Thread by @expctchaos

0/ similar to the sequencer, a centralized prover in #zk-rollup systems can introduce centralization & single-point-of-failure risks ⚠️

a 🧵 on a prover outsourcing mechanism proposed by @Scroll_ZKP (0/18) ✨👇

1/ #zk-rollups demand an off-chain #prover to generate a succinct proof for a batch of transactions. However, proof generation for complex smart contract transactions can be expensive, leading to several limitations in functionality

2/ firstly, let's dive into the typical rollup tx flow ⬇️

⚙️ Users send transactions to a centralized #sequencer on #L2

⚙️ The sequencer executes transactions, packs (& orders) them into a #rollup block

⚙️ Centralized #prover generates a succinct proof of the sequencer's batch

3/

⚙️ The sequencer submits proof to #L1

⚙️ L1 smart contract verifies proof & updates the state

4/ but this centralized prover set-up comes with certain centralization issues ⬇️

🚧 Limited computational power
🚧 Limited community participation
🚧 Potential MEV attacks and transaction denial

5/ to mitigate these problems, @Scroll_ZKP (a bytecode-level a.k.a. type 2 #zkEVM rollup) proposed a #L2 proof outsourcing mechanism in order to decentralize the prover function

6/ @Scroll_ZKP suggests engaging "miners" (referred to as rollers) to generate proofs in a permissionless network & reward them based on their proving work. This encourages rollers to contribute computational power in the form of "volunteer computation"

7/ to become a roller, one will have to stake $SCR tokens in a smart contract to become a legitimate roller & generate proofs. An initial reputation ratio is granted, proportional to the deposit.

8/ consequently, the (centralized) sequencer selects multiple rollers for each block based on their reputation ratio

9/ once the proofs are generated, the sequencer will verify the proofs after receiving them from rollers:

⚙️ If roller sends an invalid proof, she will be fined.

⚙️ If roller sends a proof later than time T, her reputation ratio will be decreased

10/

⚙️ If roller sends a valid proof within time T, the roller has a chance be rewarded

⚙️ The sequencer will aggregate proofs and upload the proofs to L1 for verification

11/ in this scheme, we use reputation ratio to balance a roller’s stake and computational power. The stake determines the upper bound of a roller’s probability to be chosen and the reputation ratio is a proxy for the roller’s real computation power

12/ this mechanism ensures fairness and encourages rollers to generate proofs for different blocks in parallel

13/ overall, decentralizing the prover like this comes with a number of benefits

✅ Larger circuit support & shorter confirmation time:

miners & mining pools will be incentivized to improve the efficiency of hardware accelerators...

14/ ... we can leverage this huge computational power to support larger circuits and enjoy a shorter confirmation time at the same time.

15/

✅ Fair distribution for users and easier support other features

L2 outsourcing is a good way to distribute the tokens to the community, as the network becomes more decentralized...

16/ ...and a permissionless roller network also allows for additional features in the future. For example, the rollers could store some transaction data off-chain, also turning into an in-protocol #DA layer

17/

✅ Enable new business models & off-chain applications

It allows for a lager range of complicated #zk apps on-chain (e.g. #zkKYC) as general off-chain computation can outsource the costly proof generation to a powerful roller network, while enjoying public verifiability

18/ definitely an innovative approach to address a core issue rollup architecture is facing today that will likely be adopted by #rollups beyond @Scroll_ZKP

a few #L2 folks that might be interested in this thread 🫶

@Swagtimus
@apolynya
@pseudotheos
@daddysether
@kunalgoel
@redvelvetzip
@hmalviya9
@georgethms1
@TheDeFISaint
@AlphaInsiders
@0xDinoEggs
@ChainLinkGod
@dankrad
@antiprosynth
@0xbilly

1/2

@crypto_condom
@Crypto_McKenna
@Subli_Defi
@ShivanshuMadan
@AltcoinPsycho
@DAdvisoor
@Slappjakke
@RyanSAdanns
@TrustlessState
@3house_io
@Layer2NewsDAO
@0xgoku_
@toghrulmaharram
@bitsplaining
@Layer2_Master
@bkiepuszewski
@CryptoMaestro

2/2