Vitalik Buterin says rollups must prove security before decentralizing

Ethereum co-founder Vitalik Buterin explained when rollup-based layer-2 platforms should go decentralized, and why “as soon as possible” is not the correct answer.

In a May 5 X post, Buterin said there is a right time for rollup-based scalability solutions to transition to a decentralized model. This moment depends on how low the proof system’s failure probability has fallen compared with the risks introduced by centralization.

Buterin’s thread came in response to a separate post by decentralized exchange Loopring founder and CEO Daniel Wang. Wang said in his thread that the maturity of a system matters to its security:

“Not all code is created equal. A rollup can be Stage 2, but running fresh code that’s never been tested under real stress.“

Rollup development is classified into stages: stage zero, stage one and stage two. Each stage is increasingly decentralized, with stage two being fully decentralized and trustless.

Related: Vitalik Buterin’s vision for Ethereum: Pectra, Glamsterdam and beyond

Code that experienced war

Cryptocurrency systems that manage significant assets are exposed to profit-motivated bad actors worldwide. Even if a project does not feature a bug bounty program promising payments to people who find vulnerabilities, it is still taken apart under a microscope — it may just pay more for its faults.

This threat is growing as nation-state-backed bad actors increase their crypto activity level. One such example is the Lazarus hacking group, responsible for many high-profile hacks in the crypto space, including the $1.4 billion Bybit hack.

Wang suggested introducing a new metric for veteran code that survived the pressure of being exposed to highly motivated advanced hackers and hacker groups: “BattleTested.” The BattleTested badge would be awarded to a rollup that consistently secured at least $100 million of assets for at least six months, with at least $50 million in Ether (ETH) and a major stablecoin.

Also, this badge would be lost at every update, as the new code needs to survive the onslaught of attackers to earn it. Buterin commented on the analysis:

“A good reminder that stage 2 is not the only thing that matters for security: the quality of the underlying proof system matters too.“

Analyst at Kronos Research Dominick John told Cointelegraph that “to responsibly transition from stage 1 to stage 2, rollup teams must […] take a hard look at correlated risks like shared custody weaknesses or geopolitical chokepoints that can compromise the reliability of multisig security councils.” He said that such risks often go unnoticed until the locked value crosses $100 million. He added:

“The real green light for decentralization comes not when the proof system looks good on paper, but when it proves under real economic pressure that it’s more reliable than the potential for coordinated failures among council members.“

Related: Vitalik wants to make Ethereum ‘as simple as Bitcoin’ in 5 years

When to go decentralized?

Buterin said the best time for a protocol to go decentralized is when its onchain proof system is safe enough that the centralized components serving as a point of failure or collusion risk becoming the bigger threat. This is because until a system is proven to be secure enough, decentralization, which increases the reliance on this system, may end up making the system less secure.

Chart showing example rollup risk analysis per stage. Source: Vitalik Buterin

Mike Tiutin, chief technology officer at decentralized compliance protocol PureFi, told Cointelegraph that “going decentralized too early […] can leave users vulnerable.”

Kronos Research’s John said that “decentralization isn’t a race, it’s a long-term responsibility shared by the entire ecosystem.” He added that rushing to stage two puts ideology before safety and increases risks:

“In stage one, councils can step in if something breaks. In Stage 2, a single bug could wipe out billions with no rollback.”

While going decentralized right away is recognized as problematic, some experts highlight not going decentralized at all. Arthur Breitman, co-founder of the Tezos blockchain, told Cointelegraph that “prominent Ethereum L2s” are fundamentally custodial, adding:

“Privileged entities control core logic, jeopardizing asset integrity; banking on their immunity to collusion is fragile, and failure is likely to be correlated.“

Yishay Harel, CEO and co-founder of rollup-centric blockchain Dymension, highlighted that “Ethereum wasn’t originally built to settle rollups.” This leads to tradeoffs:

“Move too fast toward decentralization and you risk breaking critical systems; move too slow and you remain effectively custodial, governed by multisigs and upgrade keys.“

Harel said that while Buterin’s idea of gradually staging decentralization as a system matures is “smart,” it also highlights a concern — that the underlying architecture wasn’t originally designed for sovereign execution environments.

Magazine: What are native rollups? Full guide to Ethereum’s latest innovation