8/ TL;DR. Subcommitments give rollups:. ✅ Fast off-chain finality .✅ Strong security assumptions .✅ Flexible and efficient DA strategies. We thank @donnoh_eth for his helpful feedback on an initial draft of this post. Read the complete article here:.

7/ Optimizing Finality & Cost. Subcommitments decouple data availability from finality. Sequencers can publish full data later (e.g. when blob prices drop or compression is optimal) without compromising user confidence. If sequencer fails to do so in a timely manner, anyone.

6/ What Subcommitments Enable. ⚡ Fast confirmations.🔐 Verifiable security.💸 Reduced gas costs. Users and apps don’t need to wait for full DA to hit L1. They can verify inclusion of a tx using just the subcommitment and local data.

5/ Introducing Subcommitments. Subcommitments are succinct cryptographic commitments (e.g., Merkle roots) to a sequence of L2 blocks. They’re posted to L1 more frequently than full data, and can be independently verified by anyone with access to the underlying data.

4/ The Rollup Dilemma. To give users quick confidence their tx won’t be reverted, rollups can publish full data to L1 fast. But doing that constantly is expensive. The challenge: how do we offer fast, secure finality, without posting all data immediately?.

3/ Why Off-Chain Finality Matters. Assuming the proof system is sound, off-chain finality offers almost the same guarantees as on-chain finality, but much faster. That’s why many systems (users, apps, wallets) rely on off-chain finality for UX and responsiveness.

2/ What is Off-Chain Finality?. Say Alice pays Bob 10 USDC on a rollup. There are two notions of finality for this tx:. - On-chain finality: When Alice's tx is proven to the L1 bridge. Usually takes hours (validity rollups) to days (optimistic rollups). - Off-chain finality:.

1/ 🔒 Subcommitments: Off-Chain Finality — Fast, Secure, and Cheap . We introduce subcommitments, a new mechanism that boosts off-chain finality without sacrificing security or cost efficiency. Let’s break it down 🧵👇

14/ Rollups aren’t “just L2s”. They’re intricate systems blending L1 trust, off-chain execution, and user-centric design. we would like to thank @donnoh_eth and @toghrulmaharram for their helpful feedback on an initial draft of this post. Follow us for more research content.

13/ Users care about one thing: UX. Low fees, fast txs, instant feedback. They don’t care about rollup mechanics. Designers must abstract away complexity while preserving security. And that’s not trivial.

12/ Based vs. Run-ahead Rollups. Based: L2 closely follows L1, reorgs together.Run-ahead: L2 can finalize ahead of L1, but may reorg later. It’s a spectrum, and design decisions here affect user trust, performance, and bridge logic.

11/ Transaction Data vs. State Diff. TD = Submit all tx data → re-executeable, easier to decentralize.SD = Submit only result + proof → more efficient, but complex. Only ZK rollups can do SD, and they sacrifice transparency + complicate user inclusion.

10/ Key Tradeoffs in Design. - Data availability: Tx data (TD) vs. State diffs (SD).- L1 awareness: Host-following vs. host-watching.- Latency vs. decentralization.- Compression vs. finalization time. Your design choices affect security, UX, and cost.

9/ Fast vs. Slow Path. 🔄 Fast: Rely on sequencer pre-conf = low latency, low security.🛡️ Slow: Rely on L1-confirmed data = high latency, strong security. Rollups must support both for usability and censorship resistance.

8/ L2 Nodes (Full + Light). Full nodes: Read L1, run CDF + STF, propagate L2 txs. Light nodes: Great for wallets. Minimal trust required, verify availability and correctness. nodes track multiple views:.⏱️ Latest (sequencer view).🧷 Safe (on L1, not final).✅ Finalized.

7/ The Prover.The brain of the bridge. Generates:.💡 Validity proofs (ZK).⚔️ Fraud proofs (Optimistic). Critical for bridging, security, and sometimes compression (in SD-based rollups). Decoupling sequencer & prover is hard, but vital for decentralization.

6/ 🌉 The Bridge.Handles asset transfers between L1 and L2. Deposits: custody on L1 → mint on L2.Withdrawals: burn on L2 → prove to L1 → release funds. Two kinds:.🔴 Optimistic: fraud-proof window.🔐 ZK/validity: validity proof required.

5/ The Sequencer. Acts fast, but trust is involved. Collects L2 txs, gives pre-confirmations to users. Batches and posts txs to L1. Can be centralized or decentralized. 🧠 Pre-conf ≠ finality. Users relying on pre-conf are vulnerable to sequencer failures or attacks.

4/ 📪 The Inbox. It’s the gateway. All L2 inputs (L1 messages, batched L2 txs) go here. Usually sent directly to L1 or posted by a sequencer with some access control.

3/ Rollup flow at a high level. 📨 Input: L2 tx data posted to L1 (calldata or blob).⚙️ CDF: Derive L2 chain from L1 inputs.⚙️ STF: Apply tx to derive new L2 state.🧾 Output: Canonical L2 chain and state. The key? It’s deterministic. Every honest node arrives at the same result.