Arbitrum: Scalable, Private Smart Contracts

Overview

We present Arbitrum, a cryptocurrency system that supports smart contracts without the limitations of scalability and privacy of systems previous systems such as Ethereum. Arbitrum, like Ethereum, allows parties to create smart contracts by using code to specify the behavior of a virtual machine (VM) that implements the contract's functionality. Arbitrum uses mechanism design to incentivize parties to agree off-chain on what a VM would do, so that the Arbitrum miners need only verify digital signatures to confirm that parties have agreed on a VM's behavior. In the event that the parties cannot reach unanimous agreement off-chain, Arbitrum still allows honest parties to advance the VM state on-chain. If a party tries to lie about a VM's behavior, the verifier (or miners) will identify and penalize the dishonest party by using a highly-efficient challenge-based protocol that exploits features of the Arbitrum virtual machine architecture. Moving the verification of VMs' behavior off-chain in this way provides dramatic improvements in scalability and privacy. We describe Arbitrum's protocol and virtual machine architecture, and we present a working prototype implementation.

Published at the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, 2018.

Protocol Design

Arbitrum's protocol is built on the concept of a virtual machine (VM) that runs off-chain. Parties involved in a contract create and manage VMs that execute the contract's logic. The protocol ensures correct execution through a combination of unanimous agreement and on-chain dispute resolution.

The key insight is that if all parties agree on the VM's behavior, only a hash of the agreed state needs to be posted on-chain. This dramatically reduces the on-chain footprint compared to systems like Ethereum, where every computation must be verified by all miners.

When parties disagree, Arbitrum uses a bisection protocol that efficiently identifies the exact point of disagreement, requiring only logarithmic on-chain work relative to the computation size.

Consensus and Security

Arbitrum's security model relies on the assumption that at least one honest party is participating in each VM. An honest party can always force correct execution of the VM, even if all other parties are dishonest. This is achieved through the challenge-based verification protocol.

The challenge protocol works by having a disputing party identify a single step in the VM's execution where they disagree. The verifier (on-chain contract) then executes only that single step to determine which party is correct. The dishonest party's deposit is forfeited as a penalty.

This approach provides the same security guarantees as on-chain execution while requiring dramatically less on-chain computation.

Network Operation

Arbitrum VMs operate with designated managers who are responsible for advancing the VM's state. Managers post assertions about the VM's behavior, and other managers can challenge incorrect assertions.

The system uses a time-based challenge window during which assertions can be disputed. After the challenge window closes without a successful challenge, the assertion is considered final.

Arbitrum supports multiple concurrent VMs, each operating independently. This allows the system to scale horizontally, with each VM processing its own transactions without affecting the performance of other VMs.

Economics and Governance

Arbitrum uses economic incentives to ensure honest behavior. Parties who wish to participate in a VM must post a stake (deposit). If a party makes a dishonest assertion and is caught through the challenge protocol, their stake is forfeited.

The cost of challenging is designed to be much less than the cost of making a dishonest assertion, ensuring that honest parties are always willing to challenge dishonest behavior. This economic design means that rational actors will always behave honestly, as the expected cost of dishonesty exceeds any potential gain.

Implementation Notes

The Arbitrum team developed a working prototype implementation demonstrating the feasibility of the system. The prototype includes a compiler that takes Solidity smart contracts and compiles them to run on the Arbitrum VM.

The Arbitrum virtual machine architecture is designed to support efficient bisection during challenges. Instructions are structured so that the state of the VM can be fully captured in a hash at each step, enabling the challenge protocol to identify disagreements with minimal on-chain work.

The full paper is available at: https://www.usenix.org/conference/usenixsecurity18/presentation/kalodner