An in-depth look at Rollup’s tech, application, and data
The striking upsurge of DeFi that broke out in 2020 has brought a tremendous amount of activity volume for Ethereum, and induced a scalability problem. Gas Price in Ethereum has soared and remained above 100 Gwei, which is one of the public chains with the largest ecosystems. As a result, Ethereum is criticized as “the Noble Chain”. Although the Gas Price of Ethereum decreased in recent weeks, the inefficient problem caused by redundant storage and computing still exists. Currently, Rollups is undoubtedly the most outstanding among various Layer2 solutions.
Rollups inherits the design concept from other pioneers (e.g., Lightning Network, Plasma etc.). However, the difference between Rollups and other scaling solutions is the idea of storing off-chain data back to on-chain, which was the key to solving the problems of data availability, usability, and security.
In this report, we mainly focus on four Rollups development teams: Matter Labs, Optimism, Offchain Labs and Starkware. They have made great efforts to develop different types of Rollup Solutions, including ZK Rollups, Optimistic Rollups, and hybrids of the former two. In addition to technical solutions designers, many teams are also exploring applications containing key features of Rollups, such as Layer2.finance, Caspian and Dai Bridge. We will also make an in-depth analysis of each protocol.
According to the performance of data, the total value locked (TVL) in Layer 2 is less than 3% of DeFi. Rollups account for near 1/3 of all Layer 2 solutions due to most of them have not yet been widely implemented. At present, Optimistic Rollup is about to launch, hopefully raising Ethereum’s Transactions Per Second (TPS) up to 500. The launch of a general ZK Rollup solution still takes time, which is expected to raise tps up to 100x. Meanwhile, some hybrid Rollups could improve a theoretical tps up to 20k.
In summary, Layer2 is the necessary path to public chain development. While Rollups, currently makes the best trade-off among usability, security, scalability and universality among all Layer2 solutions. We are looking forward to witnessing the brilliant future of Rollups.
【Huobi Research Institute】Wang Tianchen, Xu Miaoyan, Chen Han, Yuan Yuming
Contact the Authors
Huobi Research Institute: HuobiResearch@huobi.com
I. Overview of Rollup
1.1 What is Rollup?
In the real world, people are relying on efficiency raised by high-speed transactions, instant confirmation, massive storage and centralized trust. While things are different on chain. The distributed system controlled by codes and game theory realizes a decentralized and trust-free environment. Storage and computing redundancy has become an important method to ensure system security. However, these redundancies inevitably bring more cost and efficiency reduction, which gives users the sense of technology is stepping backwards. Therefore, various solutions to improve the efficiency of blockchain have been proposed.
On-chain scalability solutions include expanding the block size, changing the consensus algorithm and sharding, etc. These solutions have not yet fully demonstrated their power to improve efficiency due to the current stage of blockchain development (for example, sharding in ETH2.0 is still under development). Meanwhile, they are still restricted to afford storage redundancy and computing constraints considering better security. However, the constraint could be broken by the introduction of off-chain scalability solutions. Transfer the storage and computing to off-chain and then design an effective mechanism to ensure they are reliable. This is the key of off-chain scalability solutions, among which Rollup is a typical example.
Therefore, what are Rollups? Packing and compressing transaction data off-chain, and then storing them on-chain, Rollup is a general term for layer 2 tech adopting such frameworks. An interesting fact related to this is that Matter Labs publicly stated that ZKSwap is not a Rollup, but a Validium. The reason is that ZKSwap did not meet the feature then.
1.2 How did Rollup evolve?
Before Rollups, Layer2 has experienced several generations of scaling technology. However, due to difficulties in realizing trustless, security, usability and generality, none of them has become a widely accepted solution. While the emergence of Rollups is the key to break the wall.
The earliest Layer 2 scaling solution is Side Chain, which attracted less attention until the rise of Polygon recently. However, sidechains such as Polygon are based on trusting a group of verifiers. They are considered as a compromise before the emergence of an easy-to-use solution without a trustless assumption, which is not the ultimate optimal solution. In addition, the industry doubt that if Side Chain can be classified as Layer 2 solutions because it will not keep synchronizing state change to the main chain. It is more likely to be an independent chain, a new Layer 1.
Lightning Network is one of the first Layer2 scaling solutions which try to use trustless assumptions. It respectively relieved the trust dependency on the counterparty and fund routing node through RSMC and HTLC (i.e., a user does not have to assume that the counterparty and fund intermediary nodes are honest). However, it makes many trade-offs in safety, usability and generality, which limit the promotion and application of this technology.
Plasma was born after Lightning Network. It has the characteristics of both Side Chain and Lightning Network. The difference lies in the delivery, organization and submission of off-chain transactions. In Lightning Network, the transmission is based on a network connected by state channels where the transactions are safely stored in. Both sides in channel can submit the subsequent state changes by themselves. However, Plasma is more like sidechains in transaction delivery and organization. There will be Layer2 operators who are responsible for receiving transactions, organizing storage (e.g. In Plasma Cash, users need to store part of the transaction information themselves) and submitting the status changes on-chain. As mentioned above, Side Chain is a trust-based model. To improve this, Plasma follows the idea of fraud proofs in Lightning Network. It effectively prevents cheat by setting a challenge period and incentive games. Unfortunately, Plasma inherited the previous weaknesses (i.e., safety, usability and generality). At present, it is basically a technical route that has been abandoned as an independent Layer 2.
Rollups retains the idea of Plasma relying on the operators in Layer2 to receive, store and submit state changes. At the same time, it takes good care of efficiency, security, and usability, proposing an idea of compressing data on-chain. In this way, the usability problem can be directly solved because on-chain data is public and transparent, which means that it is no longer necessary to sacrifice the user experience in order to prevent fraud. For example, both Lightning Network and Plasma require users to always stay online and to store proof data. Moreover, transmitting data from off-chain to on-chain also indirectly solves some potential security issues which do not exist in Rollups, such as the privacy leakage of Lightning Network watchtower, batch withdrawal on Plasma.
Therefore, Rollups has absorbed enough previous solution ideas and integrated its unique on-chain compression storage theory. At present, Rollups is definitely the most promising one among all Layer2 solutions. In this paper, we mainly focus on the current technology, application and data of Rollups.
II. Core of Rollups
In the previous chapter, we introduced what a Rollup is and how the idea of Layer2 evolves and inherits until the birth of Rollups. In this chapter, we will introduce the core theory of Rollups in depth. Specifically, different types of Rollup and different teams in the same technical route will also have some characteristics. Therefore, we focus on the common ideas of Rollups in this section.
2.1 How Rollups work?
As shown in Figure 2–1 below, it is a schematic diagram of Rollups operating principles. At first, various transactions will be sent to the operators on Layer2. After being compressed into a single transaction, the contract on-chain will be deployed. As a result, the processed transaction will be transmitted into the memory pool like any other Layer1 transactions where miners will pack them into new blocks. Unsurprisingly, the transaction packed by Layer2 operator will also be included.
Although the specific implementation of different Rollups will be different, there are three common problems: how to achieve transaction compression, how to synchronize the state transitions from Layer2 to Layer1, and how to ensure the operators submit all state transitions honestly. We will discuss them separately in the following sections.
2.2How to realize transaction compression?
As mentioned above, it can be understood why we have to put data on chain. In general, the data availability can be guaranteed if put on chain. However, the efficiency cannot be improved if the original data remains itself. That’s why data compression matters. When discussing compression, we usually compress the byte number of one single transaction. On the contrary, it mainly focuses on compression of the used gas in a transaction, because the block limit on Ethereum is gas instead of bytes. Fewer bytes correspond to smaller storage, but it is not equal to less gas. On the one hand, a compression in Rollups does cut down the number of occupied bytes. On the other hand, it will also reduce the calculation amount to use less gas.
A compression of transaction bytes mainly includes the following methods: coding in a more efficient way, reducing the number of bytes and cutting down the amount of data, etc.
Figure 2–2 demonstrates that the number of bytes occupied by a transaction on Layer1 and Rollups, which is summarized by Vitalik. Although some details are not exactly the same, every team follows the same idea in application.
In Rollups, the nonce can be omitted entirely; sometimes the Gasprice and Gas can also be omitted. We can replace the original address with an index in State Tree (i.e., we could add a Merkle tree to store the mapping of indices to addresses). Value can be stored in scientific notation. As for Signature, BLS aggregate signatures can be used, which allows many signatures to be aggregated into a single one. Furthermore, the cost of every single signature can be saved. Finally, all transaction data will be stored in Calldata which costs lower gas.
Specifically, the uploaded data from Layer1 includes the parameters above, the updated state root (e.g. State Root in Figure 2–3) and the data used to prove reliability in state transition. ZK Rollups perform better than Optimistic Rollups in compression. An important reason is that ZK Rollups need to upload fewer transaction data than Optimistic Rollups which use fraud proofs containing some intermediate state information.
In addition to compressing the number of bytes, the calculation amount in Rollups will also be less than directly executing on Layer1. We just need to verify whether the state transition submitted by operators on Layer2 is correct instead of re-executing all transactions. For ZK Rollups, it uses zero-knowledge technology to verify the state transition proof; for Optimistic Rollups, it verifies the fraud
At present, after compression, ZK Rollups would be a 100 times improvement on the scalability while Optimistic Rollups would be a 30 times improvement.
2.3 How to synchronize the state transitions from Layer2 to Layer1
In the previous section, we’ve mentioned that operators would also publish a batch, a collection of transactions in a highly compressed form together with the previous state root and the new state root.
As shown in Figure 2–3, we use Merkle Tree to record the transition of a Rollup. Leaf nodes are account states while intermediate nodes store the hashed information. Root nodes store final hash values, which are abstract of all account statuses.
Figure 2–4 describes the state transition before and after the transaction batch is published. Layer2 transactions will change the state of related accounts, resulting in information changes in leaf nodes and ultimately in root hash. Operators will maintain the state tree locally, recoding the changing root hash value. Once the batch is published, two hash values will also be uploaded.
2.4 How to ensure the L2 operators submit all state transitions honestly?
Since both the transaction and state transition data are published by operators. How to prevent them from publishing a fraud-proof is a common problem for all Layer2 solutions that need to synchronize states with the main chain.
Before Rollups, both the Lightning Network and Plasma use fraud proofs, e.g. when operators submit the batch, they will reserve a challenge period instead of verifying state transition directly. If no one challenges its legitimacy during this period, the transaction will be confirmed; on the contrary, challengers are supposed to provide a fraud-proof to prove the operator is malicious.
A fraud-proof is an easier way (compared to a validity proof mentioned later) that sacrifices user experience and fund efficiency. In previous solutions (i.e. Lightning Network and Plasma, both of which do not require data validity), users need to stay online at the most time (i.e. user activity) to prevent fraud. At the same time, all funds cannot be withdrawn freely until the end of the challenge period. However, optimistic rollups, which use fraud proofs, have made great improvements. Given that all data are put on-chain, challengers can easily distinguish a malicious transaction. In addition, although a challenge period exists, the finality of a normal transaction can be expected. Users can establish verification nodes to quickly verify the transaction legitimacy in advance. In this way, even a transaction is confirmed until end of the challenge period, its finality can be quickly determined. Theoretically, it is possible for liquidity providers to release deposits in advance.
Another more technically challenging method is a validity proof used in ZK Rollups, i.e. operators prove the published state transition is valid (or correct) in a directly way. In this way, users are unnecessary to worry about fraud. No freezing period for withdrawal. However, various technical difficulties restricted its development for a long time. As a result, ZK Rollups can only generate proofs for some specific operations. At present, ZK Rollups have witnessed many achievements in cryptography (e.g. the PLONK protocol, polynomial commitments, etc.). More general ZK solutions are promising in the near future.
III. Analysis of major technical teams
We’ve discussed the core of Rollups. In this chapter, we will sort out several representative Rollup teams and their solutions. Furthermore, we described a comprehensive analysis for each solution in the following aspects: security, exit time, user activity assumptions, universality, calculation volume, complexity, TPS improvement, etc.
ZKSync introduced by Matter Labs is a prime ZK Rollups solution, which carries more than 9 million dollars. Theoretically, only $0.001 will be charged for every single transaction ($0.1 at present) and TPS is more than a thousand. Due to insufficient demand, the real TPS is less than 0.1. Users will also take several hours to withdraw.
From the data above, we can conclude that ZK Rollups are not performing well at present. However, it is more likely to be limited by the current native development of Layer2 technology. All kinds of ZK Rollups are facing with its technical difficulties. In fact, Matter Labs is in an absolute leading position among all ZK Rollups teams. It is EVM-compatible and will definitely be a milestone in the next stage of ZK Rollups.
3.1.1 Project progress
Based on cryptographic proofs, Matter Labs developed a new scaling solution, called zkSync. The main net was launched in July 2020. The first version zkSync1.x was released in May 2021, and then the public test net vision zkSync2.0 was online. Until August 2021, the 2.0 main net was officially launched.
v1.0 supports asset transfers and does not support universal smart contracts. v1.x supports features including atomic swap and mint for NFTs. v2.0 will use a hybrid account structure of ZK Rollup and zkPorter, which supports full interoperability of both accounts, supports Turing-complete ZincVM, is portable to existing Solidity source code, natively supports all ethereum wallets. The developing zkPorter brings a significant increase in TPS by dropping on-chain data availability, which may a reach theoretical value over 20,000.
3.1.2 Technical solution
The current main net version of zkSync is based on ZK Rollups. However, a newly solution called zkPorter introduced in mid-April have attracted much attention.
We understand that pure Rollups ensure the data availability on chain avoiding a requirement of user activity. As a result, Rollups greatly improve user experience. However, due to the gas limit for every block, they can only achieve limit scalability. In conclusion, all technical solutions to ensure on-chain data availability will have an upper limit of scalability.
In order to simultaneously avoid user activity assumptions and greatly improve scalability, zkPorter stores data off-chain to solve the gas limit problem. At the same time, state transition proofs for all transactions, verified by the guardian, will be published on chain. Furthermore, sharding is also applied in zkPorter. The shard where ZK Rollup is located in the basic shard. The rest shard can be determined by users on data availability. Guardians in zkSync or protocols on each shard are designed to maintain its availability. Hence, zkPorter can collectively process as much as 20,000 TPS. Transactions costs can also be reduced by 10 times.
- High security, no upper limit of funds volume. We are aware of that Rollups have the same security as Layer1. At the same time, no matter how much the amount of funds deposited on Layer2 increases, its security will not be affected. Data validity on L1 and zero-knowledge proof are important part for zkSync. Furthermore, smart contract can automatically verify transaction validity based on state, data and proofs on Layer1, without other security assumptions.
- Relatively short withdrawal time. At present, it takes up to several hours for users to withdraw their money in zkSync, while only 15 minutes will be cost in theory. The main reason is that the trading volume on Layer2 is relatively sluggish. Extending the total time can effectively reduce the amortized fee for each transaction. Anyway, compared to the solutions using fraud proofs (e.g. Optimistic Rollups, Plasma, Lightning Network) which takes several weeks to withdraw, zkSync is still very convenient for users.
- No activity assumption. Zksync ensures data availability on Layer1 and transaction validity. Therefore, users are not required to stay online as much as possible to prevent fraud.
- Poor universality. Current Zksync is only equipped with some limited functions, such as deposit, withdrawal, and transfer. As a result, zkSync is not outstanding among all ZK Rollups in locked value. However, it is a common problem for the whole ZK Rollups solutions to support some specific operations, not only for zkSync. The team is now doing a research on EVM compatible solution and more universal smart contract. A fully functional zkSync 2.0 is expected to be published before 2022.
- Large calculation amount. For each transaction, in addition to calculating the state transition, the corresponding proof shall be generated, which will consume large computational resources. In contrast, solutions including Lightning Network, Plasma, Op Rollup eliminate such consumption. For the same transaction, zksync’s cost of layer 2 operators are higher than that of the Op, while resource consumption makes no significant challenge for zksync’s in the current context of low layer 2 utilization. If the ZK Rollup-based Layer 2 application scenario grows, dedicated provers or customized hardware could also mitigate the impact of issues on resource consumption and user experience. Alternatively, zkPorter’s solution offers a solution for less amount of computation and higher tps.
- Great complexity. Zero-knowledge proofs are too difficult to migrate and develop for general ZK Rollups teams. An EVM compatible may greatly improve the problem but will also significantly increase its code complexity. The code audit is more difficult to audit than OVM. Meanwhile, it may take several years to verify the security and robustness of ZincVM.
- Limited throughput improvement in Rollups, greater throughput improvement expected in zkPorter. Due to the gas limit ‘s upper bound of layer one blocks, Rollup’s throughput improvement remains low-level comparing to solutions not guaranteeing the on-chain data validity. Since Matter Labs has aware of the situation, the zkPorter was proposed to massively increase TPS.
At present, zkSync, as a head solution of ZK Rollups, has attracted much attention. For example, Curve has integrated zkSync on Ethereum testnet. ZkSync is available in imToken pocket. Both Sushiswap and Argent have decided to use zkSync. However, we are aware that the current zkSync only has limited functions. Few actual applications happen in the payment field (e.g. Gitcoin, Storj and Golem). Compared to the prosperous Layer1 ecology, these applications are insufficient in practicability and financial return, resulting in the actual throughput of zkSync is only about 0.05 tx/s.
Similar to Matter Labs, Optimism is the most representative team in Optimistic Rollup, which is originated from Plasma Group.
It introduced the OVM to reduce the code migration cost from L1 to L2, which is the basis for rapid ecological integration. Although the mainnet has not been launched, Synthetix is already established on its testnet where more than $100 million are locked. Particularly, a single transaction fee is likely to be as low as about $0.07. In terms of throughput, Optimistic Rollup can achieve 500 TPS in theory.
However, Optimism is now in the stage of limited access. It will be widely used for its better compatibility with general smart contract.
However, Optimism is now in the stage of limited access. It has been adopted in a wide range of projects for its better compatibility with general smart contract. In the short run, Optimism has a wider range of application scenarios.
3.2.1 Project progress
Based on Optimistic Rollups, Optimism proposed OVM and established Optimistic Ethereum. Its mainnet soft launch happened in January 2021. Subsequently, Synthetix began its migration to OE in March. It is available for users to process some basic Layer2 staking. However, synthetic asset business has not yet been deployed to the mainnet. OE is expected to be launched in July 2021.
3.2.2 Technical solution
Optimistic Ethereum is a representative implementation of Optimistic Rollups which have been discussed as aforementioned. Specifically, we describe a comprehensive analysis on OVM.
Optimism supports the use of OVM on Layer2 scaling network. On the one hand, it is compatible with EVM. On the other hand, some adaptive adjustments have been made to ensure OVM can implement Optimistic Rollups. Firstly, some opcodes are adjusted to ensure that the program can get the same results when executed on Layer1 and Layer2, such as adjustments to TIMESTAMP and ADDRESS. Secondly, complier is designed to ensure that the programs written by Solidity can be correctly complied into OVM-support opcodes. Lastly, Geth is modified to process transaction in OVM.
- Weaker security than of layer one. Solutions using fraud proofs rely on censorship resistance on Layer1. If the amount of funds on Layer2 is too large, 51% attack may happen. Miners on Layer1 may
- Long withdrawal time and low fund efficiency. The game model of Optimistic Rollups based on economic incentives cannot guarantee the transaction certainty before the end of challenge period. Moreover, end users who cannot run full nodes are not able to verify in advance. Therefore, Optimistic Rollups has a longer verification time than ZK Rollups. The challenge period of PoW and PoS are two weeks and a week, respectively.
- No user activity hypothesis, but a verifier is needed. Optimism ensures on-chain data availability. An external verifier can be used to monitor different status, instead of monitoring by users themselves.
- High flexibility, supporting general smart contract. Optimistic Ethereum is the first solution that has a complete cross-layer migration function without rewriting smart contract, i.e. the code migration cost for application on Ethereum is relatively low. Hence, it is widely chosen by many application teams.
- Low calculation cost and gas consumption on Layer1. It is unnecessary to actively verify the validity of state transition, which will save a lot of gas consumption compared with ZK Rollups. At the same time, it also saves the calculation cost of generating proofs on Layer2.
- Limit improvement on throughput. Optimistic Ethereum needs to provide more intermediate state data to facilitate fraud proofs than Rollups, so it can only bring dozens of times throughput improvement.
Although Optimistic Ethereum is inferior to ZK Rollups in terms of security and capital efficiency, its EVM-compatible solution is expected to be the most practical scaling method. In practice, many teams have adopted it as the next scaling solution, such as the Synthetix staking. In addition, Uniswap has always been cooperating with Optimism to promote its Layer2 implementation. An alpha version on Optimistic Ethereum will be released soon. Volmex is developing application on Optimism’s local testnet and OVM deploy. IDEX has already released a 2.0 version with lower latency and higher TPS. MakerDAO proposed a fast DAI withdrawal solution for Optimism. Lastly, both Compound and Saddle are expected to choose Optimistic Ethereum.
3.3 Offchain Labs
Arbitrum, a purely research-oriented academic project, was proposed and established by Offchain Labs. After continuous optimization and improvement, it gradually turned into practice.
Arbitrum is, essentially, based on Optimistic Rollup. It maintains security through the game model of economic incentives. At the same time, the transaction validity is maintained through fraud proofs. However, the main difference lies in the challenge mechanism and implementation form. At present, Arbitrum has not yet been launched on mainnet, but it has been running on the main testnet for a period of time. The overall performance is good. Test case demonstrates that its optimal throughput is around a few hundred and the challenge period is only tens of minutes. However, setting a short challeng time may bring some security issues that need to be solved in the future.
3.3.1 Project progress
In general, the Arbitrum testnet has been running smoothly for about six months so far. In March 2021, Offchain Labs updated the fourth testnet version which is selected as a candidate of the mainnet. On May 28th, its mainnet beta version, Arbitrum One, is available for developers. The mainnet will be expected to launch in 2021. According to the official roadmap, the next step is the mainnet lauch. Numerous projects are actively cooperating with the development team, conducting network integration, audit and stress testing.
If luckily, Arbitrum is more likely to overtake Optimistic Ethereum and become the first general Rollups scaling solution, which will be a major breakthrough for both the entire ecosystem and Rollups.
3.3.2 Technical solution
Similar to Optimism, Arbitrum is also compatible with smart contract on Ethereum, while the main difference is challenge mechanism. For Optimism, it is only required that sequencer and verifier publish a fraud proof to distinguish the result. For Arbitrum, it believes that one interaction may result in a fraud proof containing too many transactions, which may exceed the gas limit. Moreover, publishing a fraud proof is caused by a single instruction execution exception. So there is no need to execute all instructions. Hence, Arbitrum divides fraud proofs into multiple steps. If a sequencer is abnormal when executing one of all instructions, then he is malicious.
Arbitrum is similar to Optimism Rollup, so we mainly focus on the difference.
- Multiple rounds of fraud proofs interaction. Arbitrum uses multiple rounds of fraud proofs to verify transaction validity, which will reduce the gas consumption for a single challenge. No more worries about exceeding gas fee.
- Stronger compatibility with EVM. Compared with OVM, which is not 100% compatible, existing applications are not required to modify their codes when migrating to Arbitrum.
- Multiple interactions may have security issues. Built-in oracles are supposed to execute asynchronous procedure to verify, which is more complex for sure. The more codes, the more potential risks.
Since Arbitrum is coming soon, some popular applications have announced to develop on Arbitrum network, such as Uniswap, Sushiswap, MCDEX, Bancor, ImToken, etc. Particularly, Uniswap has voted to deploy V3 on Arbitrum. MCDEX V3 that create contracts without permission has already published on testnet. They will collaborate with Arbitrum to promote application test. At the same time, MCDEX V3 plans to immediately deploy on the mainnet as soon as it goes online. Lastly, OKEx also announced that users will deposit and withdraw through Arbitrum network, saving on transaction fee.
StarkWare, concentrates on Ethereum scaling technology, is a zero-knowledge proof research and development organization from Israel. This team has a wide layout, covering scaling technology, off-chain network, zero-knowledge proof protocol, programming language and applications.
In general, Starkware proposed two scaling solutions: Validium and Volition. Moreover, it has launched a decentralized L2 scaling network, StarkNet, which supports general computation on Ethereum. According to its roadmap, StarkNet is divided into four phases. At present, phase 0 is completed, i.e., zk-STARK, Cairo and StarkEx.
3.4.1 Project progress
StarkWare has improved the currently popular SNARK algorithm and independently developed a new generation of zero-knowledge proof: STARK. It was launched in June,2020, which can greatly improve operation efficiency and provide zero-knowledge signatures against quantum computing. In general, it is the base of entire StarkNet.
Moreover, StarkWare also established a unique programming framework (i.e. Cairo) to generate STARK proofs for general computing. Cairo was launched in October 2020. It not only has Turing completeness but also avoids the complicated circuit design in zero-knowledge proofs. Theoretically, it can separate proof generation and verification by design. At present, StarkWare is continuously improving Cairo. More functions, syntax and internal plug-ins will be added in the future.
In phase 0, StarkWare introduced the first DeFi based on STARK, StarkEx, which is more than a specific implementation of StarkNet. StarkEx was launched in June 2020, and then it upgraded to 2.0 version in December 2020. For StarkEx 2.0, it is completely established by Cairo, supporting interaction between L1 and L2. Moreover, it supports ERC721 tokens transactions, off-chain token minting and key recovery for smart contract. At present, StarkEx is in iterative upgrade state. StarkEx 3.0 will be launched in May 2021 as expected. Until then, L1 limit orders and batch-long flash loan will be added.
According to its roadmap, other three steps are as follows:
3.4.2 Technical solution
The first scaling solution proposed by StarkWare is Validium, which stores data off-chain and inherits from ZK Rollups to provide validity proofs for state transition. Specifically, data validity is guaranteed by the Notary who will convert the state of off-chain transactions to generate SNARK proofs, which avoids publishing wrong state transition. Moreover, data is designed to store off-chain, so the Notary can freeze deposits by not submitting. Therefore, Validium is not a Rollup technology. After discussion, StarkWare introduced a new solution: Volition. In fact, Volition is a combination of ZK Rollups and Validium (shown in Figure 3–3). Users can choose whether to put their data availability proofs on-chain or off-chain. Hence, we still classify StarkWare into this paper.
We introduced the aforementioned zkPorter of Matter Labs that is derived from Validium. While in zkPorter, off-chain guardians are not able to freeze users’ funds. Moreover, there is a ZK Rollup shard in zkPorter so that data availability is guaranteed on-chain. Users can choose to put their funds into ZK Rollup shard or other off-chain shards in zkPorter. In conclusion, zkPorter is more similar to Volition.
- Weaker security. Validium stores data off-chain and the Notary only provides the proof of state transition, not the transaction details. If the Notary intends to hide the newest state, users will not be able to proof their account state by themselves. Therefore, the Notary may be malicious to freeze users’ funds.
- Shorter withdrawal time. Because the Notary in Validium provides a validity proof for state transition, so a challenge period is no long needed.
- No user activity assumption. Although data validity is not guaranteed in this solution, SNARK proofs can easily prevent the Notary from publishing a fraud transaction. As a result, users are not required to stay online all the time, even if the Notary freezes funds.
- Stronger universality, incompatibility with EVM. Cairo is not EVM-compatible so that existing protocols require additional development work to migrate. We assume that it is one of the reason why Starkware is not widely adopted.
- Higher TPS. Because data are placed off-chain, TPS in Validium is much higher than ZK Rollups.
Currently, many protocols announced to integrate StarkWare scaling solution. BadgerDAO was launched on StarkNet in February. Celer plans to use Cairo to develop a zero-knowledge proof version of Layer2.finance. Moreover, dYdX, DeversiFi and Immutalbe have been launched to support StarkEx, with more than $1 billion transaction volume. Specifically, DeversiFi was the first to use StarkEx scaling engine to provide a token exchange function. Users pay no gas fee when they enter the network from L1. DYdX launched its mainnet in April, providing ten tokens of their perpetual contract. Lastly, Immutable cooperated with SarkEx in NFT, providing an Alpha version of ImmutableX.
IV. Application Solutions Explained
In aforementioned chapters, we present an in-depth analysis on the idea of Rollups technology and its technical teams. However, DeFi protocol applications are too important to ignore. Except that some existing projects on Ethereum tend to develop their own Rollups chain, other projects are designed to solve shortcomings of Rollups (e.g., liquidity fragmentation, challenge period). In this section, we will focus on three representative application solutions.
Celer Network launched the latest scaling solution called Layer2.finance in February 2021 to lower the threshold for using DeFi protocols, which shares the transaction fees borne for individual users through aggregation. At the end of April 2021, the mainnet was officially launched, which supports three DeFi protocols on Ethereum: AAVE, Compound and Curve. According to the data from Celer, more than $1.4 million was locked in Layer2.finance, which saved nearly $34,000 gas for more than 900 transactions.
When discussing Layer2 scaling solutions, people always attempt to move on-chain DeFi protocols off-chain, so that computation and storage on chain can be transferred. This idea, involving the migration of code, funds and ecosystem, is difficult to realize under the current development stage of Layer2. However, Layer2.finance is a novel solution that allows people to access all existing DeFi protocols at a fraction of the cost by aggregating transaction instructions on Layer2 and executing on Layer1 instead of migrating the original protocols.
Celer proposed Layer2.finance, a new Layer2 solution based on an “in-place” scaling, which consists of the following components:
Firstly, users are supposed to deposit their funds into Rollup Fund Pool of Layer2.finance. These funds will be divided into three different states: idle, committed and allocated. Specifically, committed funds is an intermediate state, allocated funds represent the liquidity token (i.e., stToken) after the transaction is executed, which can be used to redeem. Moreover, allocated funds can be converted into idle funds as well.
Secondly, funds on Layer2.finance can be allocated by users i.e., all funds are allocated into different DeFi protocols to obtain revenue or withdraw from them.
Thirdly, block producer of Layer2.finance will collect transactions on Rollup chain. At the same time, it will aggregate and classify the collected transactions according to DeFi destination address. When enough transactions have been collected or specific time ends, block producer will pack all transactions into one block, providing the state root of each user and specific plan for fund allocation.
Lastly, on-chain contract of Layer2.finance execute the corresponding fund allocation according to the received instructions. At the same time, the block producer will also update the L2 fund status based on L1. If fund allocation proposal is correct, it will return the corresponding liquidity token.
Since Layer2.finance is currently based on Optimistic Rollup, so a challenge period exists when Rollup block interacts with L1. During the challenge period, if the system proposes a wrong fund allocation, anyone can publish a fraud proof to roll back. In the future, Celer plans to introduce a ZK Rollup version of Layer2.finance to address low-latency requirements for a broader spectrum of strategies and further improve economy of scale with an already large user base.
- Low cost. If we consider DeFi as various subway stations, then Layer2.finance is the subway shuttling through different DeFi protocols. Layer2.finance acts like a “DeFi Public Transportation System” so that multiple people split the cost of individual layer1 DeFi transactions in a completely trust-free and non-custodial way
- No migration. For users, their own funds can still be used in multiple DeFi protocols as before, avoiding the problem of liquidity fragmentation caused by Layer2. For DeFi protocols, it can not only save the work of dedicated network but also help to attract more Layer2 users when connected to Layer2.finance.
- High scalability. In the short term, a single Layer2.finance chain is confined to the blockchain capacity, and may not be able to maintained as transaction scale increases. In the long term, once ETH2.0 is realized, multiple Layer2.finance Rollup chain can be added to the corresponding liquidity system. Furthermore, system scalability may usher in an outbreak.
Layer2.finance also has certain limitations at present. Firstly, aggregation may result in transaction delay. Users have to make a choice between cost and effectiveness because actual funds allocation is not instant. Then, it has a limitation of advanced operations. It is not possible to implement advanced and customized combination of DeFi protocols. Lastly, alternative DeFi protocols are limited. At present, Layer2.finance only supports three protocols. Although more strategic protocols will be gradually integrated in the future, those stable protocols with relatively higher yields may be priorities.
In April 2021, StarkWare proposed an L2-powered AMM liquidity aggregation design called Caspian, which can solve liquidity fragment. According to its roadmap, this solution is expected to realize in StarkEx3.0 (coming in June). However, it seems to be delayed now.
As off-chain scaling becomes the main topic of Ethereum in 2021, new AMMs are emerging. Up till now, L2 AMM designs entailed moving the AMM in its entirety to L2, including liquidity, resulting in undesirable fragmentation of L1 liquidity. For AMMs, they often require a large amount of different tokens to provide a good trading experience. Therefore, it is necessary to properly solve the liquidity fragmentation problem and improve capital efficiency.
L2-powered AMM design Caspian, produced by StarkWare, allows transactions to be processed on Layer2, and then allocates funds to each address from AMM pools on Layer1. Caspian includes off-chain and on-chain. Off-chain part consists of operator: a market maker functions as a coordinator. Its sole purpose is to match traders within each batch with one another and match the net difference against the L1 contract. It settles batches of trades using STARK proofs. Traders are users with funds on L2. Liquidity provider are LPs on Ethereum. On-chain part includes a L2-powered AMM and starkEx. The former is a smart contract, which presents a standard AMM interface with two major modifications. Its sole counterparty is Operator and withdrawals must not be serviced before the end of an open batch. The latter is the smart contract connecting the AMM’s logic with the off-chain StarkEx scalability engine.
Firstly, Operator aggregates a batch of transactions sent by L2 traders, and matches the quote. Then, the Operator generate an L1 limit order from the AMM and match the net difference (which equals the batch-long flash loan) with the L1 Limit Order. Lastly, the Operator publish batch to StarkEx to generate a batch of STARK proofs. Once the batch is validated by verifier, the Operator is supposed to update the state. In this design, it ensures liquidity to be deposited in other L1 DeFi protocols and allocates funds by instructions from L2.
Particularly, StarkEx will soon add new functions (e.g., Batch-Long Flash Loans). Flash Loans are not limited to a single transaction. Instead, it extends for the duration of a batch. It offers the Operator the ability to mint tokens on L2, as long as these tokens are burned by the end of the batch.
Existing DeFi rely on multiple market makers to provide assets in different networks. However, Caspian realizes instruction deployment and transaction aggregation on L2, allocating funds to each address from L1 AMM pools. It provides defragmented liquidity and better capital efficiency.
Theoretically, Caspian has a centralization risk. Because the Operator, who can pack transactions independently, not only presents as the counterparty for AMM smart contract, but also the sole object interacting with L1. Once malicious behavior occurs, users may suffer a loss. In addition, Caspian is still in conceptual stage and some components need to be updated, such as L1 limit order and Batch-Long Flash Loans. Lastly, Caspian is similar to Layer2.finance, which was launched in April.
4.3 MakerDAO：Dai Bridge
In early March, the MakerDao smart contract team released a new solution on its official forum, Optimism Dai Bridge, to support fast withdrawals, in order to solve the problem of Optimistic Rollup taking a week to withdraw. According to the team, the feature will go live in the third or fourth quarter of this year.
Since users have to withdraw their money for at least a week in Optimistic Rollups, Maker thinks that it will become an important factor to restrict the development. User experience will be affected as well.
Optimism Dai Bridge introduces an oracle to quickly verify the transaction published by sequencers. Once validated, DAI to be withdrawn on Layer2 will be used in advance to mint the same amount of DAI on Layer1 through fDAI bridge. In this way, the problem of capital efficiency and composability caused by long waiting time can expected to be solved.
Firstly, all transaction requests related to oDai (DAI on Layer2) will be recorded by CTC contract (i.e., Canonical Transaction Chain, a component of Optimism Rollups). Secondly, Maker oracle will verify the withdrawal request to confirm transaction validity and amount. Verified withdrawal requests will be published on Layer1 to mint the same amount of fDai, which represent the locked DAI. Lastly, users stake fDAI and mint new DAI. When the challenge period ends, locked fDAI together with DAI will be liquidated. Therefore, users pay a few interest to near-instantly withdraw their money, instead of waiting for a week.
Maker also plans to expand on this fast withdrawal service, offering general swaps for any token. Except for DAI, trades would work by swapping the token for oDAI on L2, swapping the oDAI for L1 DAI and finally swapping back to the L1 token. This requires an AMM to be present on L2, as well as integrating with an L1 AMM.
In this design, it is assumed that the oracle works to verify the transaction in advance. Therefore, the finality of withdrawals can be validated and locked tokens are returned to users in advance.
- Fast withdrawal time. The withdrawal time is cut down from one week to a few minutes.
- No counterparties. Maker is able to issue Dai as required, so fDai is just used as a bridge. Moreover, the solution is logically connected with existing mortgage and lending contract to provide asset protection. Users are unnecessary to interact with Maker, so counterparty will not be involved.
- Strong flexibility and high liquidity. Maker has set up a fDAI vault where users can not only obtain fDAI through above process, but also trade fDAI from other users.
- No risk for the average users on Layer2. Even if the oracles fail, causing an over issue of DAI, Layer2-users will not be affected. Specifically, increased DAI is a debt for Maker, which will trigger Maker Protocol Auction. The system increases the amount of MKR in circulation to pay off debts then MKR holders have to take the loss. A DAI locked in L1 will be still worth an oDAI.
In this solution, oracles, which can be trusted, are assumed to operate normally. However, there is few details about how the oracle works. It is possible that oracle collaborate with a malicious sequencer or it suffers a crash.
V. Data Analysis
We introduced several representative projects and application orientation of mainstream Rollups. Despite getting started, most of them have produced some practical data. In this section, we will present an in-depth analysis on the locked value, development progress and actual performance.
As of June 25, more than $1.18 billion was locked in Ethereum scaling solutions (except Side Chains), accounting for approximately 2.57% of the total locked value ($45.9 billion in Ethereum). Particularly, Rollups take up 32.77% of all Layer2 solutions locked value. According to the data from each Rollup type, ZK Rollups and Optimistic Rollups account for 29.23% and 3.54% respectively, while Validium occupies only 1.73%.
Given that Rollups are quite difficult to realize, project migration is challenging for most developers. Therefore, total locked value has not grown much since ZKSwap and Loopring. At the same time, with the rapid rise of Polygon in last two months, locked value of Rollups dropped by more than 50% compared to the end of April.
Relying on ZKSwap and Loopring, ZK Rollups are carrying nearly 85% of all locked value of Rollups. Synthetix takes up 10% for Optimistic Rollups. The rest are Validium, represented by StarkWare, that applied to a few DEX.
5.1 Development Progress
For ZK Rollups, the most popular project zkSync launched its 1.x version mainnet which is now used in Curve and Sushiswap. The 2.0 version is now on testnet, and is expected to release in August when ZkPorter will be added. In addition, ZKSwap and Loopring developed their own DEX in December 2020 and February 2021 respectively, both of which seek breakthrough in ecosystem instead of technology. Mainnets of transfer application (e.g., Aztec and Hermez) were also launched, while they are still under development.
For Optimistic Rollup, Optimism and Fuel labs are the most mainstream teams. Optimism delayed launching its mainnet until July 2021. Fuel labs announced to launch its 1.0 mainnet in January 2021, but is still in the stage of wallet integration and UI development.
Validium, developed by StarkWare, completed the Phase 0 when StarkEx 2.0 was produced (i.e., an exchange scaling solution). At present, dYdX, DeversiFi and Immutable X are developing on its mainnet, but the overall participants are few.
Arbitrum, established in 2014, launched its beta version Arbitrum One. The early development teams include MCDEX and Bancor, etc. Later on, some famous DEX (e.g., Uniswap v3、Sushiswap、DODO) deployed their dedicated version. In general, more than 250 projects have applied for access.
5.2 Locked Value
In terms of Total Value Locked (TVL), as of 25 June, in the scope of incomplete statistics, projects adopting Rollup solutions performed as the following:
Overall, ZKSwap and Loopring, pioneer of ZK Rollups, locked about $123 million and $140 million, respectively. Specifically, as a thriving DEX on Layer2, ZKSwap has shrunk by more than 90% from over $1.3 billion in the past two months to the current $123 million. It may be a common dilemma for all DEX that develop ZK Rollups independently that when early mining profit exhausts an EVM-incompatible is hardly breakthrough asset islands. To solve this, ZKSwap have made two attempts: 1. Attracting more users through mining, repurchasing and burning ZKS tokens. 2. Developing a NFT platform which has not been realized. In addition, dYdX also adopted StarkEx, contributing a bonus for ZK Rollups.
Limited by the delay of Optimism, locked value of Optimistic Rollups mainly comes from Synthetix staking. It may usher a significantly increase when synthetic asset minting in Synthetix, Uniswap V3 and other DApp are integrated into Optimistic Ethereum. However, longer withdrawal time may exacerbate the asset island problem. Before deploying on Optimistic Rollups, it is a necessarily trade-off for every project between security and profitability.
Validium locks a relatively low fund volume, due to the insufficient project (e.g., DeversiFi and Immutable X); while Arbitrum, which is still in the test, will be promising after its mainnet is launched.
5.3 Actual Performance
In this section, we present a fundamental analysis on actual performance on TPS, withdrawal time and fee rate compared to Ethereum.
Figure 5–2 presents a comparison of recent actual throughput (tps) of each project recently. It can be seen that theoretical TPS has a greater increase than Ethereum (average 15 tx/s). ZK Rollups go above 100 times TPS, and Optimistic Rollups is around 33 times (500 tps). However, since all projects are getting started, they are not popular and fully-functional yet. The actual throughput is still relatively low.
Rollups is not convenient enough at present. Theoretically, users can withdraw their money in several minutes using ZK Rollups. Due to inactive transaction volume, the current withdrawal time can only be achieved in hour level. Even the fastest ones also take 20 minutes (e.g., ZKSwap and Hermez). For Optimistic Rollup, using fraud proofs, it often takes about 1 week to withdraw.
For transaction fee, most basic functions on Layer2 such as transfer and settlement has been greatly improved among above projects. The average fee is less than $1 while transaction behaviors are quite different. In deposits and withdrawals between L1 and L2, due to an interaction with on-chain contract, users still need to be charged based on the gas rate, which is less than or equal to an ordinary transaction on Ethereum. Specifically, deposit executed automatically depends on the complexity of project codes. According to our survey, current deposit fee is about 0.5~1 times of an ordinary transfer on Ethereum. Withdrawal forms a differentiation. For example, ZKSwap charges $5 as a fixed network fee. Optimism, under test, decided to reduce early transaction fee. Actual withdrawal fee is about 1/4 of Ethereum in Loopring. ZkSync is basically equivalent to transfers on Ethereum.
From a comprehensive analysis on locked value and performance, Layer2 scaling solutions are still in quite early stage, waiting for a promotion by major DeFi that attract more users to migrate. At present, zkSync and Optimism are not completed. Fully functional version will be launched in August and July, respectively. Major applications such as Curve, Sushi, Uniswap and Compound have not yet released a usable version.
In future, users can experience more complete on-chain activities in Layer2, faster and cheaper with the landing of zkSync and Optimism. Moreover, since Uniswap V3 was launched, capital efficiency has been greatly improved. But the corresponding costs also increased. If a Layer2 version is produced, more LP will participate in it. It is promising to develop a new project based on NFT.
In conclusion, Rollups made a great progress in 2020. Development progress and locked value have been significantly increased, which are still in early stage. ZK Rollups already have some implementations while Optimistic Rollups is on the horizon. Due to the immature ecology, each project still has a large gap between its theoretical peak and actual performance. Lastly, difficulty of technology development and implementation, security and ecological consideration and user habit, etc. are also major factors.
VI. Summary and Outlook
As a new generation technology of Ethereum scaling solution, Rollups has higher expectations than Lightning Network, Plasma and Sidechains, etc. At present, Rollups are still in the early stage of technology accumulation and difficulty overcoming.
From technical analysis, Optimistic Rollups have initiative to connect with EVM-compatible network. It can be expected that a more general solution will be implemented before ZK Rollups. For Layer2 scaling solution, regardless of type of Rollups, compatibility with EVM will be an important factor in determining whether the ecosystem can grow rapidly, not to mention Sidechain (e.g., EVM-compatible Polygon and EVM-incompatible xDai). At the same time, restricted by technology bottleneck, ZK Rollups and Optimistic Rollups will work on EVM compatibility and withdrawal time, respectively. In addition, cross-Layer2 interaction will be another important issue in the long term. We believe a trust-based solution in a specific scenario will be born first.
From practical analysis, different types of Rollups are currently in the early development stage. Although some outstanding project are already deployed on ZK Rollups, Optimistic Rollups and Arbitrum, most of them are DEX. With the development of Rollups from last year to the present, some important upgrades and implementation of each team will be conducted in this year. Therefore, we predict that major DEX, wallet, Oracle and some data application will be the first choice to implement. With the continuous improvement of them, major DeFi will migrate to Layer2. Once throughput is improved and transaction fee is cut down greatly, a cross-Layer2 solution is proposed simultaneously. We believe a new DeFi will come out.
Let’s looking forward to the future of Rollups
About Huobi Blockchain Research Institute
Huobi Blockchain Application Research Institute (referred to as “Huobi Research Institute”) was established in April 2016. Since March 2018, it has been committed to comprehensively expanding the research and exploration of various fields of blockchain. As the research object, the research goal is to accelerate the research and development of blockchain technology, promote the application of blockchain industry, and promote the ecological optimization of the blockchain industry. The main research content includes industry trends, technology paths, application innovations in the blockchain field, Model exploration, etc. Based on the principles of public welfare, rigor and innovation, Huobi Research Institute will carry out extensive and in-depth cooperation with governments, enterprises, universities and other institutions through various forms to build a research platform covering the complete industrial chain of the blockchain. Industry professionals provide a solid theoretical basis and trend judgments to promote the healthy and sustainable development of the entire blockchain industry.
Welcome to join the research exchange group of the Institute
1. The author of this report and his organization do not have any relationship that affects the objectivity, independence, and fairness of the report with other third parties involved in this report.
2. The information and data cited in this report are from compliance channels. The sources of the information and data are considered reliable by the author, and necessary verifications have been made for their authenticity, accuracy and completeness, but the author makes no guarantee for their authenticity , accuracy or completeness.
3. The content of the report is for reference only, and the facts and opinions in the report do not constitute business, investment and other related recommendations. The author does not assume any responsibility for the losses caused by the use of the contents of this report, unless clearly stipulated by laws and regulations. Readers should not only make business and investment decisions based on this report, nor should they lose their ability to make independent judgments based on this report.
4. The information, opinions and inferences contained in this report only reflect the judgments of the researchers on the date of finalizing this report. In the future, based on industry changes and data and information updates, there is the possibility of updates of opinions and judgments.
5. The copyright of this report is only owned by Huobi Blockchain Research Institute. If you need to quote the content of this report, please indicate the source. If you need a large amount of reference, please inform in advance (see “About Huobi Blockchain Research Institute” for contact information), and use it within the allowed scope. Under no circumstances shall this report be quoted, deleted or modified contrary to the original intent.