Let’s Talk — Layer 2 Solutions

Introduction

In recent times, the usage of layer-2 solutions has been on the rise. Since the start of April 2021, the number of transactions happening on the Polygon Network (a layer-2 solution) has increased from 200k per day to 6mn on a daily average (shown in the chart below), peaking at 9mn in the middle of June. This also signifies a jump from ~5% to ~85% network utilization in nearly 5 months. At the same time, the total number of unique addresses on the Polygon Proof-of-Stake (PoS) chain has grown from 200k to 86mn (a 430x increase!), with the daily active addresses going up from 9k to 360k. This is just one example of a layer-2 solution that has taken off. With the launch of other off-chain scaling solutions, such as Optimism and Arbitrum, on the Ethereum mainnet, the number of users on layer-2 solutions is only going to increase.

Why have layer-2 solutions started burgeoning? The reasons are twofold:

1. Transaction throughput and speed — the throughput on Ethereum, which has been the principal settlement layer for most of DeFi and NFTs’ transactions, has been roughly constant, ranging between 1.3mn and 1.7mn transactions per day. As the number of transaction requests increases at layer-1, user experience decreases due to fixed and slow transaction speeds.
2. Transaction costs — the limited transaction speeds have a cascading effect on costs, resulting in higher transaction fees paid by the user due to the auction-based transaction fees model adopted by layer-1 solutions.

Layer-2 technologies help augment the practicality of the foundational blockchain layer (layer-1). They help tackle the above two issues without much loss of decentralization and security. Thus, the main objective of layer-2 solutions is to improve transaction speed and transaction throughput on the base layer and consequently decrease transaction costs. Furthermore, layer-2 solutions also enable use-cases that require higher transaction speeds, such as blockchain-based gaming, high-frequency trading, etc.

Working of Layer-2 Solutions

Generally speaking, transactions are submitted to layer-2 nodes instead of being submitted directly to layer-1. The layer-2 instance then batches them into groups before anchoring them to layer-1, after which they are secured by layer-1 and cannot be altered. The details of how this is done vary significantly between different layer-2 technologies and implementations. The major implementations include the following:

1. Channels
2. Plasma
3. Sidechains
4. Rollups

Channels

Channels allow participants to transact X number of times off-chain (layer-2) while only submitting two transactions to the network on-chain (layer-1). The first transaction opens the connection for the transaction pipeline, whereas the second transaction closes it, therefore, essentially bundling up all the transactions performed during any session as only two transactions. The advantages of such an approach are 1) load reduction on the layer-1 blockchain, and 2) transaction cost reduction for the user.

Working of Channels Explained

Participants must lock a portion of Ethereum’s state, like an ETH deposit, into a multisig contract. A multisig contract is a type of contract that requires the signatures (and thus, agreement) of multiple private keys to execute.

Locking the state in this way is the first transaction and opens up the channel. The participants can then transact quickly and freely off-chain. Consensus inside the channel is achieved when all the channel participants unanimously agree (majority-based consensus is also possible) to the final state of the channel. When the interaction is finished, a final on-chain transaction is submitted, unlocking the state. The main chain checks the validity of the state update by verifying signatures and final balances, thus making it impossible to try to exit from an invalid state.

Further explanation: since all exchanged transactions are equally valid as far as the blockchain is concerned, state channels need a mechanism to ensure that the latest off-chain state is the one that ultimately gets settled on the main chain. Thus, if a party attempts to unilaterally close a channel, other parties in the channel have a period of time — a “dispute window” — in which they have an opportunity to submit a more recent state, thereby proving that fraud was attempted. Once the fraud is proven, the contract handles the resolution process, which typically involves punishing the guilty party by slashing their deposited funds (though one could also simply update to the valid state and proceed accordingly).

Types of Channels

1. Payment Channels — Payment Channels are simplified channels that only deal with payments. They allow off-chain transfers between two participants, as long as the net sum of their transfers does not exceed the deposited tokens.
2. State Channels — State Channels are very similar to the concept of payment channels, but instead of only supporting payments, they also support general ‘state updates’. Thus, State Channels form the superset. State channels allow for potentially arbitrary state transitions to happen off-chain, opening up the possibility of performing scalable, low-latency computations off-chain with similar security to on-chain transactions. State channels also help preserve user privacy. Transactions within a channel are only known by the participants in the channel and get instant finality. Users don’t have to wait for each transaction to confirm onto the blockchain because each signed transaction abides by the network rules.

Evaluation

Advantages

• (Almost) instant withdrawal/settling on mainnet
• Extremely high throughput is possible
• Lowest cost per transaction — good for streaming micropayments
• Transitive channels can be created (if A->B and B->C exist, A->C is possible) using Hashed Time-Locked Contracts (HTLCs), a technique that can allow payments to be securely routed across multiple payment channels

Disadvantages

• Time and cost to set up and settle a channel
• Exit Problem — long exit times if a valid exit state is not reached by members
• Need to periodically watch the network (liveness requirement) or delegate this responsibility to someone else (watchtowers) to ensure the security of your funds
• Lockup of funds in open payment channels
• Closed participation and censorship
• Cannot be used to scale general-purpose smart contracts
• Difficult to set up N-to-N channels (due to Exit Problem)
• Only safe to use when the layer-1 isn’t censored by the block producers
• Need for 100% availability of all the participants involved

Projects using State Channels

Connext Network, Raiden Network

Plasma

Plasma is a construction that enables “non-custodial” child chains (nested blockchains), which borrow the security from the main chain (definition of a child chain). Plasma uses a combination of smart contracts and cryptographic verification (fraud proofs) to achieve higher throughput and low transaction costs in a trustless and secure manner, by offloading these transactions from the main Ethereum blockchain. These Plasma chains (or child chains) periodically report back to the main chain and use it to settle any disputes.

The design goals of Plasma include:

1. World Computation — data is committed to the root chain (Ethereum) and in the events of Byzantine behavior disputes, frauds are proven and rolled back.
2. Trust Minimization — the primary risk involved in Plasma is around chain halting and blockspace availability, which are mitigated by selecting a good parent chain.
3. Payment and Ledger Scalability — more throughput and faster computation time are achieved due to the nested architecture.

Why Plasma Chains?

Building a two-way peg has been the biggest challenge in designing sidechains (or Plasma chains) with minimal trust assumptions. Creating a peg from parent chain to sidechain is easy to implement: simply lock funds into a contract on the parent chain. The backward peg, which is a sidechain to the parent chain, however, is more difficult to implement as the sidechain is “easier” to attack/manipulate than the parent chain. Various methods have been proposed to resolve this:

1. One-way Peg — This prevents anyone on the sidechain from being malicious and stealing funds on the parent chain. This design is currently being suggested for the beacon chain in Ethereum 2.0, whereby ETH is burned on the parent chain (the PoW Ethereum chain) and simultaneously minted on the sidechain (the PoS beacon chain) as BETH, with no way of doing the reverse.
2. Federated Pegs — This design uses multiple operators to control the reverse peg (centralized, custodial). The operators decide when funds can be unlocked on the parent chain.
3. Plasma — Plasma allows for an almost trustless two-way peg. It accomplishes this through the use of an exit game, which makes use of fraud proofs implicitly or explicitly, relying on variations of challenges that must be issued within a given timeout. The caveat here is the trust assumption that the parent chain has an honest majority of block producers. This is why Plasma isn’t completely trustless or completely non-custodial.

Working of Plasma Explained

1. Plasma chains are initialized by submitting smart contracts to the parent chain. These chains have special rules defined based on the application that they are being used for (can be thought of as dApps on Ethereum).
2. Once smart contracts are deployed, computation takes place in a localized environment.
3. Post a batch of computation processes, periodic commits (Plasma chain block hashes) are submitted to the parent chain.
4. If any of the data/blocks submitted to the parent chain is invalid according to the consensus rules, fraud proofs of state transitions are submitted by the validators to roll back the state of the main chain.

In Plasma, the child chain can’t steal users’ funds or prevent users from claiming their funds back on the main chain, given that no consensus rules have been broken.

Periodic Commits

Periodic Commits work in the following manner:

1. The Plasma chain makes periodic commits to the main chain.
2. Only the block hashes/headers are committed to the main chain (low size). The submission is a commitment to the blockstate as well as ordering on the main chain.
3. The root chain doesn’t perform computation unless any disputes are raised. However, data availability is needed to prove fraud (which is also a problem in non-global computation).
4. A Plasma chain needs to only watch all its parent chains and no other chain, therefore, streamlining the process of blockchain scalability.

Fraud Proofs

The communication between the child chains and the root chain is secured by fraud proofs implemented by the child chain. Fraud proofs are used by Plasma chains to file a complaint to its parent chain.

These proofs use an interactive funds-withdrawal protocol. In order to withdraw a certain amount of funds, an exit time is needed. The exiting party must confirm the outputs via the Unspent Transaction Output (UTXO) model requesting a withdrawal. Network participants can then submit a bonded proof that has to be confirmed and tested if any funds have been spent. If the event appears to be wrong, it is treated as fraudulent, and the confirmation is canceled. With time, another bonded round allows the withdrawal to happen, bonding to state before a committed timestamp. In case of attack, participants can quickly exit and save their costs, ensuring security within the system.

Types of Plasma Chains

1. Minimum Viable Plasma (MVP) — MVP is a design for an extremely simple UTXO-based Plasma chain. MVP enables high-throughput payment transactions but does not support more complicated constructions like scripts or smart contracts. In MVP, users need to sign a signature before making a transaction, wait to see the transaction included in a valid block, and then sign another signature. These second signatures must also be included within a plasma block, reducing block space available for more transactions.
2. More Viable Plasma — It is an extension of MVP that removes the need for confirmation signatures by changing the procedure for fund withdrawals. The ordering of each withdrawal becomes based on the position of the youngest input to the transaction that created an output, rather than in the order based on the position of the output being withdrawn (which is the case with MVP). OMG Network is using More VP (1K TPS, 3x cheaper, 99% energy efficient, ETH secure + watchers).
3. Plasma Cash — Plasma Cash is a Plasma design primarily built for storing and transferring non-fungible tokens. It is highly scalable because users only ever need to keep track of their own tokens, but at the same time coin proofs are massive. Each block has a ‘slot’ for each coin (unique deposit). When a coin is spent, a transaction proof is recorded in that coin’s respective slot in the block. Coin defragmentation research to support FTs is going on currently. Research is being done in the domain of ‘coin defragmentation’ to support fungible tokens. Loom Network (2017) is utilizing principles of Plasma Cash for its scaling solution (CryptoZombies, Axie Infinity).
4. Plasma Debit — It is similar to Plasma Cash, except every token is a payment channel between the user and the chain operator. The channels can be transferred just like a Plasma Cash token.
5. Plasma Prime — Plasma Prime is a new design that makes use of RSA accumulators to solve the problem of large history proofs in Plasma Cash.

Evaluation

Advantages

• High throughput, low cost per transaction because of elimination of unnecessary data in the main chain (increase in computation power)
• Security of tokens is ensured even in case the Plasma operator proposes invalid state transitions, withholds produced blocks, or stops block production
• Allows (almost) trustless transactions unlike channels
• Compatible with various on-chain scaling solutions such as sharding, varying block sizes, etc.

Disadvantages

• Long waiting period for users who want to withdraw their funds
• The complexity of exit game strategies
• Cannot be used to scale general-purpose smart contracts as it does not support general computation; only basic token transfers, swaps, and a few other transaction types are supported
• Need to periodically watch the network (liveness requirement) or delegate this responsibility to someone else (watchtowers) to ensure the security of your funds
• Relies on one or more operators (centralized) to store data and serve it upon request in case of disputes
• The necessity to provide the full history of the token when it is transferred

Projects using Plasma

Loom Network, OMG Network

Sidechains

Sidechains are “sister chains”, where assets can move between each chain (main and side) but the sidechain has its own consensus mechanism (and thus, a set of validators) which distinguishes how the sidechain achieves decentralization. Sidechains sacrifice some level of decentralization to provide higher throughputs and lower costs at varying levels of security (a well-designed sidechain is even more secure than the main chain!). The image below illustrates sidechains and rollups:

Working of Sidechains Explained

Other than functioning exactly like any blockchain, the sidechains optionally snapshot the block headers to the main chain to prevent forks. The snapshots can provide security against forks even when the validators of the sidechain collude and try to fork out.

If a participant wants to move assets from the main chain to the sidechain, he/she locks the assets on the main chain and provides proof of the lock on the sidechain. To unlock the assets on the main chain, proof of the exit is included in the sidechain block and provided to the main chain.

Evaluation

Advantages

• Established technology, since sidechains are nothing but independent blockchains connected via a two-way bridge
• Support general computation, EVM compatibility

Disadvantages

• Less decentralized, as sidechains have their own validator set
• More prone to fraud, as achieving quorum is easier due to a smaller validator set
• Uses a separate consensus mechanism, which may not be as secure as the main chain’s algorithm
• Invalid state transition problem (assumption taken: 50%+ are honest validators)
• Bridges that connect the parent to the sidechain are often centralized and act as single points of failure

Projects using Sidechains

xDAI, SKALE, Polygon Network (previously Matic)

Rollups

Rollups are a layer-2 solution that perform computation and execution outside the parent chain, bundle together the transactions into batches, and post the data onto the main chain in a compressed and efficient manner. They provide high transaction throughput, low transaction fees, and transparency because of the verifiable batching mechanism used. According to Vitalik Buterin’s article on rollups, “an Ethereum base-layer ERC-20 token transfer costs ~45000 gas, (whereas) an ERC-20 token transfer in a rollup takes up 16 bytes of on-chain space and costs under 300 gas”. This shows that a transfer operation on a rollup takes 150x less fees compared to the fees on the main chain!

Working of Rollups Explained

Rollups publish just enough data on-chain so that any observer can reconstruct the state and detect invalidity. Because of rollups’ inherited security mechanism, users of rollups can transact with security guarantees that their funds will not be lost, double-spent, or misappropriated till the batched data is added on the main chain at some point in the future. This is a defining characteristic of rollups since the smart contracts associated with rollups inherit the security features of the underlying blockchain.

Therefore, to summarize, the key properties of rollups include the following:

• transaction execution occurs outside the parent blockchain
• data or proof of transactions is posted on the parent at the end of the execution cycle
• a roll-up smart contract is deployed on layer-1, which is responsible for enforcing correct transaction execution on layer-2 by using the transaction data on layer-1

Types of Rollups

1. Optimistic Rollups — Optimistic rollups use fraud proofs to verify and ensure that the data submitted to the main chain is not incorrect. These are the same fraud proofs that are being used in Plasma. “Sequencers” are incentivized to publish a batch of state transitions to the main layer-1. This starts a “dispute period” where any party can publish a fraud-proof which shows that the state transitions are invalid. This fraud-proof is stored in an on-chain transaction, and using the proof, the state of the chain can be determined correctly and used to settle disputes. Entities called “verifiers” are incentivized to watch and report fraudulent transactions. Rollups are an effective solution as they scale without adding to the cost, but they introduce new trust assumptions with respect to the “verifier”. However, only one honest verifier is needed for the system to work properly.
2. Zero-Knowledge (ZK) Rollups — In ZK Rollups, “relayers” gather a set of transactions and create a ZK Proof, a validity proof that is stored on-chain. ZK Rollups rely on challenging transactions to tell the smart contract that some data is incorrect, and the block is invalidated as a result. Here, it is impossible for relayers to submit an invalid or incorrect state. The smart contract verifies each state’s transition before it becomes effective. Validation of a block is quicker and cheaper due to the less data that is included.

Optimistic Rollups vs Zero-Knowledge Rollups

Evaluation

Advantages

• Rollups move computation and complete state storage off-chain but keep some data per transaction on-chain
• Optimistic Rollups are EVM compatible
• High throughput and extremely low fees as computation is done off-chain
• More secure as they rely on the main chain’s security
• Research is ongoing to bring smart contract capabilities to ZK Rollups, e.g. Starknet’s ZK language (Cairo)

Disadvantages

• Withdrawal times from layer-2 to layer-1 are high in the case of Optimistic Rollups
• ZK Rollups are not EVM compatible as validity proofs are computation-intensive
• Require additional trust assumptions and economic incentives
• Vulnerable to attacks if the value in a rollup exceeds an operator’s bond

Projects using Rollups

StarkWare, Optimism Labs, Arbitrum, Loopring

Comparison

Conclusion

The world is just starting to adopt distributed ledger technologies, with approximately 1% of the world population interacting with applications built on blockchains and the like. As more and more people recognize and embrace the advantages that Web 3.0 offers, we are going to witness billions of monetary and state transactions on the blockchain every day. To cope up with such a demand, layer-1s would need to deal with the issues related to scalability, such as block size limits, consensus times, and transaction costs. One of the ways this can be achieved is on-chain scaling upgrades such as sharding, but not all chains remain composable post that. The other solution, as mentioned above, is layer-2s and the various customizable flavors that they come in.

Due to the benefits that layer-2 solutions offer with respect to the issues mentioned above, their adoption along with layer-1s is inevitable. As of now, they exist as independent projects aligned with a singular vision of improving the core blockchain that they are being built on. However, we believe in the strong possibility that layer-2s would ultimately merge with layer-1s and exist in a single composable system. The future blockchains would be built with the currently available technology, the on-chain scaling solutions, and the off-chain modular legos, all tightly coupled into fast, secure, cost-effective, and user-friendly worldwide utilities.

Resources

• List of projects that are building layer-2 solutions
• Comparing State Channels with Sidechains
• History of Payment Channels
• Tadge Dryja’s explanation of Channels
• Original research work on Plasma
• Joseph Poon’s explanation of Plasma
• Comparing various types of Plasma
• Introducing Sidechains
• Comparing Sidechains with Rollups
• Information on Rollups
• Vitalik Buterin’s article on Rollups
• Comparison of layer-2s by Matter Labs
• Layer-2 blog by NEAR Protocol
• Consensys article on layer-2s

Author — Abhinav Pathak, Vokkant Thakkar