PaperlayerView exact revision on arXiv

Source-linked AI summary

One Node, Two Roles: Simultaneous Contests for Validation and Attention in Rollups

Pranay Anchuri, Ben Berger, Matteo Campanelli, Akaki Mamageishvili

arXiv:2610.12220v1cs.CR

TL;DR

Optimistic rollups need validators to challenge incorrect assertions, but open participation does not pay for routine verification, and multiple identities can reuse one operator’s execution. The paper combines a cryptographic model of per-identity proving work with coupled validation and attention contests, then shows that TRACE can support higher execution diversity by adjusting cost through trace length, unlike Proof-of-Diligence.

  • Problem

    Open validation does not pay routine verification, and paying per identity may reward sybils rather than distinct operators executing the rollup.

    Source: §1 · p. 2

  • Method

    The paper formalizes arguments with registered provers and models validation and attention as coupled contests sharing an execution entry cost and adding per-identity costs.

    Source: §2 · p. 4, §7 · p. 15

  • Results

    TRACE supports A ≤2 at trace length 220 and A ≤29 at 224, while Proof-of-Diligence’s per-identity cost cannot be raised under non-decreasing rewards.

    Source: §2 · p. 5, §7 · p. 15

  • Takeaways & Limitations

    Trace length can raise TRACE’s per-identity cost and support higher execution diversity, whereas a decreasing reward can support a larger target without raising that cost.

    Source: §2 · p. 5, §7 · p. 15

    The equilibrium conditions do not establish uniqueness or convergence, the model excludes collusion, and baseline cost measurements use Arbitrum One at one trace length.

    Source: §6 · p. 15

Abstract

from arXiv · show

An optimistic rollup is safe as long as at least one honest validator executes its state transition function (STF) and disputes any assertion that is inconsistent with the result of the execution. Allowing anyone to participate, however, does not give incentive to do so: as long as every assertion is correct, verifying assertion correctness goes unpaid. Attention mechanisms address this by paying nodes to execute the rollup's STF, regardless of whether they participate in the validation process. Since a single node operator can back many registered identities with a single execution, paying per identity does not buy execution diversity, that is, the number of operators that independently execute. In this work we provide a new modeling framework for this problem. We formalize the underlying cryptographic primitive as a new notion, arguments with registered provers, whose properties include a form of non-amortizability that, to our knowledge, has not been studied for modern succinct cryptographic proofs before. We design validation and attention reward mechanisms and analyze them as two coupled Tullock-like contests, in which an operator pays once for the required execution and then chooses how many identities to deploy in each role. We quantify the attainable range of execution diversities in equilibrium as a function of the marginal cost of deploying an extra attention identity. We use our framework as a lens through which we compare two attention mechanisms, TRACE (MARBLE 2026) and Proof of Diligence (AFT 2024). In particular, we show that as opposed to Proof of Diligence, in TRACE the marginal cost mentioned above can be adjusted to support a higher execution diversity. As a case study, we apply our results to Arbitrum One, a widely deployed optimistic rollup.

1 Introduction

Open validation alone does not ensure anyone will bear the cost of checking assertions, while attention rewards can still pay for identities rather than independent execution. The paper couples validation and attention incentives and connects their economics to cryptographic per-identity work.

1 Introduction

  • The 1-of-N safety assumption requires an honest validator, but execution, stake, and dispute duties are costly and routine validation goes unpaid.Base and Arbitrum allow anyone to validate, yet expertise and costs can make the role unsuitable for most parties.Source: §1 · pp. 1–2
  • Attention rewards pay nodes to execute the STF, but benefits depend on independently operated nodes rather than registered identities.A single operator can back many identities using the same execution, creating sybils rather than greater execution diversity.Source: §1 · p. 2
  • Prior work leaves execution diversity open for Proof-of-Diligence and analyzes attention separately from validation, despite their shared execution cost.The roles are coupled because executing the STF for one makes that cost sunk when the operator takes on the other.Source: §1 · p. 2

1.1 Our Contributions

  • The paper models operators as choosing identities across two simultaneous Tullock-like contests, with one execution entry cost and additional per-identity costs.It derives conditions on entry and marginal sybil costs that support a target execution diversity in equilibrium.Source: §1.1 · pp. 2–3
  • Arguments with registered provers formalize non-amortizability, capturing per-identity work and enabling comparison of TRACE with Proof-of-Diligence [SRB+24].The framework connects cryptographic guarantees to the per-identity costs used in the game-theoretic analysis.Source: §1.1 · p. 3
  • The additional construction offers stronger non-amortizability than prior schemes, but requires a more expensive prover whose concrete cost estimate is left to future work.The paper applies its main results to Arbitrum One as a worked example.Source: §1.1 · p. 3

2 Overview

The overview links cryptographic per-identity proving work to a coupled contest model of execution diversity. It compares TRACE and Proof-of-Diligence, showing that TRACE’s cost can be raised with trace length while Proof-of-Diligence’s is fixed.

2 Overview

  • A reward that decreases beyond a target can support more independent operators without raising per-identity cost; otherwise that cost must rise relative to node cost.When an extra identity is cheap, an incumbent can capture reward more cheaply than a newcomer can by running another node.Source: §2 · p. 4
  • Non-amortizability with overhead ∆ means proofs under n distinct keys require roughly n∆ work, bounding the proving component of per-identity cost.The model uses arguments with registered provers, where each identity holds a registered key pair and proves knowledge of the trace behind a block commitment.Source: §2 · p. 4
  • TRACE proves knowledge of the execution trace with a succinct inner-product argument and registered-key signature; its overhead is ∆= Ω(log N · λ1−ϵ).Eligibility depends on the proof, so each identity incurs the proving cost before learning whether it qualifies for a reward.Source: §2 · p. 4
  • TRACE supports A ≤2 at trace length 220 and A ≤29 at 224, while Proof-of-Diligence’s fixed per-identity cost cannot be raised under non-decreasing rewards.TRACE’s overhead grows logarithmically with trace length, weaker than the honest prover’s linear work.Source: §2 · pp. 4–5
  • Proof-of-Diligence certifies state and trace roots, not the trace itself, so a claimant can prove a shared root without having executed the block.TRACE’s knowledge soundness lets an extractor recover the trace from an accepting proof, whereas Proof-of-Diligence relies on incentive-based diligence assumptions.Source: §2 · pp. 4–5
  • A PRF-based construction makes each identity perform fresh work proportional to trace length, strengthening non-amortizability to within a logarithmic factor of honest prover cost.It treats the PRF as a random oracle and requires a more expensive prover.Source: §2 · p. 5

2.1 Related Work

  • The paper studies non-amortizability of existing succinct arguments over nondeterministic computations, unlike prior useful-work proofs [KW25].Its contest model also differs from earlier Tullock-like work through its coupled roles and other model-specific elements.Source: §2.1 · p. 6

3 Attention Mechanisms as Non-Amortizable Cryptographic Proofs

The paper models attention proofs with properties tailored to prevent operators from sharing proving work across identities. It recasts TRACE in this framework and establishes its non-amortizability overhead.

3.1 Intuitions behind our modeling choices

  • The model treats proof systems as inspiration but requires identity-specific proving and operational trace retrievability to reflect the attention setting.Its non-amortizability property captures the requirement that each additional identity incur irreducible proving work.Source: §3.1 · pp. 6–7

3.2 Arguments with Registered Prover

  • Arguments with registered provers combine commitment proofs with completeness, binding, knowledge soundness, succinctness, designated proving, and non-amortizability.A registered secret key is required to produce a proof associated with its identity.Source: §3.2 · pp. 7–8

3.3 The TRACE Construction as an Argument with Registered Prover

  • The TRACE variant proves knowledge of the trace behind its commitment using an inner-product argument and a signature tied to the registered key.The block hash is the nonce, and the proof carries the trace sum and an inner-product proof.Source: §3.3 · p. 9
  • In the generic bilinear group model with a random oracle, ΠIPA satisfies non-amortizability with overhead Δ.The paper recasts a variant of TRACE as an argument with registered provers and proves this bound for its instantiation.Source: §3.3 · pp. 9–10

4 The Game

The game couples validation and attention through a shared execution entry cost, while each role has its own per-identity cost and reward. The analysis gives conditions for one identity per player and shows how decreasing attention rewards can support that outcome beyond the non-decreasing-reward bound.

The Game

  • Operators choose which games to enter and how many sybils to deploy, sharing an entry cost while paying a separate marginal cost in each role.The model focuses on outcomes with A attention players, V of whom also validate, where V < A.Source: §4 · p. 10
  • A good equilibrium has each player deploy at most one sybil in both games, with conditions covering best responses, participation, and entry.For non-decreasing attention rewards, Condition (11) is necessary for such an equilibrium.Source: §4 · pp. 11–12
  • With fixed reward pools, appropriate validation and attention rewards can satisfy the equilibrium conditions for any A meeting Condition (11) and any V ≤ A.The sufficiency construction uses constant reward functions for both games.Source: §4 · p. 12
  • When attention rewards may decrease beyond a threshold, the one-sybil equilibrium can be supported for an arbitrary entry cost c.The constructed reward curve may become negative, but it can be truncated.Source: §4 · pp. 12–13
  • Decreasing rewards support the desired equilibrium even when the attention sybil cost is small, while that cost affects disruption costs and headroom before collapse.The paper discusses these reward-curve trade-offs in Section 5.3.Source: §4 · p. 13

5 Worked Example: BoLD and TRACE

The Arbitrum One example measures the attention identity cost and applies the equilibrium bounds to reward designs. Non-decreasing rewards support at most two attention operators at the default trace length, while longer traces or decreasing rewards support larger populations.

5 Worked Example: BoLD and TRACE

  • At N = 220, the measured attention sybil cost is da = $0.91 per hour, and a managed Arbitrum full node costs c = $1.00 per hour.The analysis takes one hour as its period because assertions are posted hourly.Source: §5 · p. 13

5.1 Execution Diversity for Non-Decreasing Reward Functions.

  • A ≤ 2 at N = 220 under non-decreasing attention rewards, and lowering the rate at which claims win does not raise this bound.Each identity proves on every block whether or not it wins, so the trace length is the mechanism parameter that moves da.Source: §5.1 · p. 13

5.2 Execution Diversity with Non-Monotonic Attention Reward Functions

  • A = 30 attention nodes with V = 5 validators is an equilibrium under the constructed decreasing attention and constant validation rewards.In this example each operator deploys one sybil in each role it plays.Source: §5.2 · pp. 13–14

5.3 Tradeoff between the reward curves

  • For a pool of $90 and 30 identities, fifteen operators with two identities each earn 3.18, while one identity per operator earns 1.09.Dropping an identity lowers that payoff to 3.09, and the target is stable to adding or entering with another identity when β = 2 and p = 2.09.Source: §5.3 · p. 14
  • A higher β brings reward-pool collapse closer to A, while a decreasing reward limits how far identities can overshoot the target.In both reward designs, a small da lowers the cost of crossing the target.Source: §5.3 · p. 14

6 A Stronger Attention Construction and Its Limitations

The stronger PRF-based construction makes identity-specific proving work fresh on every block, but requires a more expensive prover. The paper distinguishes this construction from the honest-prover costs used in the Arbitrum example and leaves the hourly cost of registration unpriced.

6 A Stronger Attention Construction and Its Limitations

  • The main IPA construction's Section 5 cost is honest-prover work, not a lower bound, and its shared all-ones folding vector adds no per-identity work.A sharing construction reduces the cost to N^0.936 per identity.Source: §6 · p. 14
  • Deriving the vector from the registered key shifts work to registration, and the paper does not convert that one-time charge into an hourly cost.The authors leave open whether block-dependent folding would restore a recurring per-block cost.Source: §6 · p. 14
  • The PRF construction derives its secret vector from the block context and proves that derivation in each claim, giving a stronger non-amortizability guarantee.It incurs fresh work proportional to trace length, raising the overhead to linear in the trace length within a logarithmic factor.Source: §6 · p. 14

7 Conclusion

The conclusion links equilibrium execution diversity to the marginal cost of attention identities and compares TRACE with Proof of Diligence. Appendix A.1 supports the non-amortizability analysis with an entropy-based counting argument.

7 Conclusion

  • Under a non-decreasing reward, one identity per operator requires A ≤1 + 2da/c, making the per-identity cost da the deployer’s lever.The model treats validation and attention as coupled contests that share an execution cost.Source: §7 · p. 15
  • Proof of Diligence has ∆=O(1), while TRACE is knowledge sound with logarithmic trace-length overhead; Arbitrum One supports A ≤2 at trace length 220.The conclusion contrasts the mechanisms’ cryptographic guarantees and reports the Arbitrum One case-study bound.Source: §7 · p. 15
  • A decreasing reward can support a larger target without raising da, but shifts the constraint to the reward curve.Source: §7 · p. 15
  • TRACE’s PRF construction raises overhead to linear in trace length, at the price of a more expensive prover and random-oracle analysis.The conclusion also calls for study of non-amortizability across proof systems and beyond idealized models.Source: §7 · p. 15

A.1 Preliminary definitions and properties for non-amortizability

  • The A.1 proof uses counting to show that short computations cannot account for the final output’s entropy except with negligible probability.It bounds the number of formal computations by |C_N,T| ≤L(2L²)^T.Source: §A.1 · pp. 19–20

A.2 Warm-Up: The Bulletproofs Instantiation

This section analyzes Bulletproofs’ publicly verifiable inner-product argument as a warm-up, characterizing prover work and establishing a negligible-error lower bound and non-amortizability in the generic-group random-oracle model. It also relates the per-identity charge to honest prover cost and describes the argument’s logarithmic on-chain verification and its connection to TRACE’s different instantiation.

A.2 Warm-Up: The Bulletproofs Instantiation

  • The Bulletproofs instantiation is simpler, while its recursive-halving, fresh-challenge analysis applies more broadly; TRACE uses a structured-key instantiation, to which Section A.4 transfers the analysis.The warm-up avoids structured commitment keys and pairings, and one commitment absorbs both vectors and their inner product.Source: §A.2 · p. 20
  • When K and log p grow faster than log λ, accepting BP-IPA provers incur group-operation costs from witness encoding, fresh-challenge transitions, and final-message generator support.The proof combines these three sources of work to obtain the group-operation lower bound.Source: §A.2 · pp. 22, 26
  • Except with negligible probability, acceptance forces the prescribed message coefficients in every round, enabling the lower-bound analysis.The proof derives this from fresh challenges and bounds deviations using low-degree polynomial roots.Source: §A.2 · p. 23
  • In the generic-group model with a random oracle, BP-IPA is non-amortizable with overhead Δ over every witness distribution D.The argument does not require an entropy assumption on D: the adversary receives the secret keys, and the relevant unpredictability comes from the random oracle.Source: §A.2 · pp. 26–27
  • Except with negligible probability, an execution in which all n proofs verify requires Q ≥ c nΔ, ruling out adversaries with Time(A)/n = o(Δ).Every group-oracle query costs one step, so the lower bound on Q gives the contradiction with the stated runtime condition.Source: §A.2 · pp. 27–28
  • The per-identity charge grows with trace length and security parameter but remains far below the honest prover’s Θ(N log p) group operations.The bound is a genuine per-identity charge, but the passage does not establish that the gap from the honest prover’s cost can be closed.Source: §A.2 · p. 28
  • The warm-up bound does not prove that Section G’s Θ(ℓ) per identity is necessary, because generator handles and the first message can be shared across identities.Closing the gap would require a lower bound for multi-scalar multiplications with structured exponents and polynomial preprocessing; later-round sharing is also discussed for Fig. 2.Source: §A.2 · p. 28

A.3 A Publicly Verifiable Inner-Product Argument

  • Figure 2’s ΠIPA replaces transparent recursion to keep the on-chain verifier logarithmic; it uses separate structured keys, a public inner product z, and a Fiat–Shamir label for the key.Its relation is RIP[ckP]; Theorem 3.9 for this argument is proved in Section A.4, starting from the warm-up in Section A.2.Source: §A.3 · p. 28

A.4 Proof of Theorem 3.9

The proof establishes a lower bound on per-identity proving work by adapting the inner-product argument analysis to structured keys. The appendix then constructs an argument with registered provers from a labelled inner-product argument and signatures, and sketches its security and efficiency properties.

A.4 Proof of Theorem 3.9

  • The counting argument yields Q = Ω(n∆) despite structured keys, because the added signature operations do not reduce the number of group operations required.Precomputed full-support elements remove the additive N term, which is paid once per generator set and does not enter ∆.Source: §A.4 · p. 30

B Our Construction from Inner-Product Arguments and Signatures

  • The construction instantiates TRACE with a Pedersen vector commitment and the publicly verifiable inner-product argument of Daza, Ràfols and Zacharakis, rather than Bulletproofs.The key enters the inner-product argument through a label derived from the public key; the verifier receives no commitment opening.Source: B Our Construction from Inner-Product… · p. 30, Figure 3 · p. 32

B.1 Ingredients and the Properties We Need

  • The construction requires a labelled inner-product argument with completeness, black-box knowledge soundness, and succinctness, plus a correct, existentially unforgeable signature scheme.The verifier key and proof are logarithmic in N, and verification takes time proportional to the label length and log N.Source: §B.1 · pp. 31–32

B.2 The Construction

  • ΠIPA proves a trace statement using the trace and an all-ones vector; the prover’s only secret is its signing key.The eligibility test hashes the inner-product proof, which is deterministic for the trace, key, and block, preventing signature resampling from changing the outcome.Source: §B.2 · p. 32

B.3 Properties

  • Theorem 3.8 establishes that ΠIPA satisfies completeness, binding, knowledge soundness, succinctness, and designated proving under the stated assumptions.The proof uses the structured-key Find-Rep assumption for binding, the inner-product argument’s extraction analysis for knowledge soundness, and signature unforgeability for designated proving.Source: §B.3 · p. 33

C Costing a TRACE Claim on Arbitrum One

The cost analysis estimates TRACE proving expense on Arbitrum One and relates trace length to sustainable attention-node counts. Longer traces raise both per-identity proving cost and the bound on attention nodes, while proof work remains required on every block.

Costing a TRACE Claim on Arbitrum One

  • Self-hosting the equivalent full-node machine at about $0.41 per hour raises the bound in Eq. (17) from two attention nodes to five.The managed-provider estimate is about $1.00 per hour.Source: C Costing a TRACE Claim on Arbitrum One · p. 33
  • Shorter traces lower per-identity proving cost but also lower sustainable execution diversity; longer traces raise both identity cost and the attention-node bound.The rollup operator trades proving work against execution diversity as trace length changes.Source: C Costing a TRACE Claim on Arbitrum One · p. 34
  • At trace length 2^20, one TRACE proof costs 720 ms on the measured machine, and one identity requires about three machines running continuously.The proof comprises four multi-scalar multiplications of size N; the table measures one multiplication on a 12-core AMD Ryzen 9 9900X.Source: C Costing a TRACE Claim on Arbitrum One · p. 34, Table 2 · p. 34
  • TRACE requires every identity to prove on every block, so lowering the claim-winning rate does not reduce proving cost per identity.Unlike TRACE, Proof of Diligence samples which blocks require a proof; under TRACE, the sampled option is unavailable in the main instantiation.Source: C Costing a TRACE Claim on Arbitrum One · p. 34
  • For 29 attention nodes, the estimate is 46 instances per identity and $10,400 per month of proving, with c8a.6xlarge instances priced at $0.31 per hour and c = $1.00 per hour throughout.Source: Table 3 · p. 35

C.1 Reward-curve tradeoff

The reward-curve analysis shows how per-identity rewards and proving costs shape profitable identity choices. Under non-decreasing rewards, discouraging extra identities requires making each identity expensive; a decreasing reward beyond the target shifts the constraint to the reward curve and target population.

C.1 Reward-curve tradeoff

  • When β > pa, an operator with more than one identity prefers dropping identities, because the remaining identity’s payment rises by β.More generally, dropping is preferred when β > pa/(q −1).Source: §C.1 · p. 35
  • The gap above A is at most 2 + 2da/c under the stated reward-curve conditions.The bound follows by maximizing the decreasing function f(p) for p > c.Source: §C.1 · p. 35

D Proof of Proposition 4.1

The proof derives conditions for an operator to prefer one attention identity over two, then extends the necessary equilibrium condition to players deploying multiple identities.

D Proof of Proposition 4.1

  • The one-versus-two-identity comparison expresses the incentive condition using the change in reward δ := ga(A + 1) −ga(A).The proof substitutes ga(A) = A(da + p) and ga(A + 1) = ga(A) + δ into the comparison.Source: D Proof of Proposition 4.1 · pp. 35–36

E Equilibrium with Multiple Attention Sybils

F A preprocessing variant: why key derivation alone is not enough

The preprocessing variant makes each identity’s vector distinct, but shifts much of its work to registration rather than restoring recurring trace-proportional cost. A TRACE claim costs an honest prover Θ(N), while sharing across identities reduces that cost only modestly.

F A preprocessing variant: why key derivation alone is not enough

  • Key-derived vectors make each round identity-specific, but do not by themselves restore recurring cost proportional to the trace.The vector is fixed at registration, allowing block-independent work to be precomputed; the remaining secret-side work is shifted between registration and each block.Source: F A preprocessing variant: why key… · pp. 36–37
  • At N = 220 and k = 7, preprocessing uses about 5,500 group elements and 6.7 × 10^7 group operations, reducing recurring secret-side work from 2 × 10^6 to about 2 × 10^4.Each identity pays its own one-time registration charge, which an operator cannot share across identities.Source: F A preprocessing variant: why key… · p. 37
  • The registration charge cannot be reported as an hourly cost without assumptions about registration duration and a benchmark for the registration proof; block-dependent folding remains open.The paper supplies neither the duration assumption nor the benchmark.Source: F A preprocessing variant: why key… · p. 37

G Per-Identity Cost of a TRACE Claim

  • An honest TRACE prover spends Θ(N) per claim, and an operator sharing work across identities can reduce the per-identity cost only to N^0.936.The claim’s trace-side commitments and cross terms cost fewer than 2N scalar multiplications and 2N field operations, respectively; commitment-key folding adds work of the same order.Source: G Per-Identity Cost of a TRACE Claim · p. 37

H How Much Proving Work an Operator Can Share

Batching lets an operator share some TRACE proving work across identities, but the per-identity cost remains close to the honest prover’s cost. A stronger non-amortizability construction is outlined, with a more expensive prover as its trade-off.

H How Much Proving Work an Operator Can Share

  • Batching shares trace-dependent pieces across identities, then evaluates each identity’s folded vector using its own challenges before each proof finishes independently.The operator can compute pieces once and use fast matrix multiplication to produce all identities’ folded vectors together.Source: H How Much Proving Work an Operator… · p. 38
  • For n = N identities, batching yields total work O(N^(1+ω/3)); with Strassen’s exponent, the per-identity cost remains close to the honest prover’s cost.The bound counts shared precomputation, per-identity evaluation, batched folding, and independent tails; at the theoretical floor ω = 2, per-identity cost is still N^(2/3).Source: H How Much Proving Work an Operator… · p. 38
  • Sharing saves a factor of N^0.064, or 2.4 at N = 220, while the best known per-identity cost remains N^0.936 against an honest-prover cost of N.The proven lower bound is logarithmic in the trace length.Source: H How Much Proving Work an Operator… · p. 38
  • The sharing analysis uses the honest prover’s hardware-measured cost without reducing it, and the construction needs as many identities as the trace is long.Its preprocessing has not been implemented or measured.Source: H How Much Proving Work an Operator… · p. 38

I A Construction with Stronger Non-Amortizability Guarantees

  • The stronger construction derives the identity-specific vector from a registered PRF key and proves the derivation, but its more expensive prover may limit applicability.Deriving the vector from the key keeps the claim deterministic in the block and registered key, preventing eligibility grinding.Source: I A Construction with Stronger… · pp. 38–39
  • The stronger construction gives each identity fresh field elements, yielding a bound with κ = N log p paid once per identity.Its argument uses identity-specific vectors in place of fresh challenges in the non-amortizability counting argument.Source: I A Construction with Stronger… · p. 39
Loading 2610.12220v1…