Are OP Rollups More Expensive than ZK Rollups?

Transcript

snack you stretch your legs and you are ready for another presentation we going to start with elas who's from kakar ZK zkm who will tackle the question of the rollups based are ZK rups actually more cost effective than optimistic Ro so please welcome him on the stage thanks you guys okay can you hear me I guess yes so I'm elas I work at kakat we're building approvable evm why does this subject actually interest me is because I am looking into how much how easy and how much will it cost to transition op

rollups to ZK rollups that's why I'm interested in this subject uh what is a rollup who here know like feels comfortable explaining what a rollup is okay good I guess then we can skip to the next part which is currently 75% of rollups are optimistic rollups um and then the question is will it be more like forever more economically viable to run op rollups this is I think this is the common conception or like the doxa that it is always cheaper to run op rollup and we didn't have to Define rollups but

let's just Define their philosophy you want to at all cost avoid re-execution of your transactions on etherum L1 so yes it is always good to remind ourselves that on blockchains you don't trust um whoever is running your transactions and you want a network to assess the Integrity of what you're doing um and on optimistic orops how this is done is that there is a proposer which um settles some transactions on ether L1 or any base layer and these transactions are assumed uh to be done with Integrity so they're assumed correct and uh whoever whichever White Knight wants to um challenge this state has a period of

time for now for example it's seven days on arbitrum so let's let's say it this way every 1 minute there is a batch of transactions that is posted from arbitrum one to etherum L1 that is a batch of transactions and these transactions are assumed correct so they are not re-executed on etherum and if you disagree with them you have seven days to say so very akin to um right before wedding someone says uh speak now or shut up forever so if you don't challenge a state on an optimistic rup that is wrong for seven days this state will be assumed correct uh the best example to think the worst case scenario so it's always good to think of the worst case scenario what could happen the proposer could uh

submit a state that says everyone has decided to withdraw what they have locked in the bridge to to my wallet this is exactly the worst thing that can happen so they are saying give me all the tvl so for abum that would be $5 billion a bit more so this is the worst thing that can happen of course it doesn't happen for many reasons but this is the worst case so let's get into the numbers because I think this is the interesting part how much does it actually cost to I don't know become let's not take D chain because it it did go into like trouble with conduit so let's take something less uh problematic oh oops did this just happen or have I been

talking without a screen for like five minutes okay okay okay so if you're just starting like a chain today like you're a new project you expect to have one TPS of usage which is more than like most of the rollups today for example base has I think 20 to 40 uh etherum has 10 uh stet has one I think so of usage not of capacity uh you're going to be around $ 1.72k per month to run this roll out so that includes the proposer um the RPC the Explorer and then for data availability so posting your transaction you're going to pay um again one or one to 2K a

month um so that's the cost so if you are just starting your thing and you don't want to be on chain you want to have your own chain you're going to run around 40K a year that's if you really want the cheapest of the cheapest of the cheapest of course if you're feeling a bit I don't know hype uh you call up like ether scan the most known explorer on The Ether system and then you ask them to license their front end for you because everyone is familiar with it and then you're closer to 1 million per year but that's let's imagine you go for Bare Bones open source everything open source you call add layer and you ask them to run a road for you and then comes the question of so here you have like a you have a side chain so how do you go from

side chain to like secure chain you have CH like proposer and bonds what is this is the thing that we talked about the thing that says here I am I am a proposer I have posted a thousand transactions I am scaling etherum you have seven days to tell me I am lying so when you do this you lock up money to to kind of have skin in the game and for economic reasons um and this can cost you from 10K to 10m so today if you are the arbitrum one proposer there is one only one you have to lock up three 3,600 eth in a bond whenever you submit a batch of transactions what does it mean it means here is $10 million here is millions of transactions every every

month 500 million per year um if I've lied on any one of them you are going to have part of my money or all of my money so this is pretty costly in terms of it is good in terms of Economic Security it is costly in terms of immobilizing capital and then there there's attacks an attack on a fraud proof system is kind of the worst thing that can happen if someone wants to game the system um this is best explained in an article from L2 bits called fraud proof war or an article by the I think co-founder of cesy called fraud proof are broken the main gist of it is what can you do to AA fraud proof system that kind of breaks

it what you can do is what can you what you can do today for example on optimism is you can as a proposer propose like millions of proposed states that are all wrong and then obviously anyone in the right mind will challenge you but it costs money to challenge for two reasons one you have to put a bond against their bond to kind of say Okay whoever wins get the money of the other guy and the second reason is gas just onchain gas but imagine now you're a very rich attacker and you have enough money and and you have to imagine you don't lose the money instantly you lose the money after seven days so a smart attacker which is very hard to do

would propose like a million wrong States and then ask you to challenge a million of them and then you as the defender you would have to have cash available to challenge a million states which is for example for optimism if the attacker has5 billion to waste on an attack and when I say waste what I mean is they risk it it's not a waste what they're going to risk is losing it if they lose this battle but if they win they get the entire tvl of of optimism which is five billion dollars so it's always um a risk management but what you have to imagine is the there is an attack there exist attacks on fraud proof systems that are a function of the tvl of the chain um so what that's what I say so if

you run an optimistic roll up your cost are going to be from 45k in the happy case and you're like trying to save to your entire tvl the reason it doesn't happen today I have debated this with Dono from Tob is for two reasons one is it's extremely hard to be a sophisticated attacker so you would have to have funds and kind of make sure you have more funds than anyone and the second reason is there is a security Council on optimism for example and if eight members out of eight out of 12 multis argue that there is an attacker that will switch off the fraud proof system so they're kind of like the police that says we must always be in

the happy case and if one day we are in the unhappy case just shut it down and this has been done before okay so yeah this is just the numbers but this is more on the this slide is more about the number so if you protect arbitrum if you are proposer for arbitrum you pay you have to immobilize 10 million dollars of capital to propose new States and I argue that this cost you 5% or like the risk rate on those 10 millions and arbitrum Foundation agrees because they pay the proposer 5% on $10 million every month as like a proposer fee like we the opportunity cost right is that clear

what I'm saying if you are immobilizing 10 million Capital to propose you're not staking it if you're not staking it you're not getting 5% on your 10 million so you're losing money so you have to get your money somewhere for example transaction fees so FR proofs are not cheap they're not cheap for two reasons one you have to immobilize Capital but that depends on the system and two there exists the worst case scenario whereby you get attacked and everyone has to spend a lot of money so this is kind of this is frightening uh in the long run so what if we move to ZK um recap on how ZK works I have stolen and named the person I stole this light from who who is from starart KET who designed sharp which is the Shar

prover from dark net um the way ZK rollups work is that they also execute transaction of chain just like a optimistic rollup but they uh batch them inside proofs so you execute 10 blocks you compute the ZK proof for each of these blocks and then you aggregate them into a tree of proofs that ends up being one single proof and that proof is verified on N1 what does it mean in practice it means that if you are executing 10 like 10,000 transaction on L1 you're going to pay a few million dollars if you execute them on an L2 that is ZK you're going to pay a few cents a few dollars and then

they're going to get recursed into approv so you're going to pay Cloud costs and then the verification cost of the of verifying that proof on L1 so this is how Z rollup um save cost is through also not re executing transaction on L1 but providing the security not from this idea that everything is correct but challenge me if you disagree but rather saying we have proof we have ZK proofs that all we did is correct uh if you disagree uh this is more like audit us audit the proof system and prove that it's wrong like uh it's more on the mathematic side so you have to read the theorems and more more like arithmetization and you have to prove that it's there there is a

soundless problem and how do you do it I mean maybe it's off topic but you have to prove that someone who is lying so someone is for example saying you transferred them 10 bucks but you didn't so someone would have to be able to generate a proof for that action and that proof would have to pass like would have to like be correct this is the sound the the soundness problem so of course you don't want a proposer to say everyone has suddenly decided to withdraw all their bank accounts into my bank account and here is a ZK proof so this is also why ZK rollup have a Security Council is because if if they see that someone has managed to break the proof system they have to kind of shut it down as well this is why Zing

for example has proofs with proof normally your your finality is 12 minutes so the same finality as L1 but because the proof can be broken and you will still in the training wheel period you you wait like eight hours and then if someone proves that if someone finds that there has been cheating then you kind of turn off the turn you you intervene with a human okay so we are taking lots of um assumptions but arbitrum has roughly 500 million transactions a year and then we're arguing that it costs with the current costs of the km which is one of the main ZK VM so provable provable environments others are um rero suent

valida um so they are General General generalized uh ways to prove compute and this is the specific use case is how to prove a rollup so how do we scale etherum and it would cost next year it will cost $1 million to scale arbitrum so to prove all of arbitrum State such that you don't need to rely on challenges anymore so they're already cheap but you can see that it's still expensive uh and still maybe too expensive for teams that just launch and want to kind of go without uh such high costs the benefits of ZK rollups is at least there is no possibility of the exhaustion attack so no one can come and kind of try to wrect your chain the same way that they

can on arbitrum today who recalls the the way exhaustion attack are done the thing whereby the proposer kind of attacks you with millions of fake proposals and makes you spend all your gas so this is not possible on ZK you get faster finality because you don't have the 7-Day challenge P so you're sure that when a transaction is ticked green it's not going to be uh rolled up like a reverted it's irreversible and then you get better interoperability um out of the box from this idea that once a transaction is proven through ZK it can it's proven forever it can be reverified by anyone anywhere so this also offers a lot of interrupt when you are considering like

between l2s but also between l1's um for Bridges predominantly so how much does it cost today so so the bare bone infrastructure is the same as for op rollup so it's 20K per year data availability is arguably 2x 2x to 3x cheaper thanks to different ways to commit to your data on L1 we don't have to get into it it's it's can find me later but state divs are different from posting entire transactions and then prover prover and VII cost this is the problem today so why doesn't everyone run ZK rollups it's just because it's too expensive running today in production polygon cdk as a L2 you have to pay $10,000 per TPS of

bandwidth so if your chain has a lot of success like top 10 success so five TPS consumed you're going to have to pay 50k a month improver cost so cloud cloud costs for ZK proofs the thing we really need in ZK now to kind of go to the next step is 10x cheaper 10x cheaper again and again and this is occurring every 6 months so we expect that by Q2 2025 provs are so powerful for many reasons GPU optimizations new generations of PR like starkware is releasing a new prover this year which is beating everyone on the benchmarks so the tech is getting better on the software and on the hardware we're going to be able to reach rather not 10K per TPS not 1K per TPS but lower

than 1K per TPS and then that's kind of what kak out Labs that's why I'm interested in subject is we built a provable evm so The Natural end goal for provable evm is to kind of take the one or two trillion transaction that exist today no billion uh per year and prove them and the way you what you get from it is mainly security and scalability so the shield slide but at any rate I think the main thing that's really cool is rather if you agree that onchain is good like there is a use case for onchain for for defi for game f for social f for everything if you compare um do I have a

slide on this no if you compare the the number of transaction there is on NASDAQ on like options Market in the real world these are hundreds of billions of transactions every every year so the bandwidth that is available in terms of total total addressable market for web web 3 is huge it is way bigger than what we have today on on chain so if you agree that web 3 is going to penetrate lots of um ecosystems and and sectors you know that we are going to have hundreds of billions of transactions to prove and then seeing the price of proofs you also agree would agree that we need cheaper provs so this is kind of the next Frontier you have lots of blocks you

need to prove them because it is better for security and scalability and then how do you do it and so the next one here is really transitioning all those OP rollups to ZK and it's not going to happen overnight but I think a lots of people lots of cool teams are working on it and again you need 10x every six months so that's kind of the state I mean this is this is two AIS um this is a two axis kind of view on the proving landscape who is technical here okay so who has heard of rust proving like rust proving like you WR write rust and then you can prove it

yeah okay so it's not so it's not so okay so the y y AIS is just saying how easy it is to go from being an engineer writing software to a ZK proof so the more the higher you are the easier it is to go from software to proofs um and then on the right is really cost per proof so why do we say that risk five proving is easy to prove is because currently when you write a so let's take a very concrete example you are op Labs you have written uh op stack it is a code base and now you may want to prove it so you want to transition from having a op optimistic challenge

mechanism for security to ZK so now you are in the you you need someone to kind of go and literally they take your blocks one by one that you that you proposed and they replay them in a provable environment kind of like a provable bubble and they spit out proofs and those proofs act like certificates of Integrity so you need a team to do this how do you do it there are like two or three ways one way is you get cryptographers such the like of U SK psse privacy and scaling ethereum no exporation exploration from EF and they have written Halo 2 circuits for zkm along with scroll and tyo back in the day so you have a team of cryptographers

so you need cryptographers and they write circuits it's almost like electrical engineering that when replaying your transactions are going to spit out a snark that says okay this block is certified this is lengthy and this is this requires like a lot of a lot of knowledge the second approach is doing like Kakarot you rewrite kind of like the op client in Cairo which is the language targeting the approvable VM from starware so this is way easier because you don't need anyone on the team to be a cryptographer and you don't need any auditing in in inside the land of MAF like the the whole the whole purpose of Cairo is that you are given a toolbox that spits out proofs but you don't need anyone to be a cryptographer

so it's even easier and then the next step and is and it's and it's arguably more performant than anything else and then the last step is really you take your your software that you have built already and you kind of give it to the to the sp1 or vzero team as is without touching anything else and they prove it so there is no additional codee like being generated everything happens on like on the land of compilers and the reason it's not so efficient is because they are replic like they're they're emulating the the a normal computer which is really not so friendly for ZK okay wait did I lose everyone because I guess is okay I'm getting two thumbs up I consider it 100% of the problem

just kidding okay so really like how are how is the world going to evolve according to me uh not Financial device uh op rollups are going to transition to ZK slowly but surely it is hard for two reasons one is um ZK proof are still too expensive so it's going to take a few months a few years and two there needs to be a change in a software like um so but this is already being done by the opls team so those two obstacles are just time not anything else then Z robs become the default mainly for sec so most of the op rollups right now don't really have security except the

main ones so except arbitrum and uh optimism and base none of them really have like working fraud proofs in production um and then really the end goal that I Envision and everyone Envision vitalic as well which is very nice is ZK is adopted directly on L1 so you would have proofs of blocks on L1 directly um being done in real time and this would really the main goal is like how can you make ether L1 security like decentralization level reach like 100 or 1 million TPS and is really the the the challenge is how do you not how do you not degrade security by having l2s and l3s but scale leum to have to absorb

Visa Swift sepa NASDAQ um and all of these like Financial systems as well as gaming as well as social F that's it thanks [Applause] does anyone have some question okay hey oh great presentation and just like so what's your view like guess like building the cak but if you will go like to this this one so actually what will be the first one like we will see op in sp1 ORF or actually they will continue know they the infinite money right so they can like bring the all the

cryptographers everything to their team and build you know custom shers for them themselves basically I'm asking if they're willing know to give up like kind of like security or you know like kind of like the manageability like okay we will use sp1 and RIS zero which I will bet is not back free okay so you're saying there's there's one question on sovereignty so op laabs doesn't want to give up sovereignty to another startup maybe and then they think that their code is better than the code of others or like they like better worse it's like so you don't own

it I think so I think their goal is to go the this so there is a typology called stage zero stage one stage two you know it's about security of rollups and it's the idea that rollups cannot be like instantly secured and like decentralized and great they have to have training wheels so to reach state two you need to have multi- prooof which is the idea that when you submit a block you need like two or three proof systems proving it um so that's for that reason they are willing to kind of off offload proving to other people second it is I think they learned from scroll and even Tao that it's just way too expensive too hard for no results for no good results

to have uh like some circuits so the reason being teams like sp1 but Koo and line and everyone they identify the main operations that are so like super expensive in in blockchain they write custom circuits for it and then they make it available inside their zvm such that it is not even economically better to do circuits anymore and it proves actually harder to audit and be bu free when you have circuits rather than Z kvms and I think the last element but I don't it's not it's not conspiracy theories is public information but like op labs are close to sucin from being

invested in by Paradigm and it just it makes sense because sucin are very serious people and they have already started to work on op 16 for all these reasons uh op Labs will I will bet but I don't know I'm not part of them they will not hire a homemade cryptographer team to do circuits they will just uh get multi prooof and then buy the cheapest proof on the market with the highest level of security like the tradeoff anyone else okay in that case thank you alas thanks