Offchain Labs Lianchuang: Why I am optimistic about Optimistic Rollup

Author: Ed Felten, co-founder of Offchain Labs; Compiled by: Luffy, Foresight NewsArbitrum is an Ethereum expansion protocol using Optimistic Rollup. People often ask us why Arbitrum chose Optimistic, and whether we expect Arbitrum to move to ZK proof. I've answered this question before, but that was almost two years ago. This is my current personal opinion and others may disagree.

I'm a firm believer in pragmatism when it comes to designing systems. Rather than falling in love with one technical approach and applying it at all costs, we should ask which approach best meets the needs of users and developers. The best approach may change over time, and if so, we're willing to make the change.

We chose Optimistic for Arbitrum out of pragmatic considerations. I believe that Optimistic proof is still a better choice than ZK proof, and it can better meet the needs of users and developers. Simply put, Optimistic is cheaper, simpler, and more flexible than ZK. I will address each of these claims below.

That said, if things change and ZK becomes a better choice, I think Arbitrum should change. But I don't expect that to happen anytime soon.

Optimistic lower cost

The beauty of Optimistic proofs is that the proof cost is always zero for honest parties. In common situations, no evidence is required because only true statements are issued and can never be challenged. If challenges exist, there will be some cost associated with resolving them. But every dishonest party will lose the challenge, and they will lose their staked share, which can be used to pay for the cost of the challenge.

Optimistic protocols rely on execution by multiple parties so that they can check any published claims about the results of execution. In other words, the chain needs to have nodes. But any chain with a significant purpose will have a large number of ordinary nodes, run by users or infrastructure providers, to support the chain's activities. These nodes will naturally serve as watchtowers for the Optimistic protocol.

In contrast, ZK requires a cryptographic proof to be generated for every published claim, and the proof must be verified at Layer 1. Over time, ZK researchers have reduced the cost of generating these proofs, but never to zero.

In fact, the cost of ZK proofs is quite high compared to Optimistic execution. If a smart contract performs a bitwise AND operation, each validator of the Optimistic system will only perform a bitwise AND operation. The ZK prover needs to perform a bitwise AND instruction and then perform a large number of expensive cryptographic operations to prove the result of the bitwise AND instruction. If Alice and Bob go to buy fruit, Alice buys a grape, and Bob buys a grape and a watermelon, then Alice's cost will always be lower than Bob's.

In Optimistic Rollup and ZK Rollup, ordinary nodes need to execute every transaction in order to understand the evolution history of the chain, so this part is no different.

So, Optimistic costs less.

Optimistic is simpler

In software engineering, and especially in security engineering, simpler is better. Complexity increases security risks and makes everything slower and more difficult.

There is no doubt that the Optimistic proof is simpler than the ZK proof. Optimistic proofs are easily understood by developers, while ZK proofs rely on complex mathematics and esoteric and subtle cryptographic theorems that few people understand. Even professors who teach cryptography must struggle to understand the ZK proof system.

Optimistic is more flexible

The proof is necessary for any L2. But proof isn't the only thing users and developers want. They want new capabilities that can be built on Optimistic systems more easily and quickly.

A good example is Arbitrum Stylus, which allows developers to write smart contracts using general-purpose languages such as Rust and C++, and run these programs in the WASM virtual machine. They are on the same chain as the EVM contract and are fully composable. . Features like Stylus are challenging to build, requiring the integration of two virtual machines into one seamless system.

One reason that such functionality can be built into Optimistic systems is that Optimistic implementations can use standard programming languages and tools, which makes developing software easier. In contrast, ZK requires different programming tools, either building the ZK circuit manually or using some intermediate compiler to reduce everything to a circuit. Custom tools and programming methods are always slower and more cumbersome to use, which means overall system development progresses more slowly.

The simple performance of Optimistic systems translates into greater flexibility and faster evolution.

The finalization time is the same

People often ask when Optimistic Rollups and ZK Rollups will be finalized, and the answer is that they are the same.

A transaction is final when its outcome is completely certain and known to all participants in the agreement. The Rollup chain, whether it is the Optimistic chain or the ZK chain, operates in two stages: first, the sequencer publishes and records the transaction sequence that has reached the chain; second, the execution settlement layer calculates and proves the results of the executed transactions in sequence, one by one. Finality is achieved when a transaction has a finalized position in the transaction sequence, at which point the outcome of the transaction is entirely determined by the finalized transaction sequence and everyone knows the outcome.

Because finality is determined by the output of the sequencer published to Ethereum (which is the same for Optimistic and ZK processes), rather than the prover, Optimistic and ZK systems have exactly the same final behavior.

Cross-chain communication time

Where ZK has an inherent advantage is in the latency of cross-chain communication, that is, how long it takes for a contract on one chain to send a message to a contract on another chain without trust.

Cross-chain transfers of fungible assets (ETH or tokens) are usually performed through fast bridging services, and their operations do not rely on Optimistic proofs and ZK proofs, so ordinary users will not see any difference in cross-chain asset transfer times.

For other types of cross-chain messages, ZK can be faster because the ZK chain can checkpoint its state to the parent chain (i.e. L2 Ethereum) faster than the Optimistic chain. This means that if the sending chain uses ZK proofs, trustless cross-chain messaging will be faster for use cases other than asset transfers.

It's unclear exactly how important this difference is. Today, the vast majority of cross-chain activities are asset transfers, and the user experience is not much different.

in conclusion

To me, the answer is clear: Optimistic's advantages (low cost, simplicity, and flexibility) are more prominent than ZK's advantages (speed of non-asset transfer cross-chain functionality).

This is why Arbitrum still uses Optimistic proofs.