Mille-feuille: A Layer-2 Guide

Hi everyone? I'm Zac, the CEO of Aztec. We invented Plonk, a general-purpose ZK-SNARK technology, and zk.money, the world's first privacy rollup project and one of the L2 protocols recently deployed to the Ethereum mainnet. As more and more Layer-2 teams deploy their technology to the Ethereum mainnet and continue to turn the vision of scaling Ethereum into reality, the landscape on Layer 2 becomes more and more fascinating. But if the user has not yet integrated into this ecology, and has not understood the terms related to Layer-2, then the user may step on the thunder. Disappointingly, most people explain Layer-2 solutions because of their interests, and will be biased towards a specific technology (i.e. yes, the technology used by their protocol!). How is it different from them? Absolutely not! But at least I'm speaking straight and not pretending to be impartial, right? I'll do my best to give a fair overview. The world of blockchain-based cryptography/scaling solutions is small, so every team that pushes its boundaries deserves our respect. So I thought we should get involved! What is L2 and why is it important? Eth 1.0 has limited transaction throughput, resulting in extremely high transaction fees. ETH transaction fees come primarily from: Fees for state storage changes Fees for transaction data Fees for computation Layer-2 solutions delegate one or more of the above tasks to a secondary network built on top of Ethereum. Generally speaking, there are two types of Layer-2, each with its own security requirements and trade-offs: optimistic rollups and zk rollups. Aztec defines a third category: privacy rollup. Optimistic Rollups The output value of China's metaverse industry has exceeded 40 billion yuan: Jinse Finance reported that the 2022 China International Fair for Trade in Services is being held. As one of the important forums of the Service Trade Fair, the "Web3.0 Development Trend Summit Forum and 2022 Metaverse, Blockchain, Financial Technology Blue Book Conference" was held in Beijing. The conference released three annual blue papers, "China's Financial Technology Development Report (2022)", "China's Blockchain Development Report (2022)" and "my country Metaverse Development Report (2022)". More than 40 billion yuan, mainly reflected in game entertainment, VR and AR hardware, etc. In the next five years, the domestic metaverse market will break through at least 200 billion yuan. The digital asset trading platform has become the core infrastructure of Metaverse. The industrial ecology of Metaverse, including the common capability layer, scene application layer, infrastructure layer, and application system layer, has formed a complete industrial ecological environment. (Securities Times) [2022/9/5 13:08:26] An optimistic rollup is like a miniature version of Ethereum, which itself as a network can also carry smart contracts and transactions. Optimistic rollup periodically broadcasts transaction blocks to a Layer-1 smart contract. These "blocks" include the complete transaction data for every transaction in the block, and nothing else. Smart contracts on Layer-1 do not perform any calculations or make any storage updates. This drastically reduces the cost of publishing a block. The reason why it is called optimistic (optimistic) rollup is because the scheme assumes that every transaction is valid by default - the smart contract on Layer-1 will not directly check its validity. Conversely, if a user believes that a transaction is improper (e.g., a double spend transaction), they can issue a "fraud proof". At this time, the smart contracts on Layer-1 can use the block data released by rollup to verify the validity of those suspected fraudulent transactions. This operation is very costly, but must only be done if wrongdoing is suspected. If the malicious behavior is confirmed, the entity that issued the optimistic rollup block (often called a validator) will lose some of the cryptocurrency they pledged. Data: In the last week, 2.4567 million NFT assets were added to the Ethereum network: Jinse Finance reported that NFTScan data showed that in the latest week, 2.4567 million NFT assets were added to the Ethereum network, with an average of 350,900 new NFT assets minted every day. [2022/7/10 2:03:48] Optimistic rollups rely on this economic consensus to ensure transactions are legitimate. The withdrawal waiting period for Optimistic rollups is usually longer (for example, one week). This is because, once a transaction is posted to rollups, the user needs to wait to see if anyone accuses their transaction of being invalid and proof of fraud is posted to the network (it's like when a priest asks "Anyone objecting to..." at a wedding? the embarrassing silence that ensues). Time waiting for fraud proof slows withdrawal times drastically The main cost of executing a transaction in an Optimistic rollup is the cost of posting the transaction data to the chain. All rollups face this data availability problem, whether optimistic or otherwise. In order to prevent their own funds from being frozen, users need to have permission to access all transaction data of rollup. Either publish these data on Layer-1, or require additional trust assumptions from users (for example, believe that some side chains will allow users to access these data). As of this writing, if the rollups you are using are not posting their transaction data on-chain, that means you can only hope that the centralized service you rely on doesn't freeze your funds. Pros: Rich in features. The architecture of Eth1.0 can be copied and smart contracts can be supported. Easier to build and deploy than zk-rollups Cons: Longer withdrawal times. It takes about a week from the time the transaction is executed until the transaction is deemed 'safe and valid' (i.e. no proof of fraud is presented). Italian luxury brand Salvatore Ferragamo has installed an NFT booth in the SoHo district of New York City: On June 25, the Italian luxury brand Salvatore Ferragamo installed an NFT booth in the SoHo district of New York City. Customers can design and cast their own Ethereum-based NFT booths on OpenSea. NFT, a total of 256 NFTs can be minted, and it is free to all visitors. The cost of minting NFTs will be borne by Salvatore Ferragamo in advance. [2022/6/25 1:30:55] The problem of slow exit time can be alleviated with the help of insurers (that is, those who charge a small fee and provide L1 liquidity, aiming to allow users to achieve fast withdrawals) ZK Rollups by A secondary network handles computation and storage. L2 broadcasts the transaction data to the main network and provides a proof of validity - a mathematical proof that the transaction is valid. That is to say, the batch transactions on L2 are aggregated into one large transaction and sent to a smart contract in L1. The prefix "zk" in zkRollups stands for "zero knowledge". However, zkRollups provide no privacy protection - all transactions are public by default, like optimistic rollups. It is called "zk" because such validity proofs are typically generated by zero-knowledge proof systems (e.g., ZK-SNARK or ZK-STARK). The advantage of this is that there is less overhead for storage item updates and calculations on the Ethereum mainnet. There is no need to optimistically assume that the transaction is valid, and if it proves to be valid, it can be determined that the transaction is valid. This means that zkRollups have much faster withdrawal times than optimistic rollups and require fewer trust assumptions. The white elephant in the room is that zero-knowledge proofs add a staggering amount of computational overhead to a transaction. Creating a zero-knowledge proof for a computation is about a million times slower than running the computation directly! This is a rough estimate that will vary depending on the calculations involved, but is accurate for the types of calculations in Solidity smart contracts. The difficulty of the entire Bitcoin network is expected to increase by 5.45% tomorrow, breaking through the 30T mark: On May 10, according to the OKLink BTC browser of OKLink, the current Bitcoin network difficulty is 29.79T, and it is expected that the difficulty of the entire network will increase by 5.45% tomorrow , Breaking through the 30T mark and reaching 31.42T, the current Bitcoin network computing power in the past seven days is about 222.34 EH/s. [2022/5/10 3:04:20] zkRollups handles this by delegating the generation of proofs to a third-party "rollup provider" with massive computing resources. Users will rely on these third-party service providers to create transactions for them. Rollup providers can censor or front-run transactions, just like Ethereum miners can. The more computing power required, the fewer subjects can be rollup providers, so we must fully solve the review problem from the protocol architecture. When it comes to porting smart contracts to L2, the high computational overhead poses some challenges for us. It is our goal to be fully compatible with the EVM. To achieve this goal, we must solve this 1 million times slowdown problem. The EVM is extremely unfriendly to SNARKs, since the word size is 256-bits, and natively supports SHA3 and other SNARK-unfriendly hashing algorithms. Even delegating proof of computation to a third party with vast computing resources may not be sufficient. One possible solution is to write the zkSNARK prover algorithm directly into silicon via FPGAs or ASICs. Rollup providers will need this hardware to create proofs. Creating zk proofs is much slower than running a normal program. Our research on Plonk and Plookup speeds up SNARKs by an order of magnitude, but zkRollups still have performance issues compared to optimistic rollups. Typically, SNARK and STARK programming languages have had to adapt to the inefficiencies of their underlying proof systems. These two languages generally have difficulty implementing variable-length loops and dynamic memory access (such as dynamic arrays and vectors). Some of these issues were alleviated in our latest Plookup study, but not all. The digital currency sector weakened, and Beixinyuan fell by more than 11%. News on January 26, the digital currency sector weakened, and Beixinyuan fell by more than 11%. Shensi Electronics, New Cape, Advanced Datacom, Xiongdi Technology, Beijing The North, etc. are among the top decliners. [2022/1/26 9:13:21] This means that zkRollup may require developers to port their contracts to a custom language (such as Starkware's Cairo language). For those zkRollups that do not aim for full EVM compatibility, there is a benefit that transactions are cheaper. If there is no need to follow EVM semantics, it is possible to reduce the amount of broadcast data per elementary transaction. The Hermes network does just that. Transaction costs may be cheaper than optimistic rollups Does not require fraud proofs, withdrawal times are shorter Comparing to optimistic rollups, features are added more slowly Rely on third parties using custom hardware to generate proofs May require custom language with limited functionality Privacy Rollups Aztec has launched privacy rollups on the mainnet in March 2021. Users can encapsulate ETH into a privacy shield and send private transactions through zk.money, our online privacy wallet. The technique of privacy rollups is very similar to that of zkRollups, but their purpose is completely different. Privacy rollups are designed to provide strong privacy guarantees to L2 users. Users hold funds anonymously. When executing a transaction, both the sender and receiver are anonymous, and even the transfer amount is encrypted. For this, we use Plonk, a state-of-the-art zero-knowledge proof system. We invented Plonk in 2019, and it quickly became the industry standard among teams developing zero-knowledge proofs on blockchains. Achieving privacy by design requires a very different rollup architecture than zkRollup. Our approach is "privacy first" because we know that retrofitting a public L2 with programmable privacy often requires sacrificing user experience or radically refactoring the entire protocol. The current Ethereum-based privacy solution is a mixer. Mixers can be used to anonymize the amount of a user's funds, but have little else to do. The full version of our privacy L2 will include more features: fully programmable privacy smart contracts. Privacy coins will have more advanced transaction logic The privacy ownership of NFT can completely hide the attributes of NFT, only visible to the owner of the NFT Anti-money laundering and KYC checks can be directly programmed into privacy tokens/dApps (for example, KYC tokens —— Users can transact with trusted counterparties without knowing their real identity) Privacy DeFi! This is a broad topic that deserves an entire article (coming soon!) Reaping these benefits is only possible if privacy is a top priority from the start. The protocol's transaction and state models must also be designed to be compatible with privacy properties. Advantages: Realize private transactions. The user's financial activities will not be analyzed by a third party, and the Rollup provider cannot review or preempt the user's transaction.

Tags：

Shiba coin