With the breadth of research into off-chain scaling solutions, rollups have emerged as the primary candidate to power secure and scalable blockchains. Zk-rollups have garnered most of the attention despite being relatively infant in functionality compared to their optimistic counterparts. Despite this attention, optimistic rollups have many advantages over the zero-knowledge variant that is worth exploring.
Rollups
Rollups are a type of blockchain that submit their blocks to another chain (the base layer) that provides consensus and verifies data availability of the block. A rollup can also aggregate multiple blocks and post them together as a single batch. For optimistic rollups, the base layer assumes the transactions are correct by default. If a party wishes to dispute the block, a fraud proof is generated to verify invalidity. Unlike optimistic rollups, zk-rollups require each block to receive validation to ensure validity, which is done through validity proofs.
Transaction cost
Costs that rollups have to pay to publish transactions to the base layer can be separated into two categories: fixed and variable costs. Fixed costs are the costs that the rollup must pay per batch, even if it contains zero transactions. Variable costs are the marginal costs that accrue with each additional transaction included in the batch.
Zk-rollups have the largest fixed costs of the two rollups by a wide margin due to the validity proof. The cost of submitting a validity proof to the base layer is determined by its size. SNARKs incur lower costs due to their smaller size, consuming approximately 500k – 1M gas in the EVM. STARKs incur higher costs than SNARKs because of their larger proof size, consuming anywhere from 1M – 5M gas depending on proof size. Optimistic rollups don’t bare this cost because proofs aren’t required, except in the event of disputes.
Once activity increases on the rollups, the variable cost of transaction data becomes the largest factor that impacts rollup transactions fees. Transaction data is submitted by the rollup to Ethereum in the form of calldata which has a cost of 16 gas per byte for non-zero calldata. While the cost for calldata is fixed, the price per unit of gas fluctuates depending on demand for blockspace. As more transactions accompany each batch, the total cost increases are amortized among all the transactions.
More frequent batches sent to the base layer also incur more cumulative fixed cost expenditure, which is why some zk-rollups only submit large batches to amortize the cost among a larger set of transactions. Incidentally, the amortization can reduce transaction fees despite the total cost of the batch increasing, though this only holds true to a certain extent. The extent to which the rollups are limited is the capacity for data throughput on the base layer.
When rollups operate at low levels of activity, optimistic rollups have the cost advantage as they lower fixed costs than that of zk-Rollups. When operating at increased levels of activity, the variable cost of submitting data becomes the primary determiner of rollups fees. The type of rollup that can reduce the cost of data per transaction has a cost advantage at scale.
EVM equivalence
While rollups aim to scale Ethereum, many also try to emulate the same environment to reduce the friction in moving the application ecosystem from Ethereum up to the rollups. The degree by which the rollup implements the same environment in Ethereum can be split into two categories: EVM compatibility and EVM equivalence.
EVM compatibility is the approximation of the EVM inside the rollup. Most of the features of the EVM are present, and Ethereum contracts can port but require some changes to the contract code to run in the rollup. EVM equivalence is an identical implementation of the EVM inside a rollup, where all opcodes are present, and Ethereum contracts can port to the rollup with minimal changes.
When compared to optimistic rollups, zk-rollups have a substantial disadvantage in becoming both compatible and comparable to the EVM, owing to the complexity of implementing the EVM in a zero-knowledge compatible manner. Some opcodes are inherently difficult to process in the zk circuit, and other features such as certain cryptographic primitives and precompiles also have incompatibility issues with the zkEVM. The lack of comparable issues is why EVM compatible optimistic rollups have been live for over a year, whereas there is yet to be a zk-rollup on mainnet with such functionality.
Hardware requirements
To ensure that a rollup remains live despite adversarial conditions, hardware requirements must be kept reasonable such that another node can step in to maintain operation if a single or set of nodes fails. In an optimistic rollup, a sequencer must be operational to build batches and publish them to the base layer. The prover is only required to generate fraud proofs during disputes. In a zk-rollup, both the prover and sequencer are required for the chain to make progress.
While the sequencers in both rollup constructions have the same role, the provers differ significantly. zk-rollup provers generate validity proofs that attest to each batch, which require computing many cryptographic commitments to generate. The high cost to generate a validity proof increases the hardware requirements to run a prover and simultaneously decreases the number of people that could potentially bootstrap a prover if required. Importantly, withdrawals and force exits are initiated on the rollup by producing a new block therefore high hardware requirements ultimately decrease the censorship resistance of zk-rollups compared to optimistic rollups.
Finality
The point at which transactions are considered final varies by the designs of both rollups. Optimistic rollups can publish blocks frequently every few minutes whereas zk-rollups are limited by the proof generation time - a validity proof must accompany each batch that is sent to the base layer. For example, if a batch waits five hours before submission to the base layer, transactions within that batch receive no prior confirmation or guarantees of finality.
Finality is the time it takes for a transaction to be considered final from the view of the base layer contract. Finality for a transaction lets funds get withdrawn from the rollup to another chain. Optimistic rollups have natively slower finality compared to zk-rollups as finality can only occur once the dispute window has passed, which for most optimistic rollups is on the order of a week. However, faster finality for withdrawals can be provided through liquidity providers. The user initiates a withdrawal and the liquidity provider swaps their tokens for an equivalent amount on the destination chain. The disadvantage is that there must be enough liquidity for the tokens to be withdrawn otherwise the native withdrawal with the dispute window must be used. Because of this, zk-rollups have faster native finality, but optimistic rollups have faster confirmations and can have faster finality for liquid tokens.
Conclusion
Zk-rollups have received all the hype as the future of rollup scaling, however, optimistic rollups have proven themselves as a viable and beneficial candidate as a fully functional solution today.
- Optimistic rollups have lower fixed costs for submitting batches to the base layer than zk-rollups. At a smaller scale, this results in lower fees, however, this can change as activity increases and transaction data becomes the largest marginal cost for rollup fees.
- EVM compatibility and equivalence are significantly easier for optimistic rollups to implement as they don’t have to battle with the difficult and incompatible features that zk-proofs present.
- Zk-rollups have high hardware requirements to operate a prover due to the cost of generating a validity proof. The higher requirements decrease the barrier to entry and ultimately reduce the censorship-resistance of the zk-rollup as there needs to be both a prover and a sequencer to ensure the rollup continues producing blocks. As a result, optimistic rollups can have comparably higher censorship resistance.
- Optimistic rollups can provide faster confirmations and finality for liquid tokens through liquidity providers, while zk-rollups provide faster finality for native withdrawals and non-liquid tokens.