Delphi Digital: The Complete Guide to Rollup

Vitalik contributed his masterpiece The Incomplete Guide to Rollup , and I’ll show you The Complete Guide to Rollup.

Delphi Digital: The Complete Guide to Rollup

Well, actually it wasn’t complete either, but it sounded pretty cool, so I decided to go with that name. This report only analyzes the design space of Rollups on Ethereum and Celestia. I highly recommend my recent Ethereum report for background reading.

In this report, I’ve covered the two projects I’m most familiar with, but there are actually many other teams building. Polygon (Avail), Tezos and Milkomeda etc. are also in the Rollup stack game. In fact, Tezos is likely to be the first to introduce an “enshrined” Rollup, and Polygon Avail is surprisingly similar in architecture to Celestia.

First, what is a “modular” blockchain? At this point it’s mostly a meme at the moment, with a lot of disagreement, but for simplicity I’ll define how I use the term. Of course, as to whether it’s right or wrong, you can discuss it in my Twitter comments.

Delphi Digital: The Complete Guide to Rollup

The modular stack strips the following tasks into independent technology components:

  • Data Availability (DA) – ensuring that the transaction data behind the Rollup block header is published and available so that anyone can recreate the state.
  • Consensus – at least agreement on transactions and their ordering.
  • Settlement – Varies depending on implementation, but tasks can include verification/arbitration of proofs and coordination of cross-chain asset transfers/arbitrary messaging.
  • Execute — Calculation takes the pre-state → runs the transaction → transitions to the post-state.

Ethereum can handle every one of them. It provides a unified DA, consensus and settlement layer with universal execution. When you transact on L1, Ethereum acts like any monolithic chain. Additionally, Rollups can handle execution, with Ethereum providing DA, consensus and settlement.

Celestia only provides DA and consensus. There is no Uniswap on L1 Celestia, nor L1’s verification/quorum proof. Celestia has no enforced settlement layer or smart contract execution. The functionality of L1 is limited to Celestia token transfers and validator set management.

Delphi Digital: The Complete Guide to Rollup

Note that there is also the possibility of using separate layers for DA and settlement like Validiums and Celestiums . Any settlement layer can be used as long as it accepts data proofs provided by Celestia.

Delphi Digital: The Complete Guide to Rollup

However, these are not Rollups, but they bring meaningful additional security assumptions. This report will focus on the actual “Rollup” stack. I’ll break down the economics first and then dive into each stack.

Delphi Digital: The Complete Guide to Rollup

Some abbreviations used in the text are as follows:

  • SCR– Smart Contract Rollup
  • ER – Enshrined Rollup
  • SR – Sovereign Rollup

Part 1: Modular Economics

Previously, I have written about the importance of L1 value capture (fees and other forms of MEV). Assets that depend on economic safety require a high-value collateral. Income fuels attractive monetary policy (real yields, low and predictable inflation, etc.). Value capture → good monetary policy → currency premium → high economic security. Fees and other MEVs initiate step 1.

Rollup fee

Let’s analyze a Rollup transaction from first principles. This simplified diagram depicts the parts that apply to Ethereum optimistic Rollups (ORU) and zk-Rollups (ZKR).

Delphi Digital: The Complete Guide to Rollup

  • The sequencer receives and orders transactions. Users will soon be able to get soft confirmations that their transactions are finally recorded on L1 (if they trust the sequencer’s feedback). The sequencer is only used for ordering and transaction completion. They cannot submit invalid transactions.
  • A deterministic state transition function processes each transaction and updates the L2 state, creating an L2 block. These blocks can be generated faster than L1 blocks.
  • Every so often a batch of transactions is compressed and sent to L1. Currently stored as calldata, but eventually Rollups will use data blobs.

Users are charged L2 gas when applying state transitions and executing their transactions. L1 gas is paid later when batch transactions are processed. L1 and L2 gas prices vary according to their respective congestion conditions. Therefore, users incur fees in both types of gas, and there is a time mismatch. The sequencer commits to the transaction and collects the L2 fee before it knows the full content of the batch transaction, how compressed it is, or what the base fee for L1 is when it is published.

L2 does its best to guess what its L1 fee will be and charges users accordingly. When the market is calm, L2, on average, charges only a small profit on top of L1 costs. But when Rollups become constrained by their own execution environment (rather than L1 cost), this magnitude rises. The surge in pricing in the toll market acts on demand. Higher profit margins correspond to a surge in local demand.

We’ve seen this clearly in Arbitrum’s recent surge, although its margins have been otherwise stable. Arbitrum’s recent bottleneck is L2 execution (rather than L1 cost), so its local fee market kicks in:

Delphi Digital: The Complete Guide to Rollup

We see a similar trend for Optimism, albeit more variable:

Delphi Digital: The Complete Guide to Rollup

The L1 cost of Rollups today is mainly calldata. Even for ZKRs, Polygon’s fee for posting transaction data to Ethereum is estimated to be ~90% of the total cost (this is mostly calldata), in addition to ~10% for proofs. With EIP-4844 likely to appear in next year’s Shanghai hard fork, these costs will drop significantly. It increases DA throughput and enables separate EIP-1559 fee markets for Ethereum’s DA layer and settlement layer. An oversupply of DA means fees are hitting the bottom line. After that, danksharding will make DA richer. A Rollup with any reasonable activity will greatly increase these profit margins.

Finally — the data above does not include any MEV (outside of regular transaction fees). In reality, Rollup tokens are able to accrue a lot of value from MEVs (more on this soon).

fixed cost vs variable cost

The ORU publishes the compressed full L2 transaction data (with signature), L2 state root and fraud proofs (only in case of disputes) back to L1. While the full transaction data is stored in Ethereum’s history, the hash of the transaction data is added to its state. If a fraud proof is sent, then it can check the proof of inclusion against the previously stored hash as part of the fraud proof.

ZKRs do not need to publish all transaction data to L1. Just posting the state difference is enough (they chose to do this because it’s cheaper). Imagine Alice and Bob transacting 1 ETH back and forth in this batch of transactions – ZKRs only need to post a state change at the end (who owns the 1 ETH and who doesn’t), while ORU needs to post every transaction. The state difference is enough to reconstruct the state. The ORU must include all transactions for fraud proof purposes. ZKR validators must also include a validity proof, along with each batch, proving that the associated state root is valid.

SCRs have fixed costs regardless of the transaction activity they have to pay to Ethereum:

  • state commitment
  • Proof of validity (only for ZKRs)

In addition, they have variable costs that increase as transaction activity increases.

  • Transaction data (plus ORU’s signature)

On top of these fees paid to L1, Rollup charges a surge pricing for the necessary L2 gas fees and costs to cover Rollup operators. A more detailed analysis can be viewed here .

Note the time/cost tradeoff here. Frequent settlement means that L1 gives the true final result earlier. However, waiting longer to settle, amortizing these fixed costs over more transactions = cheaper transactions for Rollup users. Rollup settlement needs to balance sufficient security with low fees that give users a low guarantee (pre-confirmation).

Let’s take Optimism as an example. As background, on Optimism, sequencers and proposers need to publish information for two smart contracts:

  • Canonical Transaction Chain (CTC) contract — an appendix-only log of transaction batches submitted by the sequencer
  • State Commitment Chain (SCC) contract‌ — Proposer confirmation is the log of the proposed state root for each transaction result in the CTC

The cost breakdown of Optimism is shown in the following figure:

Delphi Digital: The Complete Guide to Rollup

There are two costs associated with publishing transaction batches on the Canonical Transaction Chain (CTC):

  • Variable cost – Calldata gas used by L1 CTC (transaction batch) submitters, roughly linear in the size of the transaction batch
  • Indirect costs – there is also a small non-calldata cost of publishing information to the CTC

The gas used to publish the state root to the State Commitment Chain (SCC) is a purely indirect cost (note that part of this cost also uses L1 calldata). Splitting it up according to the above two costs, you get something like this:

Delphi Digital: The Complete Guide to Rollup

These overhead costs may be higher than you might expect — there are still many inefficiencies that need to be addressed in the coming months. An optimization like Bedrock’s would greatly improve data compression, and it would bring the fixed cost down to almost negligible. The gas cost per batch of transactions can be reduced from ~280,000 per batch excluding calldata to ~21,000 gas per batch. SCC will be replaced by L2 OutputOracle and CTC will be removed. L2 blocks will be saved to Ethereum using non-contract addresses, greatly reducing the on-chain footprint and minimizing gas costs.

Likewise, the gas cost of Arbitrum per batch is about 375,000, which will be greatly reduced by Nitro.

Putting this all together, Rollup’s value stream can be described. The image below is from a great article by Barnabé Monnot :

Delphi Digital: The Complete Guide to Rollup

He also recently touched on this topic .

Base Layer Fees – Ethereum

Ethereum fees come from:

  • L1 Execution and Settlement – eg go to Uniswap at L1 and exchange some USDC for ETH.
  • Settlement from Rollups – Rollups publish proofs to L1. Ethereum is also responsible for handling trust-minimized bridging between Rollups and L1.
  • DA from Rollups – Rollups use calldata to publish data to L1.

The cost of a separate monomer chain is capped at:

Fees = Throughput x USD users will pay for a single transaction

In contrast, modular DA and settlement layers (like Ethereum) have a higher fee cap:

Fees = Throughput x USD users will pay for aggregated transactions

Rollup can pay Ethereum a larger single fee to settle many transactions than a single user would pay for an L1 transaction that occupies the same block space (e.g., one proof guarantees many blocks, settles many aggregated DeFi pool transactions, etc.). Assuming there is enough demand, introducing new fee payers (Rollups) to Ethereum with higher marginal utility per transaction will add value in the long run.

Note, however, that Ethereum revenue today looks like this:

Delphi Digital: The Complete Guide to Rollup

Ethereum is still a long way from being the primary settlement or DA layer for Rollup. The vast majority of fees paid to L1 come from native L1 execution:

Delphi Digital: The Complete Guide to Rollup

So while a modular base layer can extract meaningful revenue from the needs of Rollup, we need to have a lot of demand before doing so. Crucially, Ethereum’s Rollup fee is complementary to its native L1 execution, not solely dependent on it.

Where this value capture comes from is a point of contention. Many in the Ethereum and Celestia communities believe that DA will eventually have amazing value. Dankrad recently gave his opinion on his podcast with John Adler, which I host.

“Assets… need security from some… means of generating yield. So I think there are only two at the moment, and that is the settlement layer and the data availability layer. I think in the short term, we may see that the settlement layer remains generate more value.

We’ve seen in the past that we’ve had a ton of fees on Ethereum and some on other settlement layers. But in the long run, I believe the most valuable asset will simply be in the availability of data, and block space will become the most valuable asset in a decentralized economy. “

What Rollup should be willing to pay for premium DA is an interesting debate. However, the reality is that DA will soon be massively oversupplied between Ethereum scaling and alternative DA solutions. The scale of data availability can be seen in the following figure:

Delphi Digital: The Complete Guide to Rollup

The current average data for an Ethereum block is ~90 KB, of which calldata is ~10 KB. With a DA supply shock looming, Rollup will continue to greatly improve data compression. When data blobs have their own fee market, supply < demand, DA fees hit the bottom line.

Rollup users will pay higher fees, but the main bottleneck is likely to be Rollup’s own native execution environment (based on current EIP-4844 orders of magnitude activity and DA bandwidth). When you swap tokens on your favorite Rollup, DA will no longer be your main cost. Super cheap fees will drive incremental activity, more rollups, etc. Only when the DA is saturated to the target, the EIP-1559 mechanism will kick in, pulling the fee out of the lower bound. However, Rollup has a number of upcoming optimizations that will strengthen their currently limited native execution. If that goes away, it could end up making DA a bigger cost again.

For Ethereum to start charging any meaningful DA, you need more than 1.3 MB/s (assuming current danksharding specs) of actual valuable data, demanding maximum security. Even if you hit 1.3 MB/s, the overflowed data can go directly elsewhere. Alternatives like Celestia, DataLayr, DACs, Adamantiums, Polygon Avail, etc. will provide a lot of cheap DA. Only the safest transactions require full Ethereum security. Also, the throughput of the DA can be safely increased (with more validators), so 1.3 MB/s is not a fundamental limit.

I am confident that DA fee income will be negligible compared to Ethereum’s strong settlement layer, at least for a few years.

Delphi Digital: The Complete Guide to Rollup

Finally, the execution of native smart contracts can also provide ETH stakers with more value than Celestia – ETH can be used as a productive asset to earn additional income. In particular, EigenLayer‌ is an innovative solution that will allow “restaking” of ETH. ETH stakers will be able to subject their shares to additional slashing conditions. They will ensure that new applications seeking to take advantage of ETH’s economic security will have their fee income credited to ETH (much like Cosmos’ concept of interchain security, which credits value to ATOM).

Base Layer Fees – Celestia

Celestia’s only fee is DA. Rollups handle settlement. In the same podcast, John made an interesting point about dYdX’s decision to move from StarkEx to Cosmos. The base layer should accumulate as much value as possible for economic security, but economically rational applications want to accumulate as much value as possible for themselves. Other things being equal, they would rather not pay rent to the settlement layer. DA is the lowest cost of shared security. This accumulates less value for Celestia, but it can incentivize more Rollups to stay because it’s cheaper.

For this statement, I do not agree, the reason is that I emphasized earlier. The cost paid to the settlement layer is actually relatively low. For ZKRs, the cost is close to 0, because the fixed cost is amortized over many transactions, except the ones that are settled, for which the user can pay (so Rollup does not pay this fee). For ORU, there is no real settlement cost. So I think this part of the cost in the equation is negligible — teams will choose between SR or using a settlement layer depending on their particular needs. Both have interesting technical and social arguments that I’ll dig into later.

If Celestia’s business model of slicing less of the larger pie is successful, it may also be important to note that the percentage of value captured. If the base layer only captures insignificant value relative to the value it secures, the safety lever becomes uncomfortable. Maybe you’re comfortable with a $1 billion bet securing $20 billion in value ( Ethereum’s security ratio is currently ~20x ), but are you comfortable with $100 billion? What about $200 billion? There is no right answer. An economically self-sufficient base layer, even without Rollup revenue, would not have this concern.

It remains to be seen whether relying on DA alone will provide enough value capture to establish economic security. DA is valuable, but it is a resource that we know how to scale well. To change this, a paradigm shift is required. But looking at 5+ years, I don’t think anyone can reasonably predict.

So that’s exactly what I’m going to do now. Roughly calculated, DA’s data might look like this this year:

Delphi Digital: The Complete Guide to Rollup

Not bad, $30 billion!

Delphi Digital: The Complete Guide to Rollup

From where we are today, 13 bytes per transaction would be a meaningful optimization, but it’s only possible. For example, Polygon Hermez predicts that they will eventually only need 14 bytes per transaction. At the current danksharding spec of 1.3 MB/s, you get a nifty 100k TPS‌ . Note, however, that most current Rollups are nowhere near 13 bytes per transaction, you can only get to that low number by posting state differences like ZKRs. If you publish full transaction data like ORU, the value will be much higher, and even some ZKRs will choose to publish full transaction data. It is very optimistic that each Rollup will operate near the lower bound of DA efficiency.

Note that the $0.01/tx I am assuming here is for DA only. This does not include consideration of other L2 transaction fees. Valuable real estate (e.g., Rollup at the center of DeFi) can certainly charge a premium, but cheaper states tend to charge lower execution fees. That might even be enough buffer to clear Vitalik’s $0.05 test .

It will be important to consider how these margins stack up on L2 fees in the long run (ie, what percentage is paid for DA). If flipping many chains becomes easy, and bridging becomes so good that application-specific rollups eventually make sense, execution may become relatively cheap. This leaves some room for the DA to earn some fees. Important bridging developments will also have a big impact on whether SR makes more sense than a shared settlement layer, and the overall stickiness of DA.

For reference, Ethereum earned around $10 billion in fees in 2021, with a monthly annualized run rate of over $20 billion at its peak (note that this excludes other forms of MEV). Something like $30 billion/year could mean a market cap of hundreds of billions? But is that enough? I have no idea. Personally, I’d prefer much higher security at the nation-state level, so it’s a philosophical debate. At this scale, you need to secure trillions of dollars of economic activity, so I want more.

Note the difference between Ethereum and Celestia here. “Meaningful” means something different to everyone. Maybe 10% of total Ethereum revenue makes sense, maybe 20%. It has the settlement layer to pay the bills anyway. And for Celestia, it’s simple — it has to be enough to fund its entire security budget to protect everything it’s built on.

The reality is that we shouldn’t be skeptical of these numbers. They’re completely concocted in a super-optimized Rollup world that gives you an order of magnitude feel over long timeframes.

Celestia faces a hurdle in bootstrapping economic security with little value capture. We’re used to seeing startup valuations as a bet on future growth, but it’s an accepted risk proposition when the entire business model (DA) depends on a paradigm shift to accumulate enough value to be economically secure.

MEVs in a modular stack

MEV is a deep rabbit hole, so I’ll keep it short here.

Let’s start with the basics. MEV is still not fully formally defined, but I’ll simplify it here to all the potential value that a block producer can extract (including regular transaction fees, arbitrage, liquidation, etc.).

The simplified L1 Ethereum MEV will be similar to the in-protocol PBS (or mid-term MEV-boost ):

Delphi Digital: The Complete Guide to Rollup

Searchers bundle deals together and bid builders to be included in the deal. Builders aggregate bids from searchers and bid for the entire block included by validators. In an efficient market, searchers bid most of their income to builders, who in turn bid most of their income to validators. Therefore, ETH captures most of the MEV.

As for Rollup, it looks a little different, but similar concepts apply. Here is a simplified example of Optimism running a MEV auction (MEVA) for sequencing rights:

Delphi Digital: The Complete Guide to Rollup

Likewise, searchers bundle deals and bid on sequencers for inclusion. The sequencer aggregates bids from searchers and bids to include the entire block in the MEVA. In an efficient market, searchers bid most of their revenue to sequencers, who in turn bid most of their revenue to MEVA. If Rollup uses staking to elect leaders, you can also plug in validators in place of MEVA. In either case, Rollup will capture most of the MEVs. This can accrue to tokens, or to fund public goods etc. (like Optimism does).

Other things being equal, transferring transactions from L1 to Rollup does not change the number of MEVs. It just changes how it gets and who gets it. In this simplified model, the acquisition of MEVs has now been pushed from L1 assets to L2 assets.

But honestly, is it that simple?

Delphi Digital: The Complete Guide to Rollup

Sorry, I don’t know, and neither do anyone else. So if you’re a curious guy, this is a great area to study. How much MEV will leak to the shared DA and/or settlement layer? Will Rollup operators start paying L1 for MEVs they perform on L2? If something like cross-domain Flashbots emerges, we can collect more specific data. But for now, let’s first look at some assumptions.

At its simplest, it will accumulate to the bottom of the stack forever. For example, look at a stack with Celestia DA + Settlement Rollup + Recursive Rollup. A recursive rollup may rely on a cross-chain MEV that settles the rollup, but the DA layer may be able to censor and delay the settlement of the rollup’s blocks, requiring a portion of that MEV to be taken. This negotiation depends on social norms and can be insurmountable lines (similar to a time bandit attack in PoW). The power is there, but will this negotiation happen? Maybe L1 wants to eat this L1 lunch, maybe not.

Then there are the more complex cross-chain MEVs. In the following example:

  • R = Rollup
  • B = block
  • S = swap

R1 and R2 have coordinated sequencers and share the same DA layer, allowing atomic cross-chain MEVs. Each Rollup can submit blocks, and its acceptance depends on another Rollup. For example, R1 B1 (including S1) is only accepted if R2 B2 (including S2) completes, and vice versa, the same is true for R2’s condition. Likewise, a Rollup can submit two blocks to its DA layer, one for the base case and one for inclusion only if certain conditions of the other Rollup are met. The atomicity introduced here can be quite powerful, and it will be interesting to see how it affects the dynamics of MEV value accumulation.

Importantly, this is a bummer for value accumulation. If more MEVs leak out than we currently know, this could be of great value to Celestia. This will help subsidize the security budget.

Economic security at the DA layer

Now let’s see why we even care about the economic security of the DA layer.

33% attack

It’s simple — just pause the chain. If Tendermint does not have the necessary votes, it cannot make progress (invalidate) and cannot finalize (⅔). Rollups that depend on Celestia won’t like this.

Ethereum runs Gasper to reach consensus. Therefore, even if >⅓ of the shares are in question, Ethereum will continue to function, maintaining validity. However, this ledger cannot be finalized without the necessary votes. If >⅓ in question simply don’t vote, they will be subject to additional penalties due to the inactivity leak‌ mechanism (negative penalty mechanism) until the protocol can finally be finalized again.

67% attack

First – the validity condition is part of the consensus. So even if you control 100% of the shares, you can’t start printing a bunch of Celestia tokens/Ether out of thin air, stealing funds, etc. Honest nodes will refuse to do this because it is invalid. But you can try these:

Double Signing — Re-orgs are possible in Gasper, but not in Tendermint. You can still double sign, though, and cause confusion. The chain will stop and revert to social consensus. It can be shown that at least ⅓ of the pledge is double signed on the same block height and will be slashed in the protocol. So you can do this, but it’s expensive (if the value of the staking is high).

Data Withholding Attacks – Finalize a block, but never provide the data behind it. Withholding data is a non-attributable negligence and therefore cannot be forfeited in the agreement. Social coordination is required to punish attackers outside the protocol through hard forks. This is probably the worst possible attack on Rollup. You will not be able to submit fraud proofs for an invalid ORU, nor will you be able to recreate the state for a ZKR. Thankfully, we have Data Availability Sampling (DAS) nodes. They just check if the data is available, so even if the consensus signs the block, they know to reject it.

Fraud-proof censorship — A censored DA layer can maliciously bridge funds across different Rollups (even Rollups within the same DA security enclave). This cannot be protected by running a DAS node. This question is a bit subtle, so I’ll give an example.

SR1 (Sovereign Rollup) is an ORU on Celestia that wants to bridge funding for SR2. One option is to directly embed each other’s light clients into each Rollup and distribute proofs in a P2P fashion. There are no censorship attack vectors that pass malicious consensus here (other attack vectors exist, such as eclipse attacks). Additionally, SR1 can publish fraud proofs directly to SR2’s namespace Merkle tree when it wants to bridge. This effectively replaces the synchronization assumption (in the case of P2P bridging) with Celestia’s honest majority assumption (in the case of publishing to Celestia). SR2 just looks for a proof on its own NMT that it is already tracking, and executes it when it sees it. However, now this allows SR1 to maliciously bridge funds to SR2, and Celestia can review your proofs at the DA layer. Ethereum can also review fraud proofs sent to smart contracts, which is why their ORUs require such a long timeout period.

Data withholding and censorship attacks do not directly affect the DA layer itself, but they are attack vectors for Rollups that rely on the DA layer.

The TLDR–DA layer needs to be economically secure. With varying degrees of share being taken over, you can behave badly. A key point that gets confused by a lot of people is — just because something is safe to rely on, doesn’t mean it’s valuable. You must first build a valuable asset before you can rely on it for meaningful economic security. An asset that secures the system needs some way to accumulate value and/or a monetary premium.

If you want to witness the great modular wars of our time, read this thread. Open it up on Treeverse and spend the whole day sifting through it. The vast majority of this report (and to be honest, most of my cryptocurrency knowledge) comes from the process of taking notes while watching Twitter mess.

Summarize

Revenue generation is a key component of building economic security, so understanding the value flow in a modular stack is critical to design. Base layer native assets need to be designed to capture value (fees and other MEVs) and/or be good money.

As it stands, the value captured by DA is negligible. This will remain the case for the foreseeable future. The rollup execution layer currently captures relatively little value. As certain tiers become popular and may contain high-value financial transactions, they may see meaningful revenue. A good general purpose settlement layer with high value transactions will likely dominate for the foreseeable future (maybe even an L2 settlement layer, like StarkNet plans to add many L3s on top of the L2 layer).

This is Russ from “Silicon Valley” who put radio on the Internet. Don’t be like Russ.

Part 2 – Ethereum Rollup Stack

Recently, Mustafa (Celestia Labs) gave the most concise definition of Rollups in an article , I will quote it here: Rollup is a blockchain that publishes its blocks to another blockchain and inherits the blockchain Consensus and DA.

There are various roles in Rollup, such as sequencer, proposer, prover, and challenger, depending on the actual deployment. I call them collectively “operators”. Operators regularly release data to the base layer in combination with user transactions. They also commit to the latest Rollup state (eg, Merkle root).

Anyone can use the compressed transaction data (as long as it is available) to recreate the state and check if a state transition is valid. Rollup light clients do not download and execute full transaction data, so they rely on fraud/validity proofs to guarantee the validity of state transitions.

Ethereum – Smart Contract Rollup

This can be seen in current Ethereum (e.g. Arbitrum, Optimism, StarkNet, zkSync, etc.). Here’s how they work:

Delphi Digital: The Complete Guide to Rollup

Smart Contract Rollups (SCR) effectively operate in numerous L1 smart contracts. Rollup execution is processed off-chain, and operators regularly publish data to L1. Smart contracts verify proofs/arbitrate disputes as needed. They also keep track of all the Rollup state roots and transaction data so they can recompute the state:

Delphi Digital: The Complete Guide to Rollup

Delphi Digital: The Complete Guide to Rollup

A proof of fraud (ORU) or validity (ZKR) then confirms the validity of the state transition. The operator posts the deposit in the L1 smart contract to publish the block. If the block or proof is invalid, their deposit can be slashed and the transaction will not be finalized. This may take more than a week for ORU, but the proof of effectiveness can seal the final result in no time.

Submitting and arbitrating a fraud proof is actually quite fast. The ORU takes so long mainly because the L1 smart contract needs to receive proofs, which may be censored. In the case of L1 proof of censorship, we need time to reconcile through social consensus.

These smart contracts also act as trust-minimized two-way bridges between Rollup and L1. This is one of their key advantages. It is trust-minimized because Rollup implicitly does full verification of Ethereum, and smart contracts on L1 take on the role of Rollup light clients (receiving block headers protected by fraud/validity proofs).

Now is the time for FUD.

Delphi Digital: The Complete Guide to Rollup

These are always smart contracts. Just recently, we’ve just witnessed horrific cross-chain bridge attacks‌ ( mostly all bugs, nothing to do with compromised keys or economic attacks). Rollups are also not immune. This contract is a very specific trust-minimized two-way bridge, but it’s still a bridge. Even small mistakes in your code can cost you a lot.

That’s why many Rollup teams are holding onto their upgrade keys tightly. Often there is a multi-signature committee, there is an escalation notice period, and in other cases the code can even be changed arbitrarily by the team without notice.

Between security and trustlessness, the timing of the upgrade needs to be balanced. If you find a bug, you probably don’t want to hype it up on the admin forums and wait a month, but want to fix it right away.

Delphi Digital: The Complete Guide to Rollup

One idea is to have a delayed upgrade feature, but add a stop option that stops the Rollup immediately. While suspending a rollup is a bummer, it does reduce trust in upgrade key holders.

Delphi Digital: The Complete Guide to Rollup

Bartek (Maker Foundation) recently gave a great Rollup FUD talk on this topic and L2 Beat’s risk framework, linked here‌ .

Delphi Digital: The Complete Guide to Rollup

I understand that Rollup will take time to mature. What I would say is that we need to be realistic about where we are at the moment. Like centralized orderers and fraud proofs (if any), these teams intend to gradually decentralize.

There are two options for handing over an upgrade key:

1. Immutable Rollup – No one can upgrade smart contracts (unless L1 forks). This is a huge sacrifice. Basically you’ve accepted that this Rollup will eventually be scrapped and you’ll be deploying another instance from scratch. Rollup that wants to be equivalent to EVM (Ethereum Virtual Machine) absolutely cannot. When L1 changes, they must upgrade their virtual machines to be consistent. Fuel v1 is currently the only ever-changing Rollup on Ethereum.

2. Decentralized governance – this is what I actually expect. While it adds trust assumptions on top of L1 transactions, Rollup governance now controls the upgrade keys. Smart Contract Rollups (SCR) can be built on a delayed basis (set to be longer than the withdrawal period for Rollups) before the upgrade takes effect. Don’t like this upgrade? Then you can safely exit. This is trust minimization because you are now only doing Rollup governance based on the synchronization assumption (instead of the honest majority assumption). You just assume you see the planned upgrade and quit before then.

Here, some of the major Rollup teams have great conversations about their thoughts on decentralization.

Back to the last point – the exit of Rollup. A safe exit L1 execution layer is a good fallback. Ethereum has this option, but Celestia does not. They are useful in individual cases, but in future L1 gas of $1000/transaction would quickly force thousands of users back to L1 with a small amount of funds, which doesn’t seem ideal . One area that should be explored more is the possibility of designing an exit to another Rollup.

Overview of the main points

Trust-minimized two-way bridges are extremely valuable – there is a huge ecosystem where all Rollups are mining for shared liquidity and interoperability. Most of the time, it’s fine to condense security assumptions into an ultra-secure base layer.

But the bugs and upgradability of smart contracts are still a bit scary at the moment. Immutable Rollups alleviate many concerns, but it’s a price not worth paying.

Ultimately, robust contracts with well-designed governance (with escalation delays) will be the best solution to approach the security of L1 itself.

Ethereum – Smart Contract Settlement Rollup and Smart Contract Recursive Rollup

StarkNet has some pretty cool fractal scaling plans, here’s a concrete example:

  • Today – StarkEx, dYdX, Sorare and Immutable X are already in operation on a large scale. But they are not universal or composable. They are silos created through a contractual agreement with StarkWare.
  • Soon – StarkNet will appear. Like the smart contract Rollups (SCR) we are used to, a generic permissionless Rollup.
  • Later – Fractal scaling. StarkEx (and other L3s) can be deployed on top of StarkNet:

Delphi Digital: The Complete Guide to Rollup

At this stage, the relationship between L2 and L1 is as follows:

Delphi Digital: The Complete Guide to Rollup

With L3 it looks like this:

Delphi Digital: The Complete Guide to Rollup

Recursion turns out to be a pretty exciting scaling path. A validator contract on L2 can accept many L3 proofs of validity, create a proof of validity, prove that it verifies those proofs, and publish this proof to Ethereum. This efficiency is important in a gas-constrained environment like Ethereum. L3 may also experiment with off-chain DA solutions to further reduce costs (albeit with stronger security assumptions).

Rollup for specific applications

These L3s are naturally suitable for application-specific ZKRs. A large part of L3’s appeal is being able to control its own environment away from “noisy neighbors” while preserving its network effects through the L2 settlement layer. As bridges and interoperability continue to improve, I would like to see more deployments of application-specific ZKRs. They will retain most of the advantages of a shared execution environment, but get rid of the disadvantages.

Also – show me the incentives and I’ll show you the results. Application-specific Rollups capture more value than deploying smart contracts directly, because your tokens now capture execution fees and other MEVs. But if leaving a shared execution environment isolates you, it’s not worth the tradeoff. This is why (as I said before) better bridges, liquidity sharing, etc. are critical to the development of this trend.

Overview of the main points

Recursive Rollups present a very attractive value proposition, especially for application-specific use cases. You can achieve greater scale in an agile environment while preserving network effects. L2 could serve as a more scalable settlement layer than what Ethereum can currently do. As long as their data is sent back to L1, they have L2-like security guarantees – they are able to recreate state and exit.

Ethereum – Enshrined Rollups?

The crazy thing is that Enshrined Rollups (ER) is a bit futuristic. They are full of controversy, which makes them even more interesting.

You’ve probably heard ERs being talked about over and over on Twitter, but don’t actually know what they are because no one has written about them extensively (except Justin Drake‌ , who helped me a lot in this section) ‘s article.

Delphi Digital: The Complete Guide to Rollup

ER is built directly into the L1 specification rather than being deployed as a smart contract. This eliminates malicious governance/multi-signature upgrades or bug risks (outside of Ethereum itself). They follow the social consensus of the base layer within the scope of the hard fork.

When Ethereum merges (The Merge), the execution layer (Eth1) will merge with the consensus layer (Eth2). The execution layer (settlement is done by the consensus layer) can be upgraded to an enshrined Rollup (ER).

Delphi Digital: The Complete Guide to Rollup

Enshrined Rollups–Optimistic Rollup vs. zkEVM

In contrast, Optimistic Rollup (ORU) transitions to ER may be the fastest. Since weak statelessness already exists in the Ethereum roadmap, you can easily add fraud proofs. The simplest fraud proof is to distribute the block itself in isolation for re-execution (which will now include witnesses as well as pre/post state roots, transactions, etc.). However, fraud proof and transaction finality conflict, so the effect is not ideal.

An ambitious “plan” is to move directly to enshrined ZKRollup (ZKR). The Ethereum Foundation already has a team led by Barry Whitehat that is currently building a zkEVM. The caveat is that this is a daunting task that can take years.

Whether it’s ORU or ZKR, the point is that full nodes no longer need to execute transactions (unless fraud proof). This also applies to consensus nodes – neither the proposer nor anyone in the committee will execute the transaction.

Step 1 – Upgrade Settlement Layer to Enshrined zkEVM Rollup

“The settlement layer is upgraded to an Enshrined zkEVM Rollup. The entire Ethereum ecosystem — potentially thousands of Rollups/volitions and millions of TPS — will be validated by one neat ZKP. Hallelujah.”

Delphi Digital: The Complete Guide to Rollup

This is an uncontroversial step (once the technology is safe, easy to understand, etc.). The single-instance EVM as we know it today is upgraded to the state root equivalent of the zkEVM. This means that every L1 block comes with a SNARK that proves that the state root is valid.

Although there are some public implementation details, it’s still years away. Regarding proof distribution, you now have two options:

  • Sidecar – SNARK (or SNARK, an implementation detail) is just sent as a sidecar and one can implicitly verify it.
  • On-chain – SNARKs are actually on-chain, and smart contracts can easily access the proof itself to verify it.

Ultimately, there are two layers of consensus – social and code. The sidecar approach leans toward social dependencies, while the on-chain approach leans toward code.

performance bottleneck

As mentioned earlier, ER eliminates the need for full nodes to re-execute transactions. This makes syncing to the chain easier, and it also removes the computational bottleneck for validators. Currently validators have several consensus bottlenecks:

Delphi Digital: The Complete Guide to Rollup

Weak statelessness has broken storage and disk I/O – removing our major bottlenecks today. But at this stage, full nodes still need to execute every transaction. Obtaining a SNARK for the validity of each block will also cause the computation to fail. Both stateless and zkEVM represent an opportunity to increase the gas limit while removing more bottlenecks. Bandwidth is the only remaining major resource requirement (which is also proportional to Nielsen’s law).

Delphi Digital: The Complete Guide to Rollup

Benefits of zkEVM Enshrined Rollup

  • Simpler consensus – stateless (no fraud proofs) still requires full node execution, but zkEVM removes this bottleneck. Execution clients can swap thousands of lines of consensus-critical EVM execution code for simpler SNARK validation code.
  • Stateless Witness – Statelessness allows consensus nodes to stop maintaining state. They now receive witnesses (Verkle proofs) attesting to the correct state access and transactions in each block. zkEVM also removes this need – state differences are sufficient. This increases the validator’s consensus bandwidth efficiency, allowing for higher gas limits.
  • Safer Light Clients – Light clients use SNARKs to filter invalid state roots much faster than using fraud proofs. This allows for a more secure and/or faster Ethereum-to-competitive L1 bridge.

Step 2 – Deploy a massively parallel zkEVM Enshrined Rollup

Oh, you thought the execution sharding design was canceled, did you? This is the next thing to talk about – ER.

Delphi Digital: The Complete Guide to Rollup

After upgrading a single instance EVM, it is not difficult to deploy multiple (eg 64) parallel zkEVM ERs. This is a form of homogeneous L1 execution sharding. It’s also a question of whether such sharding will be needed anytime soon. As a zkEVM ER, single-instance throughput can increase by orders of magnitude over current capacity.

Delphi Digital: The Complete Guide to Rollup

The distinction between typical execution sharding and ER seems blurry, and there’s been a lot of messy debate on Twitter about it. The key point is again that full nodes do not need to execute ER blocks. Therefore, an executing shard with a zk-proof state root can be an ER. You get the same scalability and functionality as regular SCR (proposers only need to accept proofs and check DA), but you get the advantages of Rollup in consensus (more on that later).

Delphi Digital: The Complete Guide to Rollup

The old execution shard assigned a subset of the Ethereum validator set to each shard. Each monolithic shard will handle its own execution, consensus and DA, and then checkpoint back to the beacon chain.

The zkEVM ER only handles execution (making it more efficient), similar to the Rollup we see today. They rely on the beacon chain for consensus, settlement (issue proofs), and DA (they consume data blobs).

Delphi Digital: The Complete Guide to Rollup

Another implementation detail concerns the committee. There can be a committee of proposers in each rollup to validate the SNARK, which is then sent to the main settlement Rollup. Alternatively, you can skip committees and have Rollup block producers send SNARKs directly to the main chain where all proposers operate.

Either way, the proposer just accepts the highest bid, checks the DA, and verifies the SNARK that comes with each Rollup block as an extra field. You can think of it as one big block. It looks like this:

Delphi Digital: The Complete Guide to Rollup

Advantages of zkEVM Enshrined Rollups

It might seem obvious to upgrade the current settlement layer, but what is the benefit of having all these other zkEVMs compared to just being a zkEVM SCR?

  • Social Consistency – ER inherits the L1 social consensus. SCR currently has centralized operators holding upgrade keys, and ultimately this risk will lie in Rollup governance.
  • Economic Consistency – All ER fees and MEVs are credited to ETH. Nuclear Zombies Apocalypse World War 3 Economic Security.
  • Subsidized Proof Verification – ER can subsidize the cost of proof verification, while SCR has to pay EVM gas for settlement. In any case, validating SNARKs will be very cheap at this point. This alleviates the problem of rollup jobs today. Aggregators like Arbitrum, for example, delay settlement to avoid L1 gas spikes that sometimes occur.
  • Optimal settlement latency – Consensus can enforce SNARK proofs for each ER block, providing per-block settlement latency.
  • Optimal Activity – Centralized Rollup Sequencers may experience a drop in activity (we’ve seen this happen). SCRs also have the option of letting the sequencers reach their own consensus to provide pre-confirmation (StarkNet will do this). This suffers from suboptimal liveness, as external consensus can fail and the L1 escape hatch will only activate after a timeout.
  • State Root EVM Equivalence – Current tools and light clients will work out of the box. Today’s SCRs are primarily aimed at Solidity-compatible VMs (eg zkSync) or bytecode equivalent EVMs (eg Scroll), rather than full EVM state root equivalence.
  • Network Effects – Take the EVM’s network effects even further from where it already leads. There is value in allowing developers to coalesce around a standard. (Although, conversely, experimenting with new virtual machines may also yield exciting possibilities).
  • Maximize gas efficiency – ER uses native opcodes because they are built into the protocol. Instead, SCR may have to address VM inefficiencies.

Disadvantages of zkEVM Enshrined Rollups

But they are not perfect:

  • No Public Goods Financing – Private Rollups like Optimism can repurpose their revenue to fund public goods at their discretion. ER will be limited to funding L1 security and burning ETH.
  • Suboptimal compression – SCR currently settles on-chain much less frequently than per block, enabling better data compression. They may also have custom or frequently updated dictionaries to improve data compression.
  • VM is not flexible – Ethereum ER is likely to be an EVM. SCR can take other popular VMs (eg, WASM, RISC-V, MIPS) or create a new VM (eg, Cairo, FuelVM). A custom zkVM might be able to achieve better data compression than zkEVM.
  • Harder pre-confirmation – SCR may choose to have a centralized sequencer that provides instant (~100ms) pre-confirmation for a better user experience. This is more difficult to achieve with ER’s decentralized sorting.
  • Last mover – Due to the conservative nature of L1, the ER is very slow to make any changes. Various upgrades will need to be implemented through the governance process (EIP and forks). To avoid circuit errors, redundant multi-circuit setups (eg, 2-of-3 signatures) or heavy formal verification may be required.
  • Potentially increased builder cost – the builder must now create a proof unless the sequencer and the prover are split into different roles (this is possible, implementation details). Ethereum could also decide to issue ETH to offset ER proof costs. This raises the question of “how specialized will block building end up being?”. I’m currently expecting meaningful centralization anyway (due to economic incentives, as I’ve written before), but we’re not sure. Once implemented, the proof will also greatly reduce cost and speed.
  • Justin will have to redo his predictions because too much ETH will be destroyed.

Delphi Digital: The Complete Guide to Rollup

Speculative Advantages of zkEVM Enshrined Rollups

Builders running (or possibly building all Rollup blocks, settlements and data) across multiple ERs can provide synchronized interoperability between ZKRs.

For example, a builder can provide collateral and promise to include your sync transaction. If they accept your bid but fail to execute the trade, they will lose their deposit. crLists can also help provide pre-confirmation, as proposers (who can also choose to be tied to collateral) will be able to force transactions to be included.

Economic incentives lead builders to operate across Rollups – we are already seeing this centralized power in cross-chain MEVs today. These soft confirmations of synchronous interoperability are what users want, and they pay for. If you can provide this service, you can make more money. If you can make more money than everyone else, you’ll be the best builder.

Note that even before this, ZKR makes synchronous calls to L1, and similar dynamics are in play. The new danksharding design preserves this possibility as everything is confirmed in one block. For example, you can bridge funds to L1 and then perform an exchange with those funds in the same block. However, to provide this service, you need to control the production of L1 and L2 blocks to ensure that both legs execute (ie, the funds are only bridged when this swap executes immediately after it). This is a centralized force for block builders across Rollup and L1.

Arguments Against Enshrined Rollups – Credible Neutral

Upgrading a single-instance EVM to zkEVM seems like a no-brainer (if we’re comfortable with the technology). The next step for 64 Enshrined Rollups is the more controversial part.

“It turns out that most of the content in blockchain is opinion, not technical content.” The case against ER is no exception here. Here’s a fun Ethereum dev, Celestia dev, and Ethereum spam post that makes a good case on both sides. There are many disagreements here. Some people worry that the ER will do this to the SCR:

Delphi Digital: The Complete Guide to Rollup

The argument is that ER would essentially compete with the SCR that Ethereum is trying to foster, compromising its credible neutrality. SCRs can feel like “second-class citizens.” It could “limit the trusted neutrality of Ethereum’s settlement layer, weakening its socioeconomic safeguards for non-ERs.” This is similar to the debate on the minimalism of the Cosmos Hub. This interesting balance of base layer functionality/minimalism is also discussed by Vitalik before.

Rationale for Enshrined Rollups – Trusted Neutral

Conversely, some argue that ER can protect Ethereum’s trusted neutrality by preventing any commercial Rollup teams from becoming too dominant. Let’s say “Rollup Labs A” becomes so successful that their Rollup crowds out everyone else. Such reliance on a private team could seriously affect Ethereum’s trusted neutrality and network effects. A neutral balance from the ER can alleviate this.

Taking it a step further, a successful Rollup ecosystem can even break away from their Ethereum consortium.

Delphi Digital: The Complete Guide to Rollup

Here’s an argument Ali Atiia has made in the past :

Delphi Digital: The Complete Guide to Rollup

The current Ethereum scaling plan is primarily a DA layer as a SCR with a constrained settlement layer. Ethereum relies on Rollup for scalable computation. However, SCRs can cut out the “old middlemen” and introduce their own Rollup native assets.

The hypothetical example cited is that Optimism, Circle (USDC), MakerDAO (DAI) all have the same investors. Investors facilitate cross-pollination of the protocol, and locally deployed assets are cheaper and the user experience is better. Therefore, it makes economic sense for Circle and MakerDAO to deploy USDC and DAI, respectively, on Optimism. Once Rollup has built enough native assets, DeFi, and security, they may decide that Ethereum no longer provides them with enough value.

Delphi Digital: The Complete Guide to Rollup

To build stickiness, Ethereum needs a better settlement layer. DA alone may not be sticky enough. To build the best settlement layer, you need scalability and shared liquidity. ER makes communication between SCRs much more efficient. The “hyperscale” L3 we’re hearing about today may become more viable a layer on top of Ethereum’s ER. ER becomes the go-to place for sovereign and institutional settlements using the most valuable dApps = massive liquidity.

Delphi Digital: The Complete Guide to Rollup

Personal opinion on Enshrined Rollups (ER)

ER does not threaten the trusted neutrality of Ethereum. Yes, the activity will take place on the ER that could theoretically have gone to the SCR. But this is the exact same argument against Ethereum SCR and continues to be spread by many single, competing L1 proponents. SCRs are not parasitic on Ethereum – they are synergistic. ERs do not parasitize SCRs – they are synergistic. Ethereum is best to use SCR, and SCR is best to use ER.

ER made this pie a lot more than they could eat on their own.

SCRs will always be home to innovation and higher expansion, so they will continue to host the vast majority of Rollup activity. ER is designed to ensure that Ethereum can live up to its promise of maintaining an optimal settlement layer:

  • Trust-minimized bridging and access to the largest shared liquidity pool
  • Higher spreads allow for significantly lower bridging costs for SCRs located on top, opening up incredibly exciting new possibilities

I don’t share Ali’s concerns about Ethereum going away, although others have similar sentiments :

Delphi Digital: The Complete Guide to Rollup

If Rollups are economically rational players, they have a simple equation to measure:

Delphi Digital: The Complete Guide to Rollup

ER skews this scaling more favorably in both directions – they make Ethereum a better settlement layer, and they provide lower costs for SCR on top.

Delphi Digital: The Complete Guide to Rollup

Splitting the Rollup into isolated L1s (with unsafe bridges) shrinks this pie considerably, and you only get a marginally higher margin in return (saving cheap settlement fees). Additionally, you now need to subsidize your security, most likely by issuing inflationary block rewards. It doesn’t make economic sense.

Delphi Digital: The Complete Guide to Rollup

A potentially economically sound argument for why Rollup would leave Ethereum is whether they could build a better settlement layer. Then in theory you might end up with a bigger pie. The only way I think anyone has a chance is to use the following:

Delphi Digital: The Complete Guide to Rollup

However, you make huge sacrifices in terms of network effects, decentralization, and trusted neutrality in the second half. It makes more sense to build a settlement layer on top of Ethereum, as StarkNet did with their L2. You get the best of both worlds – a high-value financial settlement layer that retains the great advantages of Ethereum at a very low price.

Protocol complexity

Vitalik touched on a very important topic in his recent EthCC talk. Ethereum is entering its fastest period of innovation. Lots of good things are planned for the next few years. However, layers of complexity mean more risk, and it is increasingly difficult for even Ethereum developers to keep up with the pace of innovation. While Ethereum doesn’t need to be completely technically rigid, it eventually brakes a bit:

Delphi Digital: The Complete Guide to Rollup

To be fair, adding a zkEVM ER isn’t exactly like a walk in the park. However, they are, in my opinion, the last step in Ethereum’s ambitious roadmap, with the curve leveling off near the top of the graph. One day we will slow down, but not yet.

Delphi Digital: The Complete Guide to Rollup

Overview of the main points

My favorite analogy is that ER is the public sector and SCR is the private sector. The SCR is still home to innovation and most Rollup activity. ER is the slow and stable predictable base layer on which to operate providing maximum security. The two coexist in harmony. ERs add far more value to SCRs than any marginal activity they cannibalize.

Ethereum already has a convincing plan for scaling DA. But that doesn’t mean it should settle for its settlement layer. Ethereum can and should compete here too. zkEVM ER provides the best way to scale L1 Ethereum, positioning it as the primary settlement layer.

ER maintains its trusted neutrality with Ethereum’s economic and social alignment, creating an incredibly cohesive system. A robust currency generates the next level of economic security, subsidizing the security of the entire ecosystem.

The only arguments against ER are the “social” arguments around neutrality and competition. While I understand these concerns, I think they are generally exaggerated. Ethereum should certainly pursue a zkEVM ER when the technology is ready and then evaluate parallel instances.

You don’t think Ethereum’s base layer will always be weak and throughput will always be low, right?

Delphi Digital: The Complete Guide to Rollup

Ethereum – settlement and data availability (DA) layer

Now that we have a better understanding of how these Rollups work, let’s go back to the base layer they actually need.

Data Availability (DA) is obvious – making it super cheap, offering a lot, making it easy to verify with DAS. Both Ethereum and Celestia aim to do this one way or another.

My general argument about settlement – I don’t think the best settlement layer will be limited to the core functionality of validating/arbitration proofs and bridge tokens. Ethereum should retain a rich general purpose local execution environment. This will be where the big DeFi will be, which are price-insensitive on a per-transaction basis. This provides SCR with huge network effects, liquidity, and built-in security.

Ethereum should have a long-term focus on how to scale the settlement layer (stateless, zkEVM).

DeFi pooling

Maybe some of you have private jets, but most of us fly commercial. I need to split the bill with other people. It’s a bit like DeFi pooling‌.

  • Decentralized liquidity is bad – so it’s better to concentrate liquidity in one place (like Ethereum).
  • But high fees are not good either – so do we need to break liquidity to avoid congestion?
  • No – we’re just flying commercial on L2.

If I want to deposit $100,000 into Yearn, a $10 fee is acceptable. But paying 10% as a fee for a $100 deposit doesn’t make sense. Instead, L2 can hold 1,000 people who want to deposit $100 into Yearn, tie them together, and make a single L1 deposit! All this without the user having to pay L1 gas fees – you only pay $0.01 of the fee share. In fact, this is exactly what Argent already provides via zkSync.

Aave is also exploring this as part of its deployment on StarkNet. They will develop a smart contract to aggregate L2 user deposits and deposit them into L1. This contract will distribute aTokens from Aave L1 to StarkNet users based on the user’s proportion in the pool. This contract will aggregate the user’s aTokens and deposit them into L1 Aave when the collateral is redeemed.

Here’s an oversimplified version:

Delphi Digital: The Complete Guide to Rollup

Decentralized AMM (dAMM)

dAMM was first proposed last year by StarkWare in partnership with Loopring. I’ll summarize their designs here. However, please note that this is an active area of ​​research with open design questions. There is no live implementation yet, and future designs may look completely different from this.

dAMM is an L2 AMM that aggregates liquidity in a single L1 pool enforced by L1 contracts. Execution occurs on multiple ZKRs that share liquidity asynchronously. LPs serve L1 AMMs while participating in L2 transactions, exposing them to more transactions. (higher trading volume) / (same liquidity) = higher fee % → better capital efficiency.

Asynchrony = L2 s can process transactions without forced communication with other L2 s using the same dAMM L1 liquidity pool. This is the key to making shared AMM possible.

This is achieved by separating the liquidity pool from the pricing state. Because funding and state are decoupled, you can have multiple states (for multiple ZKRs) using the same liquidity pool. Each ZKR has its own dAMM state.

The contract agrees to offer whatever price the L2 state offers, as long as the L1 contract has sufficient liquidity to complete the offer. All states should revert to equilibrium ratios due to arbitrage.

This solves the main obstacle to sharing AMM between L2s – there is a concurrency risk if users can transact at the same time. Otherwise, this may make it impossible for each L2 to know if it can safely complete the settlement.

Delphi Digital: The Complete Guide to Rollup

Impermanence Loss (IL)

LPs face greater IL risk in dAMMs – the risk grows linearly with the number of markets the LP is exposed to. Thus, in the worst case, LPs suffer n times the IL they suffer under the regular UniswapV2 AMM. This doesn’t matter for stable currency pairs (eg, in Curve), but can be high for other pools. This can be mitigated using a parameter in the smart contract called the dAMM “health factor”, which limits the losses that the maximum IL LP can suffer. This health factor ensures that the dAMM liquidity ratio does not drop too low.

L1 <> L2 synchronous transaction

This design can support multiple independent markets on L1 and L2, all of which share the same liquidity. L1 liquidity (e.g. traded on Uniswap) can be used as dAMM liquidity by allowing L1 LP tokens (e.g. from UniSwap ETH/DAI) to be deposited directly into the corresponding pool (e.g. ETH/DAI) on dAMM.

dAMMs can support L1 transactions, but the health factor can no longer be easily mitigated. However, LPs can choose to take this additional risk and expose themselves to L1 transactions.

viscosity

Vitalik has made his thinking clear that sharing a DA layer with settlement is really tricky:

Delphi Digital: The Complete Guide to Rollup

Much of this goes back to Vitalik’s famous post on why the future is multi-chain rather than cross-chain. Roughly speaking, a trusted pairwise cross-chain bridge means a 51% attack on the connected chain = your bridge is attacked (many bridges are actually worse). Similar principles apply if you settle in Ethereum but publish your data elsewhere (eg, in Celestium). If Celestia gets a majority here, you’re out of luck again.

A Rollup that shares the DA and SL avoids these problems because they create a trust-minimized bridge between each other (it’s also possible to use a DA-only trust-minimized bridge without a shared SL, more on that later). If Ethereum isn’t 51% attacked, you can’t 51% attack Rollup alone. Even if Ethereum suffers a 51% attack and reverses transactions, its Rollup will be reversed and the two will remain the same. Therefore, you can safely hold assets published on one Rollup and wrapped on another Rollup.

So sharing a DA and settlement layer can provide the best security. However, if you decide to use Ethereum as a settlement layer and then provide another DA source (eg, a volition like zkPorter, validium, celesium, etc.), what are the benefits/tradeoffs? You can still use the same bridges and connections to L1 as any Rollup – you share liquidity, DeFi pooling, etc. For volition, off-chain (eg zkPorter) and on-chain (eg zkSync) DA modes share the same state and are fully composable. You only have to choose at the user level when you want your data to be stored on-chain or off-chain.

Settlement alone provides network effects to a large extent, while DA adds overall security. These network effects can be safely optimized by sharing DA. For example, you can more easily implement burning and minting mechanisms across Rollups, allowing you to natively deploy tokens across chains. However, with very different trust zones, it won’t be so easy.

Ultimately, we can see that there is a safety margin here. Many Ethereum Rollups, validiums, etc. will use Ethereum for settlement – but not all of them will use their DA. DA is at least somewhat more commoditized, and it will be a rich resource.

bridging

This is the biggest wild card of how strong the different layers of network effects are. The reality is that we’re still incredibly early in understanding how Rollups will communicate with each other in the future, which could have meaningful implications for how these stacks play out. There are a lot of theoretical possibilities, a lot of unsolved problems, and a lot of hard engineering problems. For example, Slush is working on some of the most exciting bridging possibilities for ZKR. In the future we may see atomic composability between ZKRs.

Part 3, the Celestia Rollup stack

Celestia – Sovereign Rollup

If ER (Enshrined Rollup) is one end of the Rollup spectrum, then Sovereign Rollup (SR) is the other end of the spectrum. Some people think both Rollups are fictional, but I think they’re cool.

Delphi Digital: The Complete Guide to Rollup

Sovereign Rollups (SRs) still publish transaction data to the DA and consensus base layer (just agree on transaction order, not validity), but they handle settlement clients in the Rollup. Full nodes and light nodes download blocks from their P2P network, and they also check data availability (DA) on Celestia. Fraud proofs are sent around the P2P layer of the Sovereign Rollup (SR) for light nodes to see. Proofs of validity can also be sent around the P2P layer.

Delphi Digital: The Complete Guide to Rollup

Alternatively, ZK Rollup can publish its proof of validity directly to Celestia along with the Rollup block. Celestia won’t be able to verify proofs, but a Rollup light client that tracks Celestia will be able to do so easily.

Delphi Digital: The Complete Guide to Rollup

Celestia refers to the Ethereum Smart Contract Rollup (SCR) as the ” Baby Chain ” because the correct Rollup chain is determined by the L1 smart contract. Instead, Sovereign Rollup (SR) nodes decide the right blockchain for themselves. They check the DA on Celestia and then validate the fork choice rules locally.

Delphi Digital: The Complete Guide to Rollup

Note that this is now just a trust-minimized one-way cross-chain bridge. Smart contracts that verify the validity of the Rollup provide you with a trust-minimized cross-chain bridge. In theory, you can send Celestia tokens to Rollup, but it can never be returned (not a good idea). Celestia’s tokens will have limitations, which we’ll talk about later.

sovereignty

“Sovereignty” refers to the right to fork at any time without losing security. Has your DEX been hacked? Some whales toyed with your airdrop?

Delphi Digital: The Complete Guide to Rollup

“Not introducing a sacred settlement layer is mainly a social feature rather than a technical feature, which means that there is a social contract between Rollup’s communities, that is, Rollup’s transaction validity rules are defined by the community, not an immutable L1 contract. In In practice, this means that cross-chain bridges to Rollups must be mutable in order to have an upgrade path that recognizes hard forks on sovereign Rollups.”

The “smart contract Rollup” can still be forked, but the decision-making power about what is the canonical chain is delegated to the L1 smart contract. This relies on multi-signature/centralized teams (as is the case today), majority governance of Rollup (decentralized way), or they become immutable and lose this right (or L1 may fork, but unlikely ). Note that this upgrade process is governed by the majority rule of on-chain governance. Off-chain coordination can deploy a new “smart contract Rollup” instance, but you’ll be drawing on-chain records from scratch. And “sovereign rollup” can fork without permission through off-chain governance, even by a few people. However, depending on your cross-chain connectivity, this fork might not be very useful (more on that later).

Considerations around sovereignty and forks

In theory you can always fork a Sovereign Rollup (SR), but in practice this is not very good in many cases. So let’s see where this sovereignty is especially useful and where it’s not.

One resistance to sovereignty is the reliance of Sovereign Rollups (SR) (or any chain) on meaningful centralized assets. If USDC does not support it, a perpetual swap exchange that relies heavily on USDC would have a useless fork.

A similar situation exists for smart contracts deployed on Generic Sovereign Rollup (SR). The socioeconomic linkages of large communities are more blurred. Suppose your DEX on Ethereum gets hacked, you are free to fork the blockchain, and restore it, but if all other users and dApps stay on the original chain, the fork is meaningless. The Sovereign Rollup (SR) as a whole certainly has the power to fork and change, but as a single contract on a shared chain, you won’t have much power. Therefore, application-specific Sovereign Rollups (SRs) are most likely to reap the greatest benefits of Sovereignty.

Sovereignty can also be valuable for a project with a strong community, but I think most projects today lack that. It’s hard to predict what the future of crypto will look like, but it’s mostly DeFi right now. Applications driven by purely financial and transactional relationships may value the other technical advantages of a given rollup stack over sovereignty, so a sovereign rollup (SR) needs to compete with a smart contract rollup (SCR) in terms of functionality, which is very important. Much depends on the effect of the Sovereign Rollup (SR) cross-chain bridge, which is still unclear to us (more on this later).

If it is immutable, it becomes very tricky for forks to trust-minimize rollups across chain bridges (for example, if SRa’s bridge logic is part of SRb’s consensus rules). This means that all linked Rollups require a synchronized hard fork. This will make Rollup usage like DeFi (which will be connected to a lot of other chains) very difficult.

But if the cross-chain bridge is not sacred, sovereign Rollup B does not have to fork when sovereign Rollup A forks, even if they have a trust-minimized cross-chain bridge. Rollups can simply run a smart contract that interprets the state of each cross-chain connected Rollup and verifies their proofs of validity. You bake everything (including fork choice rules) into proofs, so the blockchain can only have one canonical version, similar to smart contracts Rollup (SCR) on Ethereum today, if they pass governance Upgrading, the smart contracts that interact with them may also need to be upgraded.

flexibility

Another benefit of Sovereign Rollups (SRs) is that they give developers more flexibility in the execution environment. Ethereum’s smart contract Rollup (SCR) is limited by the ability of the settlement layer to process fraud proofs or proofs of validity, which can present challenges in some cases.

Sovereign Rollups (SRs) are not bound by fraud proofs or validity proofs interpretable by any particular virtual machine (e.g. EVM). As we saw in the new L1, this execution agnosticism can lead to more innovation in designing VMs.

However, this is not without difficulties. Trust-minimized cross-chain connections to other Sovereign Rollups (SRs), requiring them to interpret your execution environment and verify proofs. Therefore, you may create interoperability challenges by being too creative. The unified standard can avoid this situation.

Fraud Proof in Sovereign Rollup

First, fraud proofs come in two forms:

Non-interactive (aka list round): The challenger submits a fraudulent claim, which is checked by fully executing all state transitions between the two asserted states. This restricts Rollup execution to what can be re-executed by light clients such as smart contracts. In Sovereign Rollup (SR), the light client executes it by receiving the proof through the P2P layer.

Interactive: Challenger submits fraudulent claims and responders defend themselves. The two would play an Interactive Verification Game (IVG), where challengers asked responders to divide their claims into smaller ones, and they repeatedly narrowed disagreements over a single instruction. And there is a “person” who will “arbitrate” the dispute, which can be an Ethereum smart contract (for smart contract Rollup) or a P2P light client (for sovereign Rollup). Finally, the light client runs this single instruction to check for fraud. If either side stops responding, the other side wins. This is more complicated than a single round of fraud proofs, but will be more efficient to check for fraud.

Delphi Digital: The Complete Guide to Rollup

For reference, Arbitrum is using the Interactive Verification Game (IVG), Optimism’s original plan was to run a single-round fraud proof scheme, but they later decided to go with an IVG scheme as well. You can see an up-to-date overview of their new design here‌ .

Now, we’ll focus on how these relate to Sovereign Rollup (SR). One benefit of distributing fraud proofs via P2P is faster light client finality. Under normal circumstances, the synchronization latency here is probably lower than including it in the chain, and you no longer need to worry about L1 miners/validators reviewing your fraud proofs. You can avoid the long delay time of smart contract Optimistic Rollup.

A Stanford research group recently proposed a way to play IVG on a “dirty ledger” like Celestia . You can watch an overview here. Remember that Celestia accepts any raw information, it does not check for “invalid” transactions, so this is a “dirty” ledger. Rollup itself determines the validity of its blockchain. But here some problems have been found.

Suppose a challenger wants to prove that transaction Tc is a double-spend transaction. They submit evidence that the money has been used to trade Tb. This seems reasonable for proving fraud, but what if there is some Ta that proves that Tb is actually invalid? If transaction Tb is invalid, then transaction Tc may be fully valid. With a dirty ledger, you never know the true state unless you go back to the origin of the chain and replay every transaction. This means that both the challenger and the responder must be archive nodes, and this burden is very heavy.

This is different from a “clean” ledger like Ethereum, where smart contracts will reject any invalid transactions. You know that the latest confirmed chain end is valid until the new proposed state.

To reduce the need for archiving nodes, you can introduce new weak subjectivity assumptions. Suppose you only ask challengers and responders to keep 3 weeks of data. But even this would greatly increase the node requirements compared to the challenger and responder of the smart contract Optimistic Rollup:

  • The smart contract Rollup (SCR) challenger/responder needs to store the state during the actual dispute;
  • Sovereign Rollup (SR) challengers/responders need to store all the different historical states throughout the period of weak subjectivity;

This significantly increases their requirements, which makes Sovereign Rollups (SRs) less scalable. To limit challenger/responder requirements, block space needs to be limited.

There is also a stronger synchronization assumption in the Sovereign Rollup (SR) of IVG games:

  • Smart Contract Rollup (SCR) assumes there is an honest challenger who will submit a fraud proof to the smart contract, which will then be arbitrated for everyone to see. You assume there is no eclipse attack to completely cut off the network submitting fraud proofs, and you see fraud proofs.
  • Sovereign Rollup (SR) assumes that every light node is connected to a fraudulently honest challenger and responder. These challengers and responders are limited by how many light clients they can connect, so you’re assuming more simultaneous connections for now. And IP is also vulnerable to Sybil attacks.

Sovereign Rollup (SR) may use a single-round fraud proof scheme (which is what Cevmos plans to use). The assumptions for these operations are much weaker, as light clients can receive fraud proofs from honest challengers and pass them along. The light client is no longer between the challenger and the responder while remaining connected. You just need to receive fraud proofs from anyone and you can check for yourself. Note that single-round fraud proof schemes may introduce higher latency because they are slower to execute. Compared with IVG, the single-round fraud proof scheme also faces a larger attack surface.

Committee-based cross-chain bridge vs proof-based cross-chain bridge

Sovereign Rollups (SRs) add additional cross-chain bridge design considerations, but for other Celestia Rollups, trust-minimized or trusted cross-chain bridges are still possible. In this recent blog post by Mustafa‌ , you can read more details about some of the specific design possibilities, and I’ll summarize most of them here:

  • Committee-based cross-chain bridges (a committee attesting to the validity of the block), which is not trust-minimized, the committee could theoretically steal funds. IBC is an example of a committee-based cross-chain bridge (the committee is the validator set of the source chain). You can also have a committee run by a cross-chain bridge provider to attest to multiple blockchains.
  • Proof-based cross-chain bridges, in order to minimize trust in cross-chain bridges, Sovereign Rollup A and Sovereign Rollup B must be able to mutually verify fraud proofs/validity proofs, and therefore, they must be able to interpret each other’s state machines. This is more complicated than committee-based cross-chain bridges.

Peer-to-peer settlement vs on-chain settlement

For proof-based cross-chain bridges, there are two options:

P2P Settlement – Both Sovereign Rollup A and Sovereign Rollup B run light clients embedded in their blockchains. They receive block headers and associated fraud proofs/validity proofs via the P2P network. Both Sovereign Rollups (SRs) have a cross-chain bridge contract that allows asset transfers through a locking and minting mechanism. Cross-chain bridge contracts are monitored by each chain’s sequencer or validator (directly or indirectly through relayers) to execute transfers.

On-chain settlement – Both Sovereign Rollup A and Sovereign Rollup B run each other’s light clients, which are implemented in the form of on-chain smart contracts. These smart contracts receive block headers and fraud proofs/validity proofs. And this is how the Ethereum smart contract Rollup (SCR) works.

Static cross-chain vs dynamic cross-chain

Static cross-chain – Cross-chain bridges must be added explicitly via a chain upgrade or hard fork. Sovereign Rollup A and Sovereign Rollup B must support each other’s execution environment to account for their fraud proofs/validity proofs.

Example: Sovereign Rollup A is an Optimistic Rollup that wants to cross-chain to Sovereign Rollup B. Sovereign Rollup A’s state machine is written directly in Golang (eg using the Cosmos SDK), and Sovereign Rollup B is an EVM chain that doesn’t understand this. Sovereign Rollup B must upgrade its node software to include Sovereign Rollup A’s state machine as a library to verify Sovereign Rollup A’s fraud proofs. Sovereign Rollup B can’t just automatically add the state machine code of Sovereign Rollup A, as it could pose a security risk. The same applies to proofs of validity that the link chain cannot understand. In either case, social consensus or governance is required to add this cross-chain bridge through a chain upgrade.

Dynamic cross-chain – If Sovereign Optimistic Rollup A is written in a sandboxed smart contract environment (e.g. EVM or CosmWasm), then Sovereign Rollup B can allow Sovereign Rollup A’s state machine code to be added directly to its own code. This can be done without any social consensus or governance, such as using smart contracts. The same applies to ZK Rollups that understand each other’s proofs of validity.

Upgradable cross-chain bridge vs non-upgradable cross-chain bridge

The smart contract Rollup treats Ethereum as the sacred settlement layer that determines its validity, while the sovereign Rollup cross-chain bridge does not have this treatment, they must be mutable and have an upgrade path. That is, sovereign Rollup B must acknowledge that the validity of sovereign Rollup A is determined by its community. Sovereign Rollup A can be forked at any time through social consensus without the need for on-chain governance or hard fork settlement layers.

Let’s look at this example, Sovereign Rollup A is in the midst of a hard fork, and Sovereign Rollup B needs to upgrade its light client for Sovereign Rollup A. Here are a few ways, and they affect whether a cross-chain bridge is trust-minimized:

Delphi Digital: The Complete Guide to Rollup

Paired Span Bridge vs Hub and Spoke Span Bridge

Rollup on the shared settlement layer only requires N cross-chain bridges connected to the settlement layer. However, paired sovereign Rollup cross-chain bridges would result in N^2 cross-chain bridges for N Rollups interconnecting each other. They would also lack the shared liquidity and DeFi of a settlement layer.

There is another problem with path dependencies of assets. If I transfer an asset from chain A → B → C, the asset is not interchangeable with the asset transferred from chain A → D → C (unless it is natively deployed on all chains and you use a burn and mint mechanism) . This again decentralizes liquidity, and the solution is to connect it through a shared settlement layer.

The hub-and-spoke model relieves a lot of the complexity of many Sovereign Rollups connected to a central hub Sovereign Rollup. This approach reduces the overhead of cross-chain bridges to N orders of magnitude. The central hub can be the focal point for shared liquidity and cross-chain communication. In this respect, it functions very similarly to the Shared Settlement Layer.

This is similar to how the debate in the Cosmos ecosystem should unfold. The original “plan” was to have the Cosmos Hub as the focal point, with all zone blockchains communicating via IBC and the Cosmos Hub. But in reality, fully paired cross-chain bridges emerged. Each zone blockchain simply creates an IBC connection with whatever blockchain they want to interact with.

A hub would play a lot of valuable roles that Ethereum’s settlement layer does today. It will carry valuable DeFi and liquidity while coordinating cross-chain messaging, which could potentially capture a lot of value. However, unlike Ethereum’s settlement layer, which does not provide economic security for the Celestia ecosystem, there is no divine settlement layer deployed in the Celestia protocol.

Aggregate ZK Cross-Chain Bridge

I’ve saved the best part for last, which is an All-to-all cross-chain bridge with linear complexity using proof-of-validity aggregation. If this is feasible, the following ideas could be a game-changer for Rollup topology, greatly increasing the appeal of sovereign Rollups. Thanks to Preston Evans and Cem Özer of Sovereign Labs‌, who only recently brought this idea together.

Let’s take an example: Sovereign Rollup 1 wants to cross-chain with Sovereign Rollup 2 – Sovereign Rollup N.

Simple solution – as mentioned, the obvious choice is to have the sovereign Rollup 1 run N-1 light clients, one light client per chain, and verify one proof for each chain. The complexity of this cross-chain bridge is N^2, which is tricky, so we need to use the hub-and-spoke model described above. So can we do better? In my opinion, the answer is yes.

Better solution:

  • The Aggregator of Sovereign Rollup 1 receives the proof of Sovereign Rollup 2 – Sovereign Rollup N. The aggregator runs a light client for each chain, but now this is done off-chain, so the cost is much lower.
  • The (trustless) prover verifies and then aggregates the proofs of all N chains into one proof. This aggregation is essentially free because off-chain proofs of verification are very cheap.
  • Aggregators push only a single proof to smart contracts on-chain.
  • Sovereign Rollup 1 verifies this single proof in the same amount of time it takes to verify the proof of any single sovereign rollup.

The on-chain validator contract will contain a mapping from chainId to SR2 – SRN state root. Whenever it verifies a new aggregate proof, it updates the state root of SR2–SRN. The only remaining N^2 order of magnitude complexity is now in the state root (each chain is tracking the state root of the other chain, but the constant here will be small). SR1 removes the N^2 complexity of running N-1 light clients and verifying N-1 proofs. Each Rollup may run its own prover, but in theory you could also have a prover aggregate and send proofs to all N sovereign Rollups.

There are some assumptions about the interpretability of other sovereign Rollup state machines, but these problems can be solved. Each type of alternative VM you connect to across chains requires its own interpreter smart contract. Suppose SR1 is an EVM chain connected to 3 EVMs, 3 Moves, and 3 Sealevel SRs. It requires running two interpreter contracts, one for the Move chain and one for the Sealevel chain.

Having a DeFi “hub” (e.g. in a hub-and-spoke model or a shared settlement layer) may still be beneficial, and there is value in centralizing liquidity. But this hub no longer relies on settlement and two-hop cross-chain bridges. This removes the L3 latency of using something like StarkNet as a scalable settlement layer with high liquidity. You’ve flattened the stack and created shorter paths between all the Rollups.

Also, there is no longer a locked settlement layer. This hub, the focal point of DeFi, can evolve over time and gradually transition to other chains as technology advances. You are no longer limited by legacy technologies at the settlement layer.

The last point is that this is still a very new idea and it needs to continue to be under scrutiny, which could take years to build.

Ethereum Sovereign Rollup

The idea for the sovereign Rollup is definitely from Celestia, but note that you can also easily use Ethereum’s DA layer and ignore the settlement layer. This will work once the data blobs format gets its own cheap fee market after EIP-4844 hits the ground, and you get the same benefits and tradeoffs, but with a few differences:

  • Higher economic security – Due to the Ethereum settlement layer, it is much more economically secure than Celestia. The Ethereum settlement layer subsidizes the security cost of DA, which is provided altruistically.
  • Trust-minimizing cross-chain bridges with Ethereum Rollups – Recall that sovereign rollups can build trust-minimizing cross-chain bridges in pairs, with Rollups sharing the same DA layer (which would be harder). You can now get this option via Ethereum Rollup instead of Celestia Rollup.
  • Better liveness – Ethereum’s consensus mechanism Gasper can maintain liveness even in the event of a 33% attack, although it will not be finalized (as mentioned earlier). This is valuable for the base layer that Rollup relies on.
  • Slower finality – While Gasper gives you better liveness, it trades off finality. Ethereum is much slower to determine than Tendermint (which can be done instantly). Ethereum researchers are actively working on single-slot determination, but it will take quite some time for implementation.
  • No overhead minimization – Celestia’s Sovereign Rollup only needs to run the Celestia light client, but an Ethereum Sovereign Rollup must run an Ethereum full node to get the same guarantees. They must check the validity of all L1 executions to understand the canonical chain, because the validity rules are part of the consensus rules. However, this will no longer be the case once Ethereum implements light client DAS (which may take a few years). Then even if Ethereum’s honest majority assumption fails, a light client would suffice, it would not cause a security failure for a sovereign Rollup, since DA can still be guaranteed across a fork.

Essential Refinement

Sovereignty is useful for communities with clear social alliances that do not want to bootstrap their own L1 validator set. However, if these sovereign Rollups are cross-chained to many other chains in a trust-minimized manner, complications can arise during a fork. Relatively isolated non-financial applications may be a more niche market, but they are not widely available at the moment.

Purely financial applications may value the other technical advantages of the Rollup stack, so sovereign Rollups need to compete with smart contract Rollups in terms of functionality. The hub-and-spoke model mitigates many of the drawbacks of a shared settlement layer, but it introduces a lot of complexity. By far the most compelling cross-chain bridge vision is the aggregated ZK cross-chain bridge I described above. If successful, this would provide a very interesting route.

Celestia – Sovereign Settlement Rollup & Smart Contract Recursive Rollup

A lot of Celestia Rollups don’t want to give up the shared settlement layer, you’ll see it powerful in the Ethereum Rollup ecosystem, and you want to.

Delphi Digital: The Complete Guide to Rollup

Enter Celestia’s Billing Rollup. These are SRs designed specifically for non-sovereign recursive Rollups. Recursive rollups place smart contracts on settlement rollups, providing them with a trust-minimized two-way cross-chain bridge. These recursive rollups publish proofs, state updates, and transaction data to settlement rollups. Billing Rollup Batches recursive Rollup data and publishes it to Celestia.

Now, you avoid all the cross-chain bridge tradeoffs of sovereign rollups we just discussed, and you avoid the complexities surrounding P2P proof-of-settlement. N trust-minimized cross-chain bridges are connected to a shared settlement layer, allowing tokens to be easily cross-chained.

If the settlement rollup is fraudulent/validity provable, verifying the validity of the settlement rollup is the least expensive for the recursive rollup on top. For example, Cevmos‌ intends to be a settlement Rollup, which is a simplified single-round fraud provable EVM.

Delphi Digital: The Complete Guide to Rollup

Restricted Settlement Layer vs Universal Settlement Layer

Now, should your settlement rollup be a constrained environment optimized only for issuing proofs and token transfers? If so, recursive Rollups will get cheaper fees, they are no longer competing with DeFi, NFTs, etc. in an expensive general-purpose execution environment.

There are several ways to do this:

  • Contracts are whitelisted for permissioned settlement Rollup;
  • Change the gas cost of certain instructions to severely block any activity other than proofs and transfers;

If you go down this path, you lose all rich DeFi use cases (e.g. DeFi pools, dAMMs, etc.) and make it harder to build liquidity. Compared to Cevmos, StarkNet is of course taking the opposite route. StarkNet will be a general settlement Rollup for recursive StarkEx Rollup. Another difference is that StarkNet is a smart contract rollup, so it eventually settles back to Ethereum and retains a trust-minimized two-way cross-chain bridge (by contrast, Cevmos is a sovereign rollup, which does not go to the underlying trust-minimized two-way cross-chain bridge).

Another argument is that the day-to-day operating costs of a large-scale rollup paid to a settlement layer are low anyway. Even today’s smart contract Rollups pay very little to the Ethereum settlement layer, and with upcoming optimizations this will decrease further. Any other settlement layer is much less expensive and has much smaller constraints (especially a settlement rollup). These costs will drop further as more efficient proofs emerge and are amortized over more transactions. Ethereum will also potentially expand its settlement layer (albeit in the next few years) with statelessness, state expiration, and zkEVM technology.

Still, nothing stops you from deploying a Universal Settlement Rollup (L3) on top of Cevmos (L2), and recursive rollup (L4) on top of a Universal Settlement Rollup. It’s possible, but right now you’re extending all the way to L3 for any kind of rich trust-minimized shared liquidity and DeFi (which you usually only get at L1 Ethereum). You may need to rely on additional layers to resist censorship.

Advantages of the four-tier scheme:

More efficient resource pricing – Pricing certain resources more optimally for certain use cases. For example, if Celestia’s version of ENS just wanted a place to settle proofs and transfer tokens, it wouldn’t need to pay more to publish proofs to a general-purpose execution environment that competes with DeFi and has no value.

Disadvantages of the four-tier scheme:

Socio-Economic Fragmentation‌ – For example, the base layer and two settlement rollups now build their own economic security instead of centralizing it in one place. This makes it harder to build security into any part of the stack, creating weak links. Also, the value that constrained-settlement Rollups may generate will be small (they act more like a bridge than a typical general-purpose rollup).

Activity drop and censorship resistance – If any part of this stack fails, the Rollup at the top of it may be out of luck. Unfortunately, the above point of view exacerbates the situation. This is explained in more detail below as it has nuances.

Delphi Digital: The Complete Guide to Rollup

The smart contract Rollup forcing transaction inclusion is well understood. Typically, you can allow any L2 user to submit transactions directly to the L1 contract. If the sequencer does not commit after some predetermined window (say a day), the sequencer will no longer be able to commit blocks without it. Committing blocks will become permissionless and you can force withdrawals back to L1 individually. This is more expensive for users than batching other L2 withdrawals, but it works.

Now a recursive Rollup on top of the Sovereign Settlement Rollup. If a billing rollup censors you, there needs to be a way to force it to be included in your own rollup. However, you can still inherit the review guarantee from the L1 DA layer. You can enforce a rule in recursive Rollup so that tx published to your namespace on Celestia must be processed for the Rollup block to be valid. Users can individually force transactions into the DA layer, which will be ordered by execution layer fees. This does not depend on the settlement of the Rollup, but needs to be built into the Rollup’s state transition rules. This becomes a case of 1 of N honesty assumptions, if the sequencer doesn’t contain your transaction, you can submit a fraud proof that they must submit that transaction.

Regarding liveness, if the recursive rollup’s sequencer itself fails, then you can still exit the settlement rollup (like you do on Ethereum today). But if the activity of a settlement Rollup fails, your recursive Rollup is out of luck, and you can only follow the downtime.

Essential Refinement

You can weigh the benefits of sovereignty and then regain the real benefits of a shared settlement layer. However, adding more and more layers to the stack can start to feel uncomfortable.

Celestia – Holy Rollup?

If the Ethereum Sacred Rollup is speculation, Celestia’s Sacred Rollup is farther from reality. Celestia currently has no plans for this, it just provides an idea. I think adding a generic sacred Rollup to Celestia is a potentially attractive option, let me explain.

Delphi Digital: The Complete Guide to Rollup

We have discussed the value of the settlement layer for shared liquidity, trust-minimized two-way cross-chain bridges, and more. But in my opinion, it’s also particularly important to include it in the base layer itself, for two reasons:

  • Value capture, a well-designed generic Rollup may capture more value than the DA layer. This is critical since the entire stack on top of base layer assets relies on economic security.
  • Native asset utility, which makes the underlying asset more useful. ETH can be used for DeFi on L1, etc., or it can be connected to any specific sacred Rollup or Smart Contract Rollup through a trust-minimized two-way cross-chain bridge, allowing it to circulate as a currency throughout the ecosystem. And Celestia lacks this trust-minimized two-way cross-chain bridge, can’t send it anywhere, and you can’t do anything other than staking or transfer money on the Celestia blockchain. This effectively abandons Celestia’s vision of being a “currency”, which is still arguably the biggest narrative in crypto.

Of course, you have a few remaining options to represent Celestia’s tokens elsewhere.

  • Multi-signature cross-chain bridges: The idea of ​​a small third-party external committee that has to approve all transactions isn’t exciting.
  • Custody (eg WBTC): Hope I don’t have to explain this. It’s basically just a bad 1/1 multisignature with no cryptoeconomic penalties.
  • Light client cross-chain bridges (e.g. IBC): This is not trust-minimized because you rely on an honest-majority assumption for linking blockchains. And the number of IBC connections to Celestia, if any, must also be kept to a minimum to minimize complexity and prevent a huge burden on Celestia’s state machine.
  • Divine Settlement Rollup: This could bring a trust-minimized two-way cross-chain bridge to Celestia, as well as enhanced asset utility and greater economic security.

Delphi Digital: The Complete Guide to Rollup

To obtain a trust-minimized cross-chain bridge requires DA verification and fraud/validity proofs for state transitions of linked blockchains. The Ethereum smart contract Rollup can do this because their smart contract verifies the state transitions of the Rollup. Celestia cannot support such cross-chain bridge smart contracts, so it has to incorporate Rollup into the core protocol to achieve this.

Celestia Rollups can have a trust-minimized two-way cross-chain bridge through this settlement Rollup, which makes communication between them easier and allows Celestia tokens to flow throughout the ecosystem.

The downside is that this adds complexity to Celestia. Validators must now ensure their validity, and non-consensus nodes will validate their state transitions. This will somewhat increase their bandwidth requirements for downloading the divine Rollup data. However, since this is a holy rollup containing fraud/validity proofs, the overhead of this verification is minimized – no validator or non-consensus node need to perform.

Ultimately, I think it’s a free choice. I think the downside is very limited and the upside is very large:

  • Worst case scenario: No need for a settlement layer at all (so it doesn’t play that role) because the sovereign rollup wins and this divine rollup is defeated by other sovereign rollups. Then this holy Rollup won’t be very active and won’t pay for your security budget. But at the very least, you can get a trust-minimized two-way cross-chain bridge for your token that is now widely available across the ecosystem, so that’s also a win.
  • Medium Scenario: Sovereign Rollup wins, no settlement layer needed. Well, this might just be another Rollup in that ecosystem, unless it might have a strong Schelling point and get meaningful activity. This helps fund the security budget and provides Celestia with a trust-minimized two-way cross-chain bridge.
  • Optimism: Smart Contract Rollup wins, they really want a settlement layer. This could be a very active focal point for an ecosystem with high liquidity and activity. This helps ensure a sustainable value capture mechanism that provides security for the wider Celestia Rollup ecosystem. Of course, a trust-minimized two-way cross-chain bridge is also implemented.

Maybe the Sovereign Rollup will devour the entire Celestia world, and the DA accumulates a lot of value to protect everything. The DA value capture bull market is that even with a large supply of DA, the network impact on an ecosystem can be huge. As a result, sovereign Rollups pay for premium “real estate” to gain trust-minimized cross-chain bridges in this ecosystem.

Even so, we know how to scale DA to very extreme lengths and may need to implement artificial pricing to generate revenue. Or it could have happened naturally because there was a lot of demand. In either case, there will be many other DA tiers that provide higher throughput at a much lower cost, and possibly load balancing. For example, Ethereum’s security budget is subsidized by its settlement layer (at least for now), which does not require artificially increasing DA prices. And other cheaper DA alternatives will also exist.

Another argument against “sacred Rollup” is “credible neutrality”. That said, other Rollups will be afraid to deploy on Celestia because the base layer is competing with them, so it can’t be neutral. I generally disagree with this argument. If we think France’s future is 5 times what we see today, then we really need to think bigger. There’s room for more than one Rollup, and Rollups will continue to happily deploy on Celestia.

Alternatively, this “Sacred Rollup” could be the settlement layer that each Celestia Rollup decides to use. Then it will be very sticky and difficult to replace. Even if a better settlement layer is technically available, it may be too late to act.

It would be great if DA did accumulate a lot of value and the “sovereign rollup” devoured this Celestia world. But in my opinion, this is not very likely. It’s hard to predict what exactly will be needed for most future applications, and how technologies like ZK aggregated cross-chain bridges will unfold from here. Where any of these factors are uncertain, “Sacred Rollup” seems to have an edge.

Essential Refinement

Understandably, a lot of the decisions here are driven by the community. However, in my opinion, there are practical benefits to deploying a “sacred Rollup” in Celestia. Of course, “sovereign rollups” can still be deployed on Celestia however you want! Just as “sovereign rollups” can use Ethereum and ignore the settlement layer, they can also ignore Celestia’s “sacred rollups”. Not deploying a “sacred rollup” seems like a very expensive act of virtue.

Overall, I think that incorporating a generic “sacred Rollup” into Celestia is far better from a technical point of view than a technical point of view, and arguably disadvantageous from a social point of view. I like the technical exploration in this context, but keep in mind that “most things in blockchain are opinions, not technology.”

Delphi Digital: The Complete Guide to Rollup

concluding thoughts

Sorry, I just wanted to quote one more podcast quote of mine, back to a comment John gave on a different Rollup stack question:

“Whether I expect one stack to be more popular than the other, I wouldn’t say I expect anything but surprises. The world is full of surprises and I can’t really predict which one will be used by more people. “

It’s all facts here. I will have an opinion, and so will others. But that’s the point, they’re all opinions. Nothing I’ve described here says that one stack is better than the other. It’s all trade-offs, and I hope the really smart people build on everything I’ve described here, only time will tell what they value most, or what will yield value.

If you still don’t think Rollup is cool, honestly, that’s not my problem anymore.

Delphi Digital: The Complete Guide to Rollup

Thanks to Justin Drake, Dankrad Feist, Preston Evans, Cem Özer, Nick White, Mustafa Al-Bassam, Ismail Khoffi, and Josh Bowen for their comments and insights.

Posted by:CoinYuppie,Reprinted with attribution to:https://coinyuppie.com/delphi-digital-the-complete-guide-to-rollup/
Coinyuppie is an open information publishing platform, all information provided is not related to the views and positions of coinyuppie, and does not constitute any investment and financial advice. Users are expected to carefully screen and prevent risks.

Like (0)
Donate Buy me a coffee Buy me a coffee
Previous 2022-08-08 12:09
Next 2022-08-08 12:14

Related articles