How Do Optimistic Rollups Work (The Complete Guide)

Written by Alchemy

Reviewed by Brady Werkheiser

Published on August 9, 20238 min read

---

Once considered a fringe idea, Ethereum—the world’s first smart contracts platform—has grown considerably over the years, and now hosts nearly 3,000 decentralized applications (dApps), 4,000+ smart contracts, and over 90,000 transactions daily. 

But the increased activity on Ethereum has come with a cost: scalability.

Limits on block sizes and block times, although necessary for decentralization and security, reduce Ethereum’s capacity to scale and accept more users. The end result is a collection of problems most Ethereum users are familiar with—namely, high gas fees and slow transactions. 

Scaling Ethereum safely requires increasing its ability to scale network throughput and latency without introducing trust assumptions. This is what several scaling solutions such as Layer 2 rollups and sidechains attempt to do. 

This article explores Optimistic Rollups (ORUs), a class of L2 rollup solutions designed to make using Ethereum cheaper and faster. 

What are optimistic rollups?

‍Optimistic rollups are a layer 2 (L2) construction that improves throughput and latency on Ethereum’s base layer by moving computation and data storage off-chain. An optimistic rollup processes transactions outside of Ethereum Mainnet, reducing congestion on the base layer and improving scalability. 

The “optimistic” label points to a distinctive feature of optimistic rollups: they publish little information about transactions on-chain and automatically assume all transactions are valid. They are called “rollups” because they aggregate (“roll up”) thousands of transactions into batches before submitting them on Mainnet. 

The architecture of an optimistic rollup 

1. Entering the optimistic rollup

Optimistic rollups use smart contracts deployed on Ethereum to manage the interaction between the L2 chain and the L1 blockchain (Ethereum). Rollup users must deposit funds into one of these smart contracts before getting an equivalent amount unlocked on the rollup. 

A third party, known as a sequencer, credits the user with funds on the rollup after receiving proof of the latter’s deposit in the rollup contract. The user is then free to transact freely on the rollup until they exhaust their balance. 

2. Using the optimistic rollup

On the rollup, users sign transactions and submit them to the sequencer who’s responsible for ordering and executing transactions. The sequencer verifies transactions, compresses the data into a block, and submits the batch to Ethereum as a single transaction.

This is another area where the rollup contract comes into the picture. The on-chain contract stores a “state root”, which is a Merkle root of the rollup’s state. Let’s break this down further:

State

State is a concept referring to the available information about a network at a specific point in time. The “rollup’s state” describes the L2 chain’s present condition and specifies details, like existing accounts, balances, smart contracts, and so on. 

Every transaction performed on the rollup causes a change in its state—for example, Alice’s balances will decrease after she sends 5 ETH to Bob. Thus, transactions are called state transitions since the rollup moves from an old state to a new state after executing a transaction.

Merkle root

A Merkle root enables users to encode large amounts of information using cryptographic hashes. Merkle roots also make it easier to check if a piece of data (e.g., a transaction) is part of a larger dataset (e.g., a batch of transactions). 

Therefore, the “state root” stored in the rollup contract is a cryptographic commitment verifying the rollup’s status at different points in time. When a sequencer submits a batch of transactions to the rollup contract, it must include a pre-state root and a post-state root. 

1. Pre-state root: The old state root, which describes the rollup’s condition before the submitted transactions were executed. 

2. Post-state root: The new state root, which describes the rollup’s condition after the submitted transactions were executed. 

Once the sequencer submits the batch, the contract verifies that the pre-state root matches the existing state root. If the two match, the contract discards the old state root and stores the new state root proposed by the sequencer. 

This means transactions referenced in the post-state root have become final and cannot be reversed. Note that the sequencer doesn't have to submit proof of the validity of batched transactions. 

The only time a proof is required is if a verifier reports a fraudulent rollup transaction using a fraud proof. We’ll explain the mechanics of a fraud proof in a later section of this article. 

3. Exiting the optimistic rollup 

Say Alice (the user) has had enough of this rollup business and wants to withdraw her funds from the rollup contract on Ethereum Mainnet. To do this, she needs a Merkle proof that—yes, you guessed it—proves her transaction included in the rollup’s state root. 

Constructing the Merkle proof requires having access to the initial transaction data, which the sequencer is expected to provide. If all goes well, Alice gets the data, creates the Merkle proof, and submits to the rollup contract. 

But relying on the sequencer to provide transaction data introduces trust assumptions. A sequencer could go rogue, execute a transaction transferring Alice’s token to their wallet, and deny her the data she needs to prove ownership of the funds. Even something less malicious, like a sequencer going offline, can still threaten the decentralization and security of optimistic roll-ups. 

Optimistic rollups solve this problem by requiring sequencers to post the full transaction data on the main Ethereum execution layer. This information is published on Ethereum Mainnet as "calldata," which is cheaper than storing it in the Ethereum Virtual Machine's memory or storage (further reducing rollup fees).

This achieves two objectives:

1. If a sequencer goes offline, another sequencer can use the transaction data to reconstruct the rollup’s state and continue producing blocks. 

2. Alice (the user) can download the data herself and use it to create a Merkle proof. 

The use of on-chain data availability is what makes optimistic rollups considerably more secure than other scaling solutions. With transaction data stored on Ethereum, user funds are always safe—so long as Ethereum remains operational. 

So, one way or the other, Alice manages to create a Merkle proof to prove ownership of funds. However, she must wait for the dispute period to elapse before withdrawing her funds. In optimistic rollups, the dispute period is a 1-2 week interval between submitting a withdrawal request and getting the requested funds. 

During this period, anyone can publish a fraud proof claiming a particular transaction, or batch of transactions, is invalid. If the fraud proof succeeds, the sequencer’s bond (provided as a guarantee of honest behavior) is slashed, Alice’s “funds” are reverted, and the “whistleblower” (called a verifier) is rewarded for their efforts. 

If no one challenges Alice’s withdrawal request, then she can get her funds from the rollup contract after 1-2 weeks. 

What is a fraud proof?

A fraud proof is a claim that a state transition (i.e., transaction) is invalid and the entire batch should be reverted as a result. Although complex, fraud proofs heavily rely on state roots (mentioned earlier) to work. 

The process starts when a party (verifier) detects a mismatch between the rollup state referenced in the state root on the L1 chain and the actual state of the rollup chain. 

An example would be the sequencer submitting a post-state root that reduces Alice’s balances by 5 ETH and increases Bob’s balance by the same amount, even though Alice never performed a transfer. 

The verifier can “challenge” this state transition and prove its invalidity. This is possible because the verifier downloads data for every transaction, applies it to their copy of the rollup state, and computes the post-state root. 

If the sequencer’s post-state root matches the verifier’s, nothing happens. If, however, the sequencer’s post-state root is different—likely because it includes a false transaction, such as the one described in Alice’s case—then the verifier can trigger a fraud proof computation. 

How do fraud proofs work?

Here’s a high-level description of the fraud proof process:

1. The verifier initiates a challenge and provides the following information:

                  a. Disputed state transition

                  b. The pre-state root

                  c. Rollup state data

                  d. Their version of the post-state root.

       2. The transaction is replayed in a sandboxed environment on the L1 chain using, among other things, information provided by the challenger.

This “sandboxed environment” is a smart contract running on Ethereum, which doubles as a virtual machine (VM). 

       3. If the computation results in a post-state root matching the challenger’s, then we know the sequencer indeed published a batch with an invalid state transition.

The invalid batch (and others) published afterward will be reverted, restoring the rollup to its earlier state. 

We should note that the fraud proof mechanism is more complicated than described here. 

This article on fraud proofs in rollups may provide some additional context. 

What is the difference between fraud proofs and validity proofs?

A fraud proof is different from a validity proof mainly because it is computed on-chain. Validity proofs (also called zero-knowledge proofs) are computed off-chain (i.e., on the rollup) and verified on Ethereum. 

As explained in our article comparing different types of zero-knowledge proofs, a validity proof, such as a SNARK or STARK, is used to prove the validity of transactions performed off-chain. This is the foundation of a zero-knowledge rollup.

In a ZK-rollup, a validity proof is produced for every batch using the transaction data as inputs. This validity proof is submitted along with the batch to Ethereum Mainnet and verified by an on-chain contract. This means transactions can be declared valid immediately, without waiting for a challenge (as with optimistic rollups). 

Another difference between fraud proofs and ZK proofs is that the latter is somewhat easier to verify on-chain. All the smart contract needs to do is run the validity proof to determine the validity of batched transactions. With a fraud proof, the entire state transition must be replayed before completing the fraud proof computation. 

What are the differences between optimistic rollups and zk rollups?

The major difference between optimistic rollups and ZK rollups comes from the former's support for smart contracts, delayed withdrawals, reliance on cryptoeconomic incentives, and security properties. 

Here's a detailed comparison of optimistic rollups and ZK rollups:

What are the top optimistic rollup blockchains?

The top optimistic rollup blockchains are Arbitrum, Optimism, Metis Andromeda, and Boba Network in terms of Total Value Locked (TVL). Below is an overview of the different optimistic rollups (ORUs):

1. Arbitrum

Arbitrum is an optimistic rollup project designed to improve Ethereum’s user costs and transaction speed by moving computation and data storage off-chain. The Arbitrum Virtual Machine (AVM) supports EVM-compatible smart contracts, allowing users to use favorite dApps for a fraction of Ethereum’s costs. 

2. Optimism

Optimism is an EVM-compatible, optimistic rollup chain leveraging Ethereum’s security guarantees. Optimism uses an optimistic rollup (OR) construction to roll up thousands of off-chain transactions and save users on gas fees.

3. Metis Andromeda

Metis Andromeda is a scalable, low-cost, and functional L2 protocol based on optimistic rollups. Metis Andromeda’s unique stack can be applied to different use-cases, including dApps, DAOs, and DeFi.

4. Boba Network

Boba Network is an Ethereum L2 scaling throughput with optimistic rollup designs. Boba Network offers a Liquidity Provider (LP) service that allows users to withdraw funds immediately without waiting for a seven-day challenge period to elapse.

What optimistic blockchains or projects have tokens?

The following optimistic rollup projects have tokens:

• Optimism (OP)

• Boba Network (BOBA)

• Metis Andromeda (METIS)

Optimistic rollup tools

Optimistic rollups are useful solutions for scaling dApps and interacting with smart contracts in a more cost-effective and efficient manner. But first, you'll need various tools to use optimistic rollups easily and safely. 

Here are various optimistic rollup tools for developers and end-users:

Cross-chain bridges to optimistic layer 2 blockchains

While optimistic rollups are built on top of Ethereum’s base layer, assets on both chains are not natively compatible. However, you can transfer funds from an L1 chain, like Ethereum, to an optimistic rollup using cross-chain bridges:

Here are examples of bridges connecting L1 chains and different L2 rollups:

Bridges to and from Arbitrum

• Arbitrum Token Bridge

• cBridge

• Hop Protocol

• Synapse Protocol

• Anyway Bridge

• DeGate Bridge

Bridges to and from Optimism

• Connext

• Celer Bridge

• Li.Fi

• Optimism Bridge

• Poly Network

• Via Protocol

• Synapse Protocol

• Across

Bridges from and to Metis Andromeda

• Metis Bridge

• cBridge

• AnySwap

• Synapse Protocol

Bridges from and to Boba Network

• Across

• Boba Standard Token Bridge/Fast Token Bridge

• cBridge

• Synapse Protocol

Optimistic rollup testnets 

A testnet is a public blockchain network that simulates the behavior of an associated main network (Mainnet). Testnets don't use real funds, unlike a real blockchain, allowing developers to deploy and test smart contracts with minimal risk. 

Some optimistic rollups have versions of Ethereum testnets, like Rinkeby, which can use for testing your dApp:  

1. Optimism Ethereum Kovan Testnet 

The Optimistic Ethereum Kovan Testnet is an EVM-compatible optimistic rollup chain designed for testing purposes. Like Optimism on Ethereum Mainnet, the Optimistic Ethereum Kovan Testnet is designed for faster and cheaper transactions than obtainable on L1s. 

2. Arbitrum Rinkeby Testnet

Offchain Labs, the team behind Arbitrum, launched an EVM-equivalent rollup chain on the Rinkeby network. The Arbitrum Rinkeby testnet allows developers to deploy Solidity smart contracts on the Arbitrum rollup without downloading software. It also comes with a blockchain explorer and a bridge for moving ERC-20/ERC-721 tokens. 

3. Boba Network Rinkeby Testnet 

Boba Network is another project with an EVM-compatible rollup chain on the Rinkeby testnet. You can request testnet ETH with Alchemy's Rinkeby faucet to create or test your smart contracts. 

Conclusion

Optimistic rollups are a major part of efforts to scale Ethereum using layer 2 architecture. Optimistic rollups build on Ethereum's security and decentralization while offering cheaper fees and faster transactions. 

Alchemy supports two leading projects based on optimistic rollups, Arbitrum and Optimism. Sign up for free today and see how you can scale your dApp with Ethereum-based optimistic rollups.