The Complete Guide to Rollups

Introduction

Vitalik gave us the amazing Incomplete Guide to Rollups. I present to you The Complete Guide to Rollups. 

Ok it’s not actually complete, but it’s a great meme so I’m stealing it. This report only analyzes the design space of rollups on Ethereum and Celestia. I strongly recommend my recent Ethereum report for background. 

I cover the two I’m most familiar with, but there are actually many other teams building here. Polygon (Avail), Tezos, and Milkomeda among others are also in the rollup stack game. Tezos in fact will likely be the first to ship “enshrined” rollups, and Polygon Avail is incredibly similar to Celestia architecturally. 

First, what are “modular” blockchains? It’s mostly a meme at this point with plenty of disagreement, but I’ll define how I use the term for simplicity. Then you can fight over why I’m wrong in my Twitter comments. 

Modular stacks strip apart the following tasks into separate technical components:

• Data Availability (DA) – Ensuring the transaction data behind rollup block headers has been published and made available so that anyone can recreate the state.
• Consensus – At minimum agreement over the transactions and their ordering.
• Settlement – This varies based on the implementation, but tasks can include verifying/arbitrating proofs and coordinating cross-chain asset transfers/arbitrary messaging.
• Execution – Computation taking the pre-state → run transactions → transition to the post-state.

Ethereum can handle each of these. It offers a unified DA, consensus, and settlement layer with general execution. When you transact on L1, Ethereum acts as any monolithic chain does. Alternatively, rollups can handle execution with Ethereum providing DA, consensus, and settlement. 

Celestia only provides DA and consensus. No Uniswap living on L1 Celestia, and no verification/arbitration of proofs by the L1. Celestia has no enshrined settlement layer or smart contract execution. The L1’s functionality is limited to Celestia token transfers and validator set management.

Note possibilities such as Validiums and Celestiums using separate layers for DA and settlement also exist. Any settlement layer could be used so long as it accepts an attestation from Celestia that the data has been made available. 

However, these are not rollups, and they bring meaningful additional security assumptions. This report will focus on actual “rollup” stacks. I’ll break down the economics first, then dive into each stack in depth.

I use a few abbreviations throughout to save your eyes:

• SCR – Smart contract rollup
• ER – Enshrined rollup
• SR – Sovereign rollup

Part I – Modular Economics

I’ve written previously about the importance of L1 value capture (fees and other forms of MEV). Assets which are relied upon for economic security need a high value staked. Revenue provides the fuel to craft attractive monetary policy (real yield, low and predictable inflation, etc.). Value capture → good monetary policy → monetary premium → high economic security. Fees and other MEV kickstart step 1.

Rollup Fees

Let’s analyze a rollup transaction from first principles. This simplified graphic depicts the parts which apply to both Ethereum optimistic rollups (ORUs) and zk-rollups (ZKRs):

1. Sequencer receives and orders transactions. Users quickly get a soft confirmation of their transaction eventually being recorded on L1 (if they trust the sequencer feed). Sequencer is only relied upon for ordering and transaction completion. They’re unable to submit invalid transactions. 
2. Deterministic state transition function takes each transaction and updates the L2 state, creating an L2 block. These blocks can be produced more quickly than L1 blocks. 
3. Every so often a batch of transactions is compressed and sent to the L1. Currently stored as calldata, but eventually rollups will use data blobs. 

Users are charged L2 gas when the state transition is applied, executing their transactions. L1 gas is paid later when the batch is posted. L1 and L2 gas prices vary based on their respective congestion. So the user is incurring costs in two types of gas, and there’s a timing mismatch. Sequencers commit to a transaction and collect L2 fees before they know the full contents of the batch, how well it’ll compress, or what the L1 base fee will be when posted. 

L2s do their best to guess what their L1 cost will be and charge users accordingly. When things are quiet, only a small margin is charged over the L1 cost on average. When rollups become constrained by their own execution environment (and not L1 costs), that margin goes up. Fee market surge pricing kicks in to meter demand. Higher margins correspond to bursts of high local demand.

We clearly see this in Arbitrum’s latest spike, though their margin has been quite stable otherwise. The recent bottleneck was L2 execution (not L1 costs), and so their native fee market kicked in:

We see similar trends with Optimism, though with higher variability:

Rollups’ L1 costs today are primarily calldata. Even for ZKRs, Polygon estimates that posting transaction data to Ethereum will represent ~90% of total costs (which is largely calldata) with ~10% for proofs. With EIP-4844 potentially coming as soon as the Shanghai hard fork next year, those costs plummet. It increases DA throughput and implements isolated EIP-1559 fee markets for Ethereum’s DA layer and settlement layer. An oversupply of DA means fees hit the floor. Later on, danksharding would make DA even more abundant. Rollups with any reasonable activity will significantly increase those profit margins.

Lastly – the figures above do not include any MEV (outside of regular transaction fees). In reality, rollup tokens are able to accrue significant value from MEV (more on this shortly).

Fixed vs. Variable Costs

ORUs post compressed full L2 transaction data (with signatures), L2 state roots, and fraud proofs (only in the event of dispute) back to L1. While the full transaction data is stored in Ethereum’s history, the hash of the transaction data is added to its state. If a fraud proof is delivered, then it can check the inclusion proof against the previously stored hash as part of the fraud proof. 

ZKRs don’t need to post the full transaction data to L1. It suffices to post the state differences (they choose this because it’s cheaper). Imagine Alice and Bob trade 1 ETH back and forth within the batch – ZKRs only need to post the state change at the end (who has that 1 ETH, and who doesn’t) whereas ORUs would need to post each trade. State diffs are enough to reconstruct the state. ORUs must include all transactions in the event they’re needed for fraud proofs. ZKR provers must also include a validity proof with every batching proving that the associated state root is valid. (For more on ZKRs, you can read our previous Pro report on it here.)

SCRs have fixed costs regardless of transaction activity they must pay to Ethereum: 

• State commitments
• Validity proofs (only for ZKRs)

And they also have variable costs which scale with the transaction activity:

• Transaction data (plus signatures for ORUs)

On top of these fees paid to L1, rollups charge surge pricing for L2 gas fees as needed and costs to cover rollup operator expenses. A more detailed analysis can be found here. 

Note the timing/cost tradeoff here. Settling frequently means the L1 gives true finality sooner. However, waiting longer to settle amortizes those fixed costs over more transactions = cheaper transactions for rollup users. Rollups balance settling often enough for safety vs. giving rollup users cheaper fees with lower assurances (pre-confirmations). 

Let’s look at Optimism as an example. For background, Optimism has two smart contracts that sequencers and proposers post to:

• Canonical Transaction Chain (CTC) contract – an append-only log of transaction batches submitted by the sequencer
• State Commitment Chain (SCC) contract – log of proposed state roots which proposers assert to be the result of each transaction in the CTC

Optimism’s cost breakdown looks like this:

Posting transaction batches to the Canonical Transaction Chain (CTC) incurs two costs:

• Variable cost – Calldata gas used by the L1 CTC (transaction batch) submitter which scales roughly linearly with the size of the transaction batch
• Overhead cost – Posting to the CTC also incurs small non-calldata costs

The gas used by posting state roots to the State Commitment Chain (SCC) is pure overhead cost (though note part of this cost uses L1 calldata as well). Splitting them up by variable/overhead you get this:

These overhead costs may be higher than you expected – there are still many inefficiencies to be ironed out in coming months. Optimizations such as Bedrock will significantly improve data compression, and it will drop fixed costs to near negligible. Gas costs per batch could drop from ~280k per batch excluding calldata to ~21k gas per batch. The SCC will be replaced by the L2OutputOracle, and the CTC will be removed. L2 blocks will instead be saved to Ethereum using a non-contract address, greatly reducing the on-chain footprint and minimizing gas costs. (For more on Optimism, you can read our previous Pro report on it here.)

Similarly, Arbitrum incurs gas costs of ~375k per batch which will be significantly reduced by Nitro. (For more on Arbitrum, you can read our Pro report on it here.)

Tying everything together, the below illustration from a great article by Barnabé Monnot depicts rollup value flows:

He also recently spoke on the topic here. 

Base Layer Fees – Ethereum

Ethereum fees are derived from: 

1. L1 Execution & Settlement – Go to L1 Uniswap, and swap some USDC for ETH. 
2. Settlement from Rollups – Rollups post proofs to the L1. Ethereum also handles trust-minimized bridging between rollups and the L1. 
3. DA from Rollups – Rollups post data to the L1 using calldata. 

Fees for isolated monolithic chains are capped at: 

Fees = Throughput x $ users will pay for individual transactions

Modular DA and settlement layers (such as Ethereum) have a higher ceiling as they’re capped at:

Fees = Throughput x $ users will pay for aggregated transactions

A rollup can pay Ethereum a larger single fee to settle many transactions (e.g., a proof securing many blocks, settling many aggregated DeFi pooling transactions, etc.) compared to what a single user can pay for an L1 transaction taking up the same block space. Introducing new fee payers to Ethereum (rollups) with a higher marginal utility per transaction adds value in the long-run assuming sufficient demand. 

However, note that Ethereum’s revenue kinda looks like this today:

Ethereum is a long way from being primarily a settlement or DA layer for rollups. The vast majority of fees paid to the L1 come from native L1 execution:

So while modular base layers are capable of extracting meaningful revenue should the demand arise from rollups, we need vastly more demand before they do so. It’s critical that Ethereum’s rollup fee capture is in addition to its native L1 execution, not reliant solely on it. 

Where that value capture goes from here is a point of debate. Many in the Ethereum and Celestia communities believe DA will eventually be incredibly valuable. Dankrad recently gave his views in a podcast I hosted between him and John Adler:

“Asset… needs to derive its security from some… means of generating yield. And so I see for now only two of these, which are the settlement layer and the data availability layer. I think short-term, we will probably see that the settlement layer still generates much more value.

We’ve seen it already that we have had significant fees on Ethereum in the past, and also some on other settlement layers. But long-term, I believe that the most valuable asset will just be in the data availability, that the block space will become the most valuable asset in the decentralized economy.”

What rollups should be willing to pay for premium DA is an interesting argument. However, the reality is that DA will soon be massively oversupplied between Ethereum scaling and alternative DA solutions. For some context on scale:

Ethereum blocks currently average ~90 KB with calldata ~10 KB of this. The DA supply shock is looming, and rollups will continue to significantly improve data compression. When data blobs get their own fee market and supply < demand, DA fees hit the floor. 

Rollup users will pay higher fees, but the primary bottleneck will likely be the rollups’ own native execution environments (based on current order of magnitude activity and DA bandwidth in EIP-4844). DA will no longer be your primary cost when you go to swap on your favorite rollup. Super cheap fees will drive incremental activity, more rollups pop up, etc. Only when DA is saturated up to the target will the EIP-1559 mechanism kick in, pulling fees off the lower bound. However, rollups have many upcoming optimizations which will increase their currently constrained native execution. If this is used up, that could eventually shift the goalposts closer toward DA becoming a larger cost again.  

For Ethereum to start charging anything meaningful for DA, you need more than 1.3 MB/s (assuming the current danksharding spec) of actual valuable data that demands the highest security. Even if you hit 1.3 MB/s, the overflow can just go elsewhere. Alternatives such as Celestia, DataLayr, DACs, Adamantiums, Polygon Avail and others will offer massive amounts of cheap DA. Only the most secure transactions require full Ethereum security. Also, DA throughput can be safely increased (with more validators), so 1.3 MB/s is not a fundamental limit. 

I’m confident that for at least several years, DA fee revenue will be negligible compared to robust settlement layers such as Ethereum’s. 

Lastly, native smart contract execution can also provide ETH stakers with more value than Celestia – ETH can be used to earn additional yield as a productive asset. In particular, EigenLayer is an innovative solution which will allow for “re-staking” of ETH. ETH stakers will be able to subject their stake to additional slashing conditions. They would secure new applications looking to leverage ETH’s economic security, and their fee revenue would accrue to ETH (very similar to Cosmos’ concept of interchain security accruing value to ATOM).

Base Layer Fees – Celestia

This is where Celestia comes in – the only cost is DA. Rollups handle settlement. In that same podcast, John made an interesting point regarding dYdX’s decision to move from StarkEx to Cosmos. Base layers should accrue as much value as possible for economic security, but economically rational apps want to accrue as much value as possible for themselves. All else equal, they prefer not to pay rent to a settlement layer. DA i