“It’s the best of times, it’s the worst of times.” Just as Dickens revisited the Europe of revolutionary and dramatic change, so is Ether today. The ecology above Ether, especially DeFi, is full of life and innovation, but the exponential growth of network activity has triggered a congestion crisis. Transactions on Ether have become very expensive for the vast majority of potential users. Improving scalability is something that Ether urgently needs to do right now.
I believe Rollups are the new way forward. Much has been written about their key trust assumptions and security properties, and how they distinguish Rollups from other scalable solutions that are sidechain and EVM compatible. In this paper, I focus on the similarities and differences between two main categories of Rollups: open Rollups and zero-knowledge Rollups, both of which have essentially the same basic design and guiding principles. They differ in the way the “review process” works. In other words, how Etherpad decides whether a batch of Rollups transactions should be accepted or rejected. As we have seen, this difference has important implications for the security, EVM compatibility, and user experience of open and zero-knowledge rollups. These attributes in turn have a profound impact on users, developers and investors.
Guilty until proven innocent, or not guilty until proven guilty?
Before we dive into the complexities of the respective designs, let’s start with a high latitude comparison.
ZK Rollups send bulk transactions back to ethereum with a special type of cryptographic proof. The Ethernet network uses this so-called “proof of validity” to verify the correctness of the batch transaction. In the ZK Rollups protocol, EtherChannel only accepts the batch of transactions that can be verified by the cryptographic proof. In a nutshell: guilty until proven innocent.
In contrast, in an open Rollup, Ether assumes that a given batch of transactions is legitimate. It rejects a transaction only if a node (not only the verifier of an Open Rollup, but also any participant monitoring the Rollup chain) submits a valid statement (“proof of fraud”) that the transaction is fraudulent. Thus: innocent until proven guilty.
While ZK Rollup relies on cryptographic proof to determine the integrity of a transaction, Optimistic Rollup has a grace period between the time a transaction is processed in Rollup and its eventual acceptance by the underlying chain. This “dispute period” provides ample time for users to submit proofs of fraud. Although in practice, this will result in a longer withdrawal period (1-2 weeks at most) for the token to migrate from the Rollup chain back to the Ether base layer. In order for Open Rollup to operate securely, only one honest participant is required to submit proof of fraud if necessary. In addition, “Open Rollup” uses economic incentives to ensure that malicious users cannot spam the network with false evidence of fraud. More specifically, both the verifier processing the transaction and the network participant submitting the proof of fraud are encouraged to do so, as they must pledge tokens on their judgment, which will be confiscated if they fail.
At first glance, ZK Rollups may seem to be more stringent. Not only do they add a cryptographic proof burden to each transaction, but they also avoid the week-long withdrawal delays that plague “open Rollups”. However, in essence, ZK Rollup is no better than Open Rollup. It is much more complicated to implement than one might think.
Ready to go
Regardless of the theoretical merits of ZK Rollup, it is limited, at least at this stage, by the components it can provide to extend DeFi.
Open Rollups such as Arbitrum and Optimism offer an execution model very similar to that of an Ether virtual machine. Moving to an open Rollup is a very easy process for developers, regardless of the complexity of the code, and Arbitrum’s recently updated documentation clearly demonstrates how easy it is to migrate applications. In general, Open Rollups can provide the same functionality that alternative EVM-compatible scaling solutions such as Matic / Polygon and Binance Smart Chain offer.
On the other hand, for leading ZK Rollup protocols such as Starkware and ZkSync, compatibility is a much trickier issue. Because ZK Rollup is designed to have proofs of validity associated with each single type of transaction, its aggregation techniques are much more onerous to build. zK Rollup has been successfully used for a number of discrete tasks, such as direct transfers and transactions. But they do not yet provide generic support for DeFi smart contracts.
This does not in any way diminish the future potential of ZK Rollup. It is worth noting that, sooner or later, ZK Rollup will likely provide much of what open Rollup has already accomplished: near full EVM compatibility, computational efficiency, and easy portability of complex code. However, as things stand now, only Open Rollup can solve the emergency congestion problem in Ether and provide a way for DeFi to scale quickly.
The question is whether it is worthwhile to trade security for speed of scaling?Proponents of ZK Rollup argue that ZK Rollup provides sealed cryptographic verification of off-chain execution and therefore has a decisive security advantage over open Rollup, which means that ZK Rollup could be promising in the gradual scaling of the DeFi protocol.
In practice, however, the security issue is not so simple.
ZK Rollup is constructed by a designated party that executes the transaction, constructs the block and includes a proof of validity. This behavior is called “relayer” (or “prover”). In a ZK Rollup, the relayer is encrypted to prevent the submission of fraudulent transactions and to lock the funds processed by the Rollup. However, this reliance on a single party creates some potential vulnerabilities.
The relay’s work to construct blocks with zero-knowledge proofs requires an expensive computational infrastructure. If the repeater goes offline for any reason, there is not necessarily another party with proof technology that can seamlessly take over processing responsibilities. In practice, this means that ZK Rollup does not have strong flexibility guarantees.
Now let’s compare it to Open Rollup. On an open Rollup, a single-party “sequencer” is also designated as the block producer and transaction processor. In most cases, other validators on the open Rollup network act as “referees” and can “issue foul alerts” on the sequencers. That is, they can issue proof of fraud when necessary to trigger the dispute resolution process. But, importantly, these additional validators can also take on the role of block production without additional processing power or technical knowledge, and the founders of Arbitrum even claim that it is possible to run an Arbitrum node using a regular laptop with some extra RAM.
Proponents of ZK Rollup argue that similar vulnerabilities exist in open Rollup and that they are more severe when exploited due to the lack of password constraints. The parameter operates in the following manner.
Open Rollup assumes that ” one of the n participants” is honest. This means that as long as an honest network user can submit proof of fraud, the Rollup protocol will process the transaction correctly. The problem, these critics insist, is that while the “one honest participant” requirement is weaker than the simple majority consensus mechanism of sidechains, it is still vulnerable to censorship. If all participants are compromised or forced offline, fraudulent batches could theoretically be submitted to Ether without triggering dispute resolution.
In theory, this attack scenario makes sense, but in practice there are two important factors.
First, as mentioned above, the dispute resolution period for open Rollups is long, one to two weeks. Any participant other than the verifier who is monitoring the state of the network can submit proof of fraud during this dispute period. This means that “one in Rollup” assumes not “one of the n validators in the aggregate” but “one in the aggregate,” as leading Rollup researcher John Adler explains. John Adler, a leading Rollup researcher, told me.
Moreover, for game-theoretic reasons, we assume that corrupted network participants will defect and submit proof of fraud, since doing so would entitle the defector to a forfeited share of the block producer. In other words, “an honest participant” is really just a hypothesis, and there is a high probability that a greedy participant will be willing to submit the correct fraudulent proof for a monetary reward.
In addition to activity guarantees and the “one honest verifier” assumption, there are various other security issues that deserve to be explored. The purpose of this discussion is not to draw black-and-white conclusions about the complexities of trust and security. Instead, my goal is to make ZK Rollup’s otherwise low-consumption functionality more secure than open Rollup through cryptographic verification.
Specifically, ZK Rollup transactions can be confirmed immediately. As a result, users of ZK Rollups theoretically do not have to wait any significant amount of time to withdraw their funds to ethereum. On the other hand, as mentioned earlier, open Rollups require a delay of 1-2 weeks before they can be withdrawn in order to resolve the dispute.
These delays have long been considered the Achilles’ heel of Open Rollup, and for good reason. While some argue that Open Rollup is sticky enough for users that they don’t need to commute to Ether with any frequency, I have a hard time imagining that crypto-native users will put up with withdrawal delays worse than SWIFT.
Fortunately, withdrawal latency is a solvable problem for the open Rollup protocol, thanks in large part to the transparency and availability of Rollup data. Data availability is an essential feature of Open Rollup, as it allows other network participants (“referees”) to confidently submit proof of fraud in the event that a sequencer fraudulently processes a transaction. In addition, this data availability feature allows external observers to discover the correct outcome of a batch of contested open Rollup transactions before the challenge period has passed and before the true ending is achieved on Ether.
Currently, many promising protocols are iterating around the basic concept of providing instant liquidity to open Rollup users. connext and Hop are generic cross-chain protocols that use a variation of conditional transfer technology to allow users to exchange tokens between the Layer 2 network with EVM-compatible Layer 1 and Ether. makerDAO recently announced a more narrowly tailored approach to the In addition, Rari Capital is developing a conditional withdrawal “solution” called “Nova,” which will allow users to make withdrawals on Ether using the protocol’s unrestricted Dai liquidity and minting capabilities. withdrawal “solution” that uses “bots” to perform specific tasks on Ether on Rollup users, without forcing them to migrate all their liquidity back to Ether. Finally, it is likely that centralized exchanges will provide direct access to assets for “open Rollup”.
Of course, a more detailed study of the withdrawal latency problem and these nascent solutions is necessary, but that would require a separate article. However, at least in the short term, the success of open Rollups will depend heavily on the success of these “fast withdrawal” protocols. To its credit, ZK Rollup does not share these same user experience pain points and therefore does not rely on a viable cross-chain infrastructure.
In summary, reducing the complexity of “Zero Knowledge Rollup” and “Open Rollup” may be useful to increase scalability overall.
At this stage, it is not known how Rollup compares to its alternatives. Sidechain (Matic / Polygon) and EVM-compatible Layer 1 (Binance Smart Chain) have positioned themselves as early scaling veterans of an already impressive suite of applications. Furthermore, numerous crypto users looking for low price and high throughput have no hesitation in using these other extension solutions, regardless of their security.
My own view is that it will take time for a particular project to reach full adoption. In the short term, it is not surprising to see Rollup encounter some development difficulties. The incentives for alternative chains are lucrative and the user experience for early Rollup adopters is unlikely to create a bottleneck. In addition, we may run into real liquidity fragmentation issues with DeFi due to the lack of a reliable and seamless cross-chain infrastructure, making it difficult for any scalability solution to truly corner the market.
However, in the medium to long term, I think any differences exhibited between competing scalability solutions in terms of cost, speed and user experience will converge to zero. The main remaining differences will be security and trust assumptions, and any network impact that each solution establishes in the meantime. If this does happen (and when), the vision of a Rollup-centric ethereum could eventually become a reality.
Posted by:CoinYuppie，Reprinted with attribution to:https://coinyuppie.com/the-defi-way-open-rollup-vs-zero-knowledge-rollup/
Coinyuppie is an open information publishing platform, all information provided is not related to the views and positions of coinyuppie, and does not constitute any investment and financial advice. Users are expected to carefully screen and prevent risks.