Tradeoff Study for Rollup Solutions.

As the development of the Ethereum ecosystem drives people's demand for block space, transactions on the base layer of Ethereum have become extremely expensive. However, the block space supply remains unchanged. Interacting with DeFi applications requires paying gas fees worth hundreds of dollars, making many end users prohibitive. Rollup aims to transfer the user's transactions to the lower-cost Layer 2 for execution, and then package the proofs of these L2 transactions into an L1 transaction in batches and submit it to Layer 1 for settlement, thereby greatly reducing the occupation of block space , Alleviate the demand pressure on Layer 1. Rollups are divided into many types, with different trade-offs in throughput, latency, security, generality, and running cost. This paper formulates a Rollup analysis framework around these trade-offs and analyzes why this framework is suitable for different Rollup implementations. We hope that this framework can provide a basic reference for project parties to choose Rollup solutions on demand. The throughput limitations of Ethereum have been a well-known problem since its inception. ETH 2.0 with proof-of-stake and sharding has been seen as a solution to the scalability problem. Although ETH 2.0 launched Phase 0 and launched the beacon chain in December 2020, the scalability and throughput problems cannot be effectively alleviated before Phase 2 is launched. At the same time, Rollup has actually become a short-term solution to alleviate the scalability problem. In a recent article, Vitalik proposed a Rollup-based Ethereum roadmap, stating that "the Ethereum ecosystem may rely entirely on the Rollup scheme (and some plasma and state channels) for scalability in the short and medium term", Many teams have already started working on this roadmap. Click here to read Vitalik's comprehensive analysis of Rollup. The Ethereum account abstraction proposal EIP-4337 adds signature aggregation, which can reduce data costs for rollups: October 3 news, according to a recent tweet released by Ethereum founder Vitalik Buterin, which jointly launched in September 2021 The Ethereum account abstraction proposal EIP-4337 initiated recently released a new version, adding signature aggregation including the BLS signature algorithm. The signature aggregation function allows builders and batch submitters to also aggregate signatures (such as BLS, SNARKs), which greatly reduces the data on the chain. V God said that ERC-4337 provides something truly valuable and necessary for account abstraction, and can provide a "decentralized fee market" for user operations using smart contract wallets. We are slowly and accurately realizing the actual path of account abstraction. The newly added signature aggregation function in this release can reduce data costs for rollups, which will also become one of the driving forces for the adoption of ERC-4337. It is reported that Account Abstraction (Account Abstraction) is to reduce complexity and improve effectiveness by omitting unnecessary details in the Ethereum account system (eliminating the need for EOA and special handling of smart contract wallets). [2022/10/3 18:38:21]Rollup has made great progress in 2020: Fuel Labs and Optimistic released the first version of Optimistic Rollup on the mainnet; Loopring's ZK-Rollup has a total locked volume of more than 100 million USD; Starkware launched the Cairo tool chain, which is convenient for developers to use zero-knowledge proof technology. We have seen many breakthroughs in rollup technology, including Aztec and ZkSync introducing recursive computing capabilities by improving PLONK. In 2021, we will see more progress. Building a separate layer on top of Ethereum is complex, and analyzing existing Rollup implementations is not trivial. The Rollup team touted the theoretically optimal performance and capabilities of their solutions, but little was known about their risks and tradeoffs. Let's dig into how to analyze Rollup's tradeoffs and risks, and how well existing implementations fit these risk models. Layer 2 cross-rollup bridge Orbiter added support for USDT: On June 12, Layer 2 cross-rollup bridge OrbiterFinance added support for USDT. Currently, users can transfer up to 1,000 USDT between Ethereum, zkSync, Arbitrum, Optimism and Polygon. [2022/6/12 4:19:53] We defined and explained the main considerations of Rollup - security, generality, cost, latency, throughput, capital requirements and user experience - and built on it An analytical model of the trade-off relationship. We can use these characteristics to evaluate existing implementations, so that we can not only understand the risks and trade-offs of each Rollup from a micro perspective, but also grasp the overall situation of Rollup from a macro perspective. The security of Rollup (that is, the integrity and security of assets stored in Rollup by users and operators) relies on the underlying Layer 1 blockchain (this article specifically refers to Ethereum). However, certain assumptions of some Rollup schemes and the way they are constructed are also related to security. 1. Honest watchtower assumption This assumption assumes that at least one honest "watchtower" can successfully submit a fraud proof to the Layer 1 smart contract within the challenge period. This assumption introduces a trade-off between security and latency, since the longer the challenge period, the higher the probability that an honest watchtower will submit a fraudulent proof; conversely, the shorter the challenge period, the lower the probability. 2. Batch exit assumption This assumption assumes that all Layer 2 users can successfully execute exit transactions within the batch exit period. This assumption introduces a capital efficiency tradeoff, as the operator's funds are locked up during the batch exit period. 3. Setup (Setup) Each ZK-Rollup scheme uses a zero-knowledge proof protocol to create proofs of validity. A zero-knowledge proof system encapsulates the logic and relationships that a proof needs to check into a circuit that satisfies all constraints. The zero-knowledge proof protocol requires a predefined configuration between the prover (Layer 2 operator) and the validator (smart contract), called a "starter setup". Loopring officially launched the zkRollup second-tier AMM flash swap service: According to official news, the Loopring protocol Loopring officially launched the Ethereum second-tier AMM (automatic market maker) flash swap function based on the Loopring protocol 3.6. Loopring's second-tier AMM is currently only available on the web page. Users can use Metamask, wallets and hardware wallets that support WalletConnect to unlock their second-tier accounts. Loopring Smart Wallet will integrate AMM-related functions. When the AMM fund pool reaches a certain amount, Loopring will gradually open related order book transactions and launch smart order routing functions. The official pointed out that Loopring has only launched the LRC/ETH trading pool at present, and will launch more trading pools in the middle of this month and start AMM liquidity mining to reward liquidity providers. [2020/12/2 22:52:20] Zk-Rollup mainly has three types of settings: Trusted Setup (Trusted Setup), Updatable Setup (CRS) and Transparent Setup (Transparent Setup). Trusted setting: Under this setting (such as Groth16), the gas cost is low and the maximum throughput is high. However, each circuit supports only certain fixed functions. In addition, every time the circuit is upgraded, the trusted setting process needs to be completed. Updatable setting: In this setting (such as recursive Plonk), the gas cost is high and the maximum throughput is low. However, the main advantage of this setup is that custom smart contracts can be introduced without modifying the circuit, all thanks to recursion. Transparent setting: Under this setting (such as Stark), when the Layer 2 block is filled, the gas cost is very low, but in non-ideal situations like empty blocks, the gas cost becomes extremely high. 1. Fully compatible with EVM Fully compatible with EVM means that the Layer 2 system is fully compatible with existing smart contracts on the Ethereum mainnet. The Polkadot layer-2 expansion protocol Plasm began to study ZK-Rollups and plans to release relevant information in Q4: On October 13, the Polkadot layer-2 expansion protocol Plasm tweeted and announced the project weekly report. According to the weekly report, Plasm Network plans to implement the Rollup solution, and has begun research on ZK-Rollups. Information in this regard should be announced in the fourth quarter of 2020, officials said. In addition, the weekly report also mentioned that Plasm has integrated the Ethereum virtual machine EVM and upgraded to Substrate 2.0. [2020/10/13] 2. Custom smart contract Layer 2 clients can customize and introduce limited smart contracts. Layer 2 users and partners can introduce their smart contracts in the form of zk-SNARK circuits (representing the logic of smart contracts) through various tools, although circuits will bring limitations (circuits may not support infinitely iterative loops). 3. Fixed functions Some dApps or smart contracts can be added, but must be implemented through system upgrades. 1. Gas cost Optimal gas cost: depends on call data cost and fixed cost. Suboptimal gas cost: Depends on optimal gas cost, fixed cost, and probability of achieving optimal gas cost. Fixed costs: including the cost of Layer 2 block headers, storage of Layer 2 block roots, and zero-knowledge proofs. When demand is low (in suboptimal situations), fixed costs will account for the vast majority of transaction costs. 2. Computational cost Prover time: In Zk-rollup, the prover takes a lot of time to generate the proof. The proof process requires a lot of calculations to verify the millions of constraints in the proof. Generally speaking, the prover time of zero-knowledge proof depends on the circuit size and the capacity of the hardware used in the proof process. In the case of Plonk, the prover time may be 2 to 14 minutes; in the case of Loopring v3.0, the prover time may be 7 to 10 minutes; in the case of Stark, the prover time may be 3 to 5 minutes. This is the main determinant of the hard finality latency of Zk-rollup. Voice | Carol Goforth: U.S. regulators are too slow to respond to the fast-growing new technology of cryptocurrency: Carol, a law professor at the University of Arkansas and a former law professor at the Arkansas Bar Foundation, in response to questions about "why the United States has not yet become a leader in encryption regulation" U.S. regulators are scattered among too many different agencies, all with their own missions and interests to defend, Goforth said. Not just FinCEN, SEC, CFTC, and IRS, others are involved in how to classify and handle encrypted assets, and there are 50 state governments to consider. In their rush to assert authority, many of them over-regulate based on what they think they understand. So we have been thinking about cryptocurrencies as if all cryptocurrencies are the same interest that can be managed uniformly by each institution. The U.S. Congress can't fix this because Congress is busy dividing along party lines. The states can’t fix this because they simply don’t agree on how to solve the myriad problems that cryptoassets really pose. Our regulatory programs are fragmented across too many different agencies and departments, often too monolithic in their approach and too slow to respond to rapidly evolving new technologies. (Cointelegraph) [2019/8/5] Prover cost: The resources consumed by the prover to generate proofs, depending on the prover time and demonstration throughput. Hard finality: The time it takes to finalize a Layer 2 block. For Optimistic Rollup, this time is the length of the challenge period; for Zk-rollup, it is the prover time. Soft finality: The time it takes to commit a Layer 2 block to Layer 1. Withdrawal time: Some fast transaction schemes need to submit Layer 2 blocks before further processing. Theoretical maximum throughput: based on the gas cost of on-chain operations and the maximum gas per block on Ethereum. Demonstration throughput of Zk-rollup: 1) Demonstration throughput depends on prover time. 2) There is a trade-off between proof cost, empirical throughput, and capital requirements. Higher throughput requires higher proof costs and capital requirements. Is the experience similar to using Ethereum. Capital requirements: The funds that the operator stores in the smart contract to ensure the security of the system. Capital Efficiency: The amount of funds that a liquidity provider/operator locks in a smart contract for x time. (1) All Rollups using fraud proofs must accept liveness assumptions. This assumption introduces a security and latency tradeoff (in terms of the length of the challenge period). Arbitrum's testnet case set the challenge period at 30 minutes, which is very short and not actually secure. This means that a malicious operator can launch a 30-minute network congestion attack on Ethereum and then steal all funds in the Rollup smart contract on Layer 1. (2) New settings are required whenever Loopring changes its functionality or data structure. (The latest version of Loopring uses an internal temporary priming ceremony.) (3) Stark's validators require 5 million gas in terms of a circuit that generates a proof every 300,000 transactions. However, the Stark circuit used by deversiFi generates a proof every 150 transactions, requiring more than 2 million gas.

Tags：

Tron