Rollups Through the Prism of the Bridges by Toghrul Maharramov (@toghrulmaharram)

Transcript

hello everyone my name is togul maharamov today I'm going to be talking about Roll-Ups through the prism of validating Bridges or in other words how Roll-Ups actually actually work so to start let's discuss what Roll-Ups actually are so Roll-Ups and and just to note the data availability mode of the protocol that's it everything else is an implementational detail so this illustration shows how it works so a chain B post the data to chain a and this data should be enough to reconstruct the state of

chain B and that that chain can be classified classified as a Roll-Up so what is data availability data availability is a mode that defines for some predefined amount of time let's say t the protocol data is made available to all the nodes that are willing to download it and uh so you shouldn't confuse it with protocol data storage because data storage is a problem of making data infinitely available so rollups inherit data availability guarantees of the underlying layer that's what Roll-Ups are

and by as a side effect rollups also inherit ordering guarantees of the underlying of layer because of the data being posted and I'll explain what ordering is so ordering is a phenomenon that defines a sequence X once it's finalized and that sequence can no longer be changed or updated later once the finality is reached so as you can see in this figure here the there's a block and tip that is comprised of sequence of transactions and because it's a tip it's not finalized yet it depends on a protocol

but let's assume that in this particular protocol that if it's not finalized and at some point there's a fork that completely reorgs the contents of that blog so it still contains the same transactions but they are reversed in their order or whatever uh at that point there's no way of telling which Fork is going to be the winning one which a fork is going to be included in the canonical chain but once the chain a and the block and the chain a that contains a sequence so in this case it's the latter is the former sequence is finalized you can consider the block to be the the contents to be finalized so

the order can no longer be changed and basically that allows us to have data available ordering for free just by posting data on the underlying layer so now to roll up types there are two roll-up types that are necessary to be known uh Sovereign Roll-Ups and classic Roll-Ups note that when I refer to Classic Roll-Ups that's what you know as Roll-Ups it's your conventional Roll-Ups deployed on top of ethereum Etc uh so the difference between a sovereign and a classic roll-up is that the goal of a server roll-up is to inherit some security from the underlying layer so let's say ethereum or Celestia or something like that you want to

bootstrap the security from them instead of deploying the chain from scratch and you deploy a sovereign roll up and then classic Roll-Ups scale and introduce new features to the underlying layer through a trust minimized Bridge Sovereign Roll-Ups permit the participants of the protocol to Define The Fortress rule what I mean by Fork Jones rule is this so as you can see in this case there are three different Forks that the users can choose and while in a classic roll-up the fork chest rule is defined by the by the underlying layer so a roll up the chain to which the roller pulls the data chooses the fork for the users in case

of a sort of roll up it's actually done by the users or by the protocol by the consensus and that's why we call them Sovereign Roll-Ups because the users decide which work to follow so in other words the canonical chain is defined by the protocol participants meanwhile the ordering within the canonical chain is defined by the underlying layer so you can think of it this way if a certain order has been finalized the users are free to choose any transactions within that order and Define them as the part part of the canonical chain so with that out of the way let's look into classic Roll-Ups classic Roll-Ups

on top of inheriting data availability and ordering guarantees also inherit censorship resistance and validity guarantees from the underlying layer note the validity guarantees are inherited based on certain assumptions that are made by the state transition enforcement mechanism used by the Roll-Ups I'll go into that later that's a lot of big words so censorship resistance is defined as some time to you within which a user originated transaction is guaranteed to be inserted in the canonical chain note that the actual definition is a bit more complex but I don't want to go into the details here because I'll just bore you for hours

and validity is execution is enforcement of execution that is compliant with the state transition function of the protocol so so what I mean by it is every protocol so let's say ethereum has certain rules that the the protocol has to follow and the validity enforces that those rules are followed this is an example of a state transition function uh I know it doesn't really make any sense it's just a bunch of weird looking symbols but if you look at it in this way it's actually a state transition function of ethereum from ethereum's yellow paper so Sigma Prime

is the new state uh the weird looking y that is called Epsilon is let's say transition function Sigma is the previous state and the transaction is T so what it means is that the state transition function y Upsilon takes the previous state and the transaction and outputs the new state that is produced after the execution of the transaction so essentially you can define a search transition function as a set of rules that the execution needs to combine with in order to successfully mutate the state of the system and by mutate I mean modify the state of the system whatever that is so for for Bitcoin it's the

set of unspent transaction outputs for ethereum it's the state of all the accounts in the system that are non-empty Etc and back to validity validity guarantees are either enforced through fraud proofs or zero knowledge proofs there are two enforcement mechanisms for that optimistically fraud proves optimistic game of Force availability overall by allocating a predefined Time V for their own Lucas to challenge the committed State what I mean by it is let me show you in a gov so if you look at the figure here there's an Executor it's the entertaining optimistic Roll-Ups that commits the state to the

validating bridge and I'll go into what validating bridge is later and there's another entity and that entity is permissionless it can be any one in the system so they follow the committed State and then fetch the state from the bridge and compare it to the state that they locally computed so let's say if the states are not equivalent for for some reason the connection is a challenge and once the challenge is initiated that they basically go back and forth between the Challenger and the executor until one of them has proven to be correct or the the original state commitment or the claim by the Challenger and and there is

another model that is called what I described now is called an interactive multi-round proof but there's also a fraud proof mechanism called non-interactive single round in which the Challenger just submits the witness for the correct State and then the contract just verifies it without arbitring the uh back and forth between the two entities and now the zero knowledge proves zero knowledge proofs and force validity of the Roll Up by proving the correctness of the computation via cryptographic system so in case of a zero knowledge proof the rule up looks a bit different so the sequencer posts the data as well as the state to the Valerian bridge and then

the prover just commits the validity proof that proves that the state was computed correctly and there's no other interaction needed whatsoever so there are two types of classic Roll-Ups optimistic and pessimistic no I'm joking optimistic and zero knowledge note that some people refer to zero knowledge Roll-Ups as validity Roll-Ups I'm looking at Stark where people uh uh so the difference optimistic rollups utilize for proof stem Force validity and zero knowledge Roll-Ups utilize zero knowledge proofs to enforce a validity as the name might suggest so classic Roll-Ups that's what make

classic Roll-Ups unique is they get their trust minimized compatibility with the underlying layer for free as a side effect of validity guarantees so what I mean by trust minimized composibilities compatibility so composibility is basically when you can connect between two systems and Trust minimize compatibility is when you is when that communication between two distinct systems is trust minimized and by trust minimized I mean a system in which the assumptions required to secure the communicate is one out of n where n is unbounded or weaker and luckily both for proofs and zero

knowledge proofs comply with the definition of trust minimize so both of them allow you to have trust minimized bridging so finally after what 11 minutes I come to the topic in the title validating Bridges of validating Bridges [Music] inherits the security guarantees that are sorry the security guarantees are enforced by validating Bridges just to remind the four security guarantees of a classic roll-up is data availability ordering uh validity and sensorship resistance and validating Bridges enforce validity other either either through the use of

fraud proofs or zero knowledge proofs are as I previously explained and this is an example of how difficulty prove we're valid dating Bridge it works so you see a roll up and a post data and at some point a zero knowledge proof or a fraud proof If the data is incorrect to the validating bridge and then the chain is the chain that it posted to guarantees certain security properties that I described before and as you can see here if you remove the validating Bridge there's no longer those guarantees so the guarantees are inherited through the validating bridge if you remove it you

just get a silver and roll up so and from this we can deduce that the validating Bridge Is defined is what defines a classic Roll-Up note that it is possible to have a validating contract that doesn't actually bridge but there's no much use case for it and also it doesn't really matter from the purpose of the premise in that case the classic roll-up would be defined through the validating contract or whatever you want to call it and finally how bridging Works in classic roll-ups so this is what you expect from a classic Bridge just a

normal Bridge a user let's call the user Alice the send the request to the chain to deposit five if to roll up the chain records that request and then somebody picks up that request it depends on a bridge design there are multiple ways you can pick up the request and put it to the roll-up side Bridge and the roll-up Bridge just sends the five Eve to Alice's account on that side and the same is in Reverse so uh Alice requests the bridge on the roll-up side to withdraw five Eve back to the native chain

it just somebody threw some arbitrary mechanism you pick up that request so it was related to the other chain the other chain unlocks the phones and sends it to our list but it's not how Roll-Ups work and roll ups you have this additional mechanism which is very important so the originally it goes the same way so Alice request a deposit you meant five eth by relaying it to the bridge to the bridge of the roll up whatever whatever but at that point the the transfer actually didn't happen the transfer happens once the correctness of that transfer is proved

to the native chain and once that's done then you have a transfer happening which means that unless the proof mechanism that the roll-up uses is broken it's impossible for somebody to mend the tokens that Alice that an original request and the same goes the other way around so Alice requested what Joe the withdrawal is relayed to the validating bridge on on the chain and for the withdrawal to actually be processed you need to prove that the balance had sufficient funds and all the state transitions up to that point were correct

and so just a short conclusion so Roll-Ups can either be Sovereign or have trust minimized composibility with the underlying base layer they can't have both those two are basically mutually exclusive and finally referral up has trust minimized composibility with the underlying layer then by definition the roll-up is defined through the validating Bridge so if you remove the welding Bridge you don't you no longer have a composable Roll-Up thank you if you have any questions feel free to ask