Vitalik and the Ethereum Foundation's latest thoughts on capacity expansion

Original source: Ethereum Reddit

Original Author: Ethereum Foundation Research Team

Original compilation: EthereumCN

On July 7, 2022, the Ethereum Foundation Research Team held its eighth AMA on Reddit. ECN organized and compiled most of the questions for this AMA. It should be noted that members of the R&D team of the Foundation have personal opinions and speculations on certain topics. In order to avoid misinterpretation, please refer to the original post.

Due to the length of the article, the article is divided into topics, and this article is a topic of capacity expansion.

JonCharbonneau asked:

Can you explain how enshrined rollups work and their potential development path in Ethereum? (optimistic and zkEVM?)

(Translator's Note: L2 expansion researcher Polynya explained in this tweet that the difference between "enshrined rollups" vs. "independent (discrete) rollup" is like "public sector" and "private sector".)

And also what do you think is the biggest advantage and disadvantage that this can bring, because there are many people who have different opinions on this point.

Justin Drake, Ethereum Foundation, replied:

"Enshrined rollups" is a very interesting topic :) "Enshrined rollups" refers to rollups that enjoy some kind of consensus integration on L1. Smart contract rollups (see examples listed in L2Beat and zkrollups.xyz ) are different - run entirely on L2, outside of consensus.

Consensus ensembles can give enshrined rollups superpowers, but at a significant cost - see below for a detailed discussion of the benefits and drawbacks. Broadly speaking, enshrined rollup and smart contract rollup are complementary. I expect both to play key roles in the "Rollup-Centric Ethereum Roadmap".

Their potential development paths in Ethereum (optimistic and zkEVM?)

The current plan is to develop directly in the direction of enshrined zk-rollup. This is part of the "Generate ZK-SNARK proofs for everything" in the visualization roadmap released by Vitalik. The Ethereum Foundation has a team of about 10 people led by Barry Whitehat working on upgrading the canonical EVM instance to an enshrined zkEVM rollup. That is to say, construct a zkEVM whose state root is completely equivalent, and provide concise cryptographic proofs (SNARKs) for L1 Ethereum blocks, proving that the corresponding state root is valid. This brings various benefits:

No re-execution required : Validators and other full nodes no longer need to re-execute transactions to validate a block. This removes the computing consensus bottleneck for validators, which may be an opportunity to improve the EVM gas limit. Removing the need for re-execution also speeds up most synchronization strategies.

Easier consensus : Removing execution from consensus means that validators can run ultra-simple execution clients where tens of thousands of consensus-critical EVM execution codes are reduced to a few hundred lines of SNARK verification code.

No need for state witnesses : stateless execution clients no longer need to download witnesses (such as Merkle paths or Verkle proofs) - downloading state differences is sufficient. This greatly improves the validator's consensus bandwidth efficiency and releases a higher EVM gas limit.

Safer light clients : Light clients can quickly filter out invalid state roots, not as slowly as using fraud proofs to filter out invalid state roots. This makes the "Ethereum-L1" bridge more secure.

Upgrading the current single-instance EVM to enshrined rollup is a massive multi-year effort. A relatively easy step after that is to deploy multiple (eg 64) enshrined zkEVM instances (consuming blob data) in parallel. This is a form of L1 homogenization performing sharding (previously called "Phase 2").

The engineering work on the Enshrined zkEVM is especially interesting for technophiles, involving cryptographic proof systems, circuit design and auditing, and software and hardware acceleration. The EF team is hiring zkEVM engineers - please contact [email protected]

What are the biggest advantages and disadvantages

benefit

Social Consensus : Enshrined rollups inherit L1's social consensus and no longer require governance tokens to perform rollup upgrades. In contrast, most smart contract rollups are potentially vulnerable to governance attacks.

Subsidized proof verification : Enshrined rollups can subsidize proof verification costs for settlement (fixed cost per block). Instead, smart contract rollups must pay EVM gas for settlement. Settlement delay: Enshrined rollups naturally benefit from each block settlement delay.

Optimal Liveness : Many smart contract rollups may choose to leverage external consensus mechanisms to order transactions, as well as serve as an on-chain escape hatch. This ordering infrastructure suffers from suboptimal liveness, as external consensus can fail and escape pods only activate after a timeout.

EVM State Root Equivalence : Enshrined zkEVM's tools and light clients work out of the box. Many smart contract rollups may not choose to have an EVM state root equivalent, but rather a Solidity-compatible VM (eg, zkSync) or a bytecode-equivalent EVM (eg, Scroll).

Network Effects : Canonical EVM instances enjoy the network effects of being an early mover, while upgrading to enshrined preserves these network effects.

harm

No Public Good Funding : Enshrined zkEVM rollups will have limited discretion in funding public goods. Unlike Optimism, which has a governance mechanism to fund any public goods, enshrined zkEVMs will be limited to funding L1 security and contributing to the scarcity of ETH.

Suboptimal compression : Smart contract rollups may choose to settle on-chain rather than once per block, allowing for better data compression. A smart contract rollup can also have a custom or frequently updated dictionary to improve data compression.

Virtual machines lack flexibility : an Ethereum enshrined VM is likely to be an EVM. In contrast, a smart contract rollup can choose to adopt a more commonly used VM (eg, WASM, RiscV, MIPS) or create a new VM (eg, Cairo). A custom zkVM may achieve better data compression than zkEVM.

Harder pre-confirmation : Smart contract rollup can choose a centralized sequencer to provide instant (~100 ms) pre-confirmation to give users a good interactive experience. This kind of fast pre-confirmation is difficult to achieve using a decentralized ordering system, whether enshrined rollups or smart contract rollups.

Latecomers : Enshrined zkEVMs will be so-called latecomers due to the slowness and conservativeness of L1. To hedge against the possibility of circuit vulnerabilities, a redundant multi-circuit setup or cumbersome formal verification may be required.

TheTrueBlueTJ asks:

In theory, is it possible for a global payment system to use Ethereum as a currency? Either through L1 or rollup? Of course, future scalability improvements are taken into account.

Justin Drake, Ethereum Foundation, replied:

It's entirely possible. At present, Ethereum can reach 10 TPS (transactions per second), which is a rough order of magnitude. And there will be 3 times of 100x growth in the future, which will bring us to 10 million TPS (enough for 100 transactions per person per day):

100x growth from rollups;

100x growth from sharding;

Bandwidth increases 100 times in 10 years (Nelson's Law).

My thesis is that the safest shared security platforms will become saturated in demand due to network effects. A reasonable direction is that if Ethereum can maintain its leading edge in terms of economic security and scale to 10 million TPS at the same time, then Ethereum may serve as the settlement layer of the Internet.

AllwaysBuyCheap asks:

How does the increase in bandwidth improve the transaction speed of Ethereum? More block space?

Justin Drake, Ethereum Foundation, replied:

There are various computational bottlenecks in the consensus:

Disk I/O: removed by being stateless (and enshrined zkEVMs);

storage: removed by being stateless (and enshrined zkEVMs);

Computation: removed by enshrined zkEVMs;

Bandwidth: Essential.

Because bandwidth is the fundamental consensus bottleneck, increasing bandwidth can free up more block space.

not_a_disaster asked:

What is better in the long run? Is a single rollup dominant or are there several small rollup schemes?

The arguments I see on both sides are:

1. A dominant rollup means users don't need to bridge assets and have a better user experience

2. However, if there is a dominant rollup, then other L2s are meaningless. But then again, in the long run, the EF team has been promoting only zkRollup (ideally with zkEVM).

Ethereum Foundation Ansgar Dietrichs replied:

That's a great question! Any chain (L1 or L2) that scales its throughput to a point where normal users cannot fully verify the chain. The main difference between L1 and L2 is that L2 can leverage its underlying base layer to compensate for this:

1. On zk-rollups, the base layer guarantees the validity of state transitions and the availability of corresponding data. If you can't handle the rollup transaction yourself, the only thing that isn't guaranteed is that you have access to the current state (so that you can send a valid rollup transaction). So the only additional trust assumption is the presence of a state provider (centralized or decentralized).

2. Optimistic rollup introduces a small additional trust assumption. Not only do you need to trust that someone is processing the rollup transaction and making the current state available, but you also need to trust that in the event of a fraudulent state transition, at least one of those entities processing the rollup will submit a corresponding fraud proof. Usually optimistic rollups give everyone some economic incentive to submit these fraud proofs, so this is very different from zk-rollups.

Conceptually, the ability to scale rollups without breaking trust too much is because of the relationship between L1 and L2. As long as users trust the state of the base layer, they can tell correct from incorrect L2 behavior (eg, the state provider's response will always come with a proof against the rollup state root, which is stored on L1).

On the other hand, for the base chain, it is very important that each user handles the chain by himself. If you don't run your own node and ask an external state provider for state, then you can't tell if the state provided is real. Similarly, there is no settlement layer that can resolve disputes if there are malicious state transitions - you have to choose yourself which side to trust.

All these reasons led us to decide to turn Ethereum L1 into a settlement layer for rollup, with a focus on making it easy for every user to process transactions. I'm personally very excited about the imminent transition to Verkle trees, which will allow for completely stateless client implementations (imagine your Metamask being able to run its own embedded nodes). This way, over time, the base layer becomes the "root of trust" of the L2 ecosystem.

Hopefully my answer explains why rollup has the potential to far exceed L1 throughput without unreasonable trust tradeoffs. So I personally expect to end up with a very high throughput L2. Whether there will be a single dominant rollup, however, remains to be seen.

Justin Drake, Ethereum Foundation, replied:

What is better in the long run? Is a single rollup dominant or are there several small rollup schemes?

In the long run, rollup will be able to handle millions of transactions per second, so parallelism is necessary. We can imagine a kind of parallelism inside rollup (eg, through a multi-core rollup virtual machine) and a kind of parallelism outside rollup (eg, parallel instances of the same virtual machine).

zk-rollups that share security (e.g., zk-rollups that share the same data availability) are synchronously composable, so the line between "parallel inside a rollup" and "parallel outside a rollup" starts to blur, and the end result Not too far off.

not_a_disaster asked:

What do you think are the problems with application-specific L2/rollup?

If a Web2 company with a large user base (10M--100M users) wants to use blockchain today, but still wants to be decentralized, application-specific chains/rollups are almost the only good alternatives option.

What do you think are the disadvantages of doing this?

Justin Drake, Ethereum Foundation, replied:

What do you think are the problems with application-specific L2/rollup?

I encourage developers to build applications based on general-purpose rollups (eg, Arbitrum, Optimism; soon zk rollups) rather than deploying an application-specific rollup. This will speed up development, amortize settlement overhead together, facilitate composability, and reduce tooling friction. Having said that, the vision of a general-purpose rollup certainly has its troubles.

Rollup will have a vulnerability to be attacked. We’ve had exchange attacks that cost tens of millions of dollars, cross-chain bridging attacks that cost hundreds of millions of dollars — expect rollups to be multi-billion dollar attacks. Between EIP-4844 or EIP-4488 being implemented, transaction fees won't be as low as we'd like. Tools will underperform for a while, and network effects may be slow to kick in.

Vitalik replied:

If a Web2 company with a large user base (10M--100M users) wants to use blockchain today, but still wants to be decentralized, application-specific chains/rollups are almost the only good alternatives option.

I think in this case they should use validium. They would rely on a centralized server or a committee for liveness, but they could be protected by the security provided by the blockchain.

AllwaysBuyCheap asks:

Why was EIP-4488 not implemented while EIP-4844 was being developed? Which technology do you think will win in the long run, Snarks or Starks?

Vitalik replied:

STARKs are quantum proofs, they have better proof times and more flexibility in the domain you use.

SNARK proofs are much smaller. I expect pre-quantum, SNARKs and in some cases STARK's SNARKs (with STARK advantages but smaller proof size) to dominate, and post-quantum STARKs to dominate. But different people have different views on this.

Justin Drake, Ethereum Foundation, replied:

Why was EIP-4488 not implemented while EIP-4844 was being developed?

As you pointed out, EIP-4844 and EIP-4488 are not mutually exclusive. My preference is to implement EIP-4488 shortly after the merge, and before EIP-4844. Because it will take years for EIP-4844 to bear usable fruit. In fact, even after EIP-4844 is launched on the main network, we may have to wait a few months before rollup can actually choose to use bolob data.

Which technology do you think will win in the long run, Snarks or Starks?

In the long run, what we want are post-quantum SNARKs. This advanced post-quantum SNARK is hash-based and happens to be a STARK, i.e., a transparent SNARK ("transparent" meaning no trusted initialization is required).

egodestroyer2 asked:

How do you predict the fee market in the near, medium and long term for L2 to start settling transactions and taking business off the main chain?

Justin Drake, Ethereum Foundation, replied:

The fee market is highly volatile and has a positive correlation trend with the ETH price. Therefore, forecasting the fee market is largely guesswork.

In the short term (July, August, September), I expect the fee market to remain relatively calm in a bear market;

In the near term (i.e. a few months after the merger), I expect Ethereum and ETH to heat up and the fee market to grow significantly;

In the medium term (i.e. 2-3 years), gas prices may calm down temporarily due to the mass adoption of rollup and the supply of block space exceeds the demand. In the long term (3-10 years), due to rollup and sharding, I The per transaction fee is expected to be small, but the total fee volume will be high (maybe $1 billion/day).