A Comparative Technical Primer on Plasma, Optimistic Rollups, and ZK Rollups
Article by Sandeep | Edited by Jake and Stake and Hiro Kennelly | Cover Art by Chameleon
Before we do a deep dive into Ethereum scaling solutions, it is important to understand why scaling is needed. The answer is not complicated — scaling is needed when Ethereum reaches its capacity and the costs of using the blockchain exponentially increase. Scaling solutions expand capacity, improve efficiency, and reduce costs of blockchain usage — aka gas fees.
Gas is the unit of computational effort required to execute specific transactions on the Ethereum network. Consequently, a gas fee is the fee required to successfully complete a transaction.
Below is a diagram explaining how gas works on the Ethereum network:
Ethereum can be scaled on chain (Layer 1 Mainnet) and off chain (outside Layer 1 Mainnet). On-chain scaling, which is primarily sharding, requires changes to the Ethereum protocol, while off-chain scaling does not require any changes. Many off-chain scaling solutions are called Layer 2 solutions because they derive their security from Mainnet.
There are multiple types of Layer 2 scaling solutions, which include Rollups, state channels, side chains, Plasma, and Validium.
As for Rollups, there are essentially two types:
Optimistic Rollups, which assume that transactions are valid by default and only run computations via a fraud proof in the event of a security challenge
ZK (zero knowledge) Rollups, which also run computations off-chain, but submit a validity proof to the chain (Mainnet)
Regardless of the type, Rollups have one thing in common — they are secured by Ethereum’s native security.
In this piece, we will dig deeper into two Rollup solutions, but first we will look at Plasma scaling, which can be considered Ethereum’s native side chain or baby chain.
Plasma Scaling
Plasma is a Layer 2 scaling solution, and has its own similarities and dissimilarities with Rollups. Plasma was proposed in 2017 by Joseph Poon and Vitalik Buterin as a framework for creating scalable applications.
Plasma operates by using a combination of smart contracts and cryptographic verifications (aka Merkle Trees) to enable fast and cheap transactions. It does so by offloading transactions from Mainnet into multiple “side” chains, which are also called child chains. These child chains interact with Mainnet to resolve disputes.
The unique feature of Plasma is the ability to create an infinite number of child chains, and create them on top of other chains in a tree structure. Plasma’s similarity with Rollups is the use of “fraud proofs”. But, what is a fraud proof?
A fraud proof is proof submitted by a verifier challenging the state of a transaction. It will attempt to run through a block of transactions in an attempt to validate them. If the proof does indeed identify an error, the said transactions are removed from the specific batch, and the batch reverts to its original, correct state. If no fraud proofs are submitted, then the transactions are processed, and the changed state is assumed to be correct. Fraud proofs work by comparing Merkle roots, and verifying the beginning and end state roots either through single or multiple rounds of computation.
In the above example, a fraud proof stating that a batch is invalid would have the data highlighted in green. If both the computed and provided post-state Merkle root are not identical, then the Fraud Proof is true, and the batch of transactions is fraudulent.
Although the use of Fraud Proofs is similar between Plasma and Rollups, there are two distinguishing features:
Plasma keeps all transaction and computation data off Mainnet, while Rollups keep some of this data on Mainnet
To keep all transaction and computational data off Mainnet, Plasma needs to adopt an explicit notion of owners, which prevents them from being general; on the other hand Rollups do not need this because of their hybrid approach of keeping data both on and off chain
Although the use of multiple child chains in Plasma allows more data to be processed with less data load, the advantages over Rollups end there. Each child chain uses its own block validation mechanism, and different types of consensus algorithms for fraud-proof implementations. For each evidence of fraud, the respective child chain submits a complaint to Mainnet.
When a participant requests for a withdrawal from a Plasma child chain, there is a wait time of 7–14 days, which is called the challenge period. This is the time required for other individuals in the child chain to submit a proof to challenge the withdrawal. If no proof is submitted, the withdrawal is processed. If the withdrawal is fraudulent, then that batch of transactions and the ones after are reversed. This long withdrawal time has made Plasma less attractive compared to Rollups in terms of scaling solutions.
Attempts have been made to reduce this long waiting time by using zero-knowledge proofs instead of fraud proofs (Starkware’s Validium is an example), but Plasma has not gained popularity as a scaling solution compared to Rollups. In addition to the long waiting times, security has also emerged as a concern for Plasma. Malicious activities can compromise a whole child chain, which then forces users to move back all transactions to Mainnet. As Rollups have advanced and evolved as scaling solutions, Plasma has fallen by the wayside.
Optimistic Rollups
A key point of similarity between Optimistic Rollups and Plasma scaling is the use of Fraud Proofs. Its first and foremost difference with a ZK Rollup is this very thing, wherein a ZK Rollup uses “Validity Proof”, which is nothing but the cryptographic proof ZK SNARK.
With that basic distinction, let us understand how an Optimistic Rollup works.
Optimistic Rollups expand Mainnet’s capacity by operating in parallel on Layer 2. The contribution to the blockchain’s capacity and processing time is driven by the ability of an Optimistic Rollup to capture the new state of a transaction and propose it to Mainnet for something akin to ‘notarisation’. It frees up the computation time on Mainnet, which is the most time-consuming part of any transaction, and can add up to 10–100x improvements in Layer 1 scalability.
On the other hand, the need for ‘proof of fraud’ makes Optimism Rollups slower than ZK Rollups because of the longer wait times required for transaction settlement.
Compared to the ZK Rollups, which uses only one piece of data (the ZK SNARK cryptographic proof), Optimism Rollups process more pieces of data, which include:
Compressed rollup transaction data
Pre-state root hash
Post-state root hash
This usage of multiple pieces of data, combined with the principle of fraud proof, makes Optimistic Rollups slower solutions when it comes to withdrawal times for transactions.
Optimistic Rollups in Practice
Below is a step-by-step overview of how an Optimistic Rollup works in practice:
There are a few key components of the system — the rollup itself, Sequencers, Adjudicators (fraud-proving contracts) and the Optimistic Virtual Machine.
The rollups in this case are the regular smart contracts on Mainnet — they receive the transaction data on-chain, send it to Layer 2, and receive the results of Layer 2 computations (Layer 2 computations only happen when a Fraud Proof is valid and is executed).
Sequencers on Layer 2 receive the transactions sent to the rollup contracts.
Sequencers respond with a signed pledge to accurately execute and order the received transactions.
“Signed pledges” are problematic from the point of view that they slow down the processing of transactions when a transaction is challenged and is costly. In these instances, the Sequencer has to pledge assets far greater than the value of a transaction to defend its validity. In normal instances when there is no challenge, a signed pledge is a notional aspect.
The Fraud Proof principle in an Optimistic Rollup is applied via the following mechanism:
Sequencers are rewarded for executing transactions as expected.
Sequencers stake funds that are deducted if they behave maliciously.
Anyone suspecting fraud in a Sequencer’s action can alert the corresponding Adjudicator contract for the specific Optimistic Rollup on Mainnet.
The Adjudicator contract on Mainnet can validate or nullify the results coming from a Sequencer using the Optimistic Virtual Machine.
The offending Sequencer is slashed.
Some of the staked funds of the slashed Sequencer are awarded to the whistleblower (the entity that raised the alarm for Sequencer fraud).
Even though Optimistic Rollups are slower in terms of processing transactions (because of the combined need for fraud proofs and use of multiple data), there is interest in the solution across the blockchain infrastructure space, and from Vitalik Buterin himself.
A key driver of this interest is the cost advantage, which is due to Optimistic Rollups requiring only nodes to execute a contract. On the other hand, ZK Rollups create cryptographic proofs requiring thousands of expensive Elliptic Curve computations, making them significantly more expensive than Optimistic Rollups.
Let us now turn to these ZK Rollups.
ZK Rollups
The principle driving ZK Rollups is the cryptographic proof ZK SNARK, which is an acronym for “Zero Knowledge Succinct Non-Interactive Argument of Knowledge”.
These zero knowledge cryptographic proofs were developed in the 1980s, but practical use cases, which include privacy focused coins like Zcash, were released only in 2016. a zero-knowledge proof can be explained simply as “the ability of two parties involved in a transaction to verify that both have a particular set of information, without revealing what the information is”. These two parties have two interchangeable roles:
Prover, who wants to prove they have the information
Verifier, who wants to judge the Prover’s evidence
Where a Prover can be a Verifier and vice versa, and without revealing the actual information that will prove or disprove the Prover’s honesty, a ZK SNARK protocol has the following characteristics:
Completeness: The Prover can convince the Verifier of any true statement.
Soundness: If the Prover is dishonest, they cannot fool the Verifier.
Zero Knowledge: The Verifier will never know what the information is, but it has a secret parameter called the Witness.
If the ZK SNARK protocol is converted into a program, it will look like below:
C (x,w), where
C is an Elliptical Curve, and ‘x’ is the public input, and ‘w’ is the secret parameter (Witness String). The objective of the program is to prove, given a specific public input ‘x’, that the Verifier has the secret parameter ‘w’, which can be denoted as:
C (x,w) == TRUE
Below is a simple illustration of how the ZK SNARK protocol works:
The protocol has three separate algorithms, G, P, and V, which can be defined as follows:
The key generator G takes a secret parameter lambda and a program C, and generates two publicly available keys, a proving key pk, and a verification key vk. These keys are public parameters that only need to be generated once for a given program C.
The prover P takes as input the proving key pk, a public input x, and a private witness w. The P algorithm generates a proof prf = P(pk, x, w) that the prover knows a witness w and that the witness satisfies the program.
The verifier V (which is the V algorithm) computes V(vk, x, prf) which returns true if the proof is correct, and false otherwise. Thus this function returns true if the prover knows a witness w satisfying C(x,w) == TRUE
ZK Rollups and Ethereum
How does this work when it comes to scaling Ethereum? A ZK Rollup bundles hundreds of transfers (each with its own set of three algorithms — G, P, and V) outside Mainnet and generates cryptographic proofs. These proofs can come in two forms — one is the SNARK proof and the other is a STARK proof (which is slightly different) — and get recorded on Mainnet.
The key characteristics of a ZK Rollup are:
The smart contract maintains the state of all transfers / transactions on Layer 2.
Most or all transaction data continues to remain on Layer 1.
Validation of a block is quicker because the state of the transfers can be updated using the cryptographic proof (without needing the actual transaction data).
Validation of a block also becomes cheaper because you are not using expensive and scarce Ethereum processing resources.
ZK Rollups can be optimized even further to reduce transaction size by representing an account as an index on Layer 2 rather than an address (reduces transaction size).
Transactions are also written on Ethereum using ‘calldata’, which reduces gas fees.
Regardless of the size of a transaction, the zero-knowledge proof can be quickly verified on Mainnet, making transactions faster (for example, a withdrawal).
The faster processing speed of a ZK Rollup is driven by the fact that transaction processing and related computations are all done on Layer 2 (in short, the generation of the zero-knowledge proofs). While doing this on Layer 2, it will share the validated information about the transactions back to Layer 1 thereby updating the transaction data.
At the heart of a ZK Rollup’s ability to validate transactions and keep gas fees low are Merkle Trees. Merkle Trees are mathematical structures that enable blockchains to ensure no fake data can be introduced in the on-chain records of a ZK Rollup (remember that in a ZK Rollup, data remains on Mainnet, and only the zero-knowledge proof is generated in Layer 2).
A common ZK Rollup typically consists of two Merkle Trees, which are both stored in a smart contract on Mainnet. One tree stores account data, and the other stores all the account balances. Any other type of data needed and generated by the ZK Rollup is done off chain (Layer 2), which is the majority. The judicious amount of data storage in the Merkle Trees saves significant amounts of processing power and time on Mainnet. This, in turn, reduces gas fees for transactions.
State of Scaling Today and Beyond
Scaling is a rapidly evolving domain and it is widely accepted that it will be a driving force behind wide-scale adoption of Ethereum. Although the space is ripe for innovation, the future of scaling is unknown. Rollups hold an advantage over Plasma when it comes to scaling, but according to Vitalik himself, they require “years of refinement” before they become trustworthy sources for storing assets. In a 1,500 word blog post titled “Endgame”, Vitalik outlines three evolutionary paths for Rollups, all having the same characteristics — “Block production is centralized, block validation is trustless and decentralized, and censorship is prevented”.
Three paths towards the same destination. Source
At an industry level, the debate between Optimistic and ZK Rollups continues, with a long list of pros and cons for each. Although ZK Rollups have enabled blockchains like Solana to scale rapidly and handle significant transaction volume, it has come at the cost of maintaining and running expensive nodes. Although Optimistic Rollups seem to fall out of favor because of the longer validation time, they still remain a viable option because of their compatibility with EVMs (which still support a large proportion of smart contracts). The factors of costs and trust also come into play. Optimistic Rollups are cheaper because they do not use the expensive Fraud Proofs required by ZK Rollups. Additionally, they have a built-in trust system because they keep all the data on Layer 1. On the other hand, ZK Rollups need a trusted setup, because they conduct all the processing and computations outside Mainnet. But Optimistic Rollups require real-time fraud monitoring, which is not true for ZK Rollups.
As the debate continues, so has innovation. Considered to be the Holy Grail of scaling, and a potential death knell for Optimistic Rollups, is the sudden rise and popularity of zkEVMs, which are ZK Rollups compatible with the Ethereum Virtual Machine. This scaling solution, built over years, essentially bridges the gap between ZK Rollups and their ability to scale applications built using smart contracts running on Ethereum. This has been made possible through a breakthrough, which allows any smart contract built on Mainnet to be ported over to a ZK Rollup chain without changing the underlying code.
The need for scaling, to reduce costs and increase processing speeds, will always be there. Ethereum’s competition is also growing, meaning dApp building will gradually start happening on a more diverse blockchain landscape. This will lead to the demand for scaling solutions that have more bridging capabilities across different chains, something realized by zkEVMs. Given all of this, we are seemingly looking towards a more fragmented blockchain and scaling solutions space in the years to come.
Author
Sandeep is a brand and growth strategist with close to two decades of experience. In his web2 consulting work, he has worked with the likes of McKinsey, Prophet and Interbrand. He started his web3 journey in 2022, and has held social media management, campaign development and governance roles in the Marketing Department of BanklessDAO. Sandeep is the Director of Marketing for BLabs, the external web3 research focused entity of BanklessDAO. He is also a researcher by background and an avid writer.
Editors
Jake and Stake is a writer and editor at BanklessDAO. He is the former Writers Guild’s Governance Coordinator and runs the DeFi Download newsletter, with a background in software engineering and cybersecurity.
Hiro Kennelly is a writer, editor, and coordinator at BanklessDAO and the Editor-in-Chief at Good Morning News. He is also helping to build a grants-focused organization at DAOpunks.
Designer
Chameleon is a designer and creator in the web3 space.
BanklessDAO is an education and media engine dedicated to helping individuals achieve financial independence.
Bankless Publishing is always accepting submissions for publication. We’d love to read your work, so please submit your article here!
This post does not contain financial advice, only educational information. By reading this article, you agree and affirm the above, as well as that you are not being solicited to make a financial decision, and that you in no way are receiving any fiduciary projection, promise, or tacit inference of your ability to achieve financial gains.
More Like This
Distributed Ledger Technology 101 by The Crypto Barista
Cryptocurrency Wallets 101 by ijeblowrider
7 Etherscan Basics by Hiro Kennelly
