Original Author: Jiawei, IOSG Ventures

Is Rollup a good investment category among many infrastructures?

The investment logic of Rollup may have different answers at different stages of industry development, from the early dispute between ZK/OP narratives to the later competition in TPS and user experience in practice, and the moat built around derivative tools such as the OP Stack.

But ultimately, what we need to answer is whether Rollup is a profitable business. What is the economics of Rollup? This article attempts to study and discuss the business model of Rollup and its design space for monetization.

Barry Whitehat first proposed the concept of Rollup on the Ethereum Research forum. When the concept of Rollup was in its embryonic stage, we collectively referred to the role of operating Rollup as a Relayer or Operator. With the refinement of infrastructure development, this role has been divided into multiple entities: the Sequencer is responsible for sequencing transactions and writing to the DA (Data Availability), the Challenger is responsible for raising challenges, and the Prover is responsible for generating proofs. When discussing the economics of Rollup, we can basically sort it out from these entities.

Source: IOSG

This article mainly discusses several aspects of Rollup monetization:

• The reasons, composition, and profit and loss situation of transaction fees;

• The form and monetization of MEV (Miner Extractable Value) in the context of Decentralized Sequencer;

• The possibility of monetization based on Fault Proof and Validity Proof.

Transaction Fee

Similar to other chains, users need to pay transaction fees when sending transactions on Rollup.

From the perspective of the Sequencer, this transaction cost mainly includes two parts: execution cost and security cost.

Execution Cost

Source: John Adler

Rollup's execution cost inherits from the Ethereum model. In abstract terms, each Ethereum node runs a replicated state machine. As shown in the above figure, nodes download and store transaction data, execute computations, read/write memory and storage, which correspond to physical resource costs and consumption. Gas, as a unified pricing unit, is used to measure the underlying resources behind these operations.

Therefore, the same applies to Rollup, operating a Rollup node will incur a certain execution cost, which is the transaction fee paid by Rollup users. Due to slight differences in EVM equivalence and different designs of Rollup, different Rollups have slight variations in pricing for execution costs (e.g., zkSync Era provides native account abstraction, and some operations may require higher Gas compared to EOA), but overall they follow the Gas model of Ethereum.

Source: Dune Analytics @springzhang

In addition to the aforementioned execution cost, congestion fees and minimum transaction fees should also be considered.

• Congestion fees. Reflected in the dynamic balance between gas prices and network traffic. For example, during the Arbitrum Odyssey period, the surge in network traffic led to a significant increase in gas prices.

• Minimum transaction fee. On a low-cost blockchain network, it is necessary to set a minimum transaction fee to prevent spam and DoS attacks. Currently, it is 0.1 gwei on Arbitrum One and 0.01 gwei on Arbitrum Nova. The value of the minimum transaction fee depends on the design of the network (0.001 gwei on Optimism).

Security cost

Source: Celestia Forum @adeets_ 22 

Security cost refers to the data availability (DA) cost that we are discussing. DA is the guarantee of security for Rollups, ensuring that anyone can reconstruct the state of the Rollup based on the data published on Ethereum L1 (we are discussing the case of Ethereum L1, but there are also other DA solutions). The contribution to Ethereum L1's DA cost accounts for the vast majority of the total cost of the Rollup. In May of this year, Arbitrum submitted approximately 3,927 MB of data to Ethereum and paid 4,856 ETH for it, resulting in a DA cost of about 1.24 ETH/MB (calculated based on $0.023 per GB and ETH price of $1800, Ethereum's DA storage cost is approximately 100 million times that of AWS).

Due to the expensive cost of on-chain data availability (DA), various Rollups have adopted data compression methods. Arbitrum and Optimism Bedrock use open-source data compression libraries Brotli and zlib to compress the data published to Ethereum L1. StarkNet and zkSync Era compress the data by publishing State Diffs (i.e., the difference between previous and new states) instead of all the data. (P.S: Optimism Bedrock's upgrade also employs various methods to compress transaction costs, and more data metrics can be seen here).

Source: IOSG

It is worth looking forward to the significant alleviation of Ethereum L1's expensive DA cost with the introduction of EIP-4844 in the Decun Upgrade. Additionally, the "security overhead" discussed here implies different levels of security. Apart from the DA guaranteed by Ethereum L1, solutions like DAC, Celestia, EigenDA, etc., provide diverse "security-cost" trade-offs, offering multiple choices for the DA-demanding side. Some low-frequency, high-value DeFi applications require more security guarantees, while some high-frequency, relatively low-value applications (e.g., games) can consider costs more; each to their own.

Source: Dune Analytics @optimismfnd

In summary, simply from the perspective of the Sequencer: The Sequencer collects transaction fees from users and pays DA fees to Ethereum. Therefore, the profits of the Sequencer can be calculated in the manner described above. Currently, most Sequencers are operated by Rollup teams. If we ignore the income from token issuance and inflation, Rollup's revenue can also be roughly measured in this way.

Source: Token Terminal

Source: IOSG

Take Optimism as an example. In the past 30 days, Optimism has made a profit of approximately $20k per day. According to Token Terminal data, Optimism has made a profit of approximately $10.9M since its launch.

MEV

MEV is an important way for Rollups to establish a business model. Talking about MEV in the context of a centralized single Sequencer doesn't make much sense, so let's start with decentralized Sequencers first and then explore the MEV economy of Rollups.

Decentralized Sequencer (DS)

Currently, Arbitrum ($5.87B), Optimism ($2.14B), and zkSync Era ($649M) rely on centralized Sequencers/Operators for transaction ordering, batch submission, and other operations.

Decentralization is a complex matter, and the process of introducing multiple parties requires careful refinement. It is not necessary to achieve everything in one step. Considering security, competition, and developer resources, it makes sense to adopt a centralized Sequencer in the early stages of a project. However, centralized Sequencers have at least two clear flaws (which are also flaws in most centralized approaches).

• Transaction censorship: This involves reviewing transactions of specific users, including ransom attacks, etc. To address this issue, Arbitrum and Optimism offer options for forcefully including user transactions. For example, all users in Arbitrum can invoke the forceInclusion method to include transactions forcefully. StarkEx has implemented an Escape Hatch mechanism, providing some resistance to censorship.

• Liveness assurance: Can the Sequencer maintain continuous online presence? If a centralized service experiences a single point of failure (such as hardware failure or software misconfiguration), the entire network will go offline. Although the possibility is small, if it happens, it will have wide negative consequences.

Source: Taiko

Currently, the Sequencer plays the roles of both Builder and Proposer on Ethereum L1: it is responsible for transaction ordering and batch submission. The process of implementing DS is similar to retracing the old path of Ethereum PBS.

To implement DS, Rollup typically has several options.

• Leader election/rotation mechanism, combined with local block building, i.e., non-PBS scenarios on Ethereum L1. Vitalik proposed several methods of election/rotation in his article "An Incomplete Guide to Rollups," such as Sequencer auction, PoS-based random selection, DPoS voting, etc. Based on Ethereum's practice, it is obvious that PBS would be a better solution.

• Leader election/rotation mechanism, combined with an open block building market, i.e., Enshrined PBS or Proposer adopting MEV-Boost on Ethereum L1.

• Some specific mechanisms, such as FCFS (First Come First Serve). FCFS ultimately leads to a delay race, similar to Colocation in traditional high-frequency trading. Arbitrum currently adopts FCFS and researches variants such as Time-Boost. Time-Boost introduces a priority fee based on FCFS, which can pay a fee to accelerate the transaction by up to 0.5 seconds. This is a two-dimensional trade-off between latency and cost.

The Rollup team can build DS internally using the options mentioned above, or consider outsourcing Sequencing:

• Projects like Espresso/Astria propose their own DS/SS services;

• Flashbots is building SUAVE, a cross-domain generalized cryptographic memory pool;

• Based Rollup proposed by Justin Drake utilizes L1 consensus directly, where the Proposer of Ethereum L1 includes Rollup blocks into L1 blocks, inheriting the same level of decentralization and liveliness as L1.

There are pros and cons to choosing internal construction or outsourcing, which will be further discussed in this article.

Rollup MEV in DS context

Source: odos.xyz/arbitrage

If we have an open market for DS built on blocks, the MEV supply chain on Ethereum will be replicated on Rollup. In this case, Intradomain MEV refers to MEV that occurs within Rollup, which is not much different from MEV on Ethereum L1. For example, sandwich attacks in DEX and cross-DEX arbitrage, etc. In the image above, cross-DEX arbitrage on Ethereum L1 is used as an example because Rollup has not yet implemented DS.

More interesting possibilities are Cross-domain MEV. We divide Cross-domain MEV into regular Cross-domain MEV and Cross-domain MEV under Shared Sequencer (SS).

• Regular domain MEV

Source: odos.xyz/arbitrage

MEV occurs between Ethereum L1 and Rollup, Rollup and Rollup. In the context of DS, each domain has its own MEV pipeline, covering different roles. The above figure is an example of cross-domain arbitrage.

In the Searcher side, cross-domain MEV involves complex execution risks because different domains have different confirmation times and finality, making it uncertain whether transactions will be successfully included. To address this, Primev is building a communication network where Searchers can submit bids to multiple Builders in different domains to secure pre-confirmation for their bundles. This allows Searchers to quantify and control their execution risks.

There is a centralization trend in cross-domain MEV. As pointed out by Flashbots, Builders who construct blocks on multiple chains at the same time have a greater advantage in cross-domain MEV compared to those who only build blocks on one chain, which can lead to centralization. This is a topic that needs to be addressed in the Rollup-centric roadmap in the coming years.

• MEV under SS

If multiple Rollups use the same SS, the situation is different.

Source: IOSG

One of the features of SS is that it can achieve cross Rollup atomic arbitrage. Previously, when the Searcher submitted trades 1 and 2 separately, it was uncertain whether these two trades would be included as expected (e.g., being included in the next block). With SS, the Searcher can submit a Bundle like the one in the diagram, and the execution will only proceed if trades 1 and 2 can both be satisfied at the same time. Otherwise, neither trade will be executed (assuming the trades are not invalid). This implementation reduces the execution risk for the Searcher.

In an ideal scenario, SS will achieve "the whole is greater than the sum of its parts". For example, the information covered by a single trade may have no value on an individual Rollup, but when multiple Rollups share sorting, it can be combined with trades on other Rollups to fully utilize some "invalid information" and achieve positive-sum games.

Despite its many benefits, Sequencing involves complex business issues, so the author believes that SS will not be adopted by head Rollups in the short term. Instead, it may be implemented and validated first in the long tail of App-specific Rollups or offered as an option for Rollup-as-a-Service projects for developers to use.

Rollup Economics around MEV

Source: IOSG

After DS is implemented, the question returns to how to build an economic model and value capture mechanism around MEV.

In the previous section, we discussed the costs of Rollups. The source of these costs is the DA resources and the physical resources needed to operate the Rollup itself. These limited resources constitute the scarcity of block space. MEV reflects the dominance over the scarcity of block space. Rollups can price this dominance.

Fuel Network believes that an optimized token model should reasonably capture the value of block space. Users paying transaction fees with Rollup tokens is one way to capture value (i.e., endowing tokens with utility). However, this also introduces additional user-side friction. Fuel's idea is to tokenize the scarcity of block space by tokenizing the "right to collect fees within block space". This is from the perspective of block producers and MEV and does not affect end users.

In relation to the aforementioned options for DS, the author believes that there may be the following design spaces:

• MEV Auction (MEVA). Sequencer participates in the auction to determine the transaction ordering power of specific blocks or blocks within a specific time period. The auction bids serve as the income for Rollup.

• PoS. Stake Rollup tokens to randomly select a Sequencer; the more tokens staked, the higher the probability of becoming a Sequencer. Note that Rollup still relies on Validity/Fault Proof and Ethereum for security and does not depend on PoS for economic security. PoS only serves as a way to select leaders. Staking tokens provide value capture for Rollup, and this locking essentially reflects the scarcity of block space.

• SS. Compared to the above two points, SS is an interesting new topic that currently has no conclusive answer. Assuming Rollup outsources Sequencing to SS, it also means giving up the right to capture MEV within its own domain—although the benefit is that multiple domains will generate network effects, leading to a positive sum game. But from another perspective, Rollup can choose to keep its own MEV within its own ecosystem, capturing it or tokenizing the MEV within the domain.

Therefore, the author believes that SS should somehow redistribute the MEV captured from various domains. In the case of multiple SS competing for their Rollup clients, the incentives for this redistribution become particularly important. In this scenario, the redistributed MEV can serve as income for Rollup.

Proof of Fault (Fault Proof)

(The community has proposed renaming Fraud Proof to Fault Proof because even honest parties may submit incorrect state transitions due to software configuration errors, etc. The term "fraud" actually implies malicious intent, so it is not accurate enough)

The common design of fault proof allows people (called challengers) to question state transitions during a challenge period; once the challenge is verified as correct, the malicious actor will be penalized, and the challenger will receive a portion of the forfeited funds as a reward. The remaining forfeited funds may be destroyed. If the forfeited funds are Rollup tokens, it is considered compensation for all token holders (rather than just the victims of the attack). Arbitrum and Optimism Cannon currently adopt interactive fraud proof.

On Arbitrum, the party observing the state transition and raising challenges is called a validator, while the party observing the state transition is called a watchtower validator. The main difference between the two is that the former can raise challenges, while the latter can issue warnings in any way (such as through the community or social media). Becoming a validator requires whitelist permission, while an observer does not.

Arbitrum may have decentralized validators (also known as challengers) in the future. However, in reality, only a trust assumption of 1 of N is needed for challengers, and a honest challenger is sufficient for the network. Therefore, I believe that decentralized challengers only meet the requirement of decentralization. Besides the mentioned challenger receiving partial forfeited funds, there is not much design space in terms of economics. It is more likely due to considerations of design redundancy.

Prover Network / Market

Source: Figment Capital

Figment Capital distinguishes between Prover Network and Prover Market in its article: Prover Network is a collection of Provers that only serves a single application (e.g., Scroll). Prover Market is an open market where multiple applications (e.g., Scroll, Succinct) can submit proof requests to. This article has summarized all aspects of Decentralized Prover, so it won't go into much detail here.

Prover Network

Scroll proposed the idea of decentralized Prover two years ago.

Source: Scroll

Prover (called Roller by Scroll) needs to stake tokens to obtain initial reputation, which is proportional to the staked tokens. When the network needs to generate proofs, the Sequencer randomly selects multiple Provers based on their reputation and requires them to generate proofs within time T - if the proof is invalid, they will be fined; if the proof is valid but late, their reputation will be decreased; if the proof is valid and within time T, they have a chance to receive rewards.

Introducing a designated time limit, T, instead of simply using "fastest" for measurement, is to avoid a situation where the fastest Prover takes all the rewards. Because as long as they can complete it within time T, the fastest Prover and slightly slower Prover have an equal chance of receiving rewards. This mechanism encourages the fastest Prover to parallelize the generation of proofs for other blocks to maximize profits.

Prover Market

Source: = nil;

= nil; provides a generalized service for building circuits and proof markets. The developers who build circuits and Provers who generate proofs each receive a portion of the income.

As an open market, = nil; is similar to a spot market and has two roles: proof requesters and proof producers. The former can place buy orders, and the latter can place sell orders. The parameters for placing orders include the statement (such as the state proof circuit of Mina or Solana), cost, order timeout, and proof generation time.

= nil; also employs a similar reputation system, where Provers who fail to generate proofs on time or generate incorrect proofs will have their ratings lowered or even confiscated.

Both Scroll and = nil; adopt the design of staking-slashing and reputation systems, but they target different demand-side groups. The former serves ZKRollup itself, while the latter serves multiple ZK applications. These two instances correspond to the two forms of internally built Provers and outsourced Provers, respectively.

Closing Thoughts

Based on the above discussion, the author puts forward several viewpoints:

• Transaction fees are a simple and effective business model, and one of the main selling points of Rollup for Ethereum scalability is low fees. Therefore, they will not make too many changes to transaction fees. With the adoption of EIP-4844 and the maturity of various DA solutions (Celestia, EigenDA, etc.), Rollup transaction fees will be further reduced. This is good news for users.

• In terms of Rollup, I believe that mainstream Rollup will gradually move towards Layer 2 within two to three years, and some niche Rollup solutions may be even faster. MEV, as a more obscure business model, will become a major source of income for Rollup. If the internal construction of Layer 2 is chosen, it will involve token economic design; if DS & SS is chosen, how to allocate MEV in a reasonable manner is a point that both Rollup and DS & SS projects need to consider. The importance of MEV on Rollup is currently severely underestimated.

• Decentralization is often a gradual process and can also vary in degree. Whether it is a decentralized Sequencer or Prover, there are mainly two options: internal construction or outsourcing by a team. The former provides a broader design space and is mainly built on the cryptographic economic primitives of Staking-slashing, with some mature mechanism designs already available for reference. I speculate that the latter may depend on a payment model similar to DA.

• DS may be more complex in mechanism design, while Prover is relatively straightforward. This is because it is difficult to determine whether the transaction sequence returned by the Sequencer is correct or incorrect, whereas mathematical proofs are deterministic and can be quantitatively measured, such as in terms of time, cost, and other parameters. DS considers more from the perspective of the MEV economy.

• The choice between the two aforementioned approaches for Rollup may differ depending on the stage of the project, taking into account factors such as capital efficiency and developer resources. For early-stage Rollups, including some app-specific Rollups, outsourcing the decentralization work and quickly implementing a bootstrap solution may be the optimal choice (via DS & SS or EigenLayer). On the other hand, more mature Rollups will have more abundant developer resources and funding, and will also consider capturing token value and resource connections, thereby building moats and achieving a flywheel effect.