Rollup.pdf

Transcript

1. Rollup 11/15 輪読 B3 mikan mikan@sfc.wide.ac.jp
2. 🖌 Memo https://arxiv.org/pdf/2107.10881.pdf This paper is fine for a quick overview. If you want to know more details, please see my slide and the reference article. 2
3. Scaling BackGround/ History 3
4. 🚀 Scaling The limitation of tx number per sec. In Ethereum, Block Time 15s, Block Gas Limit: 30m Gas(target: 15m), Gas/sec: 1m - ETH Transfer: 47tx/s - Token Transfer: 12 ~ 20 tx/s - Exchange on dexes: 4 ~ 8 tx/s Block space is limited to keep the characteristics of a blockchain that allows normal PCs to participate. (≒ Decentralization) That cause Usage fees are skyrocketing. 4
5. 🚀 Scaling https://etherscan.io/gastracker 5 5
6. ⚡ OK, How we should solve In Bitcoin, they are trying to achieve Scaling through a technology called Lightning Network How it works? (in a nutshell) Alis Bob Open a 0.2BTC Channel (2of2 Multisig) Create a tx for both to broadcast when closing. 0.1BTC 0.1BTC 1.Open Channel 6 6
7. ⚡ OK, How we should solve In Bitcoin, they are trying to achieve Scaling through a technology called Lightning Network How it works? (in a nutshell) Alis Bob Channel (2of2 Multisig) Create a tx that send 0.09BTC to Alis and 0.11 BTC to Bob when closing the channel 0.1BTC -0.01BTC 2. When Alis send 0.01 BTC to bob 0.1BTC +0.01BTC … That Not write on The Bitcoin Network! 7 7
8. ⚡ OK, How we should solve In Bitcoin, they are trying to achieve Scaling through a technology called Lightning Network How it works? (in a nutshell) Alis Bob Bitcoin Network Execute the HTLC Manner. Send the tx that Alis have 0.1BTC Tx(Older tx) 3. When Alis is evil and send Old Tx Bob send newer Tx that Alis has a fraud 8 8
9. ⚡ OK, How we should solve In Bitcoin, they are trying to achieve Scaling through a technology called Lightning Network How it works? (in a nutshell) Network of the Channels= Lightning 9 9
10. ⚡OK, How we should solve Why Ethereum scaling can't just be done with Lightning Network/Channel? - Ethereum mainly execute Smart Contract (Not ETH/Token transfers) - has a Contract account - has a Public Storage - increase the someone’s balance without permission Public Contract Account 10 10
11. Rollup 11 11
12. 🔮 Rollup Basic Concept - Layer 1 (=Ethereum) basically does not “execute” transaction →L1 does not check the result(state) is true. - All of Rollup tx data or proof of transactions is on Layer 1 - Tx on Rollup can be force in Layer 1 How do you refuse to be a fraud State? 1. Optimistic Rollup: Validators watch for several days and provide fraud proof if someone found a fraud. 2. zk Rollup: Refuse to update to fake Merkle Root with zero knowledge proof. (Won't let you know that I did a lot of computation, but I will prove that I did computation turely with zero-knowledge proofs.) 12 12
13. 🔮 Rollup Basic Concept Property Optimistic rollups ZK rollups Fixed gas cost per batch ~40,000 (a lightweight transaction that mainly just changes the value of the state root) ~500,000 (verification of a ZK-SNARK is quite computationally intensive) Withdrawal period ~1 week (withdrawals need to be delayed to give time for someone to publish a fraud proof and cancel the withdrawal if it is fraudulent) Very fast (just wait for the next batch) Complexity of technology Low High (ZK-SNARKs are very new and mathematically complex technology) Ref: https://vitalik.ca/general/2021/01/05/rollup.html 13 13
14. Generalizability Easier (general-purpose EVM rollups are already close to mainnet) Harder (ZK-SNARK proving general-purpose EVM execution is much harder than proving simple computations, though there are efforts (eg. Cairo) working to improve on this) Per-transaction on-chain gas costs Higher Lower (if data in a transaction is only used to verify, and not to cause state changes, then this data can be left out, whereas in an optimistic rollup it would need to be published in case it needs to be checked in a fraud proof) Off-chain computation costs Lower (though there is more need for many full nodes to redo the computation) Higher (ZK-SNARK proving especially for general-purpose computation can be expensive, potentially many thousands of times more expensive than running the computation directly) Ref: https://vitalik.ca/general/2021/01/05/rollup.html 14 14
15. ⛓ How it works (Optimistic Rollup) ※ it actually depend on how dev implements. I introduce basics. 💤 💤 ORU Sequencer Rollup! Rollup! Rollup! 💼 OR Contract 💤 Ethereum Validator/Verifier checking that Sequencer submit correctly 15 15
16. ⛓ How it works (Optimistic Rollup) ※ it actually depend on how dev implements. I introduce basics. 💤 💤 ORU Sequencer Rollup! Rollup! Rollup! 💼 OR Contract 💤 Ethereum Validator/Verifier found the sequencer fault 🚨Wrong! actual state is S2’ S1 S2 S3 16 16
17. ⛓ How it works (Optimistic Rollup) ※ it actually depend on how dev implements. I introduce basics. 💤 💤 ORU Sequencer Rollup! Rollup! Rollup! 💼 OR Contract 🔍 Ethereum Validator/Verifier found the sequencer fault 🚨Wrong! actual state is S2’ S1 S2 S3 17 17
18. ⛓ How it works (Optimistic Rollup) ※ it actually depend on how dev implements. I introduce basics. 💤 💤 ORU Sequencer Rollup! Rollup! Rollup! OR Contract 🟢 Ethereum Validator/Verifier found the sequencer fault I totally agree. It’s rewards.💰 S1 S2’ S3’ 💸 18 18
19. ⛓ How it works (Optimistic Rollup) - Batch (=rollup commit tx) include (not include markle tree) - State Root - (Compressed) ORU tx data 19 19
20. ⛓ How it works (Optimistic Rollup) - Nonce prevent replay. Rollup can restore nonce from previous batch (state) - from/to: replace from address to index number - sig: Compress all txs sig in Batch to 1 1 sig using BLS aggregate sig. Parameter Ethereum Rollup Nonce ~3 0 Gasprice ~8 0-0.5 Gas 3 0-0.5 To 21 4 Value ~9 ~3 Signature ~68 (2 + 33 + 33) ~0.5 From 0 (recovered from sig) 4 Total ~112 ~12 20 20
21. 🛠 Implementation https://l2beat.com/?view=risk 21 21
22. 🔦 But… Is that actually work correctly? ※ it actually depend on how dev implements. I introduce basics. 💤 💤 OR Sequencer Rollup! Rollup! Rollup! OR Contract 🟢 Ethereum Validator/Verifier found the sequencer fault I totally agree. It’s rewards.💰 S1 S2’ S3’ 💸 ? 22 22
23. 🔦 But… Is that actually work correctly? - L1 Execution and Rollup Execution is sometimes not match - Return the same result if it is a simple addition like (1+1). But, block.timestamp + 1 isn’t match… (‘cause L1 block.timestamp and L2 block.timestamp isn’t the same) Solution - Build Execution Manager that bridge to L1 from L2 state that work on Solidity. https://medium.com/ethereum-optimism/ovm-deep-dive-a300d1085f52 https://medium.com/ethereum-optimism/introducing-evm-equivalence-5c2021deb306 23 23
24. 📚 References - https://medium.com/ethereum-optimism/ovm-deep-dive-a300d1085f52 - https://medium.com/ethereum-optimism/introducing-evm-equivalence-5c2021deb 306 - https://vitalik.ca/general/2021/01/05/rollup.html - https://research.paradigm.xyz/optimism - https://arxiv.org/pdf/2107.10881.pdf - https://plasma.io/plasma-deprecated.pdf - https://ethereum.org/en/developers/docs/scaling/layer-2-rollups/ - https://community.optimism.io/ - https://developer.offchainlabs.com/docs/inside_arbitrum - https://leonahioki.medium.com/bitcoin%E3%81%A8ethereum%E3%81%AElayer2 %E3%81%AE%E9%81%95%E3%81%84%E3%81%AB%E3%81%A4%E3%81%84% E3%81%A6-ln-rollup-rgb-61cb70798344 24 24