​
Anytrust DAC

Anytrust DAC (Data Availability Committee) is a key component of the Molten Network, leveraging a variant of Arbitrum Nitro technology to lower costs by accepting a mild trust assumption. This section explains the mechanics and benefits of Anytrust DAC in the Molten Network.

​
Inside Anytrust

The Molten protocol requires that all nodes, including validators (nodes that verify correctness of the chain and are prepared to stake on correct results), have access to the data of every L3 transaction in the Molten chain’s inbox. An Arbitrum rollup provides data access by posting the data (in batched, compressed form) on L2 Ethereum as calldata. The Ethereum gas to pay for this is the largest component of cost in Arbitrum. Anytrust relies instead on an external Data Availability Committee (hereafter, “the Committee”) to store data and provide it on demand. The Committee has N members, of which Anytrust assumes at least two are honest. This means that if N - 1 Committee members promise to provide access to some data, at least one of the promising parties must be honest. Since there are two honest members, and only one failed to make the promise, it follows that at least one of the promisers must be honest — and that honest member will provide data when it is needed to ensure the chain can properly function.

​
Keysets

A Keyset specifies the public keys of Committee members and the number of signatures required for a Data Availability Certificate to be valid. Keysets make Committee membership changes possible and provide Committee members the ability to change their keys. A Keyset contains:
  • The number of Committee members
  • For each Committee member, a BLS public key
  • The number of Committee signatures required
Keysets are identified by their hashes. An L2 KeysetManager contract maintains a list of currently valid Keysets. The L3 chain’s Owner can add or remove Keysets from this list. When a Keyset becomes valid, the KeysetManager contract emits an L2 Ethereum event containing the Keyset’s hash and full contents. This allows the contents to be recovered later by anyone, given only the Keyset hash.

​
Data Availability Certificates

A central concept in Anytrust is the Data Availability Certificate (hereafter, a “DACert”). A DACert contains:
  • The hash of a data block
  • An expiration time
  • Proof that N-1 Committee members have signed the (hash, expiration time) pair, consisting of:
    • The hash of the Keyset used in signing
    • A bitmap saying which Committee members signed
    • A BLS aggregated signature (over the BLS12-381 curve) proving that those parties signed
Because of the 2-of-N trust assumption, a DACert constitutes proof that the block’s data (i.e., the preimage of the hash in the DACert) will be available from at least one honest Committee member, at least until the expiration time. In ordinary (non-Anytrust) Nitro, the Arbitrum sequencer posts data blocks on the L2 chain as calldata. The hashes of the data blocks are committed by the L2 Inbox contract, allowing the data to be reliably read by L3 code. Anytrust gives the sequencer two ways to post a data block on L2: it can post the full data as above, or it can post a DACert proving availability of the data. The L2 inbox contract will reject any DACert that uses an invalid Keyset; the other aspects of DACert validity are checked by L3 code. The L3 code that reads data from the inbox reads a full-data block as in ordinary Nitro. If it sees a DACert instead, it checks the validity of the DACert, with reference to the Keyset specified by the DACert (which is known to be valid because the L2 Inbox verified that). The L3 code verifies that:
  • The number of signers is at least the number required by the Keyset
  • The aggregated signature is valid for the claimed signers
  • The expiration time is at least two weeks after the current L3 timestamp
If the DACert is invalid, the L3 code discards the DACert and moves on to the next data block. If the DACert is valid, the L3 code reads the data block, which is guaranteed to be available because the DACert is valid.

​
Data Availability Servers

Committee members run Data Availability Server (DAS) software. The DAS exposes two APIs:
  • The Sequencer API: This API, meant to be called only by the Molten chain’s Sequencer, is a JSON-RPC interface allowing the Sequencer to submit data blocks to the DAS for storage. Deployments typically block access to this API from callers other than the Sequencer.
  • The REST API: This API, meant to be available to the world, is a RESTful HTTP(S) based protocol that allows data blocks to be fetched by hash. This API is fully cacheable, and deployments may use a caching proxy or CDN to increase scale and protect against DoS attacks.
The DAS software can store its data in local files, a Badger database, Amazon S3, or redundantly across multiple backing stores. The software also supports optional caching in memory (using Bigcache) or in a Redis instance.

​
Sequencer-Committee Interaction

When the Molten sequencer produces a data batch that it wants to post using the Committee, it sends the batch’s data, along with an expiration time (normally three weeks in the future) via RPC to all Committee members in parallel. Each Committee member stores the data in its backing store, indexed by the data’s hash. Then the member signs the (hash, expiration time) pair using its BLS key, and returns the signature with a success indicator to the sequencer. Once the Sequencer has collected enough signatures, it can aggregate the signatures and create a valid DACert for the (hash, expiration time) pair. The Sequencer then posts that DACert to the L2 inbox contract, making it available to the Anytrust chain software at L3. If the Sequencer fails to collect enough signatures within a few minutes, it will abandon the attempt to use the Committee and will “fall back to rollup” by posting the full data directly to the L2 chain, as it would do in a non-Anytrust chain. The L3 software can understand both data posting formats (via DACert or via full data) and will handle each one correctly.