Written by Ed Felten, Co-founder of Offchain Labs

Compiled by: Luffy, Foresight News

Arbitrum is an Ethereum scaling protocol that uses Optimistic Rollup. People often ask us why Arbitrum chose Optimistic and whether we expect Arbitrum to move to ZK proofs. I have answered this question before, but that was almost two years ago. This is my current personal opinion, and others may disagree.

I'm a firm believer in pragmatism when designing systems. Rather than being enamored with one technical approach and applying it at all costs, we should ask which approach best meets the needs of our users and developers. The best approach may change over time, and if so, we're willing to make that change.

We chose Optimistic for Arbitrum out of pragmatic considerations, and I believe that Optimistic proofs are still a better choice than ZK proofs, and they better meet the needs of users and developers. In short, Optimistic is cheaper, simpler, and more flexible than ZK. I will go through each of these claims below.

That said, if the situation changes and ZK becomes a better option, I think Arbitrum should change. But I don’t expect that to happen anytime soon.

Optimistic Lower cost

The beauty of optimistic proofs is that the cost of proof is always zero for honest parties. In the common case, no proof is needed, because only true statements are published and will never be challenged. If there is a challenge, there is some cost to solve the challenge. But every dishonest party who loses the challenge will lose their staked share, which can be used to pay for the cost of the challenge.

The Optimistic Protocol relies on multiple parties executing it so that they can check any published claims about the results of the execution. In other words, the chain needs nodes. But any chain with any serious use will have a large number of ordinary nodes, run by users or infrastructure providers to support the chain's activities. These nodes will naturally act as watchtowers for the Optimistic Protocol.

In contrast, ZK requires that a cryptographic proof be generated for every statement published, and that proof must be verified at Layer 1. Over time, ZK researchers have reduced the cost of generating these proofs, but they will never be able to reduce it to zero.

In fact, the cost of ZK proofs is quite high compared to Optimistic execution. If a smart contract performs a bitwise AND operation, each validator of the Optimistic system will only perform the bitwise AND operation. The ZK prover needs to perform the bitwise AND instruction and then perform a large number of expensive cryptographic operations to prove the result of the bitwise AND instruction. If Alice and Bob go fruit shopping, Alice buys a grape and Bob buys a grape and a watermelon, then Alice's cost will always be lower than Bob's.

In Optimistic Rollup and ZK Rollup, ordinary nodes need to execute each transaction in order to understand the evolution history of the chain, so this part is no different.

Therefore, the cost of Optimistic is lower.

Optimistic is simpler

In software engineering, and especially in security engineering, simpler is better. Complexity increases security risks and makes everything slower and more difficult.

There is no doubt that Optimistic proofs are simpler than ZK proofs. Optimistic proofs are easily understood by developers, while ZK proofs rely on complex mathematics and deep and subtle cryptographic theorems that few people understand. Even professors who teach cryptography have to work hard to understand the ZK proof system.

Optimistic is more flexible

Proofs are necessary for any L2. But proofs are not the only thing users and developers want. They want new features, and they want those features to be built more easily and quickly on top of optimistic systems.

A good example is Arbitrum Stylus, which allows developers to write smart contracts in general-purpose languages ​​like Rust and C++ and run them in a WASM virtual machine, on the same chain as EVM contracts, with full composability. Features like Stylus are challenging to build and require integrating two virtual machines into a seamless system.

One of the reasons why such functionality can be built into the Optimistic system is that Optimistic implementations can use standard programming languages ​​and tools, which makes it easier to develop software. In contrast, ZK requires different programming tools, either to manually build ZK circuits or to use some intermediate compiler to reduce everything to circuits. Custom tools and programming methods are always slower and more cumbersome to use, which means slower progress in the development of the entire system.

The simple performance of the Optimistic system translates into greater flexibility and faster evolution.

Same final confirmation time

People often ask about the finality times of Optimistic Rollup and ZK Rollups, and the answer is that they are the same.

A transaction has finality when the outcome of the transaction is fully determined and known to all participants in the protocol. Rollup chains, whether optimistic or ZK chains, run in two phases: first, the sequencer publishes and records the sequence of transactions that have arrived on the chain; second, the execution settlement layer calculates and proves the results of the executed transactions one by one in order. Finality is achieved when a transaction has a finalized position in the transaction sequence, at which point the outcome of the transaction is completely determined by the finalized transaction sequence and everyone knows the outcome.

Because finality is determined by the output of the collator published to Ethereum (this is the same for both the Optimistic and ZK processes), rather than the prover, Optimistic and ZK systems have exactly the same finality behavior.

Cross-chain communication time

Where ZK has an inherent advantage is in the latency of cross-chain communication, that is, how long it takes for a contract on one chain to send a message to a contract on another chain without trust.

Cross-chain transfers of fungible assets (ETH or tokens) are typically performed through fast bridging services, which operate independently of Optimistic and ZK proofs, so regular users will not see any difference in cross-chain asset transfer times.

For other types of cross-chain messages, ZK can be faster because a ZK chain can checkpoint its state to the parent chain (i.e. Ethereum for L2) faster than an Optimistic chain. This means that if the sending chain uses ZK proofs, trustless cross-chain messaging will be faster for use cases other than asset transfers.

It’s unclear how significant this difference actually is. Today, the vast majority of cross-chain activity is asset transfers, and the user experience isn’t much different.

in conclusion

To me, the answer is clear: Optimistic’s strengths (low cost, simplicity, and flexibility) outweigh ZK’s strengths (speed of non-asset transfer cross-chain functionality).

This is why Arbitrum is still using Optimistic proofs.