State Committees on EigenLayer via Lagrange

In this article, we’ll explore the concept of shared security for interoperability, and explain how Lagrange State Committees can reduce the cost of bootstrapping safety for interoperability protocols. While we focus on shared security for cross-chain interoperability protocols, any decentralized application — irrespective of the use case — can harness this emerging technology to achieve sufficient decentralization and trust-minimization without incurring excessive operational overhead.

Lagrange State Committees: A Light Client for Optimistic Rollups

What are Lagrange State Committees?

The Lagrange State Committee (LSC) network is a simple and efficient ZK light client protocol for optimistic rollups (ORUs) that settle on Ethereum (e.g., Optimism, Arbitrum, Base, and Mantle). LSCs are conceptually similar to Ethereum’s Sync Committee, and support light client-based applications — like bridges and interchain message layers — that want to use an optimistic rollup’s state without taking on excessive trust assumptions.

A Lagrange State Committee is a group of client nodes that have restaked 32 ETH worth of collateral on Ethereum via EigenLayer. In other words, a Lagrange State Committee network is an AVS or Actively Validated Service. Each Lagrange State Committee attest to the finality of blocks for a given optimistic rollup once the associated transaction batches are finalized on a data-availability (DA) layer. These attestations are then used to generate state proofs, which applications can treat as a source of truth for the state of that particular optimistic rollup.

While Ethereum’s Sync Committee is capped at 512 nodes, each Lagrange State Committee network supports an unbounded set of nodes. This ensures that economic security is not artificially capped and the number of nodes attesting to the state of an optimistic roll up can scale, thereby dynamically increasing the economic security behind Lagrange state proofs.

How does the Lagrange State Committee network work?

Two key components of the Lagrange State Committee protocol are the sequencer and client nodes (another name for validators registered to a Lagrange State Committee). The sequencer is a central entity responsible for coordinating attestations in a Lagrange State Committee network and serving attestations to the provers that produce state proofs. The sequencer node is actually a combination of three modules with different functions: Sequencer, Consensus, and Governance.

At specific intervals, the Sequencer module requests attestations from client nodes to rollup blocks resulting from the execution of a batch of transactions that were written to a DA layer. Instead of executing this routine for every optimistic rollup block, we can do it once for each transaction batch that is finalized for a given rollup on a DA layer. This improves the network’s throughput and reduces overhead for both client nodes and the sequencer and prover.

An overview of interactions between the Sequencer module and client nodes in the Lagrange State Committee network.

Client nodes are expected to run a containerized watcher node — or maintain an RPC connection to a watcher — for the optimistic rollup whose state they are attesting to. That way, client nodes in a state committee can independently verify each rollup block header. This design ensures that the sequencer in the LSC network only works as a coordination mechanism and has no role in the actual attestation process.

Generating an attestation requires signing a block data object of the form:

Below is a brief analysis of each element in the block message:

1. Block_header: A header of a finalized optimistic rollup (ORU) block. “Finality” here means a block derived by rollup nodes from transaction data finalized on a given DA layer. For example, finality is defined by the safe L2 head for Optimism/OP stack rollups and an L2 block with Ethereum equivalent finality for Arbitrum and Arbitrum Orbit chains.

2. current_committee: A cryptographic commitment to the set of public keys associated with client nodes permitted to sign a block b. A client node is expected to build a Merkle tree, with leaves representing public keys of all active committee members, and sign the root of the Merkle tree with its BLS12–381 key.

3. next_committee: A cryptographic commitment to the set of public keys associated with nodes permitted to sign the next block (b+1). Nodes that wish to leave a state committee must submit a transaction at the end of the attestation period to the Lagrange Service contract on Ethereum that handles registration and deregistration of operators in the State Committee AVS.

At the end of each attestation period, the set of committee nodes may be altered if operators request to leave or join before the next attestation period commences. Client nodes are expected to build a Merkle tree of the next_committee by retrieving the current set of nodes registered to each committee from the Lagrange Service Contract.

ELI5: What are state proofs?

A state proof is a cryptographic proof of a blockchain’s state: a proof of a block header from a source chain (chain A), which can be used to prove to the destination chain the existence of a state on the source chain, such as a particular transaction. In other words, a state proof represents a proof of the source chain’s state at a specified block height. If Alice’s Merkle proof verifies against the transactions tree root stored in chain A’s block header, Bob can confidently approve the bridging transaction on chain B (the destination chain) as the state proof attests to the existence of Alice’s transaction on the origin chain.

The Lagrange State Committee network is designed to generate state proofs for optimistic rollups secured by Ethereum. State proofs are generated by aggregating BL12–381 signatures on the tuple described earlier (block_header, prev_committee, and next_committee) from at least two-thirds of nodes in the state committee. The state proof is then generated by a SNARK circuit based on the collective weight of signatures attesting to a given block header.

The Sequencer node aggregates attestations from node operators using the Consensus module.

The approach of requiring attestors to commit to the current and next state committees is similar to the Ethereum Sync Committee protocol and achieves a similar goal: enabling light clients to verify the validity of an optimistic rollup block header efficiently and securely. Each state proof is cryptographically linked by a series of next_committee commitments indicating which nodes should sign the next block. Thus it is enough to verify a SNARK proof that proves the following recursive properties in the block object signed by attesting nodes:

• At least ⅔ of the n nodes in a state committee signed the block header b.
• The current_committee of block b equals the next_committee tree of block b-1.
• Block b-1 is either the genesis block, or is valid with respect to these three conditions.

Interoperability protocols and other applications that require secure optimistic rollup state with fast finality (e.g., cross-chain bridges and messaging protocols) can use state proofs from Lagrange State Committees with minimal trust assumptions.

How does the Lagrange State Committee network interoperate with the ZK Big Data Stack?

In the first post of the series on Lagrange’s product suite, we highlighted the relationship between different parts of the ZK Big Data Stack: Lagrange State Committees, Recproofs, zkMapReduce, and the Lagrange Coprocessor. Each of these components, when combined together, collectively provide secure, efficient access to state and expressive, dynamic computation on state data:

1. The Lagrange State Committee network integrates with the other components of the ZK Big Data Stack for better performance. We use Recproofs and zkMapReduce to create updatable aggregate public key (APK) proofs for state committees — allowing us to avoid costly and time-consuming process of deaggregating and re-aggregating public keys of non-signers whenever a new aggregate signature has to be created.

Efficient aggregation of BLS public keys of operators in the Lagrange State Committees AVS facilitates higher participation rates in the AVS without increasing computational cost of verifying attestations from committee nodes. This is why Lagrange State Committees are able to support an unbounded set of nodes and exhibit superlinear security as more capital is pooled into state committees. You can learn more about this property in our post on scaling programmable trust on EigenLayer with ZK Big Data.

Integrating Lagrange State Committees with the ZK Big Data stack also has more direct benefits for client applications leveraging Lagrange state proofs. For example, we can use the Lagrange Coprocessor’s zkMapReduce feature to combine multiple state proofs from n optimistic rollup chains into a single multi-chain state proof. This allows for “nested verification”, where a single on-chain transaction simultaneously verifies the state of multiple optimistic rollups, and reduces verification costs for client services.

2. The Lagrange Coprocessor integrates with the Lagrange State Committee network to power trustless off-chain computation. The Lagrange Coprocessor — which we will analyze extensively in a subsequent post — supports cheap and scalable computation on on-chain data by performing verifiable computations off-chain.

Cross-chain interoperability protocols who integrate with the Lagrange State Committees can also integrate with the Lagrange Coprocessor, to facilitate expanding their cross-chain offerings to include verifiable computation. For instance, a developer building a multi-chain lending application may want to calculate the sum of collateral deposited by a user across n different rollups. Our friendly developer can leverage the Lagrange Coprocessor to compute this value, using whatever block header source the cross-chain protocol already relies on.

Why Lagrange’s State Committees network is a game-changer for interoperability in optimistic rollups

Shared, superlinear security for optimistic rollup light clients

Currently, interoperability protocols that support bridging from optimistic rollups are independently responsible for verifying the state of source chains — and their security depends on their mechanism for verifying that a block header is correct.

Some cross-chain communication protocols attempt to reduce trust assumptions by implementing native staking and asking a set of verifiers to bond collateral before attesting to block headers of source chains. However, this fragments economic security across different cross-chain protocols and the cost of corrupting a subset (k of n) of each protocol’s validator set is lower. In contrast, Lagrange State Committees allow multiple cross-chain protocols to derive security from a single, dynamic set of validators that can scale to an unbounded size.

This changes the status quo, where each interoperability protocol is independently responsible for verifying the accuracy of cross-chain states, to one where multiple applications can consume cross-chain state from a single source. Unlike other light client protocols, Lagrange’s State Committee network supports a dynamic, unbounded set of attesting nodes. The economic weight of signatures securing each attestation can, therefore, scale dynamically as more stake is pooled into the state committees, enabling a superlinear increase in security and raising the difficulty of attacking integrated cross-chain protocols in isolation.

Lagrange State Committees and their role in the shared security universe.

This effectively makes the Lagrange State Committee a “shared security zone” that any cross-chain protocol (regardless of its size) can plug into for maximum security. Additionally, integrating with EigenLayer’s restaking middleware enables the Lagrange State Committee network to extend Ethereum’s economic security to secure an arbitrary number of downstream cross-chain communication protocols.

Reduced overhead for cross-chain product development teams

A developer building a cross-chain interoperability protocol today must develop infrastructure to independently run watchers to verify the state of every optimistic rollup that they support. As the number of integrated optimistic rollups grow, the infrastructure overhead of managing security across each origin chain increases.

Integrating with the Lagrange State Committee allows the developer to outsource their security and instead focus resources on optimizing their product features. To put this into context: Each Lagrange state proof is lightweight enough to be verified efficiently on any EVM compatible chain.

Additional Security for Existing Interoperability Protocols

Lagrange state proofs are agnostic to the transport layer used to relay them to destination chains, allowing interoperability protocols to seamlessly stack Lagrange state proofs with existing security mechanisms. For example, a cross-chain oracle or cross-chain messaging protocol with an independent validator set can verify a Lagrange state proof as an added security measure before relaying cross-chain message requests from optimistic rollups.

Moreover, an existing interoperability protocol, once integrated with the Lagrange State Committee network, can add support for new optimistic rollups without requiring validators to increase the number of chains they monitor. By using state proofs from the Lagrange State Committee network, validators only have to relay message requests and proofs. A gateway contract on the destination chain can validate the existence of messages passed by relayers by verifying a Lagrange state proof.

How does the Lagrange State Committee network compare to other cross-chain security mechanisms?

Lagrange State Committees compare favorably to existing interoperability infrastructure that utilize bonded staking/slashing, permissioned validation, and optimistic verification mechanisms (among others) to enhance security of cross-chain state proofs. Below are some comparisons:

External Verification by Permissionless Validators

Lagrange’s restaking model mitigates a key problem in cross-chain security mechanisms that implement pure PoS staking for security: risk stacking. Take, for example, a cross-chain protocol that requires validators to buy and lock up a protocol’s native token for the bonding period. As the popularity of the cross-chain protocol’s native token changes, the volatility of the asset’s price affects the total economic security of the network.

Price volatility is less of a problem for the Lagrange State Committee network as the security of committee nodes is based on restaked collateral through EigenLayer. In addition, restaked collateral has reduced opportunity costs for prospective validators, meaning more participation in state committees and a higher level of economic security for interoperability protocols. For users, this means lower fees and more security compared to interoperability protocols that independently bootstrap their security.

We also note that consensus protocols used in traditional Proof-of-Stake place limitations on validator count (e.g., Tendermint BFT caps participation at 100–200 validators) and prevent traditional PoS protocols from scaling economic security as often as needed. Conversely, the Lagrange State Committee network uses an attestation mechanism that supports a potentially unbounded set of nodes participating in consensus. This ensures that the network can dynamically increase the number of attestors and by extension, provide more robust guarantees of economic security for client applications.

External Verification by Permissioned Validators

Proof-of-Authority (PoA) based cross-chain protocols rely on attestations to block headers from a small set of permissioned nodes. These approaches have historically proven insecure with high profile incidents including the Ronin hack (5 out of 7 validators compromised) and Harmony One bridge hack (2 out of 5 validators compromised).

Using a permissionlessly validated system like the Lagrange State Committee network does reduce efficiency somewhat compared to a centralized operator or validator set signing headers. But given the amount at risk, we consider this a sensible tradeoff. Permissionlessly validated systems also decrease the attack surface for companies who, more often than not, may end up running a majority of validators in a permissioned system.

Canonical Bridging

The Lagrange State Committee network eliminates the latency of sending cross-chain messages from optimistic rollups. Each LSC acts as a “fast mode” for bridges and messaging protocols whose users would like to bridge from an optimistic rollup without waiting out the challenge window. Optimistic rollups also directly benefit from the LSC’s fast-finality property as it solves a key UX pain point for L2 users.

This guarantee derives from the observation that: (a) the slashing mechanism is designed to raise the cost of adversarial actions, and (b) slashing of colluding nodes in a LSC can happen on-chain in slow mode as there is variable time delay on withdrawal of stake. In summary, participants in a LSC always have the incentive to attest to correct cross-chain states — which enables cross-chain applications to use state proofs from an LSC immediately and with minimal trust assumptions backed by the rollup’s canonical bridge.

Spotlighting Trailblazers in Cross-Chain Interoperability

There are some teams in the interoperability space that are moving the industry towards a future where users can move assets across different blockchains with both strong security and user-experience. This section will shine the spotlight on some of these teams:

Mantle: Modular L2 Infrastructure for Building High-Performance, User-Friendly dApps

Mantle is an Ethereum L2 blockchain pushing the boundaries of modular design with plans to integrate with EigenDA for data availability service. The protocol has also demonstrated a commitment to providing users with secure and efficient interoperability and will be partnering with Lagrange Labs to deploy a Mantle State Committee to facilitate secure interoperability for developers that wish to leverage Mantle state in their applications.

Read The Arrival of Mantle Mainnet & Our Ecosystem and Mantle Launches Best-in-Class Native Yield to learn more about Mantle’s bold approach to driving mass adoption of token-governed technologies.

Polymer: Trust-minimized interoperability for Ethereum rollups through native IBC technology

Polymer is bringing the world’s most battle-tested and advanced interoperability technology — Cosmos’s Inter-Blockchain Protocol (IBC) — to Ethereum. IBC connects 100+ blockchains in the Cosmos ecosystem and has facilitated over $30 billion in cross-chain transfers since its launch in 2021, without any large-scale security breach to date.

Polymer Labs is building Ethereum’s Interoperability Hub, enabling interoperability among all Ethereum rollups through native IBC technology. Polymer’s unique approach allows applications to have both composability between Ethereum rollups and with Cosmos chains, while leveraging features including interchain accounts and application callbacks.

Read Polymer: Ethereum’s Interoperability Hub to learn more about Polymer Labs’ design philosophy and technical roadmap.

Hyperlane: Modular economic security infrastructure for interchain applications

Hyperlane is a permissionless interoperability protocol with a simple objective: help developers build cross-chain applications that abstract complexity of interchain interactions behind simple interfaces. Hyperlane enables developers to customize security parameters and choose a custom Interchain Security Module (ISM) for messages relayed via Hyperlane’s network.

With Interchain Security Modules (ISMs), developers can choose how much stake secures relayed messages and whether that stake comes from Hyperlane’s Proof of Stake protocol or EigenLayer’s restaked validator set.

Read Modular Economic Security: Bridge Disaster Insurance and Building With Modular Security Legos for more details on Hyperlane’s design, technical architecture, and roadmap.

Omni: Unifying cross-chain liquidity for rollup applications

Omni is a solution to the problem of fragmented liquidity in Ethereum’s rollup ecosystem. The protocol provides a global, unified view of rollup states and is designed to enable developers to launch applications that can seamlessly access liquidity and state from multiple Ethereum rollups. Additionally, users of applications running on Omni’s infrastructure can securely view and interact with cross-chain states, a feature that unlocks advanced use-cases like cross-rollup NFT mints, cross-rollup lending, cross-rollup identity, and many more.

Read Interoperability in Focus: Omni’s Vision for a Connected Blockchain Future to understand Omni’s role in facilitating interoperability among Ethereum rollups.

Conclusion

Lagrange Labs is hard at work, relentlessly testing and refining our system for both a public testnet and mainnet launch in 2024. If you’re a cross-chain application developer building an interoperability-focused product and want to improve safety for users by harnessing the power of shared security, reach out!

Visit the website | Follow Lagrange Labs on Twitter | Read the documentation

Acknowledgements

Ismael Hishon-Rezaizadeh (Lagrange Labs), Omar Yehia (Lagrange Labs), and Emmanuel Awosika contributed to this article. Emmanuel was contracted by Lagrange Labs to support the writing of this article. We thank the EigenLabs team and Mantle Network for their feedback and insight.