PaperlayerView exact revision on arXiv

Source-linked AI summary

Proof of Diligence: Cryptoeconomic Security for Rollups

Peiyao Sheng, Ranvir Rana, Senthil Bala, Himanshu Tyagi, Pramod Viswanath

arXiv:2402.07241v2cs.CR

TL;DR

Optimistic rollups lack assured incentives for diligent normal-path monitoring, despite relying on fraud proofs to identify faulty transactions. The paper proposes watchtowers that submit proofs of diligence for rewards, with an incentive design intended to sustain diligent execution. Its discussion states that Proof of Diligence ensures the network executes rollup transactions diligently.

  • Problem

    Optimistic rollups lack a proper incentive mechanism ensuring that nodes diligently check posted transaction data and raise fraud-proof alarms for faulty transactions.

    Source: §1 · p. 2, Lazy watchtower · p. 6

  • Method

    The protocol uses execution-trace commitments and watchtower-specific VRFs as proof of diligence, alongside bounty rewards, staking, and challenges to inconsistent proofs.

    Source: §1 · p. 3, Proof of diligence · p. 4, §4.1 · p. 9

  • Results

    Proof of Diligence ensures that the watchtower network executes all transactions on the rollup diligently.

    Source: §7 · p. 20

  • Takeaways & Limitations

    The watchtower network is designed to provide a first line of defense by incentivizing continuous normal-path monitoring of rollups.

    Source: §1 · p. 3

    The model assumes L1 is secure and live and that L2 block data is retrievable directly or through a trusted data-availability service.

    Source: §2.1 · p. 5

Abstract

from arXiv · show

Layer 1 (L1) blockchains such as Ethereum are secured under an "honest supermajority of stake" assumption for a large pool of validators who verify each and every transaction on it. This high security comes at a scalability cost which not only effects the throughput of the blockchain but also results in high gas fees for executing transactions on chain. The most successful solution for this problem is provided by optimistic rollups, Layer 2 (L2) blockchains that execute transactions outside L1 but post the transaction data on L1. The security for such L2 chains is argued, informally, under the assumption that a set of nodes will check the transaction data posted on L1 and raise an alarm (a fraud proof) if faulty transactions are detected. However, all current deployments lack a proper incentive mechanism for ensuring that these nodes will do their job ``diligently'', and simply rely on a cursory incentive alignment argument for security. We solve this problem by introducing an incentivized watchtower network designed to serve as the first line of defense for rollups. Our main contribution is a ``Proof of Diligence'' protocol that requires watchtowers to continuously provide a proof that they have verified L2 assertions and get rewarded for the same. Proof of Diligence protocol includes a carefully-designed incentive mechanism that is provably secure when watchtowers are rational actors, under a mild rational independence assumption.

1 Introduction

Optimistic rollups face an unresolved normal-path monitoring gap: applications are not guaranteed to watch asserted states consistently. The paper proposes incentivized watchtowers that prove diligence, with incentive mechanisms and a live implementation for optimistic rollups.

1 Introduction

  • Applications are not guaranteed to monitor rollup assertions consistently during normal operation, leaving vigilance without apparent threats unresolved.Existing defenses include staked asserters and fraud-proof disputes, but the paper identifies no guarantee of active watching.Source: §1 · pp. 2–3
  • Watchtowers monitor transactions continuously and submit proof of diligence as a prerequisite for incentives.They operate independently and interact with the rollup when they identify an incorrect state.Source: §1 · p. 3, Proof of diligence · p. 3

Proof of diligence.

  • Bounty mining rewards selected watchtowers, staking enables slashing, and challenges to inconsistent proofs earn rewards.The protocol analyzes diligent and lazy strategies as a non-cooperative game.Source: Proof of diligence · p. 4
  • A whistleblower scheme offers compensation for secretly exposing collusion, and the analysis says it encourages betrayal and deters collusion.Reporting is confidential while betrayal is noticeable, so the whistleblower cannot be individually attributed.Source: Proof of diligence · p. 4

System design.

  • The system was implemented on Optimism Bedrock to watch Optimism and Base on Goerli, with low compute cost and adjustable low transaction fees.The system uses EigenLayer for staking and supports monitoring multiple optimistic rollups.Source: System design · pp. 4–5

2 Security Models and Definitions

The model places watchtowers alongside an optimistic rollup whose security depends on available L1 data and fraud-proof validation. It frames diligence and collusion as strategic choices, and supplies primitives and game-theoretic concepts for analyzing them.

2.1 Rollup Model

  • Optimistic rollups presume transactions valid unless challenged, while an asserter posts L2 state assertions and defensive validators can produce on-chain-verifiable fraud proofs.The model assumes L1 is secure and live and L2 block data is retrievable, directly or through a trusted data-availability service.Source: §2.1 · p. 5

2.2 Watchtower Model

  • Watchtowers are registered entities with relative stakes and are modeled as rational adversaries optimizing known payoffs.Rational watchtowers may act against protocol expectations when expected rewards justify it.Source: §2.2 · p. 6

Lazy watchtower

  • The lazy-watchtower problem arises when watchtowers can submit unverified arbitrary responses or leave when participation costs exceed rewards.The protocol therefore needs evidence of work and sufficient incentives for consistent task performance.Source: Lazy watchtower · p. 6

2.3 Preliminaries

  • VRFs, Merkle-tree operations, state-transition functions, and strategic and cooperative game concepts provide the paper’s verification and analysis primitives.The apply function maps prior state and transactions to a new state and execution trace; validate resolves conflicts between roots.Source: §2.3 · pp. 6–8

3 Background and Prior Work

Prior work addresses rollup foundations, validator incentives, and related risks such as data availability and sequencer behavior. The paper distinguishes its approach from earlier attention games and collusion mechanisms, emphasizing a plug-and-play solution.

3 Background and Prior Work

  • Foundational optimistic-rollup discussions and research include the Optimism framework, Arbitrum, and TrueBit, which introduced off-chain computation and dispute resolution concepts.The passage traces early discussion to Ethereum research forums [2], the Optimism team [21], Arbitrum [19], and TrueBit [49].Source: §3 · p. 8
  • Prior work studies data availability, sequencer risks, and validator behavior, including verifier incentives and attention-game approaches.Arbitrum’s attention game can punish nonparticipating verifiers [16], while TrueBit proposed validator selection and proof of independent work [20, 15].Source: §3 · p. 8
  • The paper characterizes a recent attention-game design as probabilistic rather than deterministic security and says its solution is plug-and-play with minor modifications.It also contrasts its approach with a two-party traitor contract and work focused on bargaining-based collusion.Source: §3 · p. 8

4 The Watchtower Protocol

The protocol makes watchtowers verify proposed L2 state assertions and submit proofs of that work. Its incentive analysis finds diligence to be the dominant strategy in the non-cooperative game, with an all-diligent unique Nash equilibrium.

4.1 Proof of Diligence

  • Watchtowers execute transactions, recompute the state root, and raise an alarm if it differs from the proposed assertion.They use the execution trace to construct a root that serves as evidence of their work, then generate a VRF proof using their secret key.Source: §4.1 · pp. 8–9

4.2 Incentive Design

  • Watchtowers stake slashable deposits; diligent proof winners receive fixed RB bounties, while dispute winners receive RC and validation-cost compensation.The bounty scheme accounts for the cost of executing transactions, and disputes are resolved through the validate function.Source: §4.2 · p. 10

4.3 Incentive Analysis in Non-Cooperative Games

  • The diligent strategy is dominant for every watchtower, and the unique Nash equilibrium has every watchtower diligent.The protocol's analysis considers watchtowers acting without cooperation.Source: §4.3 · pp. 11–12

5 Cooperative Games and The Enhanced Protocol

Cooperative strategies can make collusive laziness more attractive than independent diligence, so the section analyzes lazy and diligent collusion and introduces whistleblower contracts to counter collusion. With a whistleblower contract, independent diligence is the unique equilibrium.

5.1 Lazy Collusion

  • Lazy collusion requires a leader-set deposit and shared random execution root; colluders who use a different root risk losing their deposit.Non-traitors share the deposited stakes, while those who betray the arrangement lose their deposit.Source: §5.1 · pp. 12–13
  • When the deposit is high enough, obeying the lazy-collusion strategy dominates betrayal for each colluder.Theorem 3 gives conditions for obedience to be a dominant strategy.Source: §5.1 · p. 13
  • Lazy collusion adds a Pareto-efficient equilibrium alongside the equilibrium where all watchtowers are independently diligent.The collusive equilibrium requires all watchtowers to join the same contract and satisfy the specified conditions.Source: §5.1 · p. 14

5.2 Diligent Collusion

  • Diligent collusion lets a leader compute and share the execution root while other watchtowers pay rent h < cT to use the result.The leader posts a deposit; if its proof is accepted, it receives the deposit plus rent payments.Source: §5.2 · p. 14
  • When t > RC − cV /(n−1) − h, DC-Game has no pure-strategy Nash equilibrium, while the full game retains the two equilibria from lazy collusion.Those equilibria are independent diligence and collusive laziness, with the latter Pareto efficient.Source: §5.2 · p. 15

5.3 Enhanced Protocol with Whistleblower

  • The whistleblower protocol offers a bounty for reporting collusion, and a successful reporter receives Rw plus their returned deposit.A reporter stakes d and submits the correct execution root; an unsuccessful dispute forfeits the deposit.Source: §5.3 · p. 15
  • A whistleblower contract makes independent diligence the unique equilibrium when lazy and diligent collusion are allowed.Any colluder can expose the collusion for a higher payoff, discouraging the leader from initiating it.Source: §5.3 · p. 16
  • For the paper’s example, cV is approximately $600 and cT approximately $0.006; transaction value informs security requirements and minimum stake.The authors estimate that a watchtower would secure approximately $56,000 worth of transactions and say rewards should rise for higher-value transactions.Source: §5.3 · p. 17

6 Implementation and Evaluation

The implementation combines a watchtower client with on-chain contracts, targeting low compute overhead, modularity, and adjustable gas costs. It is tested on Ethereum Goerli with OP-goerli and Base-goerli.

6.1 System design

  • The system targets low compute overhead, modular adaptation across rollup stacks, and adjustable settlement-layer gas costs.The implementation adapts Optimism Bedrock modules and was tested on Ethereum Goerli with OP-goerli and Base-goerli.Source: §6.1 · pp. 17–18

6.2 On-chain Contracts

  • MineBounty consumes 380K gas on average, comparable in order to a Uniswap token swap.Proof storage and signature verification are major gas contributors; proof aggregation is proposed as a future way to reduce transaction costs.Source: §6.2 · p. 19

6.3 Off-chain Client

  • Watchtower-client CPU usage bursts to 10% when a new block is proposed, while the L2 Goerli node reaches 25% during block execution.The client otherwise consumes minimal native resources and adds minimal resource overhead on the L2 node.Source: §6.3 · p. 20

7 Discussion

The discussion presents Proof of Diligence as a means to ensure watchtowers execute rollup transactions diligently, with potential applications beyond rollups. It also identifies conditions and design directions for stronger security against adaptive adversaries.

7 Discussion

  • Proof of Diligence is described as ensuring that watchtowers execute all rollup transactions diligently.The discussion says further improvements could enhance security, enable generalized applications, and support trade-offs between delay and stake.Source: §7 · p. 20

7.1 Enabling Cryptoeceonomically Secure Watchtower Applications

  • Applications can subscribe to watchtower transaction-life-cycle traces, with attestations bound to bounties and challengeable for cryptoeconomic security.The described trace can cover sequencing, ordering on L1, and assertion into the state; consumers can contest private attestations by showing a mismatch with the mined bounty.Source: §7.1 · pp. 20–21
  • The discussion identifies AI inference, cloud computing, and light-client protocols as possible future extensions of Proof of Diligence.For AI inference, watchtowers could independently recompute results from input data and model parameters and alert on discrepancies.Source: §7.1 · p. 21

7.2 Enhancing Security

  • The current design addresses static collusion; stronger dynamic-adversary resistance requires rational independence and private whistleblower contracts.Proposed measures include random, staggered watchtower rotation and deploying whistleblower contracts after bounty mining so their addresses are not static.Source: §7.2 · p. 21

A.1 Watchtower Smart contracts

The appendix describes smart contracts for registering operators and rollups, managing bounties and alerts, and resolving disputes. EigenLayer restaking provides the underlying stake and sybil resistance.

A.1 Watchtower Smart contracts

  • The OperatorRegistry registers operators to rollups and can rotate their allocation in batches, subject to rotation protection.The RollupRegistry maintains participating rollups and their agreement terms, including geographical decentralization and bounty amount.Source: §A.1 · p. 24
  • The BountyManager sets mining difficulty and handles bounty mining and reward claims, with predictable expected rewards and low transaction costs as design goals.Its hash-minimum mechanism is intended to ensure one bounty winner per epoch.Source: §A.1 · pp. 24–25
  • The AlertManager raises alerts when asserted and executed state roots differ, then confirms or cancels them based on subsequent rollup state changes.Confirmed alerts reward the reporting watchtower; canceled alerts can lead to slashing through dispute resolution.Source: §A.1 · p. 25
  • Payment-pool and dispute-resolution contracts manage rewards and handle alert or conflicting-bounty disputes, with vetoes before slashing.The contracts are integrated with EigenLayer’s contract suite, which supplies the underlying restaked stake.Source: §A.1 · pp. 24–25

A.2 Watchtower Client

The client fetches and executes rollup transactions, observes settlement-layer assertions, and uses bounty and alert modules to submit contract transactions. Its modular design supports moving between rollups by changing the execution engine.

A.2 Watchtower Client

  • The rollup execution engine fetches transaction sequences from the sequencer or L2 outbox and generates state roots and event traces.The settlement-layer light client observes assertions and compares information from multiple full nodes to avoid reliance on a single node.Source: §A.2 · p. 26
  • The bounty miner fetches an execution trace and checks for a mined bounty, while the accumulator generator produces a Merkle root of that trace.The bounty checker signs the trace-accumulator hash and state root and can trigger a bounty-mining transaction.Source: §A.2 · pp. 26–27
  • The alert-management module compares execution and settlement-layer state roots and submits an alert transaction when they mismatch.The reconfiguration manager handles operator rotation, rollup modules, network configuration, and state transfer to incoming nodes.Source: §A.2 · pp. 27–28
  • The transaction generator manages operator keys and posts contract transactions; switching rollups primarily requires changing the connected full node.The modular design keeps additional computation largely within the bounty-miner module, with cost adjustable through execution-trace size.Source: §A.2 · p. 27
Loading 2402.07241v2…