Thread by @hugohanoi

Debunking Ethereum "Rollups"

Several Ethereum people commented that I was wrong about Rollups in my previous Ethereum thread.

This holiday, let’s have some fun and debunk them. 1/

https://twitter.com/hugohanoi/status/1465168198181945351

Prior to Rollups, Ethereum had something called Plasma.

Plasma was hailed as THE solution to Ethereum’s scaling woes, but it died 2 years ago without much fanfare. @Cointelegraph had an article about it here. 2/
cointelegraph.com/news/did-ether…

So what are Rollups?

Rollups are Ethereum’s new scaling hope. The basic idea is to bundle up a bunch of transactions in a layer 2 (L2) sidechain, execute them on L2, and then store them onto the L1 chain in a highly compressed form, skipping all the computation. 3/

There are 2 flavors: Optimistic and ZK. Although most of the money seems to be going to Optimistic projects.

Optimism raised 25mil (from who else, but @a16z), while Metis raised 100mil just this year. 4/

The official Ethereum docs predict rollups will deliver up to 10-100x scaling improvements. 5/
ethereum.org/ig/developers/…

Vitalik also claims that 100x scaling improvements are “expected to be the norm”. 6/
vitalik.ca/general/2021/0…

If it sounds too good to be true, that’s because it is.

BS #1: Anyone can be a rollup block producer/verifier

7/

Wading through ETH “optimistic” land, you’d be hard-pressed to find anything that details the requirements for running a rollup block-producing node (“sequencer”/“aggregator”) or a fraud-detection node (“verifier”).

Here is the only one I could find. 8/

research.paradigm.xyz/rollups

Let’s do some quick math:
(a) Running a L1 Ethereum full node is already prohibitively expensive for most people, leading to the reliance on Infura. Yet, a L2 sequencer/verifier needs to be both a L1 and a L2 full node. 9/

(b) Compared to L1, rollups are expected to handle at least 100x more transactions, which means L2 full node hardware will need to be beefed up even more.

What does this mean? 10/

It means that if L1 Ethereum is centralized, expect L2 Ethereum to be orders of magnitude more centralized.

But in Ethereum literature you keep seeing this vague idea of how block production can somehow be made decentralized in a distant future. Typical engineering hopium. 11/

Eventually even Vitalik admitted to this fact in his “Endgame” (I imagine much to the horror of his followers): that block production will be centralized.

*Read: Vitalik’s “high chance” = for certainty. 12/
vitalik.ca/general/2021/1…

BS #2: ZK rollups will be better
In fact, ZKPs are known to be highly computationally expensive, meaning ZK rollup block production will likely face similar centralization pressure, if not higher.

It is the classic space-time trade-off. ZK isn’t really a scaling solution. 13/

BS #3: It’s just a footnote

It turns out that when you centralize crucial aspects of a consensus system, you’ll be able to magically solve all problems, large or small. 14/

It was the same deal with their Random Oracle assumption in Gasper design (ETH2). “We will take this randomness for granted”.

Major architecture decisions with massive ramifications are just tiny little footnotes. Genius. 15/

https://twitter.com/hugohanoi/status/1465162037441433602

The Ethereum counter-argument would be: “But we have fraud proofs! Even if block production is centralized, the sequencer can’t misbehave.” 16/

First of all, the fact that your system is centralized alone means that it already fails all sorts of safety tests. Fraud proofs or no fraud proofs.

It means your system has a chokehold that could be readily exploited. 17/

BS #4: fraud proofs solve everything

Ethereum and PoS people have this weird, almost kinky obsession with finding “bad guys” and punishing them heavily for not following rules. 18/

As I said again and again, this is not a great foundation to build on - since you can’t just assume bad guys are actually bad guys, and not because someone or something made them look like bad guys. Punishment sets up all sorts of perverse incentives. 19/

https://twitter.com/hugohanoi/status/1465862136962289671

The more heavy your punishment, the more perverse it would likely become.

It’s like getting the death penalty for jay-walking. Sure you’ll deter jay-walking, but criminals will start trying to frame others for jay-walking just so that you will kill people for them. 20/

If a state actor brings down the sequencer and causes L2 to clog, is the sequencer bad? Because he allows the state to attack him?

21/

Using punishment as the panacea and replacement for real engineering is such utter BS. Just make large number of assumptions and let this fuzzy game theory stuff solve problems for us. But this is the norm in Ethereum/PoS la-la land. 22/

Random musing: revenge is a messy business. True in real life, truer in code.

It turns out that “do unto others as you would have them do unto you” is quite hard to translate into code. 23/

Similarly, replacing the wet, complex legal system developed over hundreds of years with some 20-year-olds’ naive ideas of what justice is is a tricky proposition.

What happens to plausible deniability?
To witnesses and credible evidences?
To jury and the right to trial? 24/

All of that is replaced with cold, hard code. Vitalik and co being judge, jury and executioner. Playing God basically.
What could go wrong? 25/

Back to fraud proofs.

Because of the way rollups are constructed, it is possible that rollups’ entire fraud detection scheme and game theory don’t work out at all.

How so? Let’s get a bit technical and compare rollups to Bitcoin’s Lightning Network (LN). 26/

In LN, the way L2 is pegged to L1 is through a 2-of-2 multisig.

Meaning, fundamentally LN payment channels are backed by a base layer contract between 2 counter parties.

In contrast, rollups bundle up thousands of transactions between totally unrelated parties. 27/

LN’s scaling gains come from aggregating repeated transactions between the same 2 parties.

While rollup’s scaling gains come mainly from bundling transactions from many random people into a single contract, regardless of whether they have anything to do with one another. 28/

Another way to think about it is that while LN compresses “frequency”, rollup compresses “people”.

This has some interesting consequences, one of which is Tragedy of the Commons. 29/

If you are a party in a 2-of-2 contract, you have every incentive to watch closely what your counter party is doing.
But it is not the same if you are only a party within a large group of people. Why should YOU be the one paying for the cost of playing cops for EVERYONE ELSE? 30/

A reminder: being a rollup verifier ain’t cheap. You need almost the same reqs as a sequencer, L1+L2 full nodes & all.
The only way this could work is that the payoff from catching “bad guys” is so great that you would gladly volunteer to be the symbol of civic excellence. 31/

But this is far, far from being guaranteed. Actually, an attacker’s expected payoff is high if he's willing to lay low & time his attacks wisely, combined perhaps with occasional network-wide probing attacks.

The consequence of all this is the classic Tragedy of the Commons. 32/

Fraud detection in rollups belongs to everyone, hence it belongs to no one. It’s entirely possible that rollups will end up having no verifiers at all. 33/

While I also much prefer for LN to eventually get rid of punishment in favor of eltoo (it’ll result in a much cleaner architecture and simpler security model to reason about), the current LN architecture is under-appreciated for its ability to keep damage local to the 2-of-2. 34/

One more difference.

Punishment in LN works for the victim: the wrongdoer pays the victim directly for the damage.
Punishment in rollups, however, does not: the wrongdoer pays anyone who can detect fraud, but most likely it won't be the victim. 35/

From the POV of a normal user, I wouldn’t feel safe at all with rollups. Sure, someone is getting compensated for potential mishaps, but it’s not gonna be me. The system is not working FOR ME.

Why would I want to put my money down in such a system? 36/

BS #5: PoS will make rollups better

As mentioned above, L2 rollups have massive centralization pressure already, but Ethereum’s transition to PoS will exacerbate it. 37/

Let’s look at the fee dynamics between L1<>L2 in a PoS system.

L1 validators earn fees via staking.
L2 sequencer also earns fees via staking, but potentially a lot higher given the 100x more transactions. 38/

What’s likely to happen: the biggest L1 validator will take over L2 sequencing as well. After all it doesn’t cost anything to stake. If you're already halfway to meeting the reqs of L2 sequencing & the L2 fees are lucrative, why would you leave money on the table? Being nice? 39/

Note that this dynamic can also happen in PoW but to a much smaller extent: miners can in theory become large LN nodes, earning fees on both layers.

But the thing is that miners face constant selling pressure, not to mention other risk factors. 40/

https://twitter.com/hugohanoi/status/1469748731616514049

PoW miners often don’t have the luxury of sitting on the bitcoin they mine/putting them in contracts with long lockup periods. But with PoS you can absolutely do this since there’s no selling pressure, stakers literally sit on their profits or re-stake the profits right away. 41/

They only need to decide whether to re-deploy their profits on L1 or L2.

If you understand how compounding works, you’ll understand why this is a fatal flaw. 42/

Here is the asymmetry in PoS staking:

Short-term cost (paid in time)
Permanent profit

Put permanent profit back into short-term cost. Get even more permanent profit. Repeat to infinity. 43/

PoS’s playing field is already heavily tilted in favor of the rich holders in L1.

L2 rollups tilt it much further by levering up the compounding effects of staking. Which points to further centralization pressure. 44/

Last but not least, all of this has been entirely predictable.

My original comment RE: rollups was that it represents a shameless 180-degree from the foolhardy way Ethereum initially embarked on. 45/

Bitcoiners told Vitalik early on that having computation or Turing-completeness on-chain is nonsensical & wouldn't scale. You went ahead & did it anyway, only to come back years later forced to move them off-chain due to high fees & threat of shitcoin challengers? Get a grip. 46/

BS #6: Bitcoin and Ethereum face “the same” scaling challenges

Here is one of their responses to the above critique.

“Look, Bitcoin has on-chain computation too!” (in the form of opcodes) 47/

https://twitter.com/ercwl/status/1465241437629566976

“Because Bitcoin has opcodes, Bitcoin and Ethereum have the same scaling challenges!”

@DZack23 seems highly frustrated because he has written an article titled “How Not to Critique Ethereum” and apparently I have sinned.

Here is the relevant section. 48/

https://twitter.com/DZack23/status/1465451609081757697

These arguments are disingenuous on 2 counts.

First, Bitcoin does have opcodes. But the direction has been unwaveringly in the direction of ruthlessly cutting down these opcodes over the years. 49/

For example, removing OP_CAT, OP_DUP or anything that might accidentally enable Turing-completeness.

More importantly is the evolution of scripts: P2SH > SegWit > Taproot > Scriptless Scripts

These are all trending in one clear direction: fewer and fewer opcodes on-chain. 50/

Second, let’s look at the actual computation footprint of Bitcoin and Ethereum.

Bitcoin’s blockchain size, which includes all scripts in existence, grows linearly.
Bitcoin’s only “state” is the UTXO set, which is about ~5Gb and actually trending down, not even growing. 51/

In contrast, Ethereum’s chain & state data both grow non-linearly. Monstrously. In particular, Ethereum’s state chain grows even faster than the blockchain itself!

Chart extrapolated from @BitMEXResearch’s article. 52/
blog.bitmex.com/bitcoin-vs-eth…

So when Ethereum people claim that Bitcoin and Ethereum face “the same” scaling challenges, either they need to retake their middle school algebra, or are being extremely disingenuous. 53/

Furthermore, as an example of something Bitcoin could “learn” from Ethereum, @ercwl cited a scaling proposal by @gakonst in Scaling Bitcoin 2019. 54/

https://twitter.com/ercwl/status/1465249278784327684

Among the proposal is the suggestion that Bitcoin should switch to a fixed denomination, so every UTXO would be fixed to 1 sat forever, for example. Uhm, how about no? 55/

Not only that, this proposal was actually Plasma Cash - check note - the project that got canned 2 years ago. And this is an example of something Bitcoin could learn from? Are you fucking serious?!?

And people wonder why it’s hard to take Ethereum research seriously. 56/

If you feel this shit is tiring, it’s because it is.

The saying “it takes more energy to refute BS than to produce it” is nowhere more relevant than in Ethereum. 57/

Expect more BS from Ethereum in the future, to cover up their past lies and mistakes.

The difference this time is: their lies are now documented, and their track record is clear for everyone to see. FIN.

https://twitter.com/hugohanoi/status/1465171120844197894