Rollup Security Without Active Watchers Fails

The total value locked (TVL) in optimistic rollups now exceeds $10B, while the cost to attack them remains static or decreases. A single successful fraud proof suppression attack could net $100M+ for an adversary, creating a massive incentive mismatch.\n- TVL-to-Bond Ratio: Security bonds are often <1% of sequencer revenue, making attacks profitable.\n- Time-to-Profit: The 7-day challenge window is a liability, not a defense, for high-value targets.

Running a full node and monitoring for fraud is operationally complex and capital intensive. This leads to a natural consolidation of watchmen into a few professional entities like Lido, Figment, and institutional stakers, recreating the validator centralization problem from L1s.\n- Passive Capital Dominance: Staking pools attract lazy capital, disincentivizing active monitoring.\n- Single Point of Failure: A coordinated failure or compromise of top watchmen neutralizes the security model.

New paradigms like UniswapX, CowSwap, and Across rely on cross-domain intents settled via optimistic bridges. These systems cannot wait 7 days for economic security; they need cryptographic guarantees or near-instant fraud proofs. The watchman model's latency is a fundamental architectural mismatch.\n- User Experience Failure: No user will accept a week-long delay for a swap.\n- Protocol Risk: Intent systems are forced to trust centralized watchmen or sequencers, negating decentralization.

The original Optimism OVM 1.0 launched with a 7-day challenge window but no functional fraud proof system for over a year. This created a single-point-of-failure where the sole sequencer could have stolen funds with impunity. The entire security model was theoretical until live watchers were operational.

• Key Lesson: A fraud proof you can't execute is worthless.
• Key Metric: ~$1B+ TVL secured by a promise, not a mechanism.

Arbitrum's BOLD (Bounded Liquidity Delay) design initially proposed allowing validators to post bonds and exit without watching, creating a free option on liveness. This could lead to coordinated shutdowns where watchers vanish during an attack, as their capital isn't locked. The design was revised to require stake locking for any validator, forcing economic skin in the game.

• Key Lesson: Watchdog incentives must be aligned and sticky.
• Key Entity: EigenLayer restaking faces similar watchdog apathy risks.

While not a rollup, the $611M Poly Network hack exemplifies the failure of multi-sig guardians who were not actively monitoring. Rollup security councils or multi-sig upgrades are analogous; they are passive by default. Without active, adversarial watchers scanning every state root, a malicious sequencer can exploit the delay between fraud and reaction.

• Key Lesson: Passive committees cannot catch real-time fraud.
• Key Precedent: Nomad Bridge suffered a similar $190M failure from inactive watchfulness.

Even validity-proof systems are not immune. If a single prover holds the proving key and fails (maliciously or accidentally), the rollup halts. Active watchers in this context are the entities monitoring the chain for proof submission liveness and ready to trigger a prover switch via governance. Without them, you trade sequencer centralization for prover centralization.

• Key Lesson: Liveness requires watchdogs, even with validity proofs.
• Key Metric: ~0ms tolerance for proof submission failure before chain halts.

Optimistic rollups require at least one honest actor to watch the chain and submit fraud proofs. If no one is watching, a malicious sequencer can steal all funds with impunity. This creates a systemic risk where security degrades with user apathy.

• Core Failure: Security ≠ cryptography alone; it requires constant, active participation.
• Real Consequence: A silent chain is a vulnerable chain, regardless of its 7-day dispute window.

The public good problem: watching and challenging is costly, but the rewards are diffuse. Why would a rational actor spend gas to protect others' funds? Current models rely on altruism or centralized watchdogs, creating a single point of failure.

• Incentive Misalignment: Cost is private, benefit is public.
• Centralization Vector: Leads to reliance on entities like Arbitrum's Bounded Liquidity Delay or dedicated watchtower services.

Validity proofs shift the security burden from liveness to computation. A single prover can post a proof that anyone can verify instantly and cheaply. Security becomes a function of cryptographic soundness, not a race against time.

• Paradigm Shift: From "watch and challenge" to "prove and verify".
• Architectural Imperative: Eliminates the liveness assumption, making zkSync, StarkNet, Scroll fundamentally safer under user inactivity.

Mechanisms like Arbitrum's force inclusion path allow users to bypass a censoring sequencer by posting directly to L1. This mitigates censorship but does not solve fraud. A malicious sequencer can still steal if unwatched.

• Limited Scope: Only protects availability, not validity.
• High Latency: Forces a multi-day delay for user transactions, destroying UX.

Data Availability Committees (DACs) and commercial watchtower services emerge to fill the liveness gap. This recreates the trusted intermediary problem rollups were meant to solve. You now trust AltLayer, Espresso Systems, or a consortium to be honest and online.

• Trust Regression: Shifts from trust in L1 to trust in a new committee.
• Brittle Security: Becomes a high-value attack/coordination target.

Design systems where security is cryptographically enforced, not socially enforced. Prioritize validity proofs. For optimistic designs, embed economic incentives for watching (e.g., bonded challenger rewards) directly into the protocol's tokenomics. Treat passive security as a first-class requirement.

• First-Principle: Security must be verifiable, not hopeful.
• Actionable Path: Audit your stack's liveness dependencies; model failure under 0 active users.