zkPorter: Layer-2 Composable Scalability
Editor's Note: This article comes fromEthereum enthusiasts (ID: ethfans)Ethereum enthusiasts (ID: ethfans)
Summary
, Author: Alex Gluchowski, translation: A Jian, reprinted by Odaily with authorization.
first level title
Summary
We propose a new Layer-2 scalability technology "zkPorter" that can combine zkRollup and sharding in a highly scalable and atomically composable blockchain network.
Problem #1: Transaction throughput ≠ scalability ⚖️
Transaction throughput is measured by the total number of transactions processed by the entire network; while scalability is the number of transactions processed by a single node. zkRollup can be considered as the ultimate Layer-2 scaling solution that satisfies security and usefulness. (Editor's note: see the hyperlink at the end of the article "Evaluation and comparison of various Ethereum Layer 2 expansion schemes") However, zkRollup only provides about 100 times the scalability improvement compared to the main network, because transaction data still needs to be broadcast to all full nodes. One could argue that zkRollup only increases throughput linearly, but does not provide exponential scalability.
zkRollup can handle up to 3000 TPS on Eth1, but a conservative estimate—depending on the details of the Eth2 implementation—is at least 20,000 TPS on sharded Eth2. Compared to Visa's throughput of up to 24k TPS, this is already a huge achievement, but because we want to help the billions of people who are unbanked today, we have to strive for more.
The rise of DeFi means that composability is the key to success. As "currency building blocks" that can be freely combined, DeFi applications prove the potential value that can be unlocked by layering trust-free protocols. If a project only looks at their own scaling solutions, they will eventually find themselves isolated from the security and network effects created by community-shared, composable scaling mechanisms.
Introducing zkPorter 🎉
In this paper, we demonstrate a new zero-knowledge proof-based scaling scheme that promises to solve all of the above problems: zkPorter.
secondary title
Explain zkPorter 🥜
On the other hand, scaling schemes based on zero-knowledge proofs still do not directly address the data availability problem: if state data becomes unavailable, funds are frozen. zkRollup and Validium use different methods to deal with the data availability problem (Editor's note: see the hyperlink at the end of the article "Comparison of ZK rollup and Validium").
zkPorter uses a hybrid approach combining the zkRollup concept and the sharding concept to solve the data availability problem. It can support any number of shards, each with its own data availability scheme (defined by that shard's smart contract). At the same time, the choice of shards is controlled at the individual account level (The choice of the shard is controlled at individual account level).
zkPorter separates concerns about state validity and data availability. State validity — valid state transitions must occur — is uniformly implemented by zero-knowledge proof tools, which provide exponential scalability while inheriting the security guarantees of Layer-1. Data availability, on the other hand, is entrusted to the shards themselves, allowing them to freely experiment with different solutions. Unity where necessary, freedom where there is no solution (In necessariis unitas, in dubiis libertas)!
secondary title
Composability in zkPorter: The internet of blockchains on steroids 💊
Then let zkPorter try it! All accounts in zkPorter share the same address space, and can interoperate with other accounts through zkRollup running on the basic shard 0 in zkPorter. A protocol with high traffic requirements and/or specific data availability needs can place its own protocol interface in its own (in zkPorter) shard. The security, cost, and throughput trade-offs will be discussed later.
zkPorter enables any number of protocols to interoperate smoothly. A single atomic transaction can invoke any number of smart contracts on different zkPorter shards. Not only that, transactions within a shard will have access to the entire zkPorter state - including data on other shards. This feature can be used, for example, to read information from an information input mechanism.
You can think of the zkPorter model as a blockchain Internet with zk hormones.
secondary title
zkPorter Sharding: Security and Overhead 💸
Shard 0 of zkPorter is a zkRollup with complete data availability and the security guarantee of Ethereum. Shard 0 will be the most expensive shard in zkPorter, and the transaction cost is about 1/100 of the mainnet transaction.
Shards other than Shard 0 will define their own data availability schemes in their own smart contracts. These other shards sacrifice the data availability on the chain in exchange for a further 10-100 times transaction cost savings and throughput improvement. zkPorter will introduce an optional validator mechanism, which we call "zkPorter Guardians", which allows the protocol to invite protocol stakeholders to participate as data availability guarantors for protocol shards. A shard using the guard mechanism will run a proof-of-stake consensus mechanism, so as long as 1/3 of the participating validators remain honest, users of the shard can exit with their own data at any time.
Flexible data availability is the core design goal of zk Porter. By allowing each protocol to design its own scheme, zkPorter can support many different schemes and can adapt to everyone's needs. Security Assumptions The application of a trusted centralized participant as a guarantor can achieve a proof-of-authority consensus mechanism. And applications with governance tokens can implement their own proof-of-stake consensus mechanism to protect their own shards—just avoid letting the amount of funds in the shard exceed the locked validator deposit amount. Erasure coding mechanisms can be used to prove that the verifier has not deleted the data. For example, given the relatively simple nature of the Bitcoin network and the low number of transactions, a validator for a zkPorter shard could create a Bitcoin implementation within their shard that runs the proof-of-work-based Satoshi consensus. All of these can be combined with zkPorter's Guardian validator setup, or can all run independently of it.
zkPorter was designed from the ground up with extension in mind. The zkPorter protocol reduces the data availability and validity overhead of each shard to a very low level. The marginal cost of adding a new shard is logarithmic compared to the cost incurred by including nested data on the underlying zkRollup. This allows zkPorter to efficiently scale to support hundreds of millions of accounts.
Finally, user privacy can be protected by zero-knowledge proof technology. Using a zkRollup as the basic element of a zkPorter has the inherent advantage that the validity of state transitions can be proven without disclosing the contents of these transactions.
secondary title
Architecture 🏛
In fact, zkPorter is very similar to zkRollup and Validium. A smart contract placed on Layer-1 hosts the funds and keeps a record of the Merkle root of the account state. The actual state data is kept off-chain by zkPorter validators and data guarantors for each shard: we also call it the "state tree".
A sharded smart contract defines its own state transition rules. When a zkPorter block is accepted, the block causes a state transition: a transaction on Layer-1 replaces the Merkle root with the new value. This transaction must verify the zero-knowledge proof used to prove the new value is valid: that is, to verify that every transaction in the block is valid.
In zkPorter, accounts for each shard must be stored in a separate subtree of the state tree. Additionally, each shard subtree must contain information about its own shard type and reference smart contract accounts that define its state availability policy.
Assuming that the type of a shard is zkRollup, then every transaction in the shard that changes the account state must publish the state change as Layer-1 calldata (just like a zkRollup).
All transactions that modify the state of two or more shards at the same time must be executed in zkRollup mode.
All other transactions that only affect accounts within a specific shard can be executed in the normal shard mode (we call them "shard transactions"). If a block contains some shard transactions in shard S, the following rules must be followed:
Case study 💼
I'm going to use 4 cases to demonstrate the potential of zkPorter, demonstrating how it can seamlessly combine different applications, and at the same time expand the transaction volume to meet the needs of each application.
secondary title
Case 1: Reddit Community Points
In June 2020, Reddit launched The Great Reddit Scaling Bake-Off program, giving each community the opportunity to host their own subreddits through a community points system, and also allowing Layer-2 solutions to show their talents. Obviously, the solution for the community points system must be secure, decentralized and easy to use, while maintaining interoperability with other third-party applications (wallets, contracts), and also, be able to handle hundreds of thousands counted transactions. Community points can be implemented with zkPorter in three different ways.
Option 1: Run on zkSync (zkPorter shard 0)
To connect Community Points to the Ethereum mainnet, Reddit can use the existing zkRollup functionality directly on top of zkSync. zkSync can reach 3000 TPS on Eth1. Assume that all 500 million monthly active Reddit users are actively participating. Assuming that each user sends one minting transaction, one burning transaction (subscription fee payment) and two transfers per month on average, the average load required by the community points system is:
500 million × 4 / (30 × 24 × 60 × 60) is approximately equal to 700 TPS
This is only 1/4 of zkRollup's current throughput.
Option 2: Put it on a Reddit-specific shard, verified by zkPorter guards
If it is intended to improve the elasticity of transaction throughput and reduce user costs, Reddit can transfer Reddit transactions from the basic shard to a Reddit-specific shard. Reddit is free to choose its own scheme for providing data availability guarantees to users. The simplest solution is the existing zkSync guard implementation, which provides users with data availability guarantees implemented by proof-of-stake. We would recommend that Reddit store data on Reddit's servers in addition to using Guardian templates. In this mode, even if the defenders suffer a 2/3 majority attack, Reddit can cope with it, so users can sit back and relax. Correspondingly, user data will not be overturned due to Reddit server errors or attacks.
The third method is that Reddit can choose to maximize transaction throughput and minimize user costs, which is to put the Reddit community on a dedicated shard, and use a customized data availability solution instead of a guard mechanism. A feasible solution based on proof-of-stake consensus is based on community-driven data availability, coupled with a 2/3 multi-signature mechanism (two-third multisignature).
Interoperability
Imagine a possible implementation of the scheme: Reddit and Reddit users would send signatures to attest to the validity of each state transition. Reddit could, say, take 1/3 of the total signature weight and distribute 2/3 to users. Coupled with a 2/3 majority mechanism of signature weight (A combined two thirds in signature weight), it is enough to ensure that the state transition on the Reddit shard is valid. Users can be incentivized to post proofs of invalid transitions they see, such as deducting the publisher's deposit of the invalid state transition.
The transaction cost in this scheme will become only the cost required to cover the generation of zero-knowledge proofs (currently one thousandth of a dollar per transaction, and will decrease exponentially in the future)
Interoperability
Easily interact with smart contracts on other shards, such as using DeFi protocols deployed on zkSync (Curve on zkSync, Compound on zkSync, etc.) to trade/lend/loan
Transfer their community points to users on a zkRollup shard (for maximum security)
Quickly withdraw their tokens to the Ethereum mainnet to interact with smart contracts other than zkSync
secondary title
Case 2: Smart Wallets/Cryptocurrency Banks (Argent, Dharma, MyKey, etc.)
A smart wallet is a wallet implemented with smart contracts, which can help users obtain privacy and interoperability functions (for example, it can seamlessly connect to Layer-2 expansion solutions). Some smart wallets, such as Argent, even selectively subsidize a certain percentage of transaction fees for users in the process of guiding new users. At the current Gas Price (75 Gwei) and Ethereum price ($320), a transaction is $0.5. Smart wallets can use smart contracts to call the zkRollup function to reduce the overall Gas overhead.
Here is a possible implementation, in 3 simple steps.
Step 1: zkRollup sharding
Smart wallet accounts can be migrated to a zkRollup solution such as zkSync. Transfers between wallets within zkSync are cheap, although transactions sent from zkSync to the mainnet are slightly more expensive and take longer (about 5-10 minutes to finalize).
Step 2: zkSync Guardian + Wallet Operator Sharding
After bringing in enough new users, the cost of operating on zkRollup might make wallet operators consider starting a dedicated shard. In the Reddit section above, we explained this approach in detail: migrating the user base to a stand-alone zkSync guardian (community members in Reddit's case, here could be protocol participants) and wallets Operators to ensure the availability of their data. Sharding is secure as long as the wallet operator or a majority of the zkSync guards are not compromised. This option also opens up the possibility of flexible fee-sharing schemes for wallet operators.
At some point, the user base of the wallet may become so large that the wallet needs to migrate to a shard governed by the governance token. This shard will still be part of the zkSync network and can access services on all other shards in zkRollup mode.
privacy considerations
It should be further explained that the privacy function is easy to implement in any of the above steps. Privacy is difficult to achieve without zero-knowledge proofs. But the benefit of zkRollup is that accounts can gain instant privacy and drastically reduce the cost of participating in the network without sacrificing security and decentralization.
secondary title
Case 3: DeFi protocols and DEXs (Loopring, IDEX, Curve, Coumpound, etc.)
Anticipating future throughput bottlenecks, several mainstream DeFi applications such as IDEX and Loopring have invested in deploying their own scalability solutions. This is a smart move, because on the one hand, it gives them a competitive advantage when the Gas Price is high, and on the other hand, it also gives them a deeper understanding of scalability techniques/sacrifices.
Not only that, but for decentralized exchanges eager to support high-frequency trading, the fee for a single transaction must be as small as possible, because a very high number of transactions is required to fill a single order.
Scalability in isolation lacks composability, or network effects.
As the potential of zero-knowledge proof technology is fully revealed, more and more people realize that zero-knowledge proof is the key to mass adoption. At the same time, the speed of innovation in the ZKP field is so fast that it must have its own dedicated research and development team to keep up with the pace. However, if complex cryptographic algorithms are not well audited and implemented, serious security holes may await them. The golden rule in the field of cryptography is still true: don't create a set of cryptography that only you know.
zkPorter solves this problem. DeFi protocols can be built on advanced scalability technologies and strong network effects while controlling transaction costs. To have these, a protocol can create an own shard within zkPorter, securing it with a consensus of protocol token holders. This also opens up opportunities for flexible fee sharing (or fee subsidies).
Protocols that need to handle a large number of low-value transfers (micro-transactions) can implement a shard similar to Validum (that is, a shard that allows multiple participants to use simple multi-signatures to ensure data availability), making transaction fees as low as zero The generation cost of the proof of knowledge is enough (currently around $0.001 per transaction, and is expected to be significantly reduced in the future).
Integrating the micro-transaction platform in this way, the user can also automatically transfer the balance to a zkRollup shard after the balance exceeds a certain amount.
first level title
way forward 🛣
zkPorter will be initially implemented as part of the zkSync roadmap.
For this vision, what we will do next are:
Provide support for generic smart contracts for zkSync
zkSync has been launched on the Ethereum mainnet, and now you can use the permission-free zkRollup mode. We believe its throughput is sufficient to meet the needs of the Ethereum community for the next two years, before migrating to Ethereum 2.0. However, we welcome the discussion and implementation of customized distribution solutions and close partnerships.
remind
Please contact us here.
