Opinion: The Dilemma of Optimistic Rollups

Editor's Note: This article comes fromEthereum enthusiasts (ID: ethfans)Ethereum enthusiasts (ID: ethfans)

, Author: StarkWare, translation & proofreading: Min Min & A Jian, reprinted by Odaily with authorization.

• finished in three sentences

• We believe that liquidity providers will prefer ZKR-Uniswap (Uniswap built on ZK-Rollup) over OR-Uniswap (Uniswap built on Optimistic Rollup) because the former is more capital efficient.

• If you want to improve the capital efficiency of OR, you need to shorten its challenge period (Dispute Time Delay, DTD), thereby reducing the cost of launching a "fraud + review" attack on Layer 1.

background

Fundamentally, this is OR's dilemma between capital efficiency and safety: increasing capital efficiency necessarily reduces safety.Chinese translationIn recent months, rising gas prices on Ethereum have fueled interest in scalability solutions, especially Layer 2 scalability. Such schemes can be roughly divided into two categories: validity proofs vs. fraud proofs. We have previously discussed in this article (Chinese translationChinese translation

) and this article (

Chinese translation

Proof of validity schemes include ZK-Rollups (provides on-chain data availability) and Validium (only guarantees off-chain data availability). Similar systems have already been deployed on the Ethereum mainnet, including our own StarkEx.

analyze

Fraud proof schemes include Optimistic Rollups (OR). Some of these proposals are about to go live on public testnets. OR is the latest generation of fraud proof design, and its predecessors are Lightning Network and Plasma. OR is attractive to dapp developers who suffer from Ethereum congestion because such solutions can keep the Solidity code unchanged and migrate dapps to low-cost and On the OR with scalability.

Next, we will analyze OR from the perspective of liquidity providers and users.

liquidity provider

Assuming an application as large as Uniswap can be easily migrated to OR seamlessly by porting existing Solidity code. Let's analyze OR from the perspective of liquidity providers and users.

secondary title

• liquidity provider

• As mentioned above, OR defines a challenge period in order to detect and report fraud. The waiting time for withdrawals must be longer than the DTD, otherwise the system could easily become insolvent due to theft.

OR validator detects fraud and sends fraud_detected transaction to mempool. At this point, the OR validator has fulfilled its duty: found and "reported" the fraud. However, this complaint is only valid if the fraud_detected transaction is on-chain.Chinese translationAssume that during the DTD, the attacker rents enough computing power (currently costing about $300,000 per hour) to mine to replace the block containing the fraud_detected transaction. This move can be seen as a silent attack on fraud_detected transactions. Why do you say it is silent? Because from the perspective of an innocent bystander, the entire network appears to be safe and sound. If the transaction containing the fraud proof fails to be uploaded to the chain, of course no transaction rollback will occur.

In order to prove our point: there is a trade-off relationship between capital efficiency and safety, we next explain its origin and impact. Assume the DTD has a period of one week (a DTD of 4.5 hours has been proposed (

Chinese translation

); some believe that the risks associated with too short a time period are too high). According to our analysis, whether the DTD is 1 day or 2 weeks is just two different points on the trade-off curve between security and capital efficiency. Depending on the length of the DTD, the cost to the attacker can range from $1 million to $10 million. The cost incurred by the attacker does not directly depend on the interests they are after, and if the OR holds billions of dollars in assets, the cost of attacking up to millions of dollars will not stop them.

Opportunity cost has a large impact on decentralized applications due to the actions of liquidity providers. During this time, we have seen liquidity flow from Uniswap to SushiSwap and back to Uniswap. Contrast OR-Uniswap (Uniswap built on OR) with ZKR-Uniswap (a fork of Uniswap built on ZK-Rollup). Liquidity providers can now choose to lock funds on OR-Uniswap for a week, or on ZKR-Uniswap for 30 minutes (proof generation period). ZKR-Uniswap has one fundamental advantage. In the long run, it is difficult for token economy or other incentive mechanisms to defeat this advantage.

We are often asked: Can Fast Withdrawal solve this problem? Can a level playing field be created between OR and ZK-Rollup?

cannot. Fast withdrawals only improve user experience by shortening withdrawal times, not capital efficiency: enough funds must be locked in the Layer 1 smart contract to support withdrawals throughout the DTD period.

Please note that this assumption is based on the assumption that there are no decentralized applications running outside OR, including Layer 1 and ZK-Rollup etc.

user

We argue that even in this scenario, as the throughput of the OR increases, the safety decreases. Why? Let's think from the perspective of the user (Alice).

secondary title

Trust: Alice may trust the OR, or more specifically, at least one party will verify the current state of the OR. This means that, from Alice's point of view, OR is essentially a trusted system. Trusted systems operate at staggering scale and are often the foundation of high-value businesses such as Coinbase, Binance, and traditional banks. These businesses are working hard to live up to the trust as their reputations get stronger.

in conclusion

Untrusted: Alice can verify the state of OR herself. Unfortunately, the cost of validating an OR is directly proportional to the OR's throughput: for example, if OR increases Ethereum's scalability by 20x, the validation cost will also increase by 20x. Over time, only a wealthy few can afford the verification cost of high-throughput OR.

Today, this concern is not unfounded: currently, validating Ethereum is an altruistic act. Some people believe that the current verification cost of Ethereum is so high that it will damage decentralization: affected by the cost, there are fewer network participants to verify the integrity of Ethereum. In other words, less decentralization and less security is the real problem.