Rollups: the Scaling Idea

A swap on Uniswap costs $150. Sending USDC to a friend costs $40. Minting an NFT costs $300. Ethereum processes 15 transactions per second and cannot process more without sacrificing decentralization. How do you make transactions 100x cheaper without sacrificing security? Rollups solved this: they execute thousands of transactions on a separate server, compress the result, and publish it to Ethereum. The blockchain checks whether everything is honest. Transaction cost: less than a cent.

• **Arbitrum and Optimism** process more transactions than Ethereum L1 at a transfer cost of under $0.01 after EIP-4844
• **Base** (Coinbase's rollup on OP Stack) attracted millions of users for on-chain social apps (Farcaster, friend.tech) during 2024–2025 - something that would have been impossible at $5–50 per transaction on L1
• **EIP-4844** (March 2024) cut L2 transaction costs by 10–100x in a single day by introducing blobs - a dedicated temporary data store for rollups

Предварительные знания

• Gas: Computation Model
• Transactions and Receipts in Ethereum

The L1 Bottleneck and Approaches to Scaling

Ethereum processes **~15 TPS** (transactions per second). For comparison, Visa averages ~1,700 TPS and can peak at 65,000 TPS. During high demand periods (NFT mints, DeFi summer, airdrop claims) gas fees on Ethereum spike to $50–200 per transaction. A simple USDC transfer worth $10 can cost $80 in fees. This is a **fundamental limitation** - not a bug, but a consequence of the architecture.

Why not just increase the block gas limit? More computation per block means more load on every node. If a block requires a powerful server to verify, ordinary users cannot run nodes. The network **centralizes** - the very thing blockchain is supposed to prevent. This is the **blockchain trilemma**: you cannot simultaneously maximize decentralization, security, and scalability.

What scaling approaches exist? **Bigger blocks** (raising the block gas limit) - simple, but sacrifices decentralization. **Sharding** (splitting into parallel chains) - Ethereum was moving this direction but revised its roadmap. **Sidechains** (separate chains bridged to L1) - works, but has a fundamental flaw. **Layer 2 (L2)** - executing transactions outside L1 while inheriting its security.

The key distinction: a **sidechain** (Polygon PoS) has its **own validator set**. If 2/3 of sidechain validators collude, they can steal funds and Ethereum cannot stop them. A **rollup** publishes data to L1, so **anyone** can verify correctness and challenge fraud. Rollup security = Ethereum security.

**Plasma** (the precursor to rollups, 2017) had a fatal flaw: the **data withholding attack**. A Plasma operator could publish a state root but hide the transaction data. Users had to monitor every state root and submit fraud proofs on time - otherwise funds were lost. Rollups solved this problem decisively: all transaction data is published on L1.

Data Availability: Why Data Must Be Published on L1

The core principle of a rollup: **execute transactions off-chain, but publish data on-chain**. This sounds paradoxical - if we publish data on the expensive L1, how can this be cheaper? The answer: we publish **raw transaction data**, but we do **not execute** it on L1. Execution is expensive (gas for every opcode), while storing data is significantly cheaper.

Why publish data at all? Imagine: a rollup processes 10,000 transactions and publishes only the final state root (32 bytes - a state hash) to L1. That's cheap, but a problem arises: **what if the rollup operator published the wrong state root?** Without the transaction data, no one can verify it. The operator could have transferred all funds to themselves, and no one could prove it.

Before March 2024, rollups published data in **calldata** - a transaction field used to call smart contracts. Calldata is stored forever by every Ethereum node. Cost: 16 gas per non-zero byte. For a batch of 1,000 transactions, this came to **$500–2,000** at high gas prices.

**EIP-4844 (Proto-Danksharding)**, activated on March 13, 2024 in the Dencun upgrade, changed everything. It introduced a new data type - **blobs** (Binary Large Objects). Blobs live separately from main block data and are automatically deleted after ~18 days. Rollups no longer pay for permanent storage - only for temporary availability.

There are hybrid solutions between full on-chain and off-chain data availability. **Validium** (zkPorter, Immutable X) - data is stored off-chain by a committee (Data Availability Committee, DAC). Cheaper, but if the DAC colludes, data can be lost. **Volition** - the user **chooses**: want maximum security? - data on L1 (more expensive). Want a cheap NFT mint? - data off-chain (cheaper, but less secure).

**Full Danksharding** is the next step after EIP-4844. Instead of 3–6 blobs per block, Ethereum will support **64–128 blobs** (~16 MB of data per block). This will reduce L2 transaction costs by another order of magnitude. EIP-4844 - "proto-danksharding" - established the blob transaction format so that the future upgrade will be seamless.

The Sequencer: Central Rollup Operator

Who actually collects transactions, orders them, and sends batches to L1? This is done by the **sequencer** - a specialized node (or set of nodes) that acts as the rollup "operator". Currently, almost all major rollups use a **single, centralized sequencer** controlled by the project team.

The sequencer provides a critically important advantage - **soft confirmation**. When a user submits a transaction, the sequencer confirms it in **200–500 ms** - faster than Ethereum L1 (12 sec). This is not a final confirmation (finality comes after L1 publication), but the sequencer is economically motivated not to cheat - its reputation and stake are on the line.

**Risks of a centralized sequencer:** 1. **Censorship** - the sequencer can refuse to include certain transactions. If the sole sequencer decides to block your address, you cannot interact with the rollup 2. **Downtime** - if the sequencer crashes, the entire rollup stops. Arbitrum has experienced several hours-long outages due to sequencer failures 3. **MEV extraction** - the sequencer sees all transactions and can reorder them to extract MEV (sandwich attacks, frontrunning) 4. **Single point of failure** - a single server controls the ordering of transactions on billions of dollars in TVL

How do rollups protect against censorship? Through a **forced inclusion** mechanism. A user can submit a transaction directly to the rollup's L1 contract. The sequencer is **required** to include this transaction within a certain time (usually 24 hours on Arbitrum). If the sequencer fails to do so, the contract permits forced inclusion. This is an "emergency exit" guaranteeing that funds cannot be frozen forever.

Projects are actively working on **decentralized sequencing**. Several approaches: **based sequencing** (Ethereum L1 validators act as sequencers, proposed by Justin Drake), **shared sequencers** (Espresso, Astria - a single decentralized sequencer for multiple rollups, also enabling atomic cross-rollup composability), **distributed sequencer** (the rollup's own validator set, as in Metis). Arbitrum and Optimism have announced sequencer decentralization roadmaps, but as of March 2026 progress has been limited.

Compression: How Rollups Cut Costs by 100x

The primary cost of a rollup transaction is publishing data to L1. Execution (computation) happens on the cheap L2, but every byte on L1 costs money. That's why **data compression** is a critical optimization. The fewer bytes published to L1, the cheaper the transaction for the user.

How is such compression achieved? Several techniques work together: 1. **Address indexing** - instead of 20-byte addresses, 3–4 byte indices are used. The rollup maintains a lookup table "address → index". Address 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 (Vitalik) → index #42. 2. **Zero-byte optimization** - zero bytes cost 4 gas (vs 16 gas for non-zero bytes). Compression maximizes the number of zeros. 3. **Signature aggregation** - in ZK rollups, signatures are not published to L1 because the validity proof mathematically proves correctness. In optimistic rollups, signatures are still needed, but can be aggregated via BLS signatures. 4. **State diff vs transaction data** - instead of publishing all transactions, the rollup can publish only the **net state changes** (state diff). If one address sent 100 transactions, only the final balance is published.

Let's calculate the real cost. Before EIP-4844, calldata cost 16 gas per non-zero byte. A compressed transaction of ~16 bytes = ~256 gas on L1. At a gas price of 30 gwei: 256 × 30 = 7,680 gwei ≈ **$0.025**. Plus the amortized cost of state root + proof ≈ another $0.01. Total: **~$0.03–0.05** per transaction on Arbitrum/Optimism (before EIP-4844).

After EIP-4844, costs fell even more dramatically. Blob gas is a separate market with its own base fee. During low-demand periods, the blob gas price drops to **1 wei** (the minimum). The same 16 bytes in a blob instead of calldata: cost approaches **$0.001 or less**. This makes L2 transactions cheaper than a bank transfer fee.

**Full Danksharding** plans to increase blobs from 3–6 to 64–128 per block (~16 MB of data). With a proportional decrease in blob gas price, the cost of an L2 transaction could drop to **$0.0001** - the cost of sending an SMS. The Ethereum roadmap phrases this goal as "making L2 cheaper than L1 Solana".

Key Takeaways

• **The blockchain trilemma** - L1 cannot scale without sacrificing decentralization. Rollups bypass the trilemma: they execute transactions off-chain but inherit L1 security through data publication and proofs
• **Data availability** - the foundational principle of rollups: all transaction data is published on L1 (in calldata or blobs) so anyone can verify correctness. EIP-4844 introduced blobs - temporary storage that cut costs by 10–100x
• **The sequencer** is the rollup's central operator: it collects transactions, provides instant soft confirmations (200 ms), and publishes batches to L1. Currently centralized, but forced inclusion guarantees censorship resistance
• **Compression** - address indexing, state diffs, and signature aggregation reduce data by 7x+. L1 data fee = 95%+ of the L2 transaction cost, so every byte saved directly lowers the price
• Those $150 swaps we started with cost less than a cent on a rollup - with full Ethereum security inheritance. Full Danksharding promises another order-of-magnitude reduction

Related Topics

Rollups are the core of Ethereum's scaling roadmap, connecting L1 gas economics with concrete L2 implementations:

• Gas: the Computation Model — L1 gas determines the cost of publishing rollup data - understanding calldata pricing and EIP-1559 is essential for calculating L2 fees
• Optimistic Rollups — One of the two types of rollups - uses fraud proofs and a 7-day challenge period to guarantee correctness
• ZK Rollups — The second type of rollups - uses validity proofs (zero-knowledge), enabling instant finality but requiring expensive proof generation
• Data Availability (deeper) — An in-depth look at the DA layer: DAS, erasure coding, Celestia, EigenDA, full Danksharding

Вопросы для размышления

• If the centralized sequencer provides a soft confirmation in 200 ms and has never cheated users - is there any practical difference with a decentralized sequencer? What scenarios could reveal the difference?
• A Validium stores data off-chain and costs less than a rollup. For which applications is this an acceptable tradeoff, and for which is it not? Where does the line fall?
• If Full Danksharding reduces L2 transaction costs to $0.0001 - how will this affect Ethereum's economic model (fee burn, ETH value, validator incentives)?

Связанные уроки

• dist-14-sharding