ZK rollups introduce us irrefutable advantages, there are still cons worth consideration.

Pros:

• Greater scalability and transaction cost reduction compared to optimistic rollups. Even though the fixed gas cost per batch is greater in ZK rollups than in Optimistic ones, ZK-rollups work off economies of scale, meaning that with more users in a rollup, cost per transaction is reduced (i.e. the cost of verifying transactions grows slower than the number of transactions);

• Transaction data reduction increases throughput and scalability, since, as mentioned, all unnecessary for verification data is avoided, while also a batch is used;

• Faster withdrawal times due to validity proof usage — long fraud-proof challenge period is avoided;

• Security is still present, since validity proof is stored on L1;

Cons:

• Zero-knowledge proof computing is difficult and time consuming — it will require data optimization to get maximum throughput; in addition, due to the complex math, ZK-rollups are limited to simple transactions (e.g., transfers, trading);

• Initial set up relies on a centralized structure;

• More difficult to initially build and integrate into the Ethereum network than optimistic rollups.

Benefits of rollups “as a single whole”:

The potential benefits resulting from a complete switch to rollups are straightforward: the blockchain trilemma problem in Ethereum would be solved, since decentralization is provided by PoW (will switch to PoS), security — Ethereum blockchain, scalability — Layer 2 (Rollups) and sharding. This would lead to a much more user-friendly network.

Disadvantages of rollups “as a single whole”:

Currently, L2s are still in development and they involve some potential disadvantages worth consideration.

– Transition to Ethereum centered with rollups is a years long journey. Though the L2 idea has been around the crypto community for a while, rollups on Ethereum is a new technology that has not been established yet. First smart contract rollup was deployed only in January 2021. Ethereum’s transition from a monolithic blockchain to a modular one has just started and we will be witnessing how the technology will develop throughout time. The proof of the system being only at its origin can be found in recent news — a critical bug in Optimism, one of the biggest optimistic rollup available, that allowed a malicious user to produce infinite Ethereum.

– The bigger part of rollup industry relies on economic guarantees. To this day most of the rollups are optimistic, where security is guaranteed by verifiers that get monetary benefits from finding a malicious user. In theory, for a system to work, whistleblowers should find this violator every once in a while in order to effectively continue their future verifying. However, if the system is highly secure, it will mean that the verifier will honestly check all the transactions that are coming through the rollup, and, eventually, malicious users will stop their activity, since there will be no benefit for them to try to violate in the given rollup. This would lead to a decrease in monetary benefit for the whistleblower, who can, potentially, stop checking for frauds, since no reward is present.

Does this mean that the more secure a rollup running on fraud proof is, the less secure it becomes? Well, yes, but there are some possible solutions. The first solutions that might come to one’s mind would be giving rewards to verifiers even when the system is operating without any frauds — will result in higher fees in the network, thus contradicting the very first reason of L2 creation; or increasing the number of verifiers in the whole rollup — would also not work in the long run, as the benefits of running these proves would eventually disappear, too. More proposed solutions and how they work can be found here. However, I suppose that the best way rollups could develop involves switching to ZK-rollups, which have complex cryptographic validity proof that does not rely on people.

– Centralized Provers and Sequencers. Initially, sequencers in ZK rollups are centralized. The greatest barrier to generating a proof in ZK rollups is the amount of computation that has to be done to send a validity proof with a transaction. Due to this hardness of proof, ZK rollups tend to have centralized provers. In addition, as more efficient zk proof-proving systems appear, this could lead to an increase in centralization (centralized provers could monopolize these systems). However, overall, this L2 solution will be more decentralized as time goes.

– Optimistic rollups have a lot to offer. Currently, optimistic rollups such as Arbitrum are already EVM compatible; off-chain costs of these rollups are much lower than ZK, making optimistic rollups much more decentralized overall. Moreover, there exist fast-bridges that allow users to transfer their assets between L1 and L2 almost instantly: this diminishes a serious downside of Optimistic rollups. Finally, usually when we compare ZK and Optimistic rollups, we mostly talk about ZK in a future tense, while Optimistic already have a lot to offer.

– Talking about the future of ZK, zkSync is a working Layer 2 solution available to any user at the moment. Its update, zkSync 2.0, zkEVM, in particular, gives us a promising future in the field of Layer 2 scaling solutions. zkEVM is a virtual machine that executes smart contracts in a way that is compatible with zero-knowledge proof calculations. So far, we have known that ZK rollups are limited to payment and swaps only due to the necessity of advanced knowledge in zero-knowledge proofs. zkEVM, in its turn, is going to be the key to migration of existing Ethereum applications to EVM compatible zk-rollup.

– Breakthroughs in zero knowledge cryptography might lead to even greater ZK rollup improvements. Recent improvements in arithmetization, involving tinyRAM, optimized special circuits, and recursive aggregation allowed zkEVM to actually exist. Further research and ideas might solve the existing limitations in zkSync 2.0.

• How does Optimism’s Rollup really work? | Paradigm Research

• An Incomplete Guide to Rollups | Vitalik Buterin

• An approximate introduction to how zk-SNARKs are possible | Vitalik Buterin

• How rollup fees work | Polynya

• Optimistic Rollup is Not Secure Enough Than You Think — Game Theoretic Approach for More Verifiable Rollup | 박정원(Aiden Park)

• ‘zkEVM’ — Alex Gluchowski | ETHGlobal