 My talk today is going to be about fast and furious withdrawals from optimistic roll-ups. A little bit about myself, my name is Messa and I'm a PhD candidate. I'm doing PhD at Concordia University with Jeremy Clark in Montreal and I'm also integration engineer at the off-chain labs. Alright so what I'm going to talk about today is research that I was doing during the PhD and it kind of co-located with the time that I was doing the job at the off-chain. So it's kind of a collaboration between the folks at the off-chain and Concordia. So it's a research, we are particularly interested in solving a research problem but before I dive into the details of the problem I want to take some time and talk about how roll-ups work in general and how optimistic roll-ups work. So you might have already heard from other folks during the conference but it's always good to keep refreshing and make sure everybody is on board. So let's start with the question of why is the theorem slow and expensive? So we know a theorem is slow, there's unscalability problem with the theorem and it's really a fundamental issue and why there is a problem is that let's say you have a function that you want to get executed on an input X and if it was a cloud environment the cloud service provider would give you the closest node in the network and then what happens is you send the function to the node it would execute the function for you and it would give back the results and you learn what the result is but on the blockchain because we care about trust and integrity we can really rely on one node to execute everything for us. So what happens on a blockchain is you send your function to a node and what that node does is actually relays your function together with the input to all the nodes in the network and what happens is then all the nodes in the network execute your function. So it's literally like you have to pay for each and every node executing the function for you and then it takes some time because they have to run a consensus algorithm among each other so that they could all agree on a same output and it's only that moment that you can learn the result. So that's really why it's so inexpensive. Okay so but why is it that every node has to compute everything? So the answer is because they have to make sure that it's the correct thing. So let's say I have a function I execute it for you and then I come to you and I'm like here's the output. So what is the most straightforward way for you to actually verify if I'm saying the correct thing? So you have to go and compute the function yourself right? So the question people have been asking in terms of scalability of Ethereum is that is there any way I can convince you that I've done the execution correct without you having to go and execute everything yourself? So there are two main approaches to tackle this problem. The first one is you can actually throw some math at a problem and you create kind of a mathematical proof. So you run a function you get the output and then you kind of create a cryptography proof. You hand it to me and then I can actually verify the proof and see if it's a correct thing or not. So very if like verifying the proof is less work than actually having to execute everything then I actually save some money and time right? So this is how ZK roll-ups work on a high level. So the way a ZK roll-up work is you actually send a function to a node, the node would execute it for you and then they create a cryptography proof saying that this is a correct output. Now generation of this proof takes a long time. It even takes like thousand times or even million times longer than when you have to like compute a function yourself. So that's kind of a hidden cost. But if like once you have the proof in hand you can actually go and send it to the network and then verifying the proof is really nothing. So it's really a cost effective solution especially if you're one of those nodes that have to verify those proof. And the second solution is to use kind of like economics. So I'm like I execute this function and here's the output and here's a million dollar worth of ETH backing my assertion. And it's open for you to dispute. Anybody can come along and they can prove that it's a wrong output but they have to stake money as well. So the way it works is let's say Alice is saying what output is right, Bob is saying the other output is right and then there's a dispute and disagreement right? And it's only in that point that Ethereum goes back to a normal blockchain mode where every node has to execute everything. So this is how optimistic rollups work and we call it optimistic because we're really optimistic that not every node has to compute everything because really nodes always assert the right output and you see why. So the way an optimistic rollups work is that I execute a function and I put an assertion, I stake on that and let's say Bob is coming and he says this is the wrong output. So he finds a dispute. So what happens is Ethereum would be like hey I know you guys are disagreeing on this output. I want you to pinpoint me to the exact step inside the computation where you started to disagree. So maybe you were fine for the first 30% of the computation and it's only this little step where you started to disagree. So it's actually going to verify that little step. So it ends up being very cost effective even if Ethereum has to step in. And that's why actually it's really not easy to get away with a wrong output because everybody knows that at the end of the day Ethereum can come along and it can settle things and you can lose money. And then yeah and then that's why actually the only way you can get away with a wrong output is that nobody's watching the protocol. So at least one honest party watches the protocol then you can never get out of it. Yeah and yeah this is how optimistic rollups work and like in real world it never happens. The dispute like in arbitrum there's never been a dispute before. So let's say let's see how it works on arbitrum on a smart contract level. So what happens is arbitrum puts two smart contract on the L1 inbox and outbox and what Alice does is she wants to execute some function right. So what she does is instead of putting the function on L1 and having the L1 to execute everything she puts a message saying that I want this function to be executed on layer one. And it's only the inbox contract is going to record the fact that Alice wants this function to be executed. So what happens is somebody outside L1 comes along they dump the contents of the inbox smart contract on L2 and then they're going to execute everything on the RBOS and it's really based on like the how they were sorted inside the inbox smart contract and then they're going to update everybody's account on the RBOS and then they put the output of this execution inside the inbox smart contract in the form of an assertion. So an assertion is basically a fingerprint of the latest state of the RBOS. So it doesn't care what is RBOS or how RBOS works. It actually works a lot like Ethereum. It runs a blockchain. It has blocks. It has miners. We call them validators. It has block explorers but Ethereum doesn't care about anything about that. It only cares about like here's the list of function that I'm seeing that are going to be executed on layer two. I want to see the output of this execution. That's all it cares about. So we have to wait for seven days because we want to make sure that everybody have time to come along and they react to it if there's any dispute and if there's not no dispute it's going to be finalized. So let's say Alice wants to do something slightly different this time. She wants to withdraw 100 ETH from L2 and to make that happen, Arbitrum has to introduce a smart contract which is called bridge. So bridge's job is basically to scroll whatever tokens or ethers people want to move to the L2. So if Alice wants to withdraw 100 ether from L2 it means that she has previously moved 100 ether to the Arborus. So what bridge does is hey Alice I know you're moving 100 ETH to the L2. That's fine. Just give me 100 ETH. I'm going to scroll it for you and then I'm going to mint 100 ETH on L2 out of tin air. You'll be the owner. Do whatever you want. Go ahead transfer it to Bob. And the end of the day what I care about is somebody comes along and they want their ether back from me. And that's called a withdrawal transaction. So yeah. So like any other transaction I just described Alice puts a message for the withdrawal transaction inside the inbox and Arbitrum does it things. So yeah somebody dumps the contents of the inbox on the Arborus. It gets executed and then the assertion would be placed inside the outbox. Now we have to wait for seven days so that we make sure that the assertion is finalized and our withdrawal transaction can go through. And only in that case when it is finalized Alice knows that her transaction is in assertion number 20. She can go to the outbox and she'll be like hey outbox. This is the assertion. It's just finalized. It's sitting there for you to go and see. Go check it please. And then if you're happy with that I want my 100 ETH back from the bridge. So outbox is happy. Bridge would give back the ether to Alice and then it's going to burn those on the L2. So here's the problem. I'm sure you've noticed. Withdrawals take seven days to be finalized and it could be even longer if there's any dispute. And although there's never been a dispute before but there could be and people really don't want to wait for seven days. Sometimes they have a pressing reason. They want to really do something with their ether but intrinsically you don't want to wait. And then seven days is just really an arbitrary number but there should be some time window for people to pay attention to the protocol and react to it if something happens. But something interesting that we notice is on Arbitrum let's say there's an assertion that you're just looking at it for the first time and you're trying to figure out if it's going to be finalized or not. So if it actually happens if you run a validator on Arbitrum what happens is what is validator? It's just a software that goes through the inbox transactions one by one. It's going to execute those and at the end of the day it's just going to compare the output of this execution with the state that is being asserted. So if you run an Arbitrum validator you can be 100% sure that this transaction is really going to be finalized. The assertion is going to be finalized. So we found that this is really interesting that we can leverage to get a relief of this pain point of having to wait for seven days. So the question we were asking in this research is can Alice withdraw 100 ETH from L2 back to L1 without having to wait for seven days? So we have come up with four different solutions in this work and I'm going to go through them one by one and they actually get better as we go through. So the first solution is Alice can actually use centralized exchange like hop. So what she can do is she can go to the exchange, she can trade her 100 ETH on L2 with the one on L1 and it's really easy. So these centralized exchanges they have piles of ETH on both L2 and L1 and you can actually trade with them. So this solution works, a lot of people have been using it but the problem with that is it's centralized. So now we ask ourselves, is there any way we can do it in a decentralized way? And so that's where we go to the second solution. So the story is Alice is holding 100 ETH on L2, right? So if it happens to be somebody somewhere that has the exact same amount of ETH on L1 and is willing to trade that with Alice, then they can do something called atomic swap. So I'm not going to go through the details of what atomic swap is, but it's basically like a little bit of crypto combined with smart contract that allows you to basically do transactions on two different chains at the same time. So it's like, arbitrom here is a different chain than Ethereum, right? So it's like, both Alice and Bob, they agree on atomic swap. So they have to lock up some money. And then there's a secret somewhere that if it's revealed on one chain, then you can use it to send a transaction on another chain. So it's either like, either both transaction goes through at the same time, or they don't go through at all. So this is the beauty of atomic swap. So it's perfect, it works, but the problem with that that you might have noticed is that Bob can agree to do the atomic swap, but then he can just disappear in the middle of the protocol. So there's some time window for Alice to go back and get whatever she has locked up before. But it's actually very awkward, because she's not getting what she wants. And she's actually losing some time here. So we go to the third solution. So we're like, hey, Alice, we know that you initiated your withdrawal transaction on L2 and from L2. And then now you're waiting for your assertion to be finalized. What we can do is we can give you a ticket actually that says you are actually the owner of this hundred ETH, and then you can do whatever you want with the ticket. You can go ahead, you can transfer it to Bob. That's fine, even though the seven day has not passed. So so it's basically like we're giving a tradable ticket or a claim of whatever is going to go out of the breach after the seven days. And as I said, these are tradable, they can transfer it. So if Bob happens to be an arbitrom validator, it means that he can be sure if the assertion is going to go finalized or not. So what Alice does is that she can actually go to Bob and she'll be like, hey, Bob, I know that you're you're actually validating everything. And you might not even care about my withdrawal. But what I can offer you is that I have this ticket that worth 100 ETH in seven days. So what you can do is I give you a discount or a bonus, you can buy my ticket because you know that this assertion is going to be finalized. And then you get the ticket, you get the ticket, you get the bonus. And then at the end of the day, you have profit. So Bob can do that is great. But as you may have noticed, Bob here is having two roles. So first off, he has to have the liquidity, meaning that he has to be sitting on a pile of ETH and he has to be willing to trade it with Alice. The other thing is Bob needs to run and a validator on arbitrom. So he needs some assurance. He needs to know that this assertion is going to go finalized someday. Otherwise he's not really willing to trade with Alice. So the problem, this solution is really great. But the problem with that is there's not probably a lot of Bob's in this world. So there could be some people, they have the liquidity. So they have a lot of ETH, but they're not necessarily arbitrom validators. Or there could be some arbitrom validators, but they're not sitting on a pile of ETH or they're not even interested in participating in these kind of like markets. They're just doing that because they want to be part of the arbitrom ecosystem. So that's the problem. Finding these Bob's that work for the both side of equations is not really easy. Okay, so we are at our last solution. So we were like, is there any way we can split Bob? So is there any way we can have Alice? She wants to withdraw 100 ETH from L2. Then we have David, who is the arbitrom validator, but he doesn't have the liquidity. And we have Carol, who has the liquidity, but she's not a validator. So is there any way these three can arrange something that can give Alice what she wants at the end of the day? And it turns out that yes, there is a solution for that. We have this solution and our solution is not necessarily the only one, but we think it works great. So the solution is to set up something called a prediction market. So what is a prediction market? So a prediction market is basically a betting market, but with a difference that you can get inside and outside of your position. So in a betting market, what happens is you can place a bet, but then you cannot transfer it or you cannot get out of your position. You have to sit on it, and then you have to wait for the event to happen. But on the prediction market on the other side, what happens is let's say you think the odds of Joe Biden being the next president of the United States is so high. So what you do is you're going to go place a bet against it. In three months, the odds are actually going down. So what you do is you can actually sell your position and can get out of your position. So this is the difference with a betting market. And then it's really like a betting market, but it designed more kind of like stocks, I'd say. So we have this prediction market. The way we set up it is we put the market. It's really like a vending machine. There's no bookkeeping or anything. It's autonomous smart contract. We put it on L1. And so a user would go to it. I can go to it. I deposit one ether inside the market and it would give me two shares. One yes share and one no share. So and these shares are betting against if the assertion is going to be finalized or not. So at the very beginning, I'm actually covered for both cases. So if the assertion is finalized, my yes shares are going to be worth one ether and my no shares actually worth nothing. And on the other side, if the assertion fails, there's a dispute and then my no shares going to be worth one ether and the yes shares are actually nothing. So in any case, I can go and redeem my one ether back. Okay, so how does it work? So let's say Alice wants, Alice is the one who wants to do this withdrawal, right? So she initiates the withdrawal and she's like, Okay, I want my ether now. I don't want to wait for seven days. So what I do is I come along, I go to this market and pay attention to this, that she wants to withdraw 100 ether. So what she does is she deposits 100 ether inside the smart contract, the market, and what market does, it actually gives Alice 100 shares of yes and 100 shares of no. So if Alice actually believes that this assertion is going to be finalized and at the end of the day, her ether is going to get out of the bridge, what she would do. So she would keep the yes shares for herself because it's a bet against the assertions being finalized and she would get away the no shares, right? Out of the no shares. But she's not going to do that and I tell you why. What she does is she actually keeps the yes shares for herself, the no shares for herself, and she's going to give the yes shares to David who is running the Arbitrum validator. So she goes to David and she's like, Hey, I know that you're already validating the Arbitrum chain and David doesn't care about this withdrawal at all. He doesn't even know what that is. So Alice is like, I'm giving you these 100 no shares. It's a bet against this assertion number 10 going to be finalized or not and I'm giving it to you for a discount or bonus so you can give me 99 cents per shares. So at the end of the day, you pay 99 ether and if it's going to be finalized, you can always go back to the market and you can redeem it for 100 ether. So Bob's going to profit, right? So, yeah, sorry, David's going to, I was skipping saying Bob, right? Sorry about that. So I meant David. Yeah. So David's going to profit, right? So he's willing to do that. That's fine. So what she does with the no shares that she kept for herself. Now she can actually go to Carol who has the liquidity but she doesn't know what's going on on Arbitrum chain and Alice would be like, Hi, I'm willing to trade my ticket with you. This is the ticket. It works 100 if it belongs to me now but I can sell it to you and I know that you don't have any idea about this assertion number 10. You don't know if it's going to be finalized or not. That's fine. You don't have to do anything. I provide insurance. So what I do is I'm going to give 100 no shares to you for free. So in any case, if the assertion is going to be finalized and my withdraw is actually confirmed, what I do is what you can do is you can go to the market and you can redeem your, you can go to the outbox and then you can redeem your ticket for 100 ETH. And if no, if there's a dispute happen and this assertion happens to be like not finalized, what you can do is you can go to the market and you can redeem your no shares for 100 ETH. So in any case, Alice is ensuring Carol. So Carol would be able to do the trade with her. There's no risk for her. So this is great. This is the best solution that I guess we have come up with. And for the implementation, this is a work under progress. So what we did so far is we modified arbitrom nitro to support our solutions and we provide measurements. We fully implemented solution 3 so far. It's a proof of concept. So what I did was I implemented an L1 market. It's really like a vending machine, as I said. So there's no bookkeeping or anything. And we modified the outbox so that it would support our market. And for the solution for the prediction market one, it's still under progress, but we modified the roll-up and outbox mark contracts so they could be prediction market friendly. Okay, so I'm going to walk you through the protocol of solution 3, how it works and what are the functions that we added to the arbitrom protocol. So let's say Alice wants to do a withdrawal. So she puts her withdrawal transaction inside the inbox. And then what she does, this is a function that we added to the outbox. She wants to participate inside the market. So market needs to know that she actually locked up her ether inside the market. So what Alice needs to do first is she has to go to the outbox and calls the transfer spender function. What basically it does is it transfer her exit, her withdrawal to the market smart contract. So it's like it's collateralizing her exit. And then what that's done, she can go to the market and she can actually open a market on her exit. And market would check if Alice has really deposited her exit inside the market or not. And if yes, that's fine, she can open a market. Then the market is open for some time until there's a trade. Bob comes along, he's a trader, he's willing to trade it with Alice. What he does is he submits a bit that actually is greater than what is Alice is asking for. And that's when the trade occurs. So that trade happens, everything gets settled down. What market does it first is going to send the ETH back to Alice. So Alice is happy, she got her ETH. And then what it does is because it's owning the exit now, what it can do is it can actually go inside the outbox and change the owner of this exit. So it reached inside the outbox and it changes the owner to Bob. So now Bob owns the exit, we wait for seven days. And then what happens is he can now go to the outbox smart contract, execute his withdrawal transaction. And then because he's the owner, the bridge would send 100 ETH back to him. So easy peasy, everyone's happy. And then we run some measurements too to find out how much at one gas it would cost us to run this function. So it turns out it's really cheap. So for transferring the spender inside the outbox smart contract, it's around 86k. And it's really like the most expensive one because it's the first transferring of spender. So it's actually you're paying for creation of a mapping. So because there's a mapping that keeps track of all the owners of an exit. So this is really expensive. The first one is really expensive but the second one and the third one, I guess they were around like 40k, which was really great. And for opening the market, we had to pay around 300k. And for submitting the bid, I had to pay around 100k. And then for executing the transaction, it cost 90k. And that sums up the talk. I hope you enjoyed it. It's really a work under progress. So the repo is not really public yet. But I urge you to reach out to me on Twitter if you need to learn more. We're going to submit it somewhere soon and the repo will be fabricated.