Decentralized zk-Rollup

# Decentralized zk-Rollup ## TL;DR zk-Rollup requires prover to generate a succinct proof for a batch of transactions off-chain. However, the proof generation process is costly for complicated smart contract transactions. We introduce a Layer-2 proof outsourcing mechanism which can incentivize rollers to generate proofs for us using GPU/ASIC. We indicate that proof outsourcing has many more advantages than just batching transactions. It will open a totally new proof market and enable numerous off-chain applications. Also, it's an important step towards full decentralization.  ## Background The basic workflow of a typical [zk-Rollup](https://docs.ethhub.io/ethereum-roadmap/layer-2-scaling/zk-rollups/) is that + Users send transactions to a centralized sequencer (coordinator) on Layer 2. + Centralized sequencer executes the transactions and packs multiple transactions into a Rollup block. It will pre-confirm the client once the transaction is included in a block. + Then a centralized prover will generate a succinct proof for the Rollup block. The proof will be uploaded to Layer 1 with minium required data for verification. + Layer 1 smart constract can verify the proof and update the state (i.e. root hash). It's obvious that zk-Rollup is being too centralized (both prover and sequencer are centralized). This leads to several issues that limit the functionality of zk-Rollup. + **Limited computational power.** Proof generation time is critical for zk-Rollup. It's especially the case for large-sized circuits (i.e. zkEVM). Though customized hardware (ASIC) can significantly reduce the proof generation time, the high stake in the ASIC design and manufacture makes it economically impractice for a centralized entity. + **Limited community participation.** The community members or users have no means to join the ecosystem except for buying the tokens and waiting for release from the zk-Rollup company. It makes it hard to distribute the shares fairly if we stick to the centralized setting. + **Potential attack from MEV and Deny of Transactions.** The transactions are ordered in a centralized way by the sequencer, so the sequencer can frontrun to profit (i.e. insert bad tranactions). This problem is called "Miner Extractable Value" in blockchain. The sequencer can even reject to include some transactions in the Rollup block. > Despite being centralized, the typical zk-rollup is indeed as secure as Ethereum Layer 1 since no one can make "fake proofs" for invalid transactions. Although centralized sequencer can deny your transactions, no one can steal your money! You can always do a force withdraw and get your money back from Layer 2. We want to tackle these three problems above. Our goal is to build a fully decentralized and community-driven zk-Rollup with more features. That means we plan to decentralize both sequencer and the proof generation process in the future.  In this article, we will focus on the introduction of Layer-2 proof outsourcing mechanism. We address some design concerns and then describe our approach. We show that a lot of exciting new features can be enabled through the outsoucing process.  ## Principles and some design concerns In a nutshell, Layer-2 proof outsourcing is having "miners" generate proofs for us. They will be rewarded according to proving work they have done (It usually has positive correlation with the circuit size). We encourage the miner community to contribute computation power to our platform. **However, one thing we need to emphasize is that we are absolutely not doing PoW!** "Miners" are not computing anything redundant to maintain consensus. They are doing useful work. It's more like "volunteer computation" or "verifiable outsource computation". To distinguish from PoW, we call them *rollers*. There are some concerns that need to be addressed properly. + **Fastest prover always wins.** If you do it naively, you can easily get a "fastest prover always wins" result which is unfair and fragile --- everyone except the fastest prover will shut down and then there's a risk if the fastest prover goes away. So the mechanism should incentivise provers to prove different things in parallel and maximize the overall efficiecny. + **Various attacks.** There are many kinds of attacks. For example, if you broadcast a Rollup block to everyone, attackers can send invalid proofs from multiple different addresses. Also, zk proofs are easy to randomize (i.e. zk part can be added easily), attacters can register multiple positions while only run the core computation once. The mechanism needs to be resilient to such attacks. ## Our approach We will ellaborate more technical details in the follow up articles. Here, we describe the overall workflow and some high-level ideas. ![](https://i.imgur.com/zVAYgVX.png =630x320) + One needs to stake SCR tokens in a smart contract before she can be a legit roller and generate proofs for us. She will get an initial reputation ratio proportional to the deposit (i.e. the more you deposit, the higher reputation ratio you will get). + As usual, users send transactions to the centralized sequencer and the sequencer will execute the transactions, commit the blocks locally, and confirm the users. + Then, centralized sequencer will randomly select multiple rollers for each block based on rollers' normalized reputation ratio. It then sends out the block to the selected rollers to let them generate the proofs within a time limit `T`. To achieve better throughput, the sequencer maintains a window of pending blocks at the same time. + The sequencer will verify the proofs after receiving them from rollers + If roller sends an invalid proof, she will be fined. + If roller sends a proof later than `T`, her reputation ratio will be decreased. + If roller sends a valid proof within time `T`, she has the chance be rewarded. + The sequencer will aggregate proofs and upload the proofs to Layer 1 for verification. In this scheme, we use reputation ratio to balance a roller's stake and her computation power. The stake determines the upper bound of a roller's probability to be chosen and the repuation ratio reflects the roller's real computation power. This mechanism guarantees the fairness that not only the fastest roller but everyone has a chance to receive the rewards. To maximize a roller's profit, they will be more willing to generate proofs for different blocks in parallel (i.e. even if you are faster, the chance to get reward for the same block will be the same as the ones who are slower but but still submit proof within time `T`). All those will be highly parameterized and dynamically adjusted to the community computation power at the time. Note that we are still using a centralized sequencer, only proof generation is outsourced to rollers. That's the reason why we don't need "consensus" and why users can be pre-confirmed within seconds. There are some trade off between decentralization and efficiency. The way we separate sequencer and roller lies more on the efficiency side. There are some other potential approaches (i.e. use zk proof to maintain consensus like Aleo does [here](https://developer.aleo.org/advanced/posw/posw/), we also refer interested readers to the [PoNW paper](https://eprint.iacr.org/2020/190.pdf).) ## Rich benefits from Layer-2 proof outsourcing Now let's see what benefits this design can bring. + **Larger circuit support, Shorter confirmation time** As we described earlier, proof generation time is critical for zk-Rollup. If we open our network for proof outsourcing, then miners and mining pools will be incentivized to improve the efficiency of hardware accelerators (i.e. manufacture ASIC mining machines to generate the proof). We can leverage their huge computation power to support larger circuits and enjoy a shorter confirmation time at the same time. Worth to mention that our team is super strong in building hardware accelerator. We have built [the fastest groth16 ASIC prover](https://people.iiis.tsinghua.edu.cn/~gaomy/pubs/pipezk.isca21.pdf) and the fastest GPU prover (5-10x than filecoin mining). We are collarboating with ASIC companies and plan to have real ASIC support for our platform. It will serve as the baseline benchmark to support our system.  + **A fair distribution for users and it's more easy to support other features** We believe Layer-2 outsourcing is a good way to distribute the tokens to the community. More supporters can join our proving network and contribute as a proving node. Another benefit is that if Ethereum moves to ETH2.0, GPU miners can still join us as rollers to stick to the ecosystem of Ethereum. Computing proofs is the most economic way to use their computation power. If we have a roller community, we can support more features easily. For example, we can let miners store some transaction data off-chain. Then the platform can enjoy unlimited scalability easily (comparable with [zkPorter](https://medium.com/matter-labs/zkporter-a-breakthrough-in-l2-scaling-ed5e48842fbf) of zksync and [Volition](https://medium.com/starkware/volition-and-the-emerging-data-availability-spectrum-87e8bfa09bb) of starkware). This is a trade-off between standard zk-Rollup and cheaper Validium. + **Enable new business model with numerous off-chain applications.** We can also commit a lager range of complicated ZKP applications on-chain (i.e. anonymous KYC). General off-chain computation can outsource the costly proof generation process to miners on our platform and enjoy public verifiability. We will standardize the proving process to fit into more real-world applications. This will bring in new business model which even goes beyond zk-Rollup. We believe the biggest problem of blockchain in the future is not consensus but computation. We need roller community to join and enable broader off-chain computations. This will open a totally new proof market. Layer 1 will serve as a verification layer for settlement and one can do unlimited computation on our Layer 2 platform. ## Conclusion Layer 2 proof outsourcing is a way to decentralize the proving process and engage a wider range of communities. We can benefit a lot from the strong compuatation power. It can even go beyond the traditional zk-Rollup. If you ask me for a convincing reason to compare zk-Rollup with cheap sidechain solutions like BSC or Polygon ([concern from dragonfly](https://medium.com/dragonfly-research/im-worried-nobody-will-care-about-rollups-554bc743d4f1)). I will answer: it can go beyond a chain --- doing something blockchain can't do with unlimited off-chain computation. The magic is compressing computation through a succinct proof (SNARK proof) without sacrificing security. It's especially the case when you have access to the strong proving machines on our platform. ## Next steps and more information We are still half way to achieve full decentralization. The next step will be decentralizing the sequencer. To reduce the influence of MEV, we plan to outsource the sequencer via [auction](https://ethresear.ch/t/mev-auction-auctioning-transaction-ordering-rights-as-a-solution-to-miner-extractable-value/6788) (i.e. if one can profit through re-ordering transactions, it will be reflected in the auction price). We believe it's easier to reduce [the influence of MEV on Layer 2](https://www.youtube.com/watch?v=89KSlv74zus) since the transaction ordering and proving are naturally separated. Many open questions still remain, and we would love the community to join us in this journey! ## :scroll: A little about us *Scroll Tech is a newly built tech-driven company. We aim to build an EVM-compatible zk-Rollup with a strong proving network ([See an overview here](https://hackmd.io/@yezhang/S1sJ2cEWY)). The whole team is now focusing on the development. We are actively hiring more passionate developers, reach out to us at [hr@scroll.tech](mailto:hr@scroll.tech). If you have any question about the technical content, reach out to me at yezhang@scroll.tech. [DM](https://twitter.com/yezhang1998) is also open.*