L2 MEV wat

June 13th, 2023

Special thanks to Nikete Della Penna, RJ, Matthew Finestone, and Brecht Devos for review and valuable insights.

TLDR

In this article, we “map” the current landscape of L2 MEV, thinking about different MEV consequences for different L2 designs. We also briefly overview different ways of L2s decentralization and how it might impact L2 MEV.

Wat is MEV

Disclaimer: feel free to skip if you are familiar with MEV. For a detailed MEV explanation, check the article “Ethereum is a dark forest” by Paradigm and the “Flash Boys 2.0” paper.

MEV – Maximal Extractable Value (ex-Miner Extractable Value before the Merge) – value extracted directly from smart contracts because of the control of ordering transactions in a particular epoch. It was first formally defined in the “Flash Boys 2.0” paper in 2019.

To understand what MEV is, we should understand who arbitrage bots are: arbitrage bots browse the blockchain systems (especially decentralized exchanges, DEXs) to find and exploit ordinary users’ DEX trades.

At the very beginning, MEV on Ethereum was extracted by Miners. mev-geth was an Ethereum mining Client and could accept bundles from searchers. Searchers competed with each other to find MEV in the mempool, build the bundle with the most potential MEV, and win the auction for mev-geth to include their bundle into the blockchain. $675.6M MEV was extracted before the Merge.

After the switch to the Proof of Stake, MEV extraction became available for validators: mev-boost (by Flashbots) was introduced to provide Proposer Builder Separation (PBS), which made MEV extraction a huge multi-million dollar, highly competitive industry (217 147 ETH (approx. $415M) MEV was extracted since Merge).

However, as Ethereum has a rollup-centric roadmap, and it is expected that 99% of all activity will be on L2s (and higher) as soon as rollups mature, the rollups’ design should consider the MEV extraction race.

As far as block building and validating participants are assumed to be rational economic actors while participating in the system, lucrative MEV opportunities might reasonably influence these participants towards behavior that is malicious from the network’s point of view.

Below we review different rollups’ designs and the L2 MEV consequences for each.

Disclaimer: This is a hypothetical mental map of L2 MEV to create at least some outline of this landscape. As for now, most rollups have a single centralized sequencer, so this is almost the only option available today. Reality might be different. So please take this article as an invitation for further research.

When we say, “99% of all activity will be (one day) on L2s and higher” the follow-up question is, “With 99% activity on L2 does it mean that 99% of MEV will be captured on L2s as well?”

L2 MEV current landscape

All L2 MEV explorations can be divided into two categories: (i) isolated MEV quantification and extraction on each chain separately and (ii) cross-chain MEV (as we have multiple chains, each with its own MEV opportunities).

MEV is a dark forest, so we can’t know exactly what is happening in this domain. But there were some experiments to quantify L2 MEV. Some examples below:

FlashBabies paper (2021): L2 MEV concept overview + deploying MEV quantifying tool on Optimism and Polygon;
MEV on Polygon (PoS) Explorer;
A paper on Formalization of Cross-Domain MEV (2021);
Cross-chain MEV leaderboard.

Disclaimer: There might be much more documented research in this domain. The list above contains only some examples.

However, L2s are different from Ethereum. So, the MEV Ethereum assumptions might be wrong regarding L2s. L2 MEV area is calling for curious MEV researchers. Below we briefly observe core rollup designs and think about possible MEV consequences for each.

Centralized Sequencers (any MEV observed? 👹)

The role of the sequencer is to order transactions into a block and submit this block onto L1. As of today, most sequencers in L2 Ethereum Rollups are single, centralized entities. And these entities are (to varying degrees) responsible for transaction ordering. That is, on most L2 Ethereum Rollups (as they are), MEV extraction is in the hands of the single sequencer.

However, in rollups with different sequencing mechanisms, the freedom of sequencing also varies. For example, in the First Come First Served model (currently used by Arbitrum), the work of the sequencer is to organize transactions into the block precisely in the same order it got them. Hence, the sequencer’s ability to extract MEV is pretty limited by the fluke.

While for example, in Optimism, the sequencer has more power over transaction sequencing – in fact, it can order transactions as it wishes. So, formally it has a hypothetical opportunity to extract MEV while sequencing. However, its power is also limited: if the transaction wasn’t included in a block within a specific time window, it would be forced to be included in the next block.

In 2020, Karl Floersch proposed the MEVA (MEV Auctions) idea at the ethresearch forum. The idea was “a single, sophisticated party wins the auction and can capture all of the MEV. The auction winner can reorder submitted transactions and insert their own, as long as they do not delay any specific transaction by more than N blocks.” However, we officially know nothing about its implementation.

~~Since 2018, when the first ZK-Rollup was deployed on Ethereum,~~ since the creation of the world, all rollups have an intention of being decentralized. As far as is known today, most of them start with centralized sequencers and an intention to decentralize them in the future. However, one should note that as long as there exists a mechanism for forced transaction inclusion in reasonable time – it’s not an actual hazard to rollup’s censorship resistance. But as of today, one of the downsides of existing forced transaction inclusion mechanisms is that they are pretty expensive, so one may argue that forced transaction inclusion is still not available for a wide audience, hence it can’t be considered as 100% censorship resistant.

However, with centralized sequencers, MEV extraction opportunities are pretty limited (until you run the sequencer). The fair (to some extent) way is to extract it in a centralized manner and then transparently re-distribute for public goods or other “good” goals.

However, as MEV is suggested to be a potential consensus hazard for general Ethereum network robustness (and most rollups still intend to decentralize the sequencer in the future), let’s go to the next chapter and see how we can handle it!

Decentralized Sequencers

Decentralization might have different shapes:

Number of participants

Decentralized ~ permissionless, meaning that anyone can join and leave whenever they want;
Partially decentralized, meaning that we have a constrained number of participants that are curated/whitelisted or chosen based on another criterion.

Mechanism

And then there are plenty of options to implement decentralization:

Auctions: parties place competitive bids in an open or closed format (ex., Dutch Auction, Sealed-Bid Second Price Auction, etc.) The winner can be assigned to a single slot or for a specific period;
Random leader election: random choice from the pool of parties meeting specific criterion (ex., from those who stake 32 ETH);
“Proof-of-Work style”: many potential sequencers compete for a slot or a period by being the most efficient, the quickest, etc;
Economic competition: different parties are competing to reach the best economic result (ex., blocks inclusion according to the block fees).

Additionally to the pure decentralization mechanism, one can also use an analogy to PBS (Proposer Builder Separation) on L1, separating a party that makes transaction bundles and a party that builds blocks.

However, having a decentralized sequencer is not the only option to decentralize block building. Another way is to outsource block proposal to a third party (for example, to a Shared Sequencer or Ethereum).

Several solutions are cooking right now

Outsource block proposal to Shared Sequencer (just a service, not a chain, ex., Espresso and Astria);
Outsourced block proposal to another chain (SUAVE – in fact, it’s a chain, so we outsource block building and mempool service to another chain);
Outsource block building to L1 (that is a Based Rollup, ex. Taiko);
Some more fancy options: a framework to multiply fractal instances where any blockchain can become a fractal instance (Anoma);

Outsourcing sequencing to Shared Sequencers

Considering the appearance of Data Availability layers and L2 landscape development, Shared Sequencers started to appear as a one-stop-shop for block building for multiple domains.

Data Availability layers are representatives of modular blockchains. The brief idea of Modular Blockchains is that instead of going monolithic, L2s should specialize in one or several (but not all) functions: execution, settlement, consensus, and data availability.

Picture Source: celestia.

Shared Sequencers (such as Espresso and Astria) produce blocks for multiple domains.

Mechanism

Shared Sequencers act as a shared proposer for other rollups: it builds blocks including and ordering transactions, and sends ready blocks to the party that will execute them (it might be rollups themselves or literally a third external party);
As a proposer, it guarantees the atomic inclusion of transactions across rollups opted into it;
They can also provide pretty fast pre-confirmation and conditional transaction inclusion;
However, Shared Sequencer doesn’t execute transactions, so it can’t guarantee that a transaction won’t revert;
Ordering for Shared Sequencers is stateless - Shared Sequencer nodes don’t need to store the full state for all of the different rollups;
SSs can be built upon L1 or separate Data Availability layers (such as EigenLayer and Celestia);
But when it comes to Censorship Resistance, we only care about transaction inclusion and ordering (not the Execution Layer), as transactions might be censored precisely at the stage of ordering. For ordering, SSs can use random leader rotation, FIFO with encrypted transactions (ex., Radius), or some other mechanisms.

Diagram source: legendary article by Jon Charbonneau “Rollups Aren't Real”.

Wat MEV

When it comes to Shared Sequencers, its core MEV value proposition is cross-chain MEV;
As no SS is currently live, we must assume some characteristics. But according to their documentation, Shared Sequencers allow rollups to extract cross-chain MEV, so one can assume that cross-chain MEV beneficiaries of SS are rollups themselves;
However, Shared Sequencer is the central actor and has access to MEV extraction as well, or at least the power to decide on the extracted cross-chain MEV allocation between rollups;
Shared Sequencer can also provide cross-chain atomicity and simultaneous execution of transactions on two different chains that make cross-chain MEV incredibly lucrative (ex., the same asset trading on two different chains at two different prices);
However, Shared Sequencer can’t guarantee that transactions will be executed in an order that they provide, nor that they will be executed at all. Formally, rollups can do the second round of transaction processing and re-order them;
So the best achievable guarantee is “all or nothing”: either both transactions on two chains are executed, or no transactions are executed;

Outsourcing sequencing to a separate chain

Disclaimer: for the official description of SUAVE, check this article at Flashbots’ website.

SUAVE is a separate chain that provides services of mempool and decentralized builder.

Imagine we have a blockchain X that uses SUAVE. Then users of blockchain X send transactions to SUAVE’s mempool instead of X’s mempool. Next, SUAVE builds blocks for chain X and sends them further to validators.

While having multiple chain transactions in one mempool, it allows the builder to provide:

Better efficiency (ex., trades with a coincidence of wants) thanks to aggregating and clearing preferences from multiple chains;
Privacy as a service (ex., SGX implementation is in the roadmap, but other solutions might be possible as well);
Better UX (ex. SUAVE pays gas fees on behalf of users in the cross-chain deal).

Mechanism

Users Preferences: Users’ preferences from different chains are aggregated in the SUAVE mempool. A preference is a message that a user signs to express a particular goal and that unlocks a payment if the user’s conditions have been met;
Executors: A network of “executors” listen to the SUAVE mempool and compete in an auction to execute user preferences. In cases where a user’s transaction creates MEV, executors would capture that as well and compete on paying as much as possible of it back to the user. However, executors are not necessarily validators of other chains, so they can’t guarantee atomic inclusion of X-chain transactions;
Block Builders: A decentralized block building network takes the collected preferences, many of which have their execution paths optimized by now, and turns them into blocks across all participating domains.

What is new, why it matters

In fact, SUAVE continues working on “intentions” (introduced by Anoma several years ago): an abstract statement of what the user wants to achieve, and the optimal routing is up to the executor (it might be either a regular “simple” transaction or a complex sequence of events across multiple domains) that provides lucrative opportunity for market efficiency optimisation (ex. decreasing slippage). However, there are pretty many things that can go wrong: (i) making intentpool (aka mempool for intents) permissioned invokes centralisation risk, (ii) high entry barrier for new parties invokes the risk of low innovation degree and diversity level, (iii) risk of system opacity in which it is unclear how or whether users’ expectations are met and threats to the ecosystem remain undetected. For detailed intents explanation, check the article by Paradigm.

Diagram source: Paradigm.

Wat MEV

No MEV (additionally to gas fees/network tips) is captured by SUAVE itself;
Searchers (that express their preferences as users on SUAVE) extract MEV asking executors to take their bundles (including cross-chain MEV);
Executors capture a share of searchers’ MEV as well (paying as much as possible back to searchers).

L1-based Sequencing (Based Rollups)

Rollups can also outsource sequencing to Ethereum (ex. Taiko). This approach was first described in Vitalik’s article as a “Total Anarchy” rollup in early 2021, and in March 2023 in Justin Drake’s “Based Rollup” concept.

Mechanism

L2 searchers collect L2 txs into bundles and send to L2 block proposers (those who collect L2 bundles into an L2 block);
L2 block proposers take L2 bundles from L2 searchers and build a block;
L1 searchers include L2 blocks in their bundles.

Wat MEV

MEV naturally partially flows to Ethereum, strengthening L1 economic security;
L2 searchers (who create L2 bundles) and L2 builders (that can just run mev-boost) also get a piece of MEV;
If an L2 searcher monitors the Ethereum mempool, the Based Rollup mempool, and both chains’ states, it can build bundles with pure cross-chain Based Rollup <> Ethereum MEV.

Other rollup designs and free space for experiments

The L2 solutions and L2 MEV landscape is currently shaping. More solutions and alternative designs might appear, and the creative area is pretty huge.

Below we mention several more solutions that handle MEV in an alternative way or are just somehow relevant to the L2 MEV topic.

No-MEV-DEX: Penumbra

A shielded DEX that executes all swaps in a block as a single batch with a common clearing price, for example, eliminating frontrunning by eliminating the entire concept of intra-block ordering or eliminating the opportunity to censor and insert stat arbs as off-chain market movements can’t be easily seen.

The protocol batches orders, matches Coincidences of Wants, and sources excess volume from all DEXs and DEX aggregators (solvers compete to find the best liquidity source for your trade across all decentralized exchanges and aggregators). Batches are hidden from public mempools. However, as “matching” is covered privately by solvers, they might have an incentive to form a cartel and deviate from the fair behaviour.

Drop-in solution for smart contracts at the application level that uses threshold cryptography based on distributed key generation (DKG) protocol to prevent front running on Ethereum.

And some other solutions that were not mentioned in the article.

Conclusion

Today, the L2 MEV landscape is a “finger to the sky” as most sequencers are still centralized. There were some attempts to decentralize centralized sequencers, however none of them were adopted in a long-term perspective, and decentralized from day one solutions are currently baking. No one has seen how it would work out concerning MEV.

Based on documents, assumptions, and testnets we have seen, there are a few ways to decentralized sequencers necessary for “fair” MEV extraction while chains stay robust and permissionless and don’t encourage centralization. All of them have different trade-offs between robustness, permissionlessness, economic security, and TBD:

No decentralization as a solution – centralized sequencer is fully responsible for transaction ordering, either extracting MEV in favor of the DAO, users, public goods funding, or any other solutions or not extracting any MEV at all, providing protection from negative MEV by no-MEV policy (it’s questionable if it works as an efficient long-term strategy but this option exists).
Limited decentralization – a limited number of whitelisted parties can act as sequencers. In 2022, Arbitrum declared an intention to use this approach. This solution is decentralized but not permissionless. The MEV outcome depends on the protocol solution: it might go to block sequencer, DAO, be shared with users, etc. As sequencers are whitelisted and their amount is limited – cross–chain MEV is limited but still possible.
Outsourcing sequencing to L1 + decentralized block building is a part of the protocol design, where fair block building and proving (designed similar to PBS) are incentivized by payments to builders and provers (presumably using mev-boost as on L1), permissionlessly run by the community. MEV naturally partially flows to L1, strengthening L1 economic security. Cross-chain MEV (both L1 <> L2 or L2 <> L2) is also extractable. In the case of a Based Rollup, the same mechanism works for L3s, L4s, etc. Taiko is currently designed using this approach.
Outsourcing sequencing to another chain, designed for efficient cross-chain MEV extraction. MEV flows to searchers and is partially shared with executors (those who execute user intentions). This approach was developed by flashbots for the SUAVE chain.
Outsourcing sequencing to Shared Sequencer – the larger the network effect, the higher cross-chain MEV extraction efficiency. The extracted MEV flows back to rollups, however, if many rollups rely on one SS – that creates a single point of failure and so we will see in practice if the SS design will provide uncompromising robustness and permissionlessness.
No sequencing – all transactions in a block are executed as a single batch. No ordering – no MEV (ex., Penumbra is a no-MEV-DEX).

However, most of these solutions are work-in-progress, arriving no earlier than 2024, and more mechanisms might appear (ex., inheriting the Ethereum MEV-burn smoothing mechanism on L2s) while the Ethereum roadmap is still rollup-centric. That means that the question is not what solution will be the first but what solution will long-term work for Ethereum in the most robust and permissionless way.

Sources: explore.marlin, “MEV on L2” paper by FlashBabies, “Unity is Strength: A Formalization of Cross-Domain Maximal Extractable Value” paper, “The Future of MEV is SUAVE” blog post by Flashbots, Rollups Aren’t Real blog post by Jon Charbonneau, odos.xyz, Espresso Systems blog post, Astria blog post.