Optimistic rollups vs ZK rollups

https://limechain.tech/blog/optimistic-rollups-vs-zk-rollups/

Dimitar Bogdanov, Jul 2021

Ethereum is arguably the most influential blockchain project ever and the one that has contributed the most to the development and evolution of the DLT space. Of course, we cannot talk about influential blockchain projects without mentioning Bitcoin, which kicked off the whole thing. But between initial coin offerings, DeFi and this year’s NFT boom, Ethereum has basically been the driving force behind all major blockchain and crypto trends of the past few years. Not to mention that the vast majority of crypto tokens today started their life on Ethereum. So, it’s not an exaggeration to say that Ethereum has for years been shaping the blockchain and crypto landscape.

However, the success of the Ethereum blockchain has once again demonstrated the need for ways to improve blockchain scalability. This is especially true for a platform like Ethereum, whose utility comes from its ability to run decentralized applications (dApps) powered by smart contracts.

We already know that one solution to the scalability trilemma problem can be to make a system more centralized. This is the approach the Binance Smart Chain has taken and it has certainly paid dividends in a massive increase in user accounts and activity. But increasing scalability while preserving one of blockchain’s most unique characteristics – its decentralized nature – is where the real challenge lies. This is what Layer 2 solutions are trying to accomplish.

In our previous piece on the subject, we presented a general overview of the most prominent types of Layer 2 solutions, including state channels, sidechains, Plasma and, of course, rollups. In this piece, we’ll zero in on rollups and will examine some of the most promising projects in that Layer 2 solution category.

Rollups come in two distinct flavors

Rollups are one of the most promising categories of Layer 2 solutions. These solutions move transaction computations off-chain, but store transaction data to the Ethereum chain, which means that rollups are secured by Layer 1.

All this is accomplished via smart contracts whose primary function is to bundle, or ‘roll up’, transaction data and move it off chain for processing. This data is handled by network participants typically referred to as sequencers or validators, who then submit batches of highly compressed transaction data back to the main chain. Those batches contain the minimum information needed to verify whether the transactions are valid.

Because rollups move computation off-chain but still submit (highly compressed) data to the Ethereum mainnet, they can produce gains in scalability without creating data availability issues which is sometimes the case with other Layer 2 solutions. Some rollups also come with the option of off-chain data availability (where no data is actually posted on Ethereum), which can lead to significant gains in throughput, but at the cost of reduced security.

The method of verification is the key distinction between the two types of rollups – zero knowledge (ZK) rollups and optimistic rollups. ZK rollups generate cryptographic proofs that can be used to prove the validity of transactions. Each batch of transactions has its own ‘validity proof’ which is submitted to the main chain.

In contrast, optimistic rollups assume that all transactions are valid and submit batches without performing any computation whatsoever, which can lead to significant improvements in scalability. However, they include a challenge period during which anyone can dispute the legitimacy of the data contained in a batch. If a fraudulent transaction is detected, the rollup executes a so called fraud proof and runs the correct transaction computation using the data available on Layer 1. To ensure that they are incentivized to process only legitimate transaction data, sequencers are required to stake ETH. If they perform their duties diligently they receive staking rewards, but if a sequencer submits a fraudulent transaction to the main Ethereum chain, their stake is slashed.

Optimistic rollups

One of the biggest strengths of optimistic rollups stems from the fact that they do not perform computation by default, which can lead to significant scalability gains – estimates suggest that optimistic rollups can offer up to 10-100x improvements in scalability. On the downside, the need to have a challenge period means that withdrawal periods are significantly longer than ZK rollups.

Another big advantage of optimistic rollups is that they are capable of executing smart contracts, whereas ZK rollups are mostly limited to simple transactions.

At the moment, the optimistic rollup space is shaping up to be a battleground for two main competitors – Optimism and Arbitrum. Competition between these two projects is already heating up, with both having already scored some early successes. The two solutions are very similar, with the main difference being the way they generate fraud proof. There are also differences with regards to their compatibility with the Ethereum Virtual Machine (EVM) and Ethereum tooling.

So let’s examine each in greater detail.

Source: The Defiant

Optimism

The first optimistic rollup protocol to gain traction in the blockchain space, Optimism was also supposed to be the first to have a mainnet launch. However, a delay from its originally planned March launch allowed Arbitrum to beat it to market. Nevertheless, the project continues to attract strong interest and even secured $25 million in funding from investment firm Andreessen Horowitz.

In a typical rollup fashion, Optimism uses a smart contract to relay transaction data from the main Ethereum chain to a Layer 2 network, where a sequencer can bundle multiple transactions into a batch and then submit that batch back to the main chain via a single transaction. Sequencers perform these duties optimistically under the assumption that all transactions are valid. The system has a one-week period during which that assumption can be challenged. If any discrepancies are found, the rollup generates a fraud proof. In order for such a proof to be generated, the whole Layer 2 transaction is executed on Layer 1. The advantage of this approach is that it enables very fast proof generation.

Optimism tries to stick as close as possible to the Ethereum ecosystem. It uses a modified GETH for its Layer 2 node and it has a Solidity compiler. However, it does not support any EMV languages apart from Solidity.

Currently the protocol does not have a native token and uses ETH for payments.

Arbitrum

The Arbitrum project was set to be the main challenger to Optimism, but following the latter’s launch delay, it scored an early lead in the optimistic rollup race. Arbitrum launched on the Ethereum mainnet on May 28.

As mentioned above, Arbitrum is very similar to Optimism, with the main difference between the two projects being the way they generate fraud proof. Unlike Optimism, which executes the whole Layer 2 transaction, Arbitrum takes a multi-round approach where it executes small chunks of the L2 transaction until it finds a discrepancy. This approach has the benefit of enabling higher transaction capacity. On the downside, generating fraud proof this way typically takes a week – and can take up to two weeks in some cases – much longer than with the method used by Optimism.

On the compatibility side, Arbitrum supports all EMV languages, including YUL, Vyper and Solidity, among others. However, it uses a custom L2 node. Like Optimism, Arbitrum uses ETH for payments.

ZK rollups

Whereas optimistic rollups assume that everyone acts in good faith, ZK rollups seek to ensure that that’s actually the case. The rollup moves bundles of transactions to Layer 2 and generates a validity proof for every bundle. The validity proofs are then submitted to Layer 1 to serve as proxy for their corresponding bundles. This method results in significant data size reduction and in turn lowers the time and gas cost for validating a block. You can achieve further optimization by employing some neat tricks. For example, accounts can be represented as indexes instead of an addresses, which greatly reduces transaction size.

One drawback of ZK rollups is that generating a validity proof is a complex and time consuming process. Another drawback is the aforementioned inability to execute smart contracts, although there are some exceptions, as we’ll see below.

On the other hand, ZK rollups do not require a challenge period, as the validity proof has already verified the legitimacy of transaction data. That’s why ZK rollups allow for very fast withdrawal times. So while ZK rollups are typically not good for general purpose applications, they are great for exchanges and other apps that require simple payments.

There are a number of promising projects that are currently populating the ZK rollup corner of the Ethereum ecosystem. Here are some of the most promising ones:

Hermez

We start with Hermez because of a major development that made the headlines earlier this month. According to an August 13 announcement, Hermez is merging with Polygon in a landmark deal worth $250 million. The merger means that Polygon, which is arguably the most popular Ethereum scaling project (though technically not Layer 2 as it’s a sidechain) right now is getting ZK rollup capabilities. We’ll be covering Polygon in detail in a future article.

So what exactly is Hermez? Well, it is a ZK rollup that generates cryptographic proofs called SNARKs (succinct non-interactive argument of knowledge). It is developed by Iden3, the team behind the popular Circom and SnarkJS libraries. According to Iden3, Hermez can scale Ethereum to 2,000 transactions per second.

The Hermez Network relies on coordinators for processing batches to the Hermez rollup and generating validity proofs for those batches. Coordinators are selected via an auction process that sees registered network nodes placing bids to become the next coordinator. The winning bidder gets to process as many batches as they can during a single ‘slot’ that lasts 40 Ethereum blocks or approximately 10 minutes.

Currently, bids are paid in Hermez’s proprietary token, HEZ. However, this is about to change, as following the Polygon deal, HEZ will cease to exist and will be replaced by Polygon’s token Matic. The exact date of the change is not yet determined, but Hermez has announced plans to publish a smart contract that will allow HEZ holders to swap their HEZ for Matic tokens at a rate of 3.5 Matic per HEZ.

Recently, Hermez also launched an atomic transaction feature, which enables cheap token swaps on the network. Also recently, the Hermez team announced that they are working on a zero knowledge Ethereum Virtual Machine (ZKEMV) aimed at achieving full opcode compatibility. This means that Hermez, or to be more precise, Polygon Hermez, will be able to support smart contracts.

ZKSync

Next, we have another SNARK-based rollup. The team behind ZKSync, Matter Labs, describes their project as a scaling and privacy engine, enabling low-gas transfers of Ether and ERC-20 tokens in the Ethereum network. ZKSync’s motto – “rely on math, not on validators” – certainly seems aptly chosen as currently there is only one validator processing batches and generating validity proofs.

ZKSync also supports token swaps and NFT (non-fungible tokens) minting. Earlier this year, the platform launched in alfa its ZKEVM, which allows it to execute smart contracts. ZkSync supports most opcodes in Ethereum.

A big part of the vision for ZKSync 2.0 is an off-chain data availability solution dubbed ZK Porter. The solution is meant to complement the rollup component of ZKSync 2.0, meaning that rollup contracts and accounts will be able to interact with ZKPorter accounts and vice versa. Off-chain data availability in ZKPorter will be secured by so called guardians, who stake ZKSync tokens and sign blocks to confirm data availability in ZKPorter accounts. With their stakes on the line, guardians are motivated to ensure that there are no data availability failures. What’s more, Matter Labs claim that the ZKSync’s proof of stake is significantly more secure than PoS in alternative scaling solutions like sidechains, because guardians cannot steal funds.

Loopring

Whereas Hermez is working towards supporting – and ZKSync already supports – smart contracts, the next ZK rollup solution, Loopring, focuses solely on decentralized exchanges (DEXs) and payment applications. With Loopring anyone can become an operator of their own orderbook DEX or automated market maker (AMM) and take advantage of its ZK rollup technology to achieve high throughput at low gas cost – Loopring claims that its ZK rollup can reach up to 2,025 per second, while the cost per transaction is 100 lower than the same metric on Ethereum. Exchange operators are required to post a large bond (stake) in the protocol’s native LRC token.

The Loopring moniker stems from one of the protocol’s most interesting features – order rings. An order ring is a circular trading system that contains up to 16 individual orders. So whereas a buy order typically has to be matched by an opposing sell order, and vice versa, orders in an order ring do not need direct matches to be executed. This system can result in better liquidity, price discovery and other benefits.

StarkEX

Arguably the most interesting aspect of StarkEx – a Layer 2 scaling and payment protocol developed by StarkWare, is that it uses STARKs (succinct transparent arguments of knowledge). Unlike SNARKs, which require a trusted setup (or a multiparty ceremony) to produce pre-generated keys that are then used to create and verify the proofs, STARKs utilize a method that removes the need for such a setup. That method was pioneered by StarkWare, which continues to be the driving force behind STARK-based technology. The key innovation enabling this is the Turing-complete programming language Cairo. Developed by the StarkWare team, Cairo enables generation of STARK proofs for general computation. The StarkEx protocol is written in Cairo.

Another difference between these two ZKP types is that while SNARKs are based on elliptic curve cryptography, STARKs rely on hash functions, which offers certain benefits, quantum resistance being among them.

On the downside, STARKs have a significantly bigger proof size and, because of this, are way more expensive to verify.

Nevertheless, the StarkEX protocol has already been utilized to power some interesting projects, including the DeversiFi DEX and the recently launched NFT minting and trading platform Immutable X.

Conclusion

At the end of our previous article on Layer 2, we concluded that Layer 2 will play an important part in making Ethereum more scalable and will complement nicely the larger effort (Ethereum 2.0) to solve the scalability problem at the Layer 1 level. The same view is shared by many in the blockchain industry and even by some prominent outsiders.

“While there is little debate that scaling Ethereum is necessary to continue supporting the rapid growth of the network, this issue is sometimes framed as a competition between Ethereum 2.0, Layer 2 services, and “Ethereum killer” Layer 1s,” Andreessen Horowitz said in the announcement of their $25-million Series A investment in Optimism. “One lesson from internet history is that when you give developers a powerful new computing platform, they create applications at such a rapid rate that demand consistently outpaces supply. We believe the same will be true for Ethereum, and therefore that the answer to scaling is “all of the above,” including Ethereum 2.0, bridged Layer 1s, and Layer 2 solutions.”

And when it comes to Layer 2 solutions, rollups are up there with the best of them and might even be a bit better than the alternatives in some respects. It is no coincidence that Ethereum’s creator, Vitalik Buterin, is quite fond of rollups and sees them as a natural fit for PoS and sharding – the two main components of the Ethereum 2.0 project.

If you want to learn more about this exciting technology, Vitalik’s “An Incomplete Guide to Rollups” is a great place to start. You can also check out what LimeChain co-founder and blockchain architect George Spasov has to say about some of the most prominent rollup projects and why he believes that the Polygon-Hermez deal is a gamechanger for the industry. Finally, if you want to pursue practical applications of the technology, our knowledgeable consultants and world-class dev team can help you determine how rollups can be utilized to best serve your specific needs. Don’t hesitate to get in touch with our experts.