Fast Exits from Optimistic Rollups - Willem Olding - [Toronto Ethereum Developers Meetup]

Transcript

cool um yeah so my name is willam and as mentioned i'm a solutions engineer at chainsafe um which is basically like a fancy name for a researcher and um yeah i'd like to present something that i learned the other day that i thought was just uh really cool and i'd love to share with you um with you all so this is how to fast exit from an optimistic roll-up and so yeah i'll present a bit of background on optimistic roll-ups for anybody who that's a new thing for um i'll kind of present the main inside which is like how we can potentially skip this window in certain circumstances which is a problem that plagues optimistic roll-ups and then i'd like to talk about some kind of applications we've got

within chainsafe or using this in our bridges okay so quick overview of optimistic roll-ups um basically a roll-up is a state tree which is very similar to the state tree that's already inside an ethereum block the main difference being that the state transition computation happens off chain rather than on chain so in a roll up we still have a tree and the the root of this tree is held within a block so that's a commitment to some state at some point in time all of the transactions also kind of go on chain although in a slightly different way to enforce ordering and then an off chain actor called the sequencer

is responsible for applying all these transactions to the state to calculate a new state so in this case we're you know changing the color of one of the leaf nodes from green to red and that's our state transition um so all around it's like actually quite a simple um simple model and like i guess because of that it's kind of floated as like the near-term scaling solution for ethereum near term in the sense that like it's probably not the ultimate scaling solution but it is one that we can basically do immediately um with the kind of technology that we have so that's really exciting and there's a bunch of projects which are doing amazing work in particular optimism to make these

a reality for day-to-day ethereum use and so to summarize state transition computation is done off chain and the state is committed on chain but the kind of the obvious thing that you might see with this is how can we be sure that the state transition was done correctly if the computation was done off-chain um yeah good question well the re um the way this is solved um in optimistic roll-ups in particular is by using something called a fraud proof and so in this case the sequencer doesn't just post the new state route online they are on chain sorry they also post it along with

a bond and the bond is posted in such a way that anybody can kind of challenge their commitment to the new state and if a challenge is made then the whole state transition is re-executed on chain so this is a really expensive operation that we want to avoid obviously and so it's only done in the case where you know somebody in the world suspects that um some kind of fraud has taken place in the state transition so if fraud is detected then the sequencer gets slashed the challenger gets a reward and the kind of invalid state that was found to contain a fraudulent transaction is rolled back to the last kind of known valid state although this could potentially be challenged as well and it could continue

to roll back and crucially any other state transitions that build off this um one that's been classed as fraudulent also get rolled back so everything kind of goes back to our last known good state um and so doing this kind of challenge is an expensive operation because it basically involves you know calculating state transition on chain and whoever is the challenger has to pay the gas for that and so nobody's going to do it basically unless there's a really good reason to like they can be basically certain that they'll get a reward and the reward should cover their gas costs and so this also raises kind of an interesting question which is like

um if the the roll-up can be rolled back at any time because there could be a fraud in its history what does this mean for finality and so in particular this comes up when we're exiting from a roll-up to the main chain so we could be transacting in the roll-up with some kind of assets we might want to exit these from the roller back to the main chain to then transfer it to a different layer 2 or something like that and if the roll-up could be rolled back at any time if we transfer back to the main chain and then the roll-up is rolled back then this essentially means we've kind of done a double extent and so the way that this is solved in most optimistic roll-up implementations

is by using something called a challenge window so the challenge window says that after some period of time we'll consider the roll-up state to be final even if it's fraudulent and this needs to be really long which is um a huge hassle so it needs to be long because we need to make sure that within this roll-up window there's time for a challenger to post a fraud proof and there has to be near certainty that this broad proof can be fit within a block so you can imagine a case where um maybe a roll-up sequencer would be able to fill all the block space

for the space of the window thus preventing anybody from posting a fraud proof thus allowing them to include fraudulent transactions so the window needs to be long enough that um kind of conducting one of these denial of service block space attacks is prohibitively expensive and the number that most people come up with is between one to two weeks which is insane so to for finality in a roll-up from the perspective of the chain takes um one to two weeks and as you can imagine for most people this is pretty much not acceptable so this is a huge problem for adoption for optimistic relatives so let's talk a bit about the kind of entry and exit procedures

and kind of where this problem comes up so entry onto a rollup is actually really simple if we have some actor which we'll call ashley on the main chain they could transfer ether into a contract where it becomes locked this would cause a special transaction to be included by the sequencer which then on the roll-up would trigger the minting of some wrapped ether which would then be transferred to ashley's account on the roll-up so the roll-up doesn't actually deal with either it kind of deals with a wrapped version of ether that can be um redeemed one for one so this is pretty simple and this can be done um pretty much uh in a short time period roll up exit is basically the same thing in reverse

that we um that our actor would um transfer their wrapped ether which would then be burnt but then they have to wait for one to two weeks for that action of them burning the ether to kind of pass outside of that challenge window and become final once the main chain can be 100 sure that this burning of the ether can never be undone then they can unlock the ether on the main chain so we just had to wait one to two weeks just to transfer to a different roll-up so there is one kind of really key insight um and this was the the kind of insight that made me go yeah that's cool and i should present this as the meetup and this insight is that like a valid state route can never be proven invalid

and the implication of this is that a valid state route can never be rolled back and so the chain can't know if a state route is valid without actually executing the transitions on chain but anybody off chain can validate the transitions themselves convince themselves that any particular state route is valid and therefore convince themselves that it can never be rolled back so in summary the chain can never know that something is actually final unless it's outside the challenge window but anybody off-chain can validate the roll-up themselves because it's all on public data and then they can be sure that they can never be a rollback so with this in mind it's actually

really simple to devise a fast exit so in this case we have this kind of additional actor which we call lp which is a liquidity provider and they're a kind of off-chain actor as well as on-chain so if ashley transfers their app ether into a contract where it's burnt this liquidity provider off chain can verify the roll-ups themselves up to the point where this ether was burnt they can check that everything is valid and then they can know that this can never be rolled back by observing this it allows them to dispatch funds to actually immediately without waiting then two weeks later um the uh roll-up will reach finality this will unlock some ether and then

this ether will go to the liquidity provider rather than to ashley so effectively they've kind of like provided the ether ashley and then two weeks later they'll get it themselves and so they wouldn't do this for free i imagine and they would expect some kind of fee in return for this but crucially like over time this liquidity pool isn't going to be drained it will probably actually accumulate ether because of the fees so there can be actors that provide this service for um quick roller fixes before we go on yeah so that's super cool so it actually means that this problem that a lot of people kind of tout with optimistic roll-ups of this like difficult

exit period is actually not that big an issue at all it just requires these actors called liquidity providers to exist and if it's kind of worthwhile to do so if they can get sufficient fees i imagine they will exist cool and um it turns out that we can actually use a really similar technique with one of our chainsafe products chainbridge so chainbridge is what's called a trusted federation bridge which is that there's a kind of group of relayers these relayers watch actions which take place on a chain or potentially on an l2 such as a roller when they see a particular action they come to consensus that they all saw the

same thing and that it was valid and then they submit a transaction on a target chain and the federation is authorized to do certain things on that chain for example to mint wrap tokens and doing so is like a kind of semi-trusted way to do a bridge but it's also a really simple way and what this actually allows us to do is to do near instant roll up to roll up or roll up to a different chain exits so in this case if our actor actually could make some call on a contract the relay is observed this the relayers would then verify the roll-up themselves ensure that it was all valid up to the point where that happened and then they could then vote come to

consensus and you know do some multi-seek thing and cause some action to take place on potentially another chain or another roll-up and this could really open up the world of roll-ups and l2s um by allowing kind of instant instant interoperability between multiple universes and yeah the same same thing again if they're all that's valid at the roll up they can skip waiting for finality and this allows us to do any kind of cross-chain call so not necessarily limited to value transfers or token transfers like it would be in the case of um like fast exits that this allows us to do kind of any cross chain call um instantly cool and that's all i got

so uh yeah thanks very much