Compare Optimistic Rollup and ZK Rollup from the perspectives of flexibility, scalability and cost.
Original Title: “Starting from Expansibility: Understanding Optimistic Rollup and ZK Rollup”
Written by: William Wang
In the previous article, we discussed the extensible application of ZK Rollup in Layer 2 and briefly introduced its principles. In this article, we will introduce the working principle of Optimistic Rollup and its comparison with ZK Rollup, as well as Findora’s innovation in this area.
What is Optimistic Rollup
Optimistic Rollup is a technology that uses OVM (Optimistic Virtual Machine) to extend Ethereum’s general smart contracts on L2. OVM has complete functions and can be compatible with EVM (Ethereum Virtual Machine) execution environment, and it is mainly used in layer 2 systems. Its look, feel, and behavior are very similar to the Ethereum main chain. The structure of Optimistic Rollup borrows heavily from Plasma and ZK Rollup designs. However, a certain degree of scalability has been weighed to allow fully universal smart contracts to run in Layer 2 protected by Layer 1.
If it can be deployed in a short period of time, it can migrate existing dApps and services through a simple method that compromises security/scalability within a reasonable range. Meet the growing demand of ETH1.0.
In order to better understand the usage scenarios of Optimistic Rollup on the Ethereum mainnet, let’s first refer to the following example:
We assume that a developer has written a Solidity smart contract.
- The developer sends the transaction off-chain to the Bonded Aggregator, the producer of the layer 2 block, who is responsible for deploying the contract. Anyone with Bond can become an Aggregator, and there can be multiple Aggregators on the same chain.
- Aggregator can charge fees in any way you like, including account abstraction or meta transactions.
- Then, the Aggregator must immediately assure the developer that its transaction will be included in the new block, otherwise the Aggregator will lose the Bond.
- Aggregator then uses local transaction transfers and calculates the new State Root.
- Aggregator submits a new Optimistic Rollup block containing the transaction and state root as a transfer transaction to the Ethereum main network.
- If someone downloads the block and finds that the block is invalid, and proves that the block is invalid, you can dismiss the malicious Aggregator and the Aggregator’s Bond that continues to build on the invalid block. Part of the bond owned by the Aggregator will be rewarded to the prover.
This is the simplest operating logic of Optimistic Rollup smart contract.
Since the state generated by each current transaction is part of each effective Optimistic Rollup state afterwards, this is also one of the ways to ensure the security of this smart contract . This smart contract approach is very similar to what we see on the Ethereum mainnet today. So, what are the similarities and differences between Optimistic Rollup and ZK Rollup?
In Optimistic Rollup, when the new state root is released by the operator, it will not be checked by the Rollup smart contract every time. However, if an incorrect state transition is issued, other operators or users (must observe the conditions of the contract in the L1 Rollup and execute each transfer transaction) can observe invalid transactions and restore incorrect blocks, thereby eliminating malicious attacks Operator.
In comparison, ZK Rollup is a more complex technology. Now that ZK Rollup is used for token transfer and some relatively special applications, it will take longer to implement general smart contracts with ZK Rollup, and it needs more time to effectively package the entire EVM into zero-knowledge proofs. More research work. However, once ZK Rollup is fully developed, all existing Ethereum dApps and services will be able to easily migrate to ZK Rollup.
ZK Rollup will solve several basic problems of Optimistic Rollup:
- Eliminate Tail Risk: Steal funds from OR through complex but feasible attack vectors;
- Reduce the withdrawal time from 1-2 weeks to a few minutes;
- Empowers high transaction confirmation speed, and can achieve unlimited exit flow;
- Default privacy.
Optimistic Rollup is also a good tool for ZK Rollup. The extension to L2 requires users to make drastic changes in the usage habits of e-wallets, oracles, and dApps. Optimistic Rollup has prepared an ecosystem in advance for this initiative, which brings expansion possibilities for DApps that cannot be built on ZK Rollup. This will give ZK Rollup enough time to mature and make it seamless, while maintaining the development trend of Ethereum. Below we briefly compare Optimistic Rollup and ZK Rollup through several aspects.
Flexibility: universal computing
Optimistic Rollup
Although Optimistic Rollup can be used in some special application scenarios, the most important innovation in this technology is OVM: Optimistic Virtual Machine. OVM can support the implementation of arbitrary smart contract logic. From this perspective, almost everything possible in Ethereum is also possible in OVM, including smart contracts and their composability. OVM can be based on EVM, EWASM or any other virtual machine.
If used with EVM, another benefit of OVM is that it can support Solidity code. Therefore, OVM can easily transfer most of the existing code base directly.
It is ideal for OVM to directly use the existing EVM code, and it must not be that simple to implement. The implementation of OVM will need to change the format of Ethereum CALLDATA and adopt a complex response protocol to achieve fraud proof. This may lead to divergence between OVM and EVM, which makes it impossible to correctly handle edge cases. This means that it is still difficult to rewrite existing contracts to OVM.
Another challenge for implementation is that fraud proofs for larger blocks may exceed the gas limit of L1. This makes these fraud proofs have to be broken down into multiple ETH transactions.
ZK Rollup
So far, all existing operations of ZK Rollup have focused on token transfers or atomic swaps. There are several main reasons.
First of all, there is still no effective technology that can be used to concise recursive proof combinations for different Zero Knowledge Proofs. Executing different smart contracts in the same block requires a recursive combination of different zero-knowledge proofs. Moreover, every new version of the smart contract requires a new trust setting process, which is obviously unrealistic. At present, the validators of STARK, a zero-knowledge proof technology that does not require trusted settings, only deal with a very limited type of problem. The STARK verifier must execute each constraint of the proven calculation statement at least once, which also means that we cannot repeatedly integrate and execute smart contracts with different architectures.
With the emergence of SNORK (Succinct Non-interactive Oecumenical (Universal) Arguments of Knowledge), the above-mentioned situation has begun to change. SNORK is a new generation of zero-knowledge proof based on a different set of encryption models called polynomial commitment schemes. Although the trusted setting is still required, it is now universal and can be updated. Once completed, you can continue to use it in any different program at any time. The Supersonic developed by Findora is a completely new, completely concise and transparent ZK-Snark technology.
Looking at it so far: Now the obstacles to establishing a general smart contract on ZKP have been eliminated. ZK Rollup can fully support the same programming model as EVM (including seamless composability and interoperability). Although the learning time for Solidity developers will not exceed 1 day, the initial contract may require a dedicated DSL. Ultimately, in view of the latest developments in zero-knowledge proof technology, we hope that all existing ETH contracts can be effectively transplanted with minimal effort.
Expansion and transaction costs
Optimistic Rollup
- The current estimate is about 4k gas/tx per transfer.
- Equivalent to about 100 TPS
- When using BLS signature aggregation, this number can reach up to 500 TPS.
- If EVM compatibility is broken, the throughput may theoretically increase to the limit of ZK Rollup.
- Actual throughput limit (token transmission): 500 TPS.
ZK Rollup
- The public data cost of each tx transmission in the material test network is currently 16 bytes and costs 272 gas/tx.
- In addition, the cost of certification is estimated to be approximately 300,000 gas.
- Even if we assume that a proof cost of 1M gas needs to be provided in the worst case, the estimated transaction limit will still exceed 2140 TPS.
- Gas cost is a big bottleneck because it is decentralized and anti-censorship. We expect this factor to decrease significantly over time.
- Actual throughput limit (token transfer): more than 2000 TPS-similar to VISA.
In many cases, ZK Rollup can save a large part of the cost. Although Optimistic Rollup requires users to post complete transaction input, a big difference of ZK Rollup is that users can do it without complicated operations in the two options. Out of choice, in ZK Rollup, we can flexibly choose between the following two options:
- The transaction input minus the witness does not affect the state transition,
- Only publish transaction output.
Since any Rollup will stay in each block shard, the cost of CALLDATA (and Rollup transaction cost) will not change much unless bandwidth becomes cheaper.
Optimistic Rollup is still in the proof-of-concept stage. Hope we can see the version on the mainnet soon. If it turns out that it is relatively easy to transplant existing code, many projects will gradually start to adopt it and establish a new infrastructure: for example, L2 technical support will appear in the wallet and so on.
For Ethereum, both types of Rollup must undergo similar infrastructure changes in e-wallets, oracles and other smart contract components.
Findora will deploy ZK Rollup from the bottom and directly support this expansion solution that is only available on L2 on Ethereum. Although the ZK Rollup in Ethereum is very mature in some application scenarios, such as token trading, it will take some time for a fully universal smart contract to reach a version that can be adopted by the main network.
Source link: mp.weixin.qq.com
