1 of 26

Economic Censorship Games in Fraud Proofs

Ben Berger¹, Edward W. Felten¹, Akaki Mamageishvili¹, Benny Sudakov²

1 Offchain Labs

2 ETH Zurich

2 of 26

L2 Chains

TX

L1 Ethereum

1:00
I’d like to start with a very over simplified background on Layer 2 chains, abstracting out the components which are less relevant for this talk.
Layer 2’s are a scaling solution for Ethereum, that aim to solve layer 1’s limited throughput problem.
A standard layer 2 receives and processes a sequence of transactions, and this updates the layer 2 state.
Every once in a while, the current L2 state is posted onto a proving protocol on the underlying L1, with the goal of convincing the L1 that the state is the true result of the computation.
The main idea is to increase Ethereum’s limited throughput, by offloading the expensive execution from Ethereum’s consensus mechanism, and using Ethereum only to record and verify that the execution proceeded correctly.
So in this picture, the bottom rectangles are the intermediate states resulting from each sub-sequence of transactions. Only these states, or rather commitments of them will be posted and proved on Ethereum, at some rate.
In the case of Arbitrum One this happens roughly once per hour.

3 of 26

L2 Chains

Challenge: Convince Ethereum that posted state is valid�

Two main approaches: ZK-rollup vs Optimistic-rollup

4 of 26

Fraud Proofs in Optimistic Rollups

Parties submit conflicting claimed states

Dispute is resolved with an interactive protocol on L1 --- �fraud proof

Competing parties submit moves alternately

Each move is an L1 transaction which reduces the dispute

Honest party guaranteed to win if all her moves get processed

5 of 26

Challenge Period and Censorship on L1

Moves are Ethereum transactions – prone to censorship.�
Censorship of honest moves could get a wrong state confirmed.

To mitigate possible censorship, parties get a significant time window to have all their required moves processed on-chain --- the challenge period.

Today this is set to 1 week in the major optimistic rollups – aimed against �strong censorship attacks, whereby attacker that controls over 50% of L1 stake has full control over which blocks are added to the canonical L1 chain.

Other forms of censorship are possible, not clear how challenge period defends against them.

1:30
So what could go wrong with this system? Well, since moves are L1 transactions, then they’re prone to censorship, which in this context is defined as any malicious activity which is intended to delay or exclude a transaction’s inclusion in the canonical chain.
In the fraud proof context, censorship of honest moves could get a wrong state confirmed.
To mitigate against this problem, fraud proof systems provide participants a large time window to have all their required moves processed on-chain. If some participant’s count-down clock reaches 0, then that participant is immediately disqualified. This time window is usually called the challenge period
The idea is that it’s hard to sustain censorship for a long time, and so the bigger the challenge period is, the calmer we are that the honest part can mange to get the required moves on chain.
Today this is set to roughly 1 week, and this is aimed against so-called censorship attacks, whereby an attacker that controls over 50% of the Ethereum stake has full control over which blocks are added to the canonical chain.
However, other forms of censorship are possible, and it’s not clear how the challenge period defends against them.

6 of 26

Economic Censorship Attacks

7 of 26

Economic Censorship Attacks

Goals:

Understand dynamics of these attacks in the fraud proof context.

What strategies will the players use? Optimal strategies?

Who is expected to win, given parameters?

Understand implications for optimistic rollup security

8 of 26

Model

9 of 26

10 of 26

The larger the challenge period T is, the more funds Attacker needs to use to guarantee victory.

Theorem

11 of 26

Theorem

12 of 26

Theorem

13 of 26

14 of 26

15 of 26

1:40
So recall, our goal is to understand how large Attacker’s budget has to be as a function of the other parameters so that she can guarantee victory.
So we define this curly A as a function of these parameters, Pi here is the configuration of regular and special rounds, and this is the minimal winning budget for Attacker given the parameters.
So first we prove that curly A is linear in D, and that its dependence on Pi is only on the number of special rounds, and not their location. So we can redefine curly A, now as a function of T,N and S (where S is the number of special rounds), and this the minimal number r, such that the attacker wins given T,N,S iff the ratio between The attacker and defender budgets is at least r.
So as an example, when S=0, this is exactly the previous game, and the theorem we've proved says exactly that curly A of T,N,0 equals T-N+1/N.

16 of 26

Theorem

17 of 26

18 of 26

19 of 26

20 of 26

21 of 26

Given Attacker and Defender’s payment offers, we calculate proposers’ strategies in symmetric Nash equilibria.

Theorem

22 of 26

Future Work

23 of 26

Thank you!

24 of 26

Fraud Proofs in Optimistic Rollups

Optimistic rollups have parties (validators) post the latest rollup state on L1, at some rate (about once per hour on Arbitrum One)

In case of disagreement, parties can submit counter-claims

Dispute is resolved with fraud proof --- interactive protocol executed on L1 where disagreeing parties submit moves alternately. Each move is an L1 transaction.

Defender guaranteed to win if all her moves get processed

1 of 26

2 of 26

3 of 26

4 of 26

5 of 26

6 of 26

7 of 26

8 of 26

9 of 26

10 of 26

11 of 26

12 of 26

13 of 26

14 of 26

15 of 26

16 of 26

17 of 26

18 of 26

19 of 26

20 of 26

21 of 26

22 of 26

23 of 26

24 of 26

25 of 26

26 of 26