Ethereum layer 2 scaling solutions: Zero Knowledge and Optimistic rollups explained.

Rollups are an Ethereum layer 2 scaling solution that takes computation off-chain, improving transaction speed and significantly reducing gas fees. Although rollups perform their work off-chain, they keep transaction data on the Ethereum mainnet and are thus able to derive security from it, maintaining trust. Zero Knowledge rollups work by using validity proofs to verify that the off-chain transactions are genuine but are complicated to implement and computationally expensive. Optimistic rollups assume that all transactions are genuine and allow users to challenge transaction legitimacy, triggering fraud proofs that have the ability to roll transactions back.

Why do we need them?

Historically, Ethereum has struggled with high gas fees and scalability issues, which are exacerbated by increased traffic and more users. To address this, Ethereum transitioned to Proof of Stake (PoS) during the Shapella upgrade. This was a major change to the core Ethereum protocol and greatly improved its scalability. To solve scalability issues, you can generally attempt to make changes to the Ethereum mainnet, like the PoS upgrade (Layer 1), or you can find an alternative solution, that moves some degree of computation off-chain, like a Layer 2 does. The Ethereum community has gravitated towards Layer 2 scaling solutions since they are easier to implement and do not risk altering Ethereum’s security or decentralization.

What are rollups?

There are different types of Layer 2’s like State Channels, Plasma and Rollups. All of these Layer 2’s move transactions off-chain but remain anchored to the Ethereum mainnet, where they submit transaction data. This increases transaction speed and lowers gas prices while maintaining decentralization and security. Rollups are currently the most popular Layer 2’s and have two variations: Optimistic rollups and Zero Knowledge rollups. Both solutions perform their computation off-chain before bundling/rolling up the transactions and submitting them to the Ethereum mainnet. There is a smart contract on the main net which contains the state of the rollup. The batch, containing thousands of transactions, is stored as only a single transaction on Ethereum, saving a massive amount of space. The types of rollups differ in the way they submit their transaction data to Ethereum and verify that the transactions have been processed honestly.

In order for someone to use a rollup, they must first deposit their Layer 1 tokens into a bridge contract. This locks the tokens and mints an equivalent amount of Layer 2 tokens for the user. At this point, the user can interact with Dapps and make various transactions. Once a transaction is made, it is submitted to a node operator, which processes new transactions. The operator then bundles the transactions up and compresses them so that they can be added to a batch. The transactions have now obviously changed the state of the rollup (the account balances etc) and so the operator needs to create a new state root.

A state root is the root of a Merkle Tree, which contains all of the account balances and smart contracts inside the rollup. The new state root is combined with the compressed transactions and the previous state root to create a batch. The batch is the data that is sent to Ethereum, in the form of calldata. Calldata is a type of data in smart contracts, which is used to pass parameters to functions, and is cheaper than storing the data in storage.

Optimistic rollups:

With optimistic rollups, there is no verification before submitting the batch to the rollup contract on the main Ethereum chain. Once the batch has been submitted, the state will be updated, as long as the previous state root in the batch matches the state root currently declared in the rollup contract. The way Optimistic rollups provide security is by introducing a challenge period and fraud proofs. Once the batch has been sent to Ethereum, a challenge period begins, which is a seven-day period in which validators can dispute the batch. Because the transaction data is available on the Ethereum mainnet, anyone can re-execute the transactions and verify if the new state is correct. If someone (a user or another node) disputes the batch, a fraud proof will be triggered, that executes the disputed transactions on the Layer 1 chain to confirm the true state root (this is called a single round interactive proving). If the state is incorrect, the operators who submitted the batch will be punished by having their bond slashed. A bond is an amount of collateral, or stake, an operator needs to commit so that they can execute transactions and submit batches. As long as one honest operator remains in the network to compute fraud proofs, trust can be maintained. It must be noted that liquidity providers are available who can allow you to bypass the challenge period and withdraw your funds on Ethereum much faster.

The two biggest Optimistic Rollup protocols are Optimism and Arbitrum. There are a plethora of defi protocols and other Dapps available on these networks and they allow a seamless integration with base Ethereum.

+Very cheap gas costs per batch
+High throughput
+Technology is not overly complex
+High compatibility with EVM and solidity allows easy transition for developers

-The withdrawal period is a week-long
-Full block data needs to be published off-chain somewhere so validators can perform fraud proofs. This can be costly and tricky to implement
-If a Layer 2 has only a small group of operators to submit batches, there is the risk of centralization

ZK rollups:

If you’ve never heard of a Zero Knowledge proof before, this video does a great job of explaining how an Interactive ZK proof works:

Zero Knowledge rollups share many similarities with Optimistic rollups: They both execute transactions on their own network, they both use Merkle trees to represent the state of the rollup, they both compress and bundle up transactions and submit them to Ethereum as calldata, and they both ultimately improve scalability and lower gas fees. However, they differ greatly in the way they process the transactions and the way in which they ensure trust and verify that the transactions are honest.

Zero Knowledge rollups contain two on-chain smart contracts. One of them stores the state of the rollup, similar to the Optimistic rollup’s smart contract, and the other is used to verify the proof submitted by operators. When an operator submits a batch to the Ethereum mainnet, it also needs to submit a validity proof. The validity proof proves that the new state of the rollup has legitimately resulted from the transactions that occurred in that batch. In the case of ZK rollups, the validity proof is called a Zero Knowledge Proof. A ZK proof uses complex cryptography to prove a statement, without revealing any data about the actual statement. Because the data can be verified through the ZK proof, not all transaction data needs to be stored on-chain, like in the Optimistic rollup. This allows even greater compression and further increases throughput.

There are many different types of ZK proofs, but the two we are seeing the most in Ethereum are zkSNARKS and zkSTARKS. Both zkSNARKS and zkSTARKS generate proofs by running an advanced algorithm through a circuit, with a number of different inputs. The inputs include the data to be proved, public inputs, and a proving key. The result of the circuit is the proof and some outputs. A verifier can verify the legitimacy of the proof by running a separate algorithm that takes some inputs, including the proof, and verifies if the transactions are valid.

A zkSNARK is an acronym for Zero-Knowledge Succinct Non-Interactive Argument of Knowledge. As we have mentioned, zero-knowledge means that the statement can be proved without revealing any information (or evidence) about it. Succinct means the proof is smaller in size than the data it is proving to be true. Non-interactive means the prover and verifier do not need to continuously interact with each other (like in the video). Argument in this context means that the proof works and cannot be cheated. (of) Knowledge means that the SNARK cannot be constructed without access to the data it is trying to prove.

zkSNARKs refer to the proving key as a Common Reference String (CFS). The CFS sets the public parameters for proving and verifying validity proofs and its security is thus of the utmost concern. When generating the CRS, secret, random numbers are encrypted into it. False proofs can be generated if the inputs to a CFS are known, attesting to the importance that they remain secret. To ensure secrecy of the random values, many protocols implement a multi party computation ceremony, where numerous participants submit a random number.

zkSTARK stands for Zero-Knowledge Scalable Transparent Argument of Knowledge. They are very similar to SNARKS but instead of using CFS’s, they use publicly verifiable randomness to set parameters for generating and verifying proofs. Using public randomness is more secure and “Transparent”. STARKs are said to be “Scalable” and keep their proving and verifying times low as the data inputted grows. The proofs however are much larger than those in SNARKs and are therefore far more costly to verify. STARKs also use collision-resistant hashing, which is resistant to quantum computing attacks.

It must be noted that the generation of ZK proofs is a complicated and computationally expensive process, which is not yet suited for general-purpose EVM execution. Currently, ZK proofs have a few applicable use cases such as anonymous payments, authentication, and reducing bribery and collusion in on-chain voting. SNARKs have been used for rollups like ZKSync, Loopring, Aztec etc. STARK project on the other hand includes StarkNet, dYdX, and Polygon Miden. The technology is still evolving and perhaps in time, we will see ZK proofs ready for general purpose execution. When compared to Optimistic rollups, we can see some clear advantages, but there are still some cons that may be solved in time.

+Faster withdrawal period when compared with Optimistic rollups
+Even higher throughput and better data compression
+Secured by trustless cryptography measures

-Higher cost of submitting batches
-Complex technology, difficult to implement
-ZK rollups are not very compatible with the EVM and existing smart contracts
-High hardware requirements

Summary:

Layer 2 scaling solutions are an effective means to improve scalability whilst still maintaining the security provided by the Ethereum consensus mechanism. Optimistic rollups and Zero Knowledge rollups each have their pros and cons and are constantly evolving technologies that may change over time. Each Layer 2 presents an immediate solution to the Ethereum scaling problem and could even combine with Layer 1 scaling solutions like sharding, to immensely improve transaction speeds and throughput, while lowering gas fees.

References:

https://ethereum.org/en/developers/docs/scaling/optimistic-rollups/

https://ethereum.org/en/developers/docs/scaling/zk-rollups/

https://vitalik.ca/general/2021/01/05/rollup.html

https://ethereum.org/en/developers/docs/scaling/

https://docs.alchemy.com/docs/what-is-the-difference-between-memory-and-calldata-in-solidity

https://www.alchemy.com/overviews/snarks-vs-starks

https://limechain.tech/blog/zero-knowledge-proofs-explained

https://betterprogramming.pub/understanding-zero-knowledge-proofs-through-the-source-code-of-tornado-cash-41d335c5475f