Fast and Furious Withdrawals from Optimistic Rollups by Mahsa Moosavi | Devcon Bogotá

foreign [Music] my talk today is going to be about Fast and Furious withdrawals from optimistic Roll-Ups so a little bit about myself my name is Masa and I'm a PhD candidate I'm doing PhD at Concordia University with Jeremy Clark and Montreal and I'm also integration engineer at the often labs all right so what I'm going to talk about today is uh research that I was doing during the PHD and it kind of co-located with the time that I was doing uh the job at the off chain so it's kind of a collaboration between the folks at FJ and Korea so it's a research we are particularly interested in solving a research problem but before I dive into the details of the problem I want to take some time and talk about how Roll-Ups work in general and how optimistic Roll-Ups work so you might have already heard from other folks during the conference but it's always good to keep refreshing and make sure everybody is on board so let's start with the question of why is the term slow and expensive so we know ethereum is slow uh there's unscalability problem with ethereum and it's really a fundamental issue and why there is a problem is that let's say you have a function that you want to get executed on an input X and if it was a cloud environment the cloud service provider would give you the closest node in the network and then what happened is you send the function to the node it would execute the function for you and it would give back the results and you learn what the result is but on a blockchain because we care about trust and integrity we can't really rely on one node to execute everything for us so what happens on a blockchain is you send your function to a node and one note what that node does is actually relays your function together with the input to all the nodes in the network and what happens is then all the nodes in a network execute your function so it's literally like you have to pay for each and every node executing the function for you and then it takes some time because they have to run a consensus algorithm among each other so that they could all agree on the same output and it's only that moment that you can learn the result so that's that's uh that's really why it's so inexpensive okay so but why is it that every node has to compute everything so the answer is because they have to make sure that it's the correct thing so let's say I have a function I execute it for you and then I come to you and I'm like here's the output so what is the most straightforward way to for you to actually verify if I'm saying the correct thing so you have to go and compute the function yourself right so the question people have been asking in terms of scalability of ethereum is that is there any way I can convince you that I've done the execution correct without you having to go and execute everything yourself so there are two main approaches to tackle this problem the first one is you can actually throw some math at a problem and you create kind of a mathematical proof so you run a function you get the output and you then you kind of create a cryptography proof you hand it to me and then I can actually verify the proof and see if it's a correct thing or not so very if like verifying the proof is less work than actually having to execute everything then I actually save some money and time right so this is how ZK Roll-Ups work on a high level so the way SDK roll-up work is he actually sent a function to a node the node would execute it for you and then they create a cryptographic proof saying that this is a correct output now generation of this proof takes a long time it even takes like 1000 times or even million times longer than when you have to like compute a function yourself so that's kind of a hidden cost but if like once you have the the proof in hand you can actually go and send it to the network and then verifying the proof is really nothing so it's really a cost effective solution especially if you're one of those nodes that have to verify those proof and the second solution is to use kind of like economics so I'm like I execute this function and here's the output and here's a million dollar worth of eth packing uh my assertion and it's open for you to dispute anybody can come along and they can prove that it's the wrong output but they have to stake money as well so the way it works is let's say Alice is saying what apple is right uh Bob is saying the other output is right and then uh there's a dispute and disagreement right and it's only in that point that ethereum goes back to a normal blockchain mode where every node has to execute everything so uh this is how optimistic rollups work and we call it optimistic because because we're really optimistic that not every node has to compute everything because it really notes always assert the right output and you see why so the way an optimistic rollups work is that uh I I execute a function and I put an assertion I stick on that and let's say Bobby's come coming and he says this is the wrong output so he finds a dispute so what happens is ethereum would be like hey I know you guys are disagreeing on this output I want you to pinpoint me to the exact step inside the computation where you started to disagree so maybe you were fine for the first 30 of the computation and it's only this little step where you started to disagree so it's actually going to verify that little step so it ends up being very cost effective even if ethereum has to step in and that's why actually it's near really not easy to get away with the wrong output because everybody knows that at the end of the day a term can come along and it can settle things and you can lose money and then uh yeah and then that's why actually the only way you can get away with the wrong output is that nobody is watching the protocol so at least what honest party watches the protocol then you you can never get out of it yeah and yeah this is how optimistic rollups work and like um in in real world it never happens and they're dispute like an arbitrum there's never been a dispute before so let's say let's see how it works on arbitrom on a smart contract level so what happens with Arbitron puts two smart contracts on the L1 inbox and outbox and uh what Alice's Alice does is she wants to execute some function right so what she does is instead of putting the function on L1 and having the L1 to execute everything she puts a message saying that I want this function to be executed on layer one and it's only the inbox contract is going to record the fact that Alice wants this function to be executed so what happens is somebody outside L1 comes along they dump the contents of the inbox smart contract on L2 and then they're going to execute everything on the arbos and it's really based on like the the how they were sorted inside inbox smart contract and then they're gonna update everybody's account on the arbos and then they put the uh like the output of this execution inside the outbox more contract in the form of an assertion so an assertion is basically a fingerprint of the latest state of the arbos so a term doesn't care what is our Os or how our OS works it actually works a lot like ethereum it runs a blockchain it has blocks it has miners we call them validators it has block explorers but a term doesn't care about anything about that it only cares about like here's the list of function that I'm seeing that are going to be executed on Layer Two I want to see the the output of this execution that's all it cares about so we have to wait for seven days because we want to make sure that everybody have time to come along and they react to it if there's any dispute and if there's not no dispute it's going to be finalized so let's say Alice wants to do something slightly different this time she wants to withdraw 100 eth from L2 and to make that happen arbitrom has to introduce a smart contract which is called Bridge so Bridge's job is basically to Escrow whatever tokens or ethers people want to move to the L2 so if Alice wants to withdraw 100 ether from L2 it means that she has previously moved 100 ether to the rbos so what bridge does is hey Alice I know you're moving 100 East to the L2 that's fine just give me 100 each I'm gonna score it for you and then I'm gonna mint 100 is on L2 out of thin air you'll be the owner do whatever you want go ahead transfer it to Bob and the end of the day what I care about is somebody comes along and they want their ether back from me and that's called a withdraw transaction so yeah so like any other transaction I just described Alice puts a message for the withdrawal transaction inside the Inbox and arbitrum does it things so yeah somebody dumps the contents of the Inbox and the arbos it gets executed and then the assertion would be placed inside the outbox now we have to wait for seven days so that we make sure that the assertion is finalized and our withdraw transaction can go through and only in that case when it is finalized Alice knows that her transaction is in assertion number 20. she can go to the outbox and she'll be like hey upbox this is the assertion it's just finalized it's sitting there for you to go and see go check it please and then if you're happy with that I won my 100 East back from the bridge so outbox is Happy Bridge would give back The Ether to Alice and then it's gonna burn those on the L2 so here's the problem I'm sure you've noticed withdrawals take seven days to be to be finalized and it could be even longer if there's any dispute and uh although there's never been a dispute before but there could be and people really don't want to wait for seven days sometimes they have a pressing reason they want to really do something with their ether but intrinsically you don't want to wait and then seven days is just really an arbitrary number but there should be some time window for people to pay attention to the protocol and react to it if something happens but something interesting that we notice is on arbit's room let's say there's an assertion that you're just looking at it for the first time and you're trying to figure out if it's going to be finalized or not so if it ha it actually happens if you run an validator on arbitrol what happens is what is validator is just a software that goes through the inbox transactions one by one it's going to execute those and at the end of the day it's just gonna compare the output of this execution with the state that is being asserted so if you run an orbits from validator you can be 100 sure that this transaction is really going to be finalized the assertion is going to be finalized so we found that this this is really interesting that we can leverage to get a relief of this pain point of having to wait for seven days so the question we were asking in this research is can Alice withdraw 100 eth from L2 back to L1 without having to wait for seven days so we we have come up with four different solutions in his work and I'm gonna go through them one by one and they actually get better as we go through okay so the first solution is Alice can actually use a centralized exchange like hop right so what you can do is you can go to The Exchange she can trade uh her hundred each on a two with the one on L1 and it's really easy so these centralized exchanges they have piles of eth on both L2 and L1 and you can actually trade with them so this solution works a lot of people have been using it but the problem with that is it's centralized so now we ask ourselves is there any way we can do it in a decentralized way and uh so that's where we go to the second solution so the story is Alice is holding 100 East on L2 right so if it happens to be some somebody somewhere that that has the exact same amount of if on L1 and is willing to trade that with Alice then they can do something called Atomic swap so I'm not gonna go through the details of what Atomic swap is but it's basically like a little of crypto combined with smart contract that allows you to basically do transactions on two different chains at the same time so it's like arbits from here is a different chain than a term right so it's like uh both Alice and Bob they agree on Atomic swap so they have to lock up some money and then there is a secret somewhere that uh if it's if it's revealed on one chain then you can use it to send a transaction on another chain so it's either like either both transaction goes through at the same time or they don't go through at all so this is the beauty of atomic swap so it's perfect it works but the problem with that that you might have noticed is that Bob can agree to do the atomic swap but then he can just disappear in the middle of the protocol so there's some time window for Alice to go back and get whatever she has locked up before but it's actually very awkward because she's not getting what she wants and she's actually losing some time here so we go to the third solution so we're like hey Alice we know that you initiated your withdraw transaction on L2 and uh from L2 and then now you're waiting for your assertion to be finalized what we can do is we can give you a ticket actually that says you are actually the owner of this hundred each and then you can do whatever you want with the ticket you can go ahead you can transfer it to Bob that's fine even though the seven day has not passed so uh so it's basically like we're giving a tradable ticket or a claim of whatever is going to go out of the bridge after the seven days and as I said these are tradable they can transfer it so if Bob happens to be an Orbitz from validator it means that he can be sure if the assertion is going to go finalized or not so what she does is what Alice does is that she can actually go to Bob and she'll be like hey Bob I know that you're you're actually validating everything and you might not even care about my withdrawal but what I can offer you is that I have this ticket that worth 100 ether in seven days so what you can do is I give you a discount or a bonus you can buy my ticket because you know that this assertion is going to be finalized and then uh you get the ticket you get the ticket you get the bonus and then at the end of the day you have profit so Bob can do that it's great but as you may have noticed Bob here is having two roles so first off he has to have the liquidity meaning that he has to be sitting on a pile of East and his he has to be willing to trade it with Alice the other thing is Bob needs to run an evalidator on arbitrom so he needs some Assurance he needs to know that this assertion is gonna go finalize someday otherwise he's not really willing to trade with Alice so the problem this solution is really great but the problem with that is uh there's not probably a lot of Bobs in this world so there could be some people they have the liquidity and so they have a lot of it but they're not necessarily arbitrary validators or there could be some arbits from validators but they're not sitting on a pile of eth or they're not even interested in participating in this kind of like markets they're just but doing that because they want to be part of the arbitrary ecosystem so that's the problem finding these bulbs that work for the both side of equations is not really easy okay so we are at a last solution we so uh we were like is there any way we can split Bob so is there any way we can have Alice she wants to withdraw 100 East from L2 then we have David who is the arbits from validator but he doesn't have the liquidity and we have Carol who has the liquidity but she's not a validator so is there any way these three can arrange something that can give Alice what she wants at the end of the day and it turns out that yes there is a solution for that we have this solution and our solution is not necessarily the only one but but we think it works great so the solution is to set up something called a prediction market so what is a prediction market so a prediction Market is basically a betting Market but with a difference that you can get inside and outside of your position so in a betting Market what happens is you'll have you can place a bet but then you cannot transfer it or you can you cannot get out of your position you have to sit on it and then you have to wait for the event to happen but on the prediction Market on the other side what happens is let's say you think the odds of Joe Biden being the next president of the United States is so high so what you do is You're Gonna Go place a bet against it in three months the odds are actually going down so what you do is you can actually sell your position and can get out of your position so this is the difference with a betting market and then it's really like a betting Market but it designed more kind of like stocks I'd say so okay so we have this prediction Market the way we set up it is we put the market it's really like a vending machine it's there's no bookkeeping or anything it's autonomous smart contract we put it on L1 and uh so a user would go to it I can go to it I deposit one ether inside the market and it would give me two shares one yester and one no share so and these Shares are betting against if this session is going to be finalized or not so at the very beginning I'm actually covered for both cases so if the assertion is finalized my yester is going to be worth one ether and my no shares actually worth nothing and on the other side if the assertion fails there's a dispute and then my no share is going to be worth one ether and the gestures are actually nothing so in any case I can go and redeem my one ether back okay so how does it work so let's say Alice wants Alice is the one who wants to do this withdrawal right so she initiates the withdrawal and she's like okay I want my there now I don't want to wait for seven days so what I do is I come along I go to this market and I I and pay attention to this that she wants to withdraw 100 ether so what she does is she deposits 100 if inside the smart contract the market and what Market does it actually gives Alice hundred shares of yes and 100 shares of no so if Alice actually believes that this assertion is going to be finalized and at the end of the day her ether is going to get out of the bridge but she would do so she would keep the gestures for herself because it's a bet against the assertions being finalized and she would get away there are no shares right out of the no shares but she's not going to do that and I tell you why what she does is she actually keeps uh the gestures for herself at the Notions for herself and she's gonna give the yes shares to David who's running the orbits from validator so she goes to David and she's like hey I know that you're already validating the orbits from chain and David doesn't care about this withdrawal at all she doesn't even he doesn't even know what that is so Alice is like I am giving you these hundred no shares is a bet against this assertion number 10 is going to be finalized or not and I'm giving it to you for a discount or bonus so you can give me 99 cents per shares so at the end of the day you pay 99 ether and if it's going to be finalized you can always go back to the market and you can redeem it 400 East so Bob's gonna profit right so yeah um sorry Dave is going to pray I was keeping saying Bob right sorry about that so I'm in debut yeah so so Dave is going to profit right so he's willing to do that that's fine so what she does with the no shares that she kept for herself now she can actually go to Cairo who has the liquidity but she doesn't know what's going on on arbitrome chain and Alice would be like hi I'm willing to trade my ticket with you this is a ticket it's worth 100 if it belongs to me now but I can sell it to you and I know that you don't have any idea about this assertion number 10 you don't know if it's going to be finalized or not that's fine you don't have to do anything I provide insurance so what I do is I'm gonna give hundred no shares to you for free so in any case if the assertion is going to be finalized and my withdraw is actually confirm what I do is what you can do is you can go to the market and you can redeem your you can go to the outbox and then you can redeem your ticket for 100 East and if no if there's a dispute happen and these assertions happens to be like uh not finalized what you can do is you can go to the market and you can redeem your no shares for 100 each so in any case Alice is ensuring Carol so Carol would be able to do the trade with her there's no risk for her so this is great this is the best solution that I I guess we have come up with and for the implementation this is a work uh under progress so what we did so far is we modified arbits from Nitro to support our Solutions and we provide measurements we fully implemented solution three so far it's a proof of concept so what I did was I implemented an L1 Market it's really like a vending machine as I said so there's no bookkeeping or anything and we modified the outbox so that it would support our Market and for the solution for the prediction Market one it's still under progress but we modified the roll up and outbox more contracts uh so uh there could be prediction Market friendly okay so I'm gonna walk you through the the protocol of solution three how it works and how what what are the functions that we added to the product the Arbitron protocols so let's say Alice wants to do a withdraw so she puts her a withdrawal transaction inside the Inbox and then what she does this is the function that we added to the outbox she wants to participate inside the market so Market needs to know that she actually locked up her her ether inside the market so what Alice needs to do first is she has to go to the outbox and cause the transfer spender function with what basically it does is it it transfer her exit her withdrawal to the market smart contract so it's like it's collateralizing her exit and then once that's done she can go to the market and she can actually open a market on her exit and Market would check if Alice has really deposited her exit inside the market or not and if yes that's fine she can open a market then the market is open for some time until there's a trade Bob comes along he's a Trader he is willing to trade it with Alice what he does is uh he submits a bid that actually is greater than what is Alice as Alice is asking for and that that's when the trade occurs so the trade happens everything gets settled down but Market does it first gonna first is gonna send the East back to Alice so Alice is happy she got her ether and then what it does is because it's owning the exit now what it can do is it it can actually go inside the outbox and change the owner of this exit so it reached inside the outbox and it changes the owner to the ball so now Bob owns the exit we wait for seven days and then what happens is he can now go to the outbox smart contract execute his withdrawal transaction and then because he's the owner the bridge would send 100 East back to him so easy peasy everyone's happy and then we run some measurements too to find out how much at one gas it would cost us to run this function so it turns out it's really cheap so for transferring the spender inside the output smart contract it's around 80 uh six K and it's really like the most expensive one because it's the like the it's the first transferring of spender so it's actually you're paying for creation of a mapping so the because there's a mapping that keeps track of all the owners of an exit so this is really expensive the first one is really expensive but the LA the second one and the third one I guess they were around like 40K away which was really great and for opening the market we had to pay around 300K and for for submitting the bid uh I had to pay around 100K and then for executing the transaction it cost 90k and that sums up the talk uh I I hope you enjoyed it it's really a work under progress so uh the repo is not really public yet but I urge you to reach out to me on Twitter if you need to learn more we're gonna submit it somewhere soon and the repo will be public