foreign
[Music]
my talk today is going to be about Fast
and Furious withdrawals from optimistic
Roll-Ups so a little bit about myself my
name is Masa and I'm a PhD candidate I'm
doing PhD at Concordia University with
Jeremy Clark and Montreal and I'm also
integration engineer at the often labs
all right so what I'm going to talk
about today is uh research that I was
doing during the PHD and it kind of
co-located with the time that I was
doing uh the job at the off chain so
it's kind of a collaboration between the
folks at FJ and Korea so it's a research
we are particularly interested in
solving a research problem but before I
dive into the details of the problem I
want to take some time and talk about
how Roll-Ups work in general and how
optimistic Roll-Ups work so you might
have already heard from other folks
during the conference but it's always
good to keep refreshing and make sure
everybody is on board
so let's start with the question of why
is the term slow and expensive
so we know ethereum is slow uh there's
unscalability problem with ethereum and
it's really a fundamental issue and why
there is a problem is that let's say you
have a function that you want to get
executed on an input X and if it was a
cloud environment the cloud service
provider would give you the closest node
in the network
and then what happened is you send the
function to the node it would execute
the function for you and it would give
back the results and you learn what the
result is but on a blockchain because we
care about trust and integrity we can't
really rely on one node to execute
everything for us
so what happens on a blockchain is you
send your function to a node and one
note what that node does is actually
relays your function together with the
input to all the nodes in the network
and what happens is then all the nodes
in a network execute your function so
it's literally like you have to pay for
each and every node executing the
function for you and then it takes some
time because they have to run a
consensus algorithm among each other so
that they could all agree on the same
output and it's only that moment that
you can learn the result so that's
that's uh that's really why it's so
inexpensive
okay so but why is it that every node
has to compute everything so the answer
is because they have to make sure that
it's the correct thing so let's say I
have a function I execute it for you and
then I come to you and I'm like here's
the output so what is the most
straightforward way to for you to
actually verify if I'm saying the
correct thing so you have to go and
compute the function yourself right so
the question people have been asking in
terms of scalability of ethereum is that
is there any way I can convince you that
I've done the execution correct without
you having to go and execute everything
yourself
so there are two main approaches to
tackle this problem the first one is you
can actually throw some math at a
problem and you create kind of a
mathematical proof so you run a function
you get the output and you then you kind
of create a cryptography proof you hand
it to me and then I can actually verify
the proof and see if it's a correct
thing or not so very if like verifying
the proof is less work than actually
having to execute everything then I
actually save some money and time right
so this is how ZK Roll-Ups work on a
high level
so the way SDK roll-up work is
he actually sent a function to a node
the node would execute it for you and
then they create a cryptographic proof
saying that this is a correct output now
generation of this proof takes a long
time it even takes like 1000 times or
even million times longer than when you
have to like compute a function yourself
so that's kind of a hidden cost but if
like once you have the the proof in hand
you can actually go and send it to the
network and then verifying the proof is
really nothing so it's really a cost
effective solution especially if you're
one of those nodes that have to verify
those proof
and the second solution is to use kind
of like economics so I'm like I execute
this function and here's the output and
here's a million dollar worth of eth
packing uh my assertion and it's open
for you to dispute anybody can come
along and they can prove that it's the
wrong output but they have to stake
money as well so the way it works is
let's say
Alice is saying what apple is right uh
Bob is saying the other output is right
and then uh there's a dispute and
disagreement right and it's only in that
point that ethereum goes back to a
normal blockchain mode where every node
has to execute everything so uh this is
how optimistic rollups work and we call
it optimistic because
because we're really optimistic that not
every node has to compute everything
because
it really notes always assert the right
output and you see why
so the way an optimistic rollups work is
that uh
I I execute a function and I put an
assertion I stick on that and let's say
Bobby's come coming and he says this is
the wrong output so he finds a dispute
so what happens is ethereum would be
like hey I know you guys are disagreeing
on this output I want you to pinpoint me
to the exact step inside the computation
where you started to disagree so maybe
you were fine for the first 30 of the
computation and it's only this little
step where you started to disagree so
it's actually going to verify that
little step so it ends up being very
cost effective even if ethereum has to
step in
and that's why actually it's near really
not easy to get away with the wrong
output because everybody knows that at
the end of the day a term can come along
and it can settle things and you can
lose money and then uh yeah and then
that's why actually the only way you can
get away with the wrong output is that
nobody is watching the protocol so at
least what honest party watches the
protocol then you you can never get out
of it yeah
and yeah this is how optimistic rollups
work and like um in in real world it
never happens and they're dispute like
an arbitrum there's never been a dispute
before
so let's say let's see how it works on
arbitrom on a smart contract level so
what happens with Arbitron puts two
smart contracts on the L1 inbox and
outbox and uh what Alice's Alice does is
she wants to execute some function right
so what she does is instead of putting
the function on L1 and having the L1 to
execute everything she puts a message
saying that I want this function to be
executed on layer one and it's only the
inbox contract is going to record the
fact that Alice wants this function to
be executed
so what happens is somebody outside L1
comes along they dump the contents of
the inbox smart contract on L2 and then
they're going to execute everything on
the arbos and it's really based on like
the the how they were sorted inside
inbox smart contract and then they're
gonna update everybody's account on the
arbos
and then they put the uh like the output
of this execution inside the outbox more
contract in the form of an assertion so
an assertion is basically a fingerprint
of the latest state of the arbos
so a term doesn't care what is our Os or
how our OS works it actually works a lot
like ethereum it runs a blockchain it
has blocks it has miners we call them
validators it has block explorers but a
term doesn't care about anything about
that it only cares about like here's the
list of function that I'm seeing that
are going to be executed on Layer Two I
want to see the the output of this
execution that's all it cares about
so we have to wait for seven days
because we want to make sure that
everybody have time to come along and
they react to it if there's any dispute
and if there's not no dispute it's going
to be finalized
so let's say Alice wants to do something
slightly different this time she wants
to withdraw 100 eth from L2 and to make
that happen arbitrom has to introduce a
smart contract which is called Bridge so
Bridge's job is basically to Escrow
whatever tokens or ethers people want to
move to the L2 so if Alice wants to
withdraw 100 ether from L2 it means that
she has previously moved 100 ether to
the rbos so what bridge does is hey
Alice I know you're moving 100 East to
the L2 that's fine just give me 100 each
I'm gonna score it for you and then I'm
gonna mint 100 is on L2 out of thin air
you'll be the owner do whatever you want
go ahead transfer it to Bob and the end
of the day what I care about is somebody
comes along and they want their ether
back from me and that's called a
withdraw transaction so yeah so like any
other transaction I just described Alice
puts a message for the withdrawal
transaction inside the Inbox and
arbitrum does it things
so yeah somebody dumps the contents of
the Inbox and the arbos it gets executed
and then the assertion would be placed
inside the outbox now we have to wait
for seven days so that we make sure that
the assertion is finalized and our
withdraw transaction can go through
and only in that case when it is
finalized Alice knows that her
transaction is in assertion number 20.
she can go to the outbox and she'll be
like hey upbox this is the assertion
it's just finalized it's sitting there
for you to go and see go check it please
and then if you're happy with that I won
my 100 East back from the bridge
so outbox is Happy Bridge would give
back The Ether to Alice and then it's
gonna burn those on the L2
so here's the problem I'm sure you've
noticed withdrawals take seven days to
be to be finalized and it could be even
longer if there's any dispute and uh
although there's never been a dispute
before but there could be and people
really don't want to wait for seven days
sometimes they have a pressing reason
they want to really do something with
their ether but intrinsically you don't
want to wait and then seven days is just
really an arbitrary number but there
should be some time window for people to
pay attention to the protocol and react
to it if something happens
but something interesting that we notice
is on arbit's room let's say there's an
assertion that you're just looking at it
for the first time and you're trying to
figure out if it's going to be finalized
or not so if it ha it actually happens
if you run an validator on arbitrol what
happens is what is validator is just a
software that goes through the inbox
transactions one by one it's going to
execute those and at the end of the day
it's just gonna compare the output of
this execution with the state that is
being asserted so if you run an orbits
from validator you can be 100 sure that
this transaction is really going to be
finalized the assertion is going to be
finalized so we found that this this is
really interesting that we can leverage
to get a relief of this pain point of
having to wait for seven days
so the question we were asking in this
research is can Alice withdraw 100 eth
from L2 back to L1 without having to
wait for seven days so we we have come
up with four different solutions in his
work and I'm gonna go through them one
by one and they actually get better as
we go through
okay so the first solution is Alice can
actually use a centralized exchange like
hop right so what you can do is you can
go to The Exchange she can trade uh her
hundred each on a two with the one on L1
and it's really easy so these
centralized exchanges they have piles of
eth on both L2 and L1 and you can
actually trade with them so this
solution works a lot of people have been
using it but the problem with that is
it's centralized so now we ask ourselves
is there any way we can do it in a
decentralized way
and uh so that's where we go to the
second solution so the story is Alice is
holding 100 East on L2 right
so if it happens to be some somebody
somewhere that that has the exact same
amount of if on L1 and is willing to
trade that with Alice then they can do
something called Atomic swap so I'm not
gonna go through the details of what
Atomic swap is but it's basically like a
little of crypto
combined with smart contract that allows
you to basically do transactions on two
different chains at the same time so
it's like arbits from here is a
different chain than a term right
so it's like uh both Alice and Bob they
agree on Atomic swap so they have to
lock up some money and then there is a
secret somewhere that uh if it's if it's
revealed on one chain then you can use
it to send a transaction on another
chain so it's either like either both
transaction goes through at the same
time or they don't go through at all so
this is the beauty of atomic swap so
it's perfect it works but the problem
with that that you might have noticed is
that Bob can agree to do the atomic swap
but then he can just disappear in the
middle of the protocol so there's some
time window for Alice to go back and get
whatever she has locked up before but
it's actually very awkward because she's
not getting what she wants and she's
actually losing some time here
so we go to the third solution so we're
like hey Alice we know that you
initiated your withdraw transaction on
L2 and uh from L2 and then now you're
waiting for your assertion to be
finalized what we can do is we can give
you a ticket actually that says you are
actually the owner of this hundred each
and then you can do whatever you want
with the ticket you can go ahead you can
transfer it to Bob that's fine even
though the seven day has not passed so
uh
so it's basically like we're giving a
tradable ticket or a claim of whatever
is going to go out of the bridge after
the seven days and as I said these are
tradable they can transfer it
so if Bob happens to be an Orbitz from
validator it means that he can be sure
if the assertion is going to go
finalized or not so what she does is
what Alice does is that she can actually
go to Bob and she'll be like hey Bob I
know that you're you're actually
validating everything and you might not
even care about my withdrawal but what I
can offer you
is that I have this ticket that worth
100 ether in seven days so what you can
do is I give you a discount or a bonus
you can buy my ticket because you know
that this assertion is going to be
finalized and then uh you get the ticket
you get the ticket you get the bonus and
then at the end of the day you have
profit so Bob can do that it's great but
as you may have noticed Bob here
is having two roles so first off he has
to have the liquidity meaning that he
has to be sitting on a pile of East and
his he has to be willing to trade it
with Alice the other thing is Bob needs
to run an evalidator on arbitrom so he
needs some Assurance he needs to know
that this assertion is gonna go finalize
someday otherwise he's not really
willing to trade with Alice so the
problem this solution is really great
but the problem with that is uh there's
not probably a lot of Bobs in this world
so there could be some people they have
the liquidity and so they have a lot of
it but they're not necessarily arbitrary
validators or there could be some arbits
from validators but they're not sitting
on a pile of eth or they're not even
interested in participating in this kind
of like markets they're just but doing
that because they want to be part of the
arbitrary ecosystem
so that's the problem finding these
bulbs that work for the both side of
equations is not really easy okay so we
are at a last solution we so uh we were
like is there any way we can split Bob
so is there any way we can have Alice
she wants to withdraw 100 East from L2
then we have David who is the arbits
from validator but he doesn't have the
liquidity and we have Carol who has the
liquidity but she's not a validator so
is there any way these three can arrange
something that can give Alice what she
wants at the end of the day and it turns
out that yes there is a solution for
that we have this solution and our
solution is not necessarily the only one
but but we think it works great
so the solution is to set up something
called a prediction market so what is a
prediction market so a prediction Market
is basically a betting Market but with a
difference that you can get inside and
outside of your position
so in a betting Market what happens is
you'll have you can place a bet but then
you cannot transfer it or you can you
cannot get out of your position you have
to sit on it and then you have to wait
for the event to happen but on the
prediction Market on the other side what
happens is let's say you think the odds
of Joe Biden being the next president of
the United States is so high so what you
do is You're Gonna Go place a bet
against it in three months the odds are
actually going down so what you do is
you can actually sell your position
and can get out of your position so this
is the difference with a betting market
and then it's really like a betting
Market but it designed more kind of like
stocks I'd say
so okay so we have this prediction
Market the way we set up it is we put
the market it's really like a vending
machine it's there's no bookkeeping or
anything it's autonomous smart contract
we put it on L1 and uh so a user would
go to it I can go to it I deposit one
ether inside the market and it would
give me two shares one yester and one no
share so and these Shares are betting
against if this session is going to be
finalized or not so at the very
beginning I'm actually covered for both
cases so if the assertion is finalized
my yester is going to be worth one ether
and my no shares actually worth nothing
and on the other side if the assertion
fails there's a dispute and then my no
share is going to be worth one ether and
the gestures are actually nothing so in
any case I can go and redeem my one
ether back okay so how does it work so
let's say Alice wants Alice is the one
who wants to do this withdrawal right so
she initiates the withdrawal and she's
like okay I want my there now I don't
want to wait for seven days so what I do
is I come along I go to this market and
I I and pay attention to this that she
wants to withdraw 100 ether so what she
does is she deposits 100 if inside the
smart contract the market and what
Market does it actually gives Alice
hundred shares of yes and 100 shares of
no so if Alice actually believes that
this assertion is going to be finalized
and at the end of the day her ether is
going to get out of the bridge but she
would do
so she would keep the gestures for
herself because it's a bet against the
assertions being finalized and she would
get away
there are no shares right out of the no
shares but she's not going to do that
and I tell you why what she does is she
actually keeps uh the gestures for
herself at the Notions for herself and
she's gonna give the yes shares to David
who's running the orbits from validator
so she goes to David and she's like hey
I know that you're already validating
the orbits from chain and David doesn't
care about this withdrawal at all she
doesn't even he doesn't even know what
that is so Alice is like I am giving you
these hundred no shares
is a bet against this assertion number
10 is going to be finalized or not and
I'm giving it to you for a discount or
bonus so you can give me 99 cents per
shares so at the end of the day you pay
99 ether and if it's going to be
finalized you can always go back to the
market and you can redeem it 400 East so
Bob's gonna profit right
so yeah um sorry Dave is going to pray I
was keeping saying Bob right sorry about
that so I'm in debut yeah so so Dave is
going to profit right so he's willing to
do that that's fine so what she does
with the no shares that she kept for
herself now she can actually go to Cairo
who has the liquidity but she doesn't
know what's going on on arbitrome chain
and Alice would be like hi I'm willing
to trade my ticket with you this is a
ticket it's worth 100 if it belongs to
me now but I can sell it to you and I
know that you don't have any idea about
this assertion number 10 you don't know
if it's going to be finalized or not
that's fine you don't have to do
anything I provide insurance so what I
do is I'm gonna give hundred no shares
to you for free so in any case if the
assertion is going to be finalized and
my withdraw is actually confirm what I
do is what you can do is you can go to
the market
and you can redeem your you can go to
the outbox and then you can redeem your
ticket for 100 East
and if no if there's a dispute happen
and these assertions happens to be like
uh not finalized what you can do is you
can go to the market and you can redeem
your no shares for 100 each so in any
case Alice is ensuring Carol so Carol
would be able to do the trade with her
there's no risk for her
so this is great this is the best
solution that I I guess we have come up
with and for the implementation this is
a work uh under progress so what we did
so far is we modified arbits from Nitro
to support our Solutions and we provide
measurements we fully implemented
solution three so far it's a proof of
concept so what I did was I implemented
an L1 Market it's really like a vending
machine as I said so there's no
bookkeeping or anything and we modified
the outbox so that it would support our
Market
and for the solution for the prediction
Market one it's still under progress but
we modified the roll up and outbox more
contracts uh so uh there could be
prediction Market friendly okay so I'm
gonna walk you through the the protocol
of solution three how it works and how
what what are the functions that we
added to the product the Arbitron
protocols so let's say Alice wants to do
a withdraw so she puts her a withdrawal
transaction inside the Inbox and then
what she does this is the function that
we added to the outbox she wants to
participate inside the market so Market
needs to know that she actually locked
up her her ether inside the market so
what Alice needs to do first is she has
to go to the outbox and cause the
transfer spender function with what
basically it does is it it transfer her
exit her withdrawal to the market smart
contract so it's like it's
collateralizing her exit
and then once that's done she can go to
the market and she can actually open a
market on her exit and Market would
check if Alice has really deposited her
exit inside the market or not and if yes
that's fine she can open a market then
the market is open for some time until
there's a trade Bob comes along he's a
Trader he is willing to trade it with
Alice what he does is uh he submits a
bid that actually is greater than what
is Alice as Alice is asking for and that
that's when the trade occurs so the
trade happens everything gets settled
down but Market does it first gonna
first is gonna send the East back to
Alice so Alice is happy she got her
ether and then what it does is because
it's owning the exit now what it can do
is it it can actually go inside the
outbox and change the owner of this exit
so it reached inside the outbox and it
changes the owner to the ball
so now Bob owns the exit we wait for
seven days and then what happens is he
can now go to the outbox smart contract
execute his withdrawal transaction and
then because he's the owner the bridge
would send 100 East back to him so easy
peasy everyone's happy
and then we run some measurements too to
find out how much at one gas it would
cost us to run this function so it turns
out it's really cheap so for
transferring the spender inside the
output smart contract it's around 80 uh
six K and it's really like the most
expensive one because it's the like the
it's the first transferring of spender
so it's actually you're paying for
creation of a mapping so the because
there's a mapping that keeps track of
all the owners of an exit so this is
really expensive the first one is really
expensive but the LA the second one and
the third one I guess they were around
like 40K away which was really great
and for opening the market we had to pay
around 300K
and for for submitting the bid uh I had
to pay around 100K and then for
executing the transaction it cost 90k
and that sums up the talk uh I I hope
you enjoyed it it's really a work under
progress so uh the repo is not really
public yet but I urge you to reach out
to me on Twitter if you need to learn
more we're gonna submit it somewhere
soon and the repo will be public