Bankless: The Prosperity and Dilemma of Optimistic Rollups

Author: Jack Inabinet Compiler: Kate, Marsbit

Ethereum’s second-layer network has seen tremendous growth over the past few years, especially Optimistic Rollups like Arbitrum and Optimism. Value is moving towards them, but are they growing too big, too fast?

——Bankless team

Optimistic Rollup was never for pessimists. Since the beginning of the year, the TVL of Ethereum's two major Optimistic Rollup duos, Arbitrum and Optimism, has climbed an impressive 108% and 52%, respectively.

However, despite these benefits, Optimistic Rollup is not the ultimate goal of Ethereum scaling. While they continue to grow in terms of TVL and help solidify L2 as an integral part of the Ethereum ecosystem, as they continue to succeed, the likelihood of a black swan attack on Optimistic Rollup's core security components will only increase .

Today, we'll explain why Optimistic Rollups (despite their popularity) are still easy to exploit, explore zero-knowledge solutions to mitigate all of these problems, and return to the DAO hack to explain why Ethereum may not simply get away with it. Another major vulnerability.

Weaknesses of Optimistic

As the name suggests, Optimistic rollups optimistically assume that the rollup state published by the operator to Ethereum is correct unless proven otherwise, and derive their security from cryptographic "fraud proofs".

Today, Arbitrum is the only major L2 with valid fraud proofs, and currently only permissioned participants can prove their state is incorrect. If a participant disputes the state of the chain, the rollup protocol initiates a fraud-proof proof computation, a form of on-chain dialogue between the challenger and the rollup to determine whether the state is valid. Otherwise, the transaction state change is reverted and the hash is reset to the provably correct state root. Optimistic rollups revolve around the standard challenge period of 7 days, which gives bona fide participants enough time to challenge the status of the data rollup.

However, the security of optimistic rollup is based on two core assumptions:

1. In the case of an invalid state, someone submits a proof of fraud

Regarding assumption one, we can reasonably expect that an honest participant would challenge the invalid state by attempting to publish evidence of fraud.

2. The underlying L1 is still censorship resistant

Ethereum’s censorship resistance is certainly commendable. For example, EIP-1559 exponentially increases the base fee (a portion of transaction fees) when a block is full. In theory, this should prohibit participants from conducting DDos attacks on L1 by spamming transactions to prevent publication of fraud proofs, as the gas cost required for the attack would quickly exceed the value accumulated before the 7-day challenge period ends.

Source: Twitter

Unfortunately, even in a hypothetical future world where all optimistic rollps have permissionless proofs of fraud, a worrisome attack vector remains. Although unlikely, it is still possible to prevent the publication of fraud proofs while circumventing the exponentially increasing gas fees of EIP-1559 through validator collusion.

Competing parties must be able to submit fraud proofs at the L1 level, since the rollup protocol interprets the absence of any challenge as an implicit agreement to its state. Potential censorship of fraudulent proofs due to collusion at L1 would invalidate point 2 and thus rollup's security promise.

Source: Twitter

The Inevitable Choice

While their Optimistic counterparts are easier to implement and dominate the Ethereum L2 space today, zkRollup could disrupt the current paradigm, offering instant confirmation, faster finality, higher throughput, and native privacy.

Instead of disputing an incorrect rollup state with proofs of fraud, these rollups opt for proofs of validity, a form of off-chain computation that verifies the correctness of transactions submitted by the rollup operator and proves the correctness of the rollup , without revealing the state itself.

While cryptographically complex, this proof design means that the published state will always reflect the correct state of L2, and means that zkRollup only relies on Ethereum's censorship-resistant features, not security, as Optimistic rollup does in its as done under the Fraud Proof Scheme.

Some of these zkRollups have already made it to mainnet, and their rapid adoption shows the need for zero-knowledge scaling solutions built on top of Ethereum.

Leading the way is zkSync Era, which has the most positive inflow both in terms of users and TVL (largely due to airdrop speculation), having amassed a staggering 1.55 TVL since deploying to mainnet at the end of March One hundred million U.S. dollars.

Source: Artemis

There’s no denying that competitors have been trying to achieve similar success, with both Starknet and Polygon’s zkEVM seeing massive TVL inflows from early April.

Just yesterday, Polygon Labs proposed an upgrade to the existing Polygon PoS chain, and in the process, the discussion around what constitutes a "rollup" became further confused.

Source: Twitter

One key distinction, however, separates zkRollup highlighted above (including Polygon's zkEVM Rollup) from zero-knowledge validity (which appears to be the future of Polygon PoS chains).

Publishing proofs of validity or "zk" to Ethereum does guarantee the correctness of Polygon PoS state transitions, but users will still rely on the MATIC network for data availability and functionality of validity.

Source: Polygon Labs

While this approach will undoubtedly cut transaction fees and improve scalability, by outsourcing data availability outside of Ethereum, the "validity" vision proposed for Polygon PoS will not inherit the full security package and availability supported by Ethereum. Liveness on real zkRollups.

The DAO Hack

When considering any potential future black swan events, it is helpful to look back at history. Less than a year after Ethereum launched, the fledgling ecosystem was forced to face a cataclysmic event: the DAO hack.

The DAO launched in April 2016 and raised $150 million in its formative period of just four weeks by giving token holders unprecedented voting rights. Unfortunately, their unprecedented success in fundraising was short-lived when an attacker used a reentrancy attack that drained almost all of the ETH the DAO controlled.

Despite the best efforts of the white hat hacking group "Robin Hood" to recover the funds, the attackers still left behind $40 million in ETH, equivalent to 5% of the circulating supply of ether at the time. In the chaotic aftermath, the Etherians hit the final reset button: an irregular state change!

While Ethereum often employs coordinated hard forks to implement protocol upgrades, as seen during Merge and Shapella, cleaning up the DAO hack required an additional step. This hard fork not only fixed the bug that caused the DAO to crash, but also returned all hacked funds to their rightful owners.

Rolling back the DAO hack was a controversial decision, with much of the resistance coming from Bitcoin proponents arguing that an irregular state chain would reduce the credibility of the Ethereum network and circumvent the entire premise of blockchain immutability. In the end, professional hard forkers won the battle, a feat made possible by fears that hackers' massive concentration of ether (5%) would make it equally difficult for people to take the network seriously.

Such a reset would be required if rollup was exploited - and for good reason, as it worked out well before - but don't cross your fingers just yet, no one is going to save your crypto project this time .

The decision to hard fork is not taken lightly, and using it to manipulate account balances does damage the value proposition of blockchain technology. Requests to implement something like a hard fork have stalled in proposal purgatory, such as EIP-867 (to standardize fund recovery requests) and EIP-999 (to undo the 513k ETH Parity Wallet disaster).

Ethereum magician Vitalik Buterin recently issued a scathing condemnation of any possible rollback nodes in his article "Don't Overload Ethereum's Consensus", arguing that a fragile social consensus creates a high risk of chain splits, and at maturity Hard forks should be used with caution in the community.

Although this article mainly discusses the dangers re-staking poses to social consensus, Vitalik clearly pointed out that rollup may rely on Ethereum to fork and recover funds, which is a high-risk consensus application and thus may lead to chain splits.

Source: Vitalik Buterin

Unless we see a fundamental change in the guarding of the Ethereum community, it's unlikely we'll see another DAO-style irregular state change to cover up a rollup vulnerability.

TL;DR

Truth be told, we are still in the early stages of the Ethereum scaling journey!

Optimistic rollups represent developers’ best attempts to scale Ethereum to date, but they remain vulnerable, and the attack surface will only expand with their growing success. However, in the face of the reality that Ethereum’s social consensus may not be able to save exploited optimistic rollups, it is imperative to seek alternative scaling solutions.

While the shortcomings are evident today, it is inevitable that further time and development will allow the teams behind various zkRollup and rollup-like scaling methods to refine their solutions to Ethereum's current scaling challenges.