Rollups are offchain scaling solutions that let you do cool stuff with your bitcoin. They've been dubbed as scaling solutions in the Ethereum space, and now members of the Bitcoin community are beginning to explore how they can drive more use cases, users and fee revenue to Bitcoin.
This page answers frequently asked questions. It also includes a number of articles and blogs on rollups, their design and the different components within rollup architecture. To get straight into the resources, you can check out various blogs and articles on Bitcoin rollups here, and video and audio pieces here.
Rollups are blockchains that take transaction execution offchain and use a parent blockchain for data availability. They bundle, or "roll up", transactions that were executed offchain and post that data to its parent blockchain (e.g. Bitcoin). Offchain execution reduces the amount of data that has to be posted to and stored on the Layer 1 blockchain.
A validity rollup is a blockchain that uses validity proofs to prove its updated state to the Layer 1. Validity proofs are cryptographic proofs that take transaction data from the rollup, compress the transaction data within the proof, and prove the correctness of the proposed state change to the Layer 1. In Ethereum, the validity rollup state is maintained by a smart contract in the Layer 1. ELI15 - Users do a bunch of transactions offchain, provers take those transactions and summarize how those transactions change the state of the blockchain, and a validity proof proves that the summary is true.
A sovereign rollup is a blockchain that uses a Layer 1 blockchain for data availability, but not for settlement. Nodes in a sovereign rollup are responsible for verifying if state changes are correct. In this design, they would read a validity proof containing a state change and verify that execution was done correctly. This is advantageous for blockchains that want to trustlessly explore different execution environments and functionalities, but still inherit the security of a decentralized Layer 1 protocol. There are also differences in how they upgrade their protocol versus validity rollups.
A zero knowledge proof (zkp) is a cryptographic proof that allows you to prove that a statement is true without revealing the statement in full. In the context of blockchains, they are mainly used for privacy and scaling. In privacy, zkps prove that transactions are valid without revealing information about users engaging in a transaction. In scaling, zkps prove that a batch of transactions really are the result of a proposed state change.
Bitcoin rollups are new phenomena that were first introduced by Trey Del Bonis and further researched by John Light. Due to tradeoffs made to ensure decentralization of the Bitcoin protocol, it needs to use offchain solutions to scale the amount of transactions it can process efficiently. Rollups are popular scaling solutions in the Ethereum space and are now being developed using the Bitcoin protocol for data availability. The rollups being developed on Bitcoin today are sovereign rollups and rollups that are optimistically verified rollups through BitVM.
The main solution for scaling Bitcoin is lightning. The majority of lightning use is custodial due to user complexity for self-custody, and during the Ordinals craze of 2022, lightning broke for many of its users due to high transaction volume on Layer 1. Other Bitcoin scaling solutions are natively custodial (i.e. Ecash). These solutions are also mainly used for payments.
Rollups could prove to be a more effective scaling solution for payments, and they also would enable better privacy. They also provide different execution environments that would drive new users to the Bitcoin protocol and increase fees that can be paid out to miners. This would help make the Bitcoin network more secure long term and maintain its 21 million unit supply cap. Today, a small percentage of miner revenue is paid from fees generated by the network.
Rollups will (basically) have users create transactions offchain, and then submit those transactions to a sequencer who orders the transactions within a rollup block. The rollup will then execute these transactions in the given order. After execution, a prover will submit a validity proof containing proof that the transactions were executed correctly, and the rollups corresponding state difference. Then, depending on the rollup, those transactions will be verified by a Layer 1 smart contract (in smart contract rollups) or a network of rollup nodes (in sovereign rollups).
Sovereign rollups add zero security risks to Bitcoin. They simply use Bitcoin to store transaction data. This is technically no different than creating an Ordinal, and they can be implemented today. Validity rollups would require a soft fork and come with different tradeoffs, but the technology has been well researched, peer-reviewed, and is being used on the most used blockchain in the cryptocurrency space, Ethereum.
The first implementations of zero-knowledge proofs required a trusted setup. This was one of the main reasons that Bitcoiners were initially cautious about the tech being implemented in Bitcoin. But, the zero-knowledge proof space has come a long way and a variety of proving systems do not require trusted setups.
zk-STARKs and zk-SNARKs are the two primary types of zero-knowledge proofs used in validity rollups. STARKs do not require a trusted setup, and a newer zk-SNARK, called Halo, removed the need for a trusted setup. This is really cool because now we have trustless ways to implement the zero-knowledge proofs that Satoshi was talking about.
Sequencers receive, include and order transactions in rollup blocks. Sequencers can be centralized nodes, or decentralized protocols. When they include a transaction in a rollup block, they provide users a soft confirmation that their transaction will be eventually finalized on the Layer 1. These soft confirmations are known as "preconfirmations".
Provers take ordered rollup blocks from the sequencer and prove that they were executed correctly. They will generate a proof of execution (a validity proof) and then post the proof to the Bitcoin L1 so verifying nodes can verify that it was executed correctly. This process also provides scalability beneffits, as provers do not need post all of the rollup's transaction data to the L1, just proof that the transactions were executed correctly.
Verifiers verify that validity proofs were generated correctly, and that the rollup is posting a correct state transition to the Layer 1. In Bitcoin, there are two ways to accomplish this. In sovereign rollups, rollup nodes will read the validity proof posted to the Bitcoin Layer 1 and agree that it is correct. In BitVM, a group of verifiers will verify validity proofs posted to the L1 are correct. In BitVM, if a proof was generated incorrectly, only 1 of the participating verifiers needs to be honest to ensure the rollup is secure.
The argument that rollups will add scams to Bitcoin simply isn't true. People can add "tokens" to the Bitcoin network today. What people should worry about is if the current fee market can sustain Bitcoin's 21 million supply cap. If it can't, then they should explore solutions that could drive more usage to the Bitcoin network! Rollups are one of those solutions and offer a set of different tradeoffs when compared to other solutions, like Drivechain.
We've compiled a list of resources that cover a number things related to rollups, both on Bitcoin and elsewhere. Check them out below.
If you’d like to add materials to this site, please see our contribute section.