Rollups：比特币扩容的难点

Rollups 最近已经成为比特币扩容的叙事焦点，成为第一个真正从闪电网络中“抢尽风头”的东西

Rollups have become a hot topic in the Bitcoin scaling discussion lately, being the first thing to truly “steal the limelight” from the Lightning Network in terms of wider mindshare. Rollups aim to be an off-chain layer two that is not bound or constrained by the liquidity limitations that are central to the Lightning Network, i.e. end users required someone allocate (or “lend”) them funds ahead of time in order to be able to receive money, or intermediary routing nodes requiring channel balances that can facilitate the movement of the payment amount all the way from sender to receiver.

Rollup 最近已成为比特币扩容讨论中的热门话题，它是第一个真正从闪电网络中“抢尽风头”的东西。 Rollup 的目标是成为链外第二层，不受闪电网络核心流动性限制的约束，即最终用户需要有人提前分配（或“借出”）他们的资金，以便能够接收资金或需要通道余额的中间路由节点，可以促进支付金额从发送者到接收者的一路移动。

These systems were originally developed to function on Ethereum and other Turing complete systems, but as of late the focus has shifted to porting them to UTXO based blockchains such as Bitcoin. This article is not going to discuss the current state of things being implemented on Bitcoin currently, but going to discuss the function of an idealized rollup that people are aiming for in the long term depending on features Bitcoin currently does not support, namely the ability to verify Zero Knowledge Proofs (ZKPs) on Bitcoin directly.

这些系统最初是为了在以太坊和其他图灵完备系统上运行而开发的，但最近重点已经转移到将它们移植到基于 UTXO 的区块链上，例如比特币。本文不会讨论目前在比特币上实现的现状，而是讨论人们长期追求的理想化汇总功能，具体取决于比特币目前不支持的功能，即能够直接验证比特币上的零知识证明（ZKP）。

The basic architecture of a roll is as follows: a single account (or in Bitcoin’s case UTXO), holds the balances of all users in the rollup. This UTXO contains a commitment in the form of a merkle root of a merkle tree that commits to all the current balances of existing accounts in the rollup. All of these accounts are authorized using public/private key pairs, so in order to propose an off-chain spend a user must still sign something with a key. This part of the structure allows users to leave without permission whenever they want, simply by crafting a transaction proving their account is part of the merkle tree, they can unilaterally exit the rollup without the operator's permission.

Rollup 的基本架构如下：单个账户（或者在比特币的情况下为 UTXO），保存 Rollup 中所有用户的余额。该 UTXO 包含 Merkle 树的 Merkle 根形式的承诺，该承诺承诺汇总中现有账户的所有当前余额。所有这些帐户都使用公钥/私钥对进行授权，因此为了提出链外支出，用户仍然必须使用密钥签署某些内容。这部分结构允许用户随时无需许可地离开，只需制作一笔交易证明其账户是merkle树的一部分，他们就可以在未经操作者许可的情况下单方面退出rollup。

The operator of the rollup must include a ZKP in transactions that update the merkle root of account balances on-chain in the process of finalizing off-chain transactions, without this ZKP the transaction will be invalid and therefore not includable in the blockchain. This proof allows people to verify that all changes to off-chain accounts were properly authorized by the account holder(s), and that the operator has not conducted a malicious update of balances to steal money from users or reallocate it to other users dishonestly.

Rollup 的运营商必须在交易中包含 ZKP，以在完成链下交易的过程中更新链上账户余额的 Merkle 根，如果没有此 ZKP，交易将无效，因此无法包含在区块链中。该证明使人们可以验证对链外账户的所有更改均已得到账户持有人的正确授权，并且运营商没有进行恶意更新余额以窃取用户资金或不诚实地将其重新分配给其他用户。

The problem is, if only the root of the merkle tree is posted on-chain where users can view and access it, how do they get their branch in the tree in order to be capable of exiting without permission when they want to?

问题是，如果只有默克尔树的根发布在链上，用户可以查看和访问它，那么他们如何在树中获得分支，以便能够在需要时未经许可退出？

In a proper rollup, the information is put directly into the blockchain everytime that new off-chain transactions are confirmed and the state of the rollup accounts change. Not the entire tree, that would be absurd, but the information necessary to reconstruct the tree. In a naive implementation, the summary of all existing accounts in the rollup would have balances and accounts simply added in the transaction updating the rollup.

在正确的汇总中，每次确认新的链下交易并且汇总账户的状态发生变化时，信息都会直接放入区块链中。不是整棵树，那是荒谬的，而是重建树所需的信息。在简单的实现中，汇总中所有现有帐户的摘要将在更新汇总的事务中简单地添加余额和帐户。

In more advanced implementations, a balance diff is used. This is essentially a summary of what accounts have had money added to or subtracted from them during the course of an update. This allows each rollup update to only include the changes to account balances that occur. Users can then simply scan the chain and “do the math” from the beginning of the rollup to arrive at the current state of account balances, which allows them to reconstruct the merkle tree of current balances.

在更高级的实现中，使用平衡差异。这本质上是在更新过程中增加或减少资金的帐户的摘要。这允许每次汇总更新仅包含发生的帐户余额更改。然后，用户只需扫描链并从汇总开始“进行数学计算”即可得出帐户余额的当前状态，这使他们能够重建当前余额的默克尔树。

This saves a lot of overhead and blockspace (and therefore money) while still allowing users to guarantee access to the information needed for them to exit unilaterally. Including this data in a formal rollup that uses the blockchain to make it available to users is mandated by the rules of the rollup, i.e. a transaction that does not include the account summary or account diff is considered an invalid transaction.

这节省了大量的开销和块空间（因此也节省了金钱），同时仍然允许用户保证访问他们单方面退出所需的信息。汇总规则强制要求将此数据包含在使用区块链的正式汇总中以供用户使用，即不包含账户摘要或账户差异的交易被视为无效交易。

The other way to handle the problem of data availability for users to withdraw is to put the data somewhere else besides the blockchain. This introduces subtle issues, the rollup still needs to enforce that the data was made available somewhere else. Traditionally other blockchains are used for this purpose, specifically designed to function as data availability layers for systems like rollups.

解决用户提现数据可用性问题的另一种方法是将数据放在区块链之外的其他地方。这引入了微妙的问题，汇总仍然需要强制数据在其他地方可用。传统上，其他区块链用于此目的，专门设计用作汇总等系统的数据可用性层。

This creates the dilemma of security guarantees being as strong. When the data is posted directly to the Bitcoin blockchain, consensus rules can guarantee it is correct with absolute certainty. However when it is posted to an external system, the best it can do is verify an SPV proof that the data was posted to another system.

这就造成了安全保障同样强大的困境。当数据直接发布到比特币区块链时，共识规则可以保证其绝对正确。然而，当它被发布到外部系统时，它能做的最好的事情就是验证数据已发布到另一个系统的 SPV 证明。

This entails verifying an attestation that data exists on other chains, which is ultimately an oracle problem. Bitcoin’s blockchain cannot verify anything completely except what occurs on its own blockchain, the best it can do is verify a ZKP. A ZKP however cannot verify that a block containing rollup data was actually publicly broadcast after being produced. It cannot verify that external information is actually publicly available to everyone.

这需要验证数据存在于其他链上的证明，这最终是一个预言机问题。比特币的区块链无法完全验证除了在其自己的区块链上发生的事情之外的任何事情，它能做的最好的事情就是验证 ZKP。然而，ZKP 无法验证包含汇总数据的区块在生成后是否确实被公开广播。它无法验证外部信息是否确实向所有人公开。

This opens the door to data withholding attacks, where a commitment

这为数据扣留攻击打开了大门，其中承诺