'What are Rollups even?' - Patrick McCorry

without further ado i'd like to welcome our first talk of today uh patrick mccrory he's going to be talking about what are roll-ups and uh he'll be doing a really amazing talk on how everything works in this world so patrick welcome and i'll let you kick off with your presentation awesome thanks for the introduction card tape i'll just share my screen now um hi everyone so i'm just going to quickly present for the next 15 minutes you know what even is a roll up and what i want to highlight before i begin is that i'm not affiliated with any roll up you know project so i'm going to try my best to give you an unpassed view off you know the problems that they're trying to solve i currently work for inferior and i also advise lavender cap so without further ado as everyone's aware you know this uh wonderful event is going to be about blockchain scalability for the next month and over the past year a bunch of new projects have emerged like arbitrary aztec sailors uk sync optimism polygon star wars uk swap and loopering and these are projects that are called rule ups that are promising low fees you know smart contract deployment transfers and a much better user experience than developing on ethereum so what i really want to highlight is you know why does this matter what are the problems they're trying to solve and hopefully sets you up for the next three weeks you can get a really good understanding what's going on but before i get into that i always like to ask people this question you know have you ever deposited coins into an exchange or an online service like coinbase finance or bitstump uh nobody asks people to raise their hand but there's no hands here to be raised but pretty much if you've ever used an exchange before then you've actually used a layer 2 system you know you've had the deposit coins under the service you get a balance that you know becomes positive on the website you can then you trade you can execute transactions whatever and the idea there is that these intermediary services you know coinbase bitstop binance etc they're technically layer 2 sequencers they take all of their users transactions they order them they execute them then they update their you know their layer two database which basically determines how much funds you have on the service now the problem with these layer two services is one they're fully custodial they can freeze confiscate or they could even just lose your funds two they're not auditable they're you know that layer two database that they have you know can anyone here access the coinbase database well obviously not because it's so peak and it's not publicly auditable so the question then is you know are these layer two services are they running a fractional reserve and we don't know you know who knows we can't actually look at the database and as i mentioned they also you know control the ordering of transactions so given a list of transactions they can order them and determine how they're executed so layer 2 is used every day but it is custodial and is high risk back in 2016 goon had this wonderful tweet that 33 of bitcoin exchanges have been hacked and then as they get hacked they tend to be large scales and then gox is lost 850 000 bitcoin bitfenix lost 120 000 bitcoin and it's not because they're you know they're not being melissa's or adversarial is this very difficult to keep custody of a large big honey pot of funds that a hacker can just get in steal the private key and then run away about your funds so the question is all of these rule offs and all these cool layer two protocols can we transact on a layer two system while still allowing users to maintain full self-custody of their own funds so let's find out what i'm going to explore today is i want people to get a better understanding of roll-ups and more generically as polygon said commit chance you know because rule after just a single instance within this entire design space we're going to look at this from first principles so what is a commit chain and how does it work what is the wider environment they live in and what are the protocol assumptions who is the adversary what is their power and how are they trying to break the system and steal your funds and finally what are the security goals that need to be satisfied before a roll up is secure and hopefully this will set you up for the rest of the hackathon so the big difference with these commit chains is that you still have this sequencer that can be one sequencer or multiple sequencers they're still collecting layer two transactions they're still ordering the transactions but the big difference is that they have to post little checkpoints to ethereum periodically these checkpoints will define the order of transactions and also the execution of all those transactions so what is the current state of the layer 2 database and there's like this little checkpoint that's sent to ethereum and so this big difference allows for layer 1 enforcement so it's up to the layer 1 to enforce it all these transactions are valid and correct then alice comes along and alice wants to use the layer 2 system so alice will still have to deposit one coin into this layer 2 system but the big difference here is that this coin is deposited into a layer one smart contract and is never given to the sequencer so the sequencer never has custody of your funds and typically you still have to do a signature in order to transfer funds in the layer to your system so this layer one contract that enforces the roll-up rules also has custody of your funds then bob comes along hi bob and alice wants to sign a coin the bob so alice will sign a transaction give it to the sequencer then the sequencer can ping bob and say bob you've now got one transact in one coin but this isn't final yet this is still pending until the sequencer pushes the checkpoint to ethereum so we run around there's no new transactions checkpoint gets posted then everyone can see that alice's transfer is confirmed and bob has received the one coin and over time checkpoints get posted and that finalizes their transactions now the final difference which really makes roblox you know commit chains beautiful is that alice should be able to use ethereum this layer one blockchain they get the ground truth theater you know about the layer two system it should also be able to fetch the entire transaction history for the layer two system and recompute the entire layer two database herself and then she can verify that everything is valid and everything is correct but what does it mean to be secure for a competition well georgia has this wonderful twitter thread that says what makes layer 2 special is that layer 2 security equal equal layer 1 security but i'm going to argue that's too ambiguous you know layer 2 protocols really cannot have the same security as layer one but they can get pretty damn close and it's really this pretty damn close is where the detail and the really cool innovation is happening so what does it mean to be secure so now i'm gonna cover the protocol assumptions on the threat model you know what do we assume to be true who is our adversary and what special powers do they have and then i'm going to talk about the security goals and what we're trying to actually keep secure so adversarial model i'm going to break it down the two parts first the adversary has control over the messi's control flow so any message is sent on the layer two system the adversary can view order and drop so therefore they can censor all the transactions and layer two if they want and they can reorder them the only thing they can't do and this is a protocol assumption is alice can always reliably send a transaction to the layer one blockchain with his ethereum and as long as he has an appropriate fee it will always get mined and this also assumes alice can always see the layer one you know ethereum can always see the contents of that and the layer two system can't stop her from looking at it the second you know part of the adversary model is that there's only two trusted parties there's alice who's honest the single user and the smart contract you know ethereum uh we assume both of those parties are honest otherwise the sequencer or sorry the adversary can corrupt everyone they can corrupt every sequencer and they can corrupt all users so really if i'm using this layer 2 system i have to assume everyone can be corrupted and i still have to be safe and secure within that environment so really we've described the most powerful adversary possible and really not every rule up has the tools to fully constrain or outright defeat this beast but another way to look at it is that is a tag team battle between the honest user this layer one smart contract and they're fighting the sequence during the adversary to make you know constrain it and make a bend to their will and if you don't have this epic fight in your hands for a layer two protocol then it's not really a layer two protocol then unfortunately i'm not too interested in that uh so what are the security goals what are security properties what are we trying to keep secure how are we trying to constrain this adversary the first one is the data availability problem so what do i mean by this so as i mentioned the sequencer has to post little checkpoints to ethereum it's typically a 32 byte hash this will include the layer 2 state and the list of transactions that are being executed so how do we guarantee that the entire transaction history for the layer two ledger is publicly available so this is important for several reasons one audibility alice wants to re-compute the layer to database herself she must she needs to know the transactions that recomputed herself to interaction if she's going to send a you know a swap on uni swap on this layer 3 system she wants to verify that the exchange rate sees being quoted is correct according to the layer 2 database and finally withdrawal if alice wants to withdraw her coins from the system she may have to inform the lair one blockchain but her final balances that she's going to withdraw and bingo this is where we get rollups you know rule this is the only thing the rule-ups solve in terms of all these problems a rule up literally means all transaction data is rolled up and posted to the layer 1 blockchain this is actually a slightly stronger assumption we now assume the layer on blockchain has plenty of storage it can store all the transaction data bandwidth is not an issue and you know everything can be stored on ethereum but this is one of four ways to solve that problem but that is what a roll up is the state transition integrity problem now so the issue here is how do we guarantee that the final execution of a layer 2 transaction is correct because a sequencer could pose a checkpoint which has the state and an invalid transaction that steals everyone's coins and if the sequencer can get away with this then obviously they can steal all the funds in the layer 2 system and it's not secure so there's another bingo card this is optimistic versus zero knowledge fraud food versus validity proofs i'm not going to go into it now but you'll hear plenty of debates over the next few weeks about the pros and cons of either approach but again that's the only problem fraud proofs and validity proofs are solving steel transition integrity and the final problem is withdrawal integrity so let's just say alice wants to withdraw her coins from the systems he says sequencer here's my withdrawal transaction give me my 10 die and the sequencer says no you're stuck forever you're never getting your coins out they're confiscated you know the system should be set up so alice can always withdraw her coins even if this sequencer is offline or does not cooperate so now we have our three problems data availability state transition integrity and withdrawal integrity if we can satisfy the above problems then hopefully we can slay the beast deploy a secure layer to your system and you know everyone can have all their unicorns but even if we can satisfy all three properties do we still need the trusted sequencer so the answer is yes no yes no yes no one it depends how well people can satisfy those three problems i know there's no perfect solution out there but there's also other problems that pop up that relate to security the first is minor extractable value and you're going to hear a lot about this over the next three weeks but the idea is that the sequencer can control the order of all transactions so if i send in a trade on uni swap and i allow for one thousand dollars worth of slip each the sequencer can sandwich me they frontrow me they background me the victim transaction goes in the middle and they interfere with your computation and they extract one thousand dollars from your trade they haven't tampered with your transaction they've just played out of the state so they could take the slippage is this an outright attack on you know an outright attack on the system or is it a potential business model is it the robin hood of rule ups uh there's still a debate out there but what we do know is mev is very profitable you can go look at the flashbots project and they're making way more money than honest miners you just take the transaction fee i think over 60 percent of miners now are now using flashbacks but most importantly we need a trust sequence search because this is the difference between the fast path and the slow path and i mean the very slow path if sequencers are honest i give my transaction to the sequencer they'll acknowledge me right away to say potty your transaction will be mine this is the final execution and it'll be finalized within the next two three hours i walk away i'm happy it gets finalized and the sequencer did what they promised if the sequencer cannot be trusted you know maybe i give them my transaction they want to do some mev or whatever and i have no guarantee what the final execution is going to be then actually i may end up on the very slow path because one i'm waiting for four hours or two hours you know what the final execution really was but also i may just have to send the transaction to ethereum directly if i wanted to be truly executed the way i wanted to be definitely 100 included in the blockchain then that's actually the very slow path and that's even worse than ethereum today so we still have to care who these sequencers are going to be and what keeps them honest so what we need to consider is that you know first how are sequencers selected is it centralized are they appointed are they elected do they have stake on the system and also the consensus protocol how do these you know sequencers reach agreement on the next set of transactions to be executed do they take an intern to alice bald carlin alice about carline or do they have something new bpft protocol there so this is my final slide um i obviously haven't give many solutions in these uh in these slides but what i hope that i've given you is a much better understanding about the problems that surround roll-ups and throughout the hackathon you can now poke your favorite project and say you know how do you solve the data availability problem how are you solving the standard integrity problem do you deal with mev do you have order fairness etc etc so i'm going to finish with this slide this is what a layer 2 protocol is about and if you don't have this bottle on your hands then it's not a layer 2 protocol so thank you for listening thank you so much patty this was super helpful as a as a context and we also have our a few questions coming