Foreword

Ethereum is one of the most popular blockchains and has long struggled with scalability issues. High gas fees and slow transaction speeds are major concerns that have led to network congestion. To address these issues, various scaling solutions have emerged. In this lesson, we will introduce some of Ethereum’s scaling solutions and delve into two common rollups: optimistic rollups and ZK-rollups.

Optimistic rollups are layer 2 protocols for Ethereum designed to scale the throughput of its base layer. By processing transactions off-chain, optimistic rollups reduce computation on Ethereum Mainnet, significantly improving processing speeds. Unlike other scaling solutions, such as sidechains, optimistic rollups package transaction results and publish them on Ethereum, inheriting the security of the Mainnet. It verifies transactions on Ethereum with fraud proofs but stores transaction data elsewhere.

Optimistic rollups can offer more than 10x improvements in scalability by avoiding direct processing of each transaction on the slow and expensive Ethereum network. Instead, it writes transactions to Ethereum as calldata, which serves as temporary storage without consuming significant space on the Ethereum blockchain, thereby reducing gas costs for users.

Zero-knowledge rollups (ZK-rollups) are also layer 2 scaling solutions that increase the throughput on Ethereum Mainnet by moving computation and state storage off-chain. ZK-rollups can process thousands of transactions in batches and then only post minimal summary data to Mainnet. This summary data defines the changes that should be made to the Ethereum state and some cryptographic proof known as zero-knowledge proofs, which verify the correctness of the batch transaction processing.

How Rollups Work

Optimistic Rollups

Optimistic rollups are a technological solution for improving the efficiency and security of blockchain transactions. It involves bundling multiple transactions into a “rollup” and submitting them to the main chain (Ethereum). This solution helps save resources on the main chain, increase transaction speed and throughput, and lower transaction fees.

Optimistic rollups execute transactions off-chain but post transaction data as calldata on the Ethereum mainnet. Optimistic rollup operators, also known as sequencers, bundle multiple off-chain transactions together in large batches before submitting them to Ethereum. This approach spreads fixed costs across multiple transactions in each batch, reducing costs for end users. Additionally, optimistic rollups employ compression techniques to reduce the amount of data posted on Ethereum.

Optimistic rollups are considered “optimistic” because they assume that all off-chain transactions are valid and do not publish proofs of validity for transaction batches posted on-chain. This is the primary difference between optimistic rollups and ZK-rollups, where ZK-rollups must provide validity proofs for off-chain transactions.

Optimistic rollups use fraud proofs to detect transactions that are not correctly calculated. Every rollup batch submitted to Ethereum has a time window called a “challenge period,” during which anyone can act as a validator and compute a fraud proof to verify the results of a rollup transaction. If the fraud proof succeeds, the rollup protocol will re-execute the transaction and update the state of the rollup accordingly, while the nodes that included the incorrectly executed transactions in a block will be penalized.

If a rollup batch remains unchallenged after the challenge period ends (meaning all transactions have been correctly executed), the batch is considered valid and accepted on Ethereum. Any node can continue to build on unconfirmed rollup blocks, but if they happen to execute transactions based on an incorrectly executed batch, the transaction results will be revoked.

In this way, optimistic rollups can achieve efficient and low-cost transaction processing while maintaining blockchain security. It is a solution that shifts the scalability issue from the consensus layer to the computation layer, and it is currently a widely recognized and applied blockchain scaling technology.

Rollups sequence individual transactions off-chain and package them together before posting them to Ethereum

ZK-Rollups

ZK-rollups, like optimistic rollups, are scaling solutions that leverage batch transaction processing to improve the efficiency of blockchain transactions. However, they adopt different approaches to achieve this.

In ZK-rollups, the operators (also known as sequencers) submit a summary of aggregated transaction data to the main chain, representing the changes required for all transactions in the batch, instead of individually sending each transaction. Operators write transactions as calldata stored on Ethereum temporarily, and when the information in calldata is published on the blockchain, anyone can independently reconstruct the rollup’s state.

Additionally, operators must generate validity proofs to demonstrate the correctness of their rollup data. These validity proofs primarily rely on ZK-proofs to prove the authenticity and validity of all transactions in the rollup batch.

Nodes on Mainnet only need to verify the correctness of ZK-proofs, without examining the details of each transaction. In contrast, optimistic rollups use fraud proofs to detect computational errors in transactions. This means that ZK-rollups only need to provide validity proofs to complete transactions on Ethereum, whereas optimistic rollups require all transaction data to be included on-chain.

When moving funds from a ZK-rollup to Ethereum, there is no delay as exit transactions are executed immediately after the ZK-rollup contract verifies the validity proof. On the other hand, extracting funds from optimistic rollups faces a delay to allow anyone to challenge the exit transactions with fraud proofs.

ZK-rollups also utilize compression techniques to reduce transaction data. For example, ZK-rollups use Merkle trees to maintain the security and integrity of off-chain transactions without storing all transaction data on Mainnet. Additionally, accounts are represented by indexes instead of addresses, which saves 28 bytes of data. On-chain data publication is a significant cost for rollups, so data compression can reduce fees for users.

Zero-Knowledge Proofs

Zero-knowledge proofs come in various algorithms. Taking the Sigma protocol as an example, if Alice wants to prove to Bob that she indeed knows a secret key “password”, she can do so using the following steps:

1. Alice randomly chooses a number r and uses the hash function to compute H(r), and then sends the result to Bob. The hash function H converts arbitrary-length data into a fixed-length hash value. For example, H(“hello”) might be “2f95f89f1c2328712ef7bde608ce5404e97d5f04”.

2. Bob generates a random number s and sends it to Alice.

3. Alice computes x = r + H(“password”) * s, where “password” is the secret key known to Alice. She then sends the result to Bob.

4. Bob computes y = H(x) and sends y to Alice.

5. Alice computes z = r + H(“password”) s y and sends z to Bob.

6. Bob computes w = H(z). If w is equal to y, indicating that z = x, Bob knows that Alice possesses the secret key “password”.
   In step 3, Alice combines the known secret key “password” with the random number r and the fixed value H(“password”) * s to create a seemingly random value x, which serves as a pseudorandom representation of “password” through the hash function computation. It forms a new value x composed of the truly random value r and the fixed password “password”.

During the interaction, both parties can only see their own random numbers. For example, Alice knows r but not s, while Bob knows s but not r. However, Bob can use the random value s to verify Alice’s hash value and determine whether it contains the pseudorandom component. The pseudorandomness represents that Alice indeed possesses the secret key, while true randomness signifies that Alice is lying.

The key to this process is that Alice uses the secret key to compute x and z in steps 3 and 5, thereby proving her ownership of the secret key without revealing its actual content. The random numbers r and s, along with the hash function H, help protect Alice’s privacy.

Advantages of Rollups

Optimistic Rollups

1. Significantly improves scalability without sacrificing security or decentralization.

2. Transaction data is stored on the layer 1 chain, which enhances transparency, security, resistance to censorship, and decentralization.

3. Ensures trustless finality with fraud proofs and allows honest minorities to secure the chain.

4. Computation of fraud proofs is relatively easy and can be executed by any layer 2 nodes without requiring high-spec hardware.

5. Highly compatible with EVM and Solidity, allowing developers to port Ethereum-native smart contracts to rollups or create new dApps using existing tools.
   ZK-Rollups

6. Validity proofs ensure the correctness of off-chain transactions, preventing operators from executing invalid state transactions.

7. Offers faster transaction finality as state updates are approved once validity proofs are verified on layer

8. Relies on trusted cryptographic mechanisms for security, rather than relying on the honesty of incentivized actors as in optimistic rollups.

9. Users benefit from greater capital efficiency and can withdraw funds from layer 2 without delays.

10. Lower load for layer 1 validator nodes and better data compression can help reduce the costs of data publishing on Ethereum, minimizing rollup fees for users.
    Common zero-knowledge proofs come in the form of a zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) and zk-STARK (Zero-Knowledge Scalable Transparent Argument of Knowledge). The differences between the two are summarized as follows:

Disadvantages of Rollups

Optimistic Rollups

1. Potential fraud challenges can lead to delays in transaction finality.

2. Centralized rollup sequencers can influence transaction ordering.

3. When there are no honest nodes, malicious sequencers can steal funds by posting invalid blocks and state commitments.

4. The security model relies on at least one honest node executing rollup transactions and submitting fraud proofs to challenge invalid state transitions.

5. Users must wait until the challenge period is over to withdraw funds back to Mainnet.

6. Data stored and published on layer 1 is more than that on ZK-rollups, making them consume more resources and increase costs.
   ZK-Rollups

7. The cost of computing and verifying validity proofs is high, which can increase fees for rollup users.

8. Due to the complexity of zero-knowledge technology, it is difficult to build EVM-compatible ZK-rollups.

9. Generating validity proofs requires specialized equipment, which increases the barrier for operators and may result in a few participants controlling the blockchain network.

10. Centralized operators can influence the ordering of transactions.

Leading Rollup Projects

Optimism

Optimism is an Ethereum-based layer 2 scaling solution that utilizes optimistic rollups to increase transaction throughput, reduce fees, and maintain high compatibility with Ethereum. The goal of Optimism is to establish a Superchain, a unified network that merges all layer 2 chains based on the Optimism Stack. It enables cross-chain composability and interoperability.

The Optimism ecosystem has made significant progress, starting with an airdrop to the community in mid-2022 to reward early supporters and contributors. OP tokens were distributed to Optimism users, DAO voters, select multi-sig signers, and Gitcoin donors.

In early 2023, Coinbase launched Base, a layer 2 blockchain network developed using the open-source Optimism Stack. Base aims to provide developers with a fast, secure, and customizable layer 2 platform and plans to integrate it with Coinbase Wallet and Exchange to enhance user experience and security.

Optimism continues to improve its technology and governance architecture. For example, it introduces features such as the Cannon fault proof engine, designs the sequencer protocol, and establishes the Optimism Collective. The application of Chain Factory will facilitate building a Superchain ecosystem around the Ethereum network.

Currently, several well-known decentralized applications, such as Uniswap, Aave, and Synthetix, have been deployed on Optimism, representing flagship optimistic rollup projects.

Arbitrum

Arbitrum is also a layer 2 blockchain network using optimistic rollups. It uses a multi-round interactive design to resolve disputes and reduce on-chain workload. Arbitrum offers strong EVM compatibility, allowing developers to easily deploy their smart contracts on the Arbitrum network. However, compared to Optimism’s single-round fraud proof, Arbitrum has larger block sizes.

Arbitrum has gained popularity among innovative DeFi projects. The most notable ones include the derivatives trading platform GMX and Gains Network, as well as the lending protocol Radiant. Established projects like Sushiswap and Curve have also brought significant liquidity to the Arbitrum ecosystem. According to Dune Analytics, as of April 2023, the number of users on Arbitrum has exceeded 1 million, with a trading volume surpassing $10 billion and on-chain assets reaching $2 billion.

In addition to attracting more projects and users, Arbitrum continues to innovate and optimize its technology and governance. In February 2023, it conducted an airdrop of the ARB governance token, allowing the community to participate in the decision-making regarding the upgrades of the Arbitrum network.

Despite controversies and disputes arising from the AIP-1 proposal and the foundation’s decision to sell ARB tokens, the price of ARB tokens has continued to rise, indicating market optimism about its future potential.

Currently, the Arbitrum network stands as one of the most vibrant layer 2 blockchain projects utilizing the optimistic rollup, offering more possibilities and value to the Ethereum ecosystem.

zkSync

zkSync is a Layer 2 scaling solution based on zero-knowledge proofs, aimed at improving transaction speed and reducing costs on the Ethereum network while maintaining compatibility with the EVM. The development team, Matter Labs, launched the second phase of the zkSync network, called zkSync Era, in early 2023. This phase uses a Succinct, Transparent Argument of Knowledge (STARK) to further improve the efficiency of zero-knowledge proof.

The launch of zkSync’s mainnet has garnered significant attention from the development community. It has nearly achieved full implementation of zkEVM, allowing developers to build zero-knowledge applications using the Solidity language. This means that developers can easily port their Ethereum applications to zkSync and benefit from increased scalability and security.

zkSync also offers interoperability with other layer 2 and layer 1 networks through the Multichain and Orbiter Finance cross-chain services. Currently, several blockchain projects have already announced their support for the deployment of zkSync, including wallets, cross-chain bridges, payment gateways, block explorers, exchanges, DeFi protocols, NFT platforms, games, etc.

The zkSync ecosystem is still in its early stages, but we have seen some active components, including the decentralized exchange SyncSwap and the lending protocol Nexon Finance. Gitcoin donation campaigns can also be accessed through zkSync.

The launch of zkSync’s mainnet is considered a key milestone in Ethereum’s scalability journey, showcasing the immense potential of zero-knowledge technology in the blockchain space. As more projects and users migrate to zkSync, we can expect faster, cheaper, and more secure blockchain transactions and applications.

StarkNet

StarkNet is a layer 2 scaling project for Ethereum developed by the startup company Starkware. Its core technology is based on the STARK (Scalable Transparent Arguments of Knowledge), a zero-knowledge proof, to enable faster, more secure, and resource-efficient transaction verification on the blockchain while protecting user privacy.

StarkNet has already integrated with multiple popular blockchains. StarkGate, a cross-chain bridge, has been integrated to support interactions with various rollup solutions. This allows users to seamlessly transfer ETH across Ethereum, Arbitrum, Optimism, and Polygon onto StarkNet.

In late 2022, the team announced the successful implementation of ZK-EVM using the Cairo programming language. This achievement has attracted renowned projects, such as Sorare, immutableX, dYdX, and ApeX, to deploy their decentralized applications on StarkNet.

Currently, the StarkNet ecosystem is in its early stages of development. Notable projects within the ecosystem include the decentralized exchange JediSwap, the lending protocol CurveZero, and the NFT marketplace Aspect. As StarkNet’s application scenarios and the user base expand, the performance of its ZK-EVM compatibility will become increasingly apparent.

Conclusion

In this lesson, we delved deep into the technology and development trends of Ethereum rollups. Rollups package multiple transactions and separate the protocol layer from the computation layer, thereby alleviating congestion on Ethereum Mainnet and achieving higher transaction throughput and lower costs.

Rollup technology can be divided into two categories: optimistic rollup and ZK-rollup. Optimistic rollup assumes that all packaged transactions are correct, while ZK-rollup requires providing zero-knowledge proofs.

Each rollup technology has its own strengths. As the technology matures, significant progress has been made in cross-chain capabilities and integrating EVM. Projects such as Optimism, Arbitrum, zkSync, and StarkNet are actively developing and optimizing their technical infrastructure to meet the growing market demand for scalability, security, and decentralization.

In the next lesson, we will compare various EVM-compatible blockchain networks and explore how they compete in the potential market for Ethereum scalability.

Highlights

• ZK-rollups and optimistic rollups are technical solutions aimed at improving the efficiency and security of blockchain transactions. By packaging multiple transactions into a “rollup” and submitting them to Mainnet, they can save Mainnet’s resources, increase its transaction speed and throughput, and reduce transaction fees for users.
• Optimistic rollups execute transactions off-chain and use fraud proofs to detect incorrectly executed transactions, allowing anyone to verify the results of rollup transactions.
• If incorrectly executed transactions are found during the challenge period, the rollup protocol will re-execute the transaction, and the responsible sequencer will receive a penalty.
• In ZK-rollups, operators submit a summary of aggregated transaction data to Mainnet and generate validity proofs using zero-knowledge proof to demonstrate the correctness of their rollup data.
• Nodes on Mainnet only need to verify the correctness of the zero-knowledge proofs, without examining the details of each individual transaction. Therefore, there is no challenge period.
• Both optimistic rollups and ZK-rollups use compression techniques to reduce transaction data. For example, they use Merkle trees to maintain the security and integrity of off-chain transactions or use indexes instead of wallet addresses.
• Optimistic rollups and ZK-rollups have their own advantages and disadvantages. Building EVM-compatible ZK-rollups is more challenging, and the security of optimistic rollups relies on honest nodes.
• With the continuous development of rollup technology, we can expect to see more widespread applications in various fields such as DeFi, NFTs, and gaming.