Vitalik and the Ethereum Foundation's latest thoughts on capacity expansion
Original source: Ethereum Reddit
Original author: Ethereum Foundation Research Team
Original compilation: EthereumCN
On July 7, 2022, the Ethereum Foundation Research Team held its eighth AMA on Reddit. ECN organized and compiled most of the questions for this AMA. It should be noted that members of the R&D team of the Foundation have personal opinions and speculations on certain topics. In order to avoid misinterpretation, please refer to the original post.
Due to the length of the article, the article is divided into topics, and this article is a topic of expansion.
JonCharbonneau question:
Can you explain how enshrined rollup works and how they work in Ethereum potential development path? (optimistic and zkEVM?)
(Translator's Note: L2 scaling researcher Polynya at This tweet explains the difference between "enshrined rollups" vs. "discrete rollups" like "public sector" and "private sector ".)
And what do you think is the biggest advantage and disadvantage that this can bring, because many people have different opinions on this point .
Ethereum Foundation Justin Drake answered:
"Enshrined rollups" is a very interesting topic :) "Enshrined rollups" refer to rollups that enjoy some kind of consensus integration on L1. And smart contract rollup (see L2Beat and zkrollups.xyz ) are different - run entirely on L2, outside of consensus.
Consensus integration can give enshrined rollups superpowers, but at a significant cost - see below for a detailed discussion of the benefits and drawbacks. Broadly speaking, enshrined rollup and smart contract rollup are complementary. I expect both to play key roles in the "rollup-centric Ethereum roadmap".
Their potential development paths in Ethereum (optimistic and zkEVM?)
Current The plan is to develop directly in the direction of enshrined zk-rollup. This is part of the visualization roadmap published by Vitalik "Generating ZK-SNARK Proofs for Everything". The Ethereum Foundation has a team of about 10, led by Barry Whitehat, working on upgrading the canonical EVM instance to an enshrined zkEVM rollup. That is to say, construct a zkEVM whose state root is completely equivalent, and provide concise cryptographic proofs (SNARKs) for L1 Ethereum blocks, proving that the corresponding state root is valid. This brings various benefits:
No re-execution required: validators and other full nodes no longer need to re-execute transactions to validate a block. This removes the computing consensus bottleneck for validators, which may be an opportunity to improve the EVM gas limit. Removing the need for re-execution also speeds up most synchronization strategies.
Consensus is more concise: Removing execution from consensus means validators can run ultra-simple execution clients, where In the client, tens of thousands of consensus key EVM execution codes are reduced to hundreds of lines of SNARK verification codes.
No State Witness Required: stateless execution clients no longer need to download witnesses (such as Merkle paths or Verkle proofs) - download state The difference is enough. This greatly improves the consensus bandwidth efficiency of validators and releases a higher EVM gas limit.
A more secure light client: Light clients can quickly filter out invalid state roots, unlike using fraud proofs to filter out Invalid state root so slow. This makes the "Ethereum-L1" bridge more secure.
Upgrading the current single-instance EVM to enshrined rollup is a massive multi-year effort. A relatively easy step after that is to deploy multiple (say 64) parallel enshrined zkEVM instances (consuming blob data). This is a form of L1 homogeneous execution sharding (formerly known as "Phase 2").
Engineering work on the Enshrined zkEVM is of particular interest to tech buffs, involving cryptographic proof systems, circuit design and auditing, and software and hardware acceleration. The EF team is hiring zkEVM engineers - please contact justin@ethereum.org
What are the biggest advantages and disadvantages
Benefits
Social Consensus: Enshrined rollups inherit the social consensus of L1, no longer Governance tokens are required to perform rollup upgrades. In contrast, most smart contract rollups are vulnerable to governance attacks.
There is a subsidy for proof verification: Enshrined rollups can subsidize the proof verification cost for settlement (the cost of each block is fixed) . Instead, smart contract rollups must pay EVM gas for settlement. Settlement delay: Enshrined rollups naturally benefit from each block settlement delay.
Optimal Liveness: Many smart contract rollups may choose to use external consensus mechanisms to sort transactions and act as an on-chain escape hatch. This ordering infrastructure suffers from suboptimal liveness, as external consensus can fail and escape pods only activate after a timeout.
EVM state root equivalence: Enshrined zkEVM tools and light clients are available out of the box. Many smart contract rollups may not choose to have an EVM state root equivalent, but rather a Solidity-compatible VM (eg, zkSync) or a bytecode-equivalent EVM (eg, Scroll).
Network Effects: Canonical EVM instances enjoy the network effects of being a first mover, while upgrading to enshrined preserves them.
Disadvantages
No Public Goods Funding: Enshrined zkEVM rollups will have limited discretion in funding public goods. Unlike Optimism, which has a governance mechanism to fund any public goods, enshrined zkEVMs will be limited to funding L1 security and contributing to the scarcity of ETH.
Suboptimal compression: Smart contract rollups may choose to settle on-chain instead of once per block, thereby Enables better data compression. A smart contract rollup can also have a custom or frequently updated dictionary to improve data compression.
Virtual Machine Inflexibility: An Ethereum enshrined VM is likely to be an EVM. In contrast, a smart contract rollup can choose to adopt a more commonly used VM (eg, WASM, RiscV, MIPS) or create a new VM (eg, Cairo). A custom zkVM may achieve better data compression than zkEVM.
Harder pre-confirmation: smart contract rollup can choose a centralized sequencer to provide instant (~100 ms) Pre-confirmation to give users a good interactive experience. This kind of fast pre-confirmation is difficult to achieve using a decentralized ordering system, whether enshrined rollups or smart contract rollups.
Latecomer: The enshrined zkEVM will be a so-called latecomer due to the slowness and conservativeness of the L1. To hedge against the possibility of circuit vulnerabilities, a redundant multi-circuit setup or cumbersome formal verification may be required.
TheTrueBlueTJ question:
In theory, is it possible for a global payment system to use Ethereum to As a currency in circulation? Either through L1 or rollup? Of course, future scalability improvements are taken into account.
Ethereum Foundation Justin Drake Answer:
It is entirely possible. At present, Ethereum can reach 10 TPS (transactions per second), which is a rough order of magnitude. And there will be 3 times of 100-fold growth in the future, which will allow us to reach 10 million TPS (enough for 100 transactions per person per day):
The 100-fold growth comes from rollups;
100x growth from sharding;
100x increase in bandwidth in 10 years ( Nelson's law).
My contention is that,due to network effects, the demand for the safest shared security platforms will become saturated. A reasonable direction is that if Ethereum can maintain its leading edge in economic security and scale to 10 million TPS at the same time, then Ethereum has the potential to serve as the settlement layer of the Internet.
AllwaysBuyCheap asks:
How does the increase in bandwidth improve the transaction speed of Ethereum ? More block space?
Answer by Justin Drake of the Ethereum Foundation:
There are various calculations in the consensus Bottleneck:
Disk I/O: removed by being stateless (and enshrined zkEVMs);
Storage: removed by statelessness (and enshrined zkEVMs);
Compute: removed by enshrined zkEVMs;
Bandwidth: Fundamental.
Because bandwidth is the fundamental consensus bottleneck, increasing bandwidth can free up more block space.
not_a_disaster asks:
What is better in the long run? Is a single rollup dominant or are there several small rollup schemes?
The arguments I see on both sides are:
1. A dominant rollup means This means that users do not need to bridge assets and will have a better user experience
2. However, if there is a dominant rollup, then other L2 is meaningless . But then again, in the long run, the EF team has been promoting only zkRollup (ideally with zkEVM).
Ethereum Foundation Ansgar Dietrichs Answer:
That's a good question! Any chain (L1 or L2) that scales its throughput to a point where normal users cannot fully verify the chain. The main difference between L1 and L2 is that L2 can make use of its underlying base layer to compensate for this:
1. On zk-rollups, the base layer The validity of state transitions and the availability of corresponding data are guaranteed. If you can't handle the rollup transaction yourself, the only thing that isn't guaranteed is that you have access to the current state (so that you can send a valid rollup transaction). So the only additional trust assumption is the presence of a state provider (centralized or decentralized).
2. Optimisticrollup introduces a small additional trust assumption. Not only do you need to trust that someone is processing the rollup transaction and making the current state available, but you also need to trust that in the event of a fraudulent state transition, at least one of those entities processing the rollup will submit a corresponding fraud proof. Usually optimistic rollups give people some economic incentive to submit these fraud proofs, so this is very different from zk-rollups.
Conceptually, the reason why rollup can be scaled without breaking trust too much is because of the relationship between L1 and L2. As long as users trust the state of the base layer, they can tell correct from incorrect L2 behavior (e.g. state provider responses will always come with a proof against the rollup state root stored on L1).
On the other hand, with the base chain, it is very important that each user handles the chain by himself. If you don't run your own node and ask an external state provider for state, then you can't tell if the state provided is real. Similarly, there is no settlement layer that can resolve disputes if there are malicious state transitions - you have to choose yourself which side to trust.
All these reasons led us to decide to turn Ethereum L1 into a settlement layer for rollup, with a focus on making it easy for every user to process transactions. I'm personally very excited about the imminent transition to Verkle trees, which will allow for completely stateless client implementations (imagine your Metamask being able to run its own embedded nodes). This way, over time, the base layer becomes the "root of trust" of the L2 ecosystem.
Hope my answer explains why rollup has the potential to far exceed L1 throughput without unreasonable trust tradeoffs. So I personally expect to end up with a very high throughput L2. However, it remains to be seen whether there will be a single dominant rollup.
Answer by Justin Drake, Ethereum Foundation:
What is better in the long run ? Is a single rollup dominant or are there several small rollup schemes?
In the long run, rollup will be able to process millions of transactions per second, so parallelism is necessary. We can imagine a kind of parallelism inside rollup (e.g., through a multi-core rollup virtual machine) and a kind of parallelism outside rollup (e.g., parallel instances of the same virtual machine).
Zk-rollups that share security (e.g., zk-rollups that share the same data availability) have synchronous composability, so "parallel inside a rollup" and The boundary between "rollup external parallelism" begins to blur, so the final result will not be too far behind.
not_a_disaster Question:
What do you think are the problems with application-specific L2/rollup?
If a Web2 company with a large user base (10 million - 100 million users) wants to use the blockchain, but still wants to achieve Centralization, application-specific chains/rollups are almost the only good alternatives.
What do you think are the disadvantages of doing this?
Answer by Justin Drake, Ethereum Foundation:
What do you think application-specific L2/rollup What are the problems?
I encourage developers to build applications based on general-purpose rollups (eg, Arbitrum, Optimism; soon zk rollups) rather than deploying an application-specific rollup . This will speed up development, amortize settlement overhead together, facilitate composability, and reduce tooling friction. Having said that, the vision of a general-purpose rollup will of course have its troubles.
Rollup will be vulnerable to attack. We’ve had exchange attacks that cost tens of millions of dollars, and cross-chain bridging attacks that cost hundreds of millions of dollars — expect rollups to be multibillion dollar attacks. Between EIP-4844 or EIP-4488 being implemented, transaction fees will not be as low as we would like. Tools will underperform for a while, and network effects may be slow to kick in.
Vitalik's answer:
If a company has a large user base (10 million -- 1 100 million users) Web2 companies wanting to use the blockchain, but still want to be decentralized, application-specific chains/rollups are pretty much the only good alternatives.
I think in this case they should use validium. They would rely on a centralized server or a committee for liveness, but they could be protected by the security provided by the blockchain.
AllwaysBuyCheap asks:
Why was EIP-4488 not developed while EIP-4844 was being developed? be implemented? Which technology do you think will win in the long run, Snarks or Starks?
Vitalik Answer:
STARKs are quantum proofs, they have better proofs Time, more flexibility in the fields you use.
SNARK proofs are much smaller. I expect pre-quantum, SNARKs and in some cases STARK's SNARKs (with STARK advantages but smaller proof size) to dominate, and post-quantum STARKs to dominate. But different people have different views on this.
Ethereum Foundation Justin Drake Answer:
Why is EIP-4844 being developed at the same time , EIP-4488 is not implemented?
As you pointed out, EIP-4844 and EIP-4488 are not mutually exclusive. My preference is to implement EIP-4488 shortly after the merge, and before EIP-4844. Because it will take years for EIP-4844 to bear usable fruit. In fact, even after EIP-4844 is launched on the main network, we may have to wait a few months before rollup can actually choose to use bolob data.
Which technology do you think will win in the long run, Snarks or Starks?
In the long run, what we want are post-quantum SNARKs. This advanced post-quantum SNARK is hash-based and happens to be a STARK, i.e., a transparent SNARK ("transparent" meaning no trusted initialization is required).
egodestroyer2 question:
For L2 to start settlement transactions and grab business from the main chain Come on, how do you predict the fee market in the near, medium and long term?
Answer by Justin Drake, Ethereum Foundation:
In the short term (Jul, Aug, Sep) I expect the fee market to remain relatively calm in a bear market;
< br>
In the near term (i.e. a few months after the merger), I expect Ethereum and ETH to heat up and the fee market to grow significantly;
In the medium term (i.e. 2-3 years), because rollup is widely adopted and the supply of block space is greater than the demand, the gas price may calm down temporarily. In the long run (3-10 years), Due to rollup and sharding, I expect small per-transaction fees, but high total fees (maybe $1B/day)
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
