Jedi Master himself, Eli Ben-Sasson, has an intriguing riddle: (1) Eli Ben-Sasson on Twitter: “Riddle (I’ll answer this tomorrow): Why are Rollup txs CHEAPER than Validium ones on StarkEx? Rollup tx: 600 gas (@dydxprotocol)< 650 / Validium tx Wut??????????????? (Numbers from @StarkWareLtd production systems today)” / Twitter
So, how can a validium with off-chain data be more expensive than rollup with on-chain data availability? (I miswrote this initially — corrected now) Here’s my hypothesis: it comes down to transaction amortization.
A single STARK batch costs ~5M gas to verify on Ethereum, and increases poly-log for larger batches. So, it’s a highly sub-linear increase — the more transactions you have, the lower your costs are. If you have 1,000 transactions in a batch, the batch cost is very high — at 5,000 gas per transaction. If you have 1 million transactions, it’s going to be only 7–XX gas (large margin for error — I don’t know the numbers for a 1M tx batch, but it’ll be very, very low) or so — basically negligible. As a side note, StarkEx has a brilliant feature — SHARP — that lets multiple instances share this batch cost, but that’s actually a separate topic from this particular discussion. As far as I’m aware, dYdX hasn’t yet joined the SHARP bandwagon — which is why this post exists.
So, while on-chain data is awfully expensive till data sharding releases — and why there’s so much work around validium — if you have enough activity, there’s a break-even point at which rollups actually become cheaper because its per-transaction batch costs are much lower. dYdX is the only rollup instant on StarkEx currently, and it’s clear to see it has the most activity. We’ve seen peaks as high as 25 TPS, with averaging 10+ TPS over the last weekend. While this may not seem like a large number, remember — derivative trades are highly complex. Especially dYdX with fraction-of-a-second oracle updates — something not even possible on monolithic blockchains — though with the magic of signature aggregation this barely costs anything with a zkR. Either way, the 25 dYdX TPS peak is more like 150-200 TPS adjusted to simple ETH transfers. Of course, this is far from StarkEx’s capacity — it can easily scale to thousands of TPS today, and tens of thousands once data sharding is here or through validium. But, this is enough capacity at which the batch costs start rapidly diminishing. At 600 gas at 50 gwei, the average dYdX transaction costs only $0.10 — and this will continue decreasing as it gets more popular. When data sharding is released, and we have GPU/eventually ASIC provers, the cost of even the most complex DeFi trade will be well under $0.01 — perhaps even $0.001 long-term. And yes, this is in rollup mode with full Ethereum security.
So, why are validiums costing 650 gas/tx — more than rollups? It’s simple — they are much less active than dYdX at this time, so the per-transaction batch cost is much higher, high enough to not be able to compensate for the high on-chain DA costs. However, we have seen Immutable X do mass mints with on-chain transaction costs as low as 10 gas — or $0.003 — so with enough activity validiums will definitely be cheaper, and eventually the prover and DA costs will become the bottleneck — not verifying on Ethereum.
Of course, all of this can be much easier illustrated with a graph, but I’m not a blockchain/ZKP engineer and I don’t have the exact numbers. But it would be a great blog post idea for someone at StarkWare or other zkR teams like Matter Labs and Polygon Hermez.
Now, things get even more intriguing when we start considering other validity proof systems. Let’s consider PLONKs — which have a batch cost of only ~0.5M gas. Even more interestingly, this batch cost remains almost the same irrespective of the number of transactions. So, if you have 1,000 transactions, your batch cost per transaction is already very low at 500 gas. At 1M transactions per batch, your batch cost per transaction is basically negligible at 0.5 gas per tx — or $0.00007 per transaction. Of course, at this point you’re fully bottlenecked by data availability, and for validiums — prover cost.
So, at this point, it seems like PLONK rollups are just much cheaper than STARK rollups. But there’s more to it! Firstly, PLONKs have an “unfair advantage” as the EVM is much more friendly. Theoretically, with a future EVM upgrade, STARKs could become cheaper to verify — although they’ll always be more expensive than PLONKs, just by a much lesser amount. STARKs also have other advantages cryptographically— but I won’t go into those now. Back on topic, STARK provers are faster and cheaper than PLONKs. A highly active STARK rollup can actually be cheaper than a highly active PLONK/Groth16 rollup despite the higher batch cost. Again — I don’t have the numbers — but I hope to see detailed analyses by people more in the know. As alluded to above, all of this can be visualized nicely, showing us TPS at which each of the solutions are optimal — I just lack the data.
In the end, the overall tl;dr is: the more active a zkR* is, the cheaper it gets to use! dYdX with very complex derivative trades only costs $0.10 per transaction on-chain and through some clever UX is effectively $0.00 gas to the end user. And this is just the beginning!
*Don’t play mind tricks on me, Jedi Master! It’s just what everyone calls them…
Discussion here: The dynamics around validity proof amortization : ethfinance (reddit.com)
