Offchain Labs Co-founder: Why I Still Believe in Optimistic Rollup

Written by: Ed Felten, Co-founder of Offchain Labs

Original Title: “Why I'm Still Optimistic about Optimistic”

Compiled by: Luffy, Foresight News

Arbitrum is an Ethereum scaling protocol that uses Optimistic Rollup. People often ask us why Arbitrum chose Optimistic and whether we expect Arbitrum to switch to ZK proofs. I have previously answered this question, but that was almost two years ago. Here are my current personal views, which others may disagree with.

When designing systems, I firmly believe in pragmatism. We should not become enamored with a particular technical approach and apply it at all costs; instead, we should ask which approach best meets the needs of users and developers. The best approach may change over time, and if that is the case, we are willing to adapt.

We chose Optimistic for Arbitrum out of pragmatic considerations, and I believe that Optimistic proofs are still a better choice than ZK proofs, as they better meet the needs of users and developers. Simply put, Optimistic is cheaper, simpler, and more flexible than ZK. I will elaborate on these claims one by one below.

That said, if circumstances change and ZK becomes a better choice, I believe Arbitrum should change. However, I do not expect that to happen anytime soon.

Optimistic is Cheaper

The beauty of Optimistic proofs is that the proof cost is always zero for honest parties. In common cases, no evidence is needed because only true statements are published and are never questioned. If there is a challenge, resolving the challenge incurs some cost. However, every dishonest party will lose the challenge and forfeit their staked shares, which can be used to pay for the challenge's cost.

Optimistic protocols rely on multiple parties executing so they can verify any statements made about execution results. In other words, the chain needs to have nodes. But any chain with significant utility will have a large number of ordinary nodes run by users or infrastructure providers to support the chain's activities. These nodes naturally act as watchtowers for the Optimistic protocol.

In contrast, ZK requires generating cryptographic proofs for each statement made, and the proofs must be verified on Layer 1. Over time, ZK researchers have reduced the cost of generating these proofs, but it can never be reduced to zero.

In fact, the cost of ZK proofs is quite high compared to Optimistic execution. If a smart contract executes a bitwise AND operation, each validator in the Optimistic system will only perform the bitwise AND operation. ZK provers need to execute the bitwise AND instruction and then perform a large number of expensive cryptographic operations to prove the result of the bitwise AND instruction. If Alice and Bob go to buy fruit, and Alice buys a grape while Bob buys a grape and a watermelon, then Alice's cost will always be lower than Bob's.

In both Optimistic Rollup and ZK Rollup, ordinary nodes need to execute each transaction to understand the evolution history of the chain, so this part is no different.

So, Optimistic is cheaper.

Optimistic is Simpler

In software engineering, especially in security engineering, simpler is better. Complexity increases security risks and makes everything slower and more difficult.

There is no doubt that Optimistic proofs are simpler than ZK proofs. Optimistic proofs are easy for developers to understand, while ZK proofs rely on complex mathematics and obscure and subtle cryptographic theorems that few people understand. Even professors who teach cryptography must struggle to understand ZK proof systems.

Optimistic is More Flexible

Proofs are necessary for any L2. But proofs are not the only thing users and developers want. They want new features, and these features can be built more easily and quickly on Optimistic systems.

A good example is Arbitrum Stylus, which allows developers to write smart contracts using general-purpose languages like Rust and C++ and run these programs in a WASM virtual machine, which is fully composable with EVM contracts on the same chain. Building features like Stylus is challenging and requires integrating two virtual machines into a seamless system.

One reason such features can be built in Optimistic systems is that Optimistic implementations can use standard programming languages and tools, making software development easier. In contrast, ZK requires different programming tools, either manually building ZK circuits or using certain intermediate compilers to simplify everything into circuits. Custom tools and programming methods are always slower and more cumbersome, which means the overall system's development progress is slower.

The simplicity of Optimistic systems translates into greater flexibility and faster evolution.

Finality Time is the Same

People often inquire about the finality time of Optimistic Rollup and ZK Rollups, and the answer is that they are the same.

A transaction achieves finality when the result of the transaction is completely determined and all participants in the protocol know the result. Rollup chains, whether Optimistic or ZK, operate in two phases: first, the sequencer publishes and records the sequence of transactions that have reached the chain; second, the execution settlement layer sequentially computes and proves the results of executing the transactions. Finality is achieved when a transaction has a final position in the transaction sequence, at which point the result of the transaction is entirely determined by the finalized transaction sequence, and everyone knows that result.

Because finality is determined by the output of the sequencer published to Ethereum (in this respect, the Optimistic and ZK processes are the same) rather than the prover, Optimistic and ZK systems exhibit exactly the same finality behavior.

Cross-Chain Communication Time

ZK has an inherent advantage in the latency of cross-chain communication, which is how long it takes for a contract on one chain to send a message to a contract on another chain without trust.

Cross-chain transfers of alternative assets (ETH or tokens) are typically conducted through fast bridging services, which do not rely on Optimistic proofs versus ZK proofs, so ordinary users will not see any difference in cross-chain asset transfer times.

For other types of cross-chain messages, ZK can be faster because ZK chains can checkpoint their state to the parent chain (i.e., Ethereum for L2) more quickly than Optimistic chains. This means that if the sending chain uses ZK proofs, trustless cross-chain messaging will be faster for use cases other than asset transfers.

It is still unclear how significant this difference is. Today, the vast majority of cross-chain activity is asset transfers, and the user experience does not differ much.

Conclusion

For me, the answer is clear: the advantages of Optimistic (low cost, simplicity, and flexibility) outweigh the advantages of ZK (speed of non-asset transfer cross-chain functionality).

That is why Arbitrum continues to use Optimistic proofs.