What are optimistic and zk rollups and how they work

What are zk rollups and how do they work? We explain the characteristics of optimistic and zero knowledge (zk) protocols, clarifying differences and common features.

What are zk rollups? 

Studying Ethereum you will surely have come across the term ‘rollup‘, optimistic or zero-knowledge, but what are they and how do they work? In short, it is a layer 2 technology that increases the scalability of the main blockchain by collecting several transactions in one ‘package‘, thus improving speed, finality and lowering the transaction fees. 

Vitalik Buterin himself undertook to explain what rollups are, because they represent a key step in the roadmap to realising the ‘world computer’ he has envisioned. The Ethereum blockchain, in fact, is designed to host decentralised applications (DApps) of all kinds, beyond the simple Peer-to-Peer exchange of value. Its network, therefore, should be able to handle immense volumes of traffic, without sacrificing performance or excessively increasing costs.

The trilemma of scalability, however, presents a challenge: layer 1 blockchains, i.e. basic infrastructures with autonomous operation (such as Bitcoin or Ethereum), in order to be more flexible and performant, risk sacrificing one aspect between decentralisation and security. However, there are uncompromising solutions: support layers (layer 2 and sidechain) that operate in parallel with the mainnet, shifting workloads off-chain.

Given these premises, we can understand what rollups are and how they work: one of the possible models for solving the trilemma of scalability, in addition to state channels (as in the Lightning Network) and plasma chains.

How do rollups work?

Rollups, from the English ‘to roll up’, can be either optimistic or zero-knowledge, but both share a basic structure and some fundamental steps. Before dealing with the two types individually, therefore, let us define in general terms what rollups are and how they work. 

In both cases, transactions are first executed on a layer 2 and grouped into batches by an aggregator or sequencer; the collected information is then compressed and sent to the main blockchain (Ethereum), where it will be processed as a single exchange and placed on a block. In this way, rollups increase the transactions per second (TPS) that can be processed by layer 1s, as well as distributing the cost of fees (and gas) among the different participants.

To really understand how rollups work, we need to consider the role of the set of smart contracts that receive blocks on the main blockchain. These programmes, in fact, store and verify the data received, so that valid state changes are immutably recorded. These essentially correspond to updates in the balance of the wallets involved in transactions, Ethereum being based on the account model. 

In particular, the state of a rollup is represented by the root of a Merkle tree, a hierarchically organised branching structure. This ‘state root’ is cryptographic summary code, similar to a hash: it represents the ‘final’ stage in the balances of senders and receivers, following all transactions collected in the rollup. 

In addition to the ‘state roots’, rollups must provide a batch root: another cryptographic code derived from a second Merkle tree that includes information on the individual transactions in a batch. Understanding the role of the root is fundamental to understanding what rollups are and how they work: they allow anyone to reconstruct the ‘history’ of transactions, prove their inclusion in the rollup and verify the correctness of the final state. 

In fact, these codes are the basis for generating the ‘proof’ that all transactions in the group are legitimate. This step, however, can take place at two different times, depending on whether it is an optimistic rollup or a zk rollup (zero-knowledge): let us compare the two types.

Optimistic rollups and fraud proof

Before going into the details of what rollups are and how optimistic and zero-knowledge types work, let us make one last technical point. Layer 2 aggregator nodes, in order to produce transaction ‘packets’, must provide a guarantee. As in Proof-of-Stake, they must deposit a certain amount of coins or tokens to participate in the rollup process. In this way, they are incentivised to be trustworthy and honest: if a rollup block contained incorrect information, such as to render it invalid, the coins left as ‘pledge’ would be destroyed, or otherwise taken away from the fraudulent node.

The correctness of optimistic rollups, in particular, is verified a posteriori and only ‘on demand’: they are called optimistic precisely because they assume the collected transactions as valid, thus sending blocks without ‘proof’ to the main blockchain. However, there is an anti-fraud scheme that provides a fixed 7-day period (challenge period) within which other layer 2 nodes can challenge the results, providing fraud proof. Essentially, they re-execute the transactions contained in the rollup off-chain and, in case they reach a different ‘state root’, report it to the layer 1 smart contract, which will proceed with the necessary verifications. 

To better explain what optimistic rollups are and how they work, the main blockchain can resolve the dispute in one or more rounds, objectively determining who is right between the aggregator that created the block and the challenger node that generated the fraud proof. In the case of a single verification round, additional information is requested from layer 2, so that the transactions contained in the rollup can be processed one by one; this requires the payment of higher gas fees. 

Alternatively, the contending nodes can ‘argue’ in multi-rounds, specifying to layer 1 the precise information they disagree on. In the case of multi-rounds, in fact, they proceed according to a ‘bisection protocol’: the rollup is divided into smaller and smaller halves until the challenger recognises the one containing the possible error. Should the latter win the contest, it would receive part of the aggregator’s stake.

In any case, users must wait until the end of the ‘challenge period’ before withdrawing funds sent to layer 1, even if the rollup receives no objections. The security of the entire system is defended by the possibility of ‘criticism’ during this period. The validity of optimistic rollups, in fact, is based on the existence of at least one honest node: the aggregator or objector providing fraud proof.

ZK rollups and validity proof

Let us see now how zero knowledge or zk rollups work. These follow a different verification scheme: aggregator ‘supernodes’ associate validity proofs to the rollups, to cryptographically prove that the proposed states are correct. This minimises the amount of information that the rollup must contain, because by definition a zero-knowledge proof allows one to prove the correctness of a statement without revealing the data that makes it up.

In fact, layer 1 merely verifies the validity proof and changes the ‘root state’ of the smart contract to reflect the changes caused by the rollup. Compared to optimistic, therefore, zk rollups are ‘lighter’ and finalised instantly, because they do not need the challenge period; this allows funds to be transferred to layer 1 and withdrawn in a very short time. In addition, zero-knowledge proofs can be recursive, meaning that one validity proof can verify others. A single ZK-SNARK or STARK could in fact aggregate several rollup blocks, so that they are sent together to layer 1 and finalised simultaneously; this exponentially increases scalability. 

However, validity proofs are basically already complex to produce, requiring specific hardware. This entails a risk of centralisation and censorship but, as with optimistic rollups, dishonest aggregators are punished by slashing of funds. In addition, if a user suspects that their transactions have not been taken care of, they can verify this through the Merkle roots and eventually send these to the rollup contract on their own. 

A final feature to consider when addressing what zk rollups are and how they work, is their compatibility or equivalence to the Ethereum Virtual Machine (EVM): in practice, the programming environment of ETH, having its own specific functions and languages. EVM-compatible layer 2s can accommodate smart contracts designed for Ethereum, so as to improve their performance through rollups. It is easier to develop optimistic EVM-compatible technologies, such as Optimism and Arbitrum, but there is no shortage of zero knowledge examples, such as Polygon‘s zkEVM and ZKSync.

Are rollups the future of Ethereum?

Besides Polygon, many other projects (such as Consensys and Scroll) are developing solutions for the scalability of ETH. The roadmap of Vitalik’s project itself changed as a result of the success of the rollups: before the switch to Proof-of-Stake with the Merge, Ethereum had to implement sharding. The first version of this sharding solution, however, was rendered redundant by the rollups of projects such as Arbitrum and Optimism , but in the future it will be reintroduced in the form of Danksharding.

Now that we know what zk rollups are and how they work, and have delved into the optimistic model too, we might then appreciate their first real applications, ranging from digital identity verification to play-to-earn (such as ImmutableX video games). Are optimistic and zk rollups the key to realising the multipurpose network dreamt up by Vitalik, or will the forthcoming updates to Ethereum make them superfluous? The upcoming phase The Surge will perhaps reveal this to us.