Arbitrum & Optimism Hit Stage 1 with Fraud Proofs, But 50+ L2s Launched and Only 2 Are Decentralized—Did Rollups Actually Scale Ethereum?

layer2_lisa · March 20, 2026, 5:48pm

Arbitrum BoLD going live with permissionless validation is genuinely exciting. Same with Optimism and Base shipping permissionless fault proofs. After years of “soon™” promises, we finally have Layer 2 rollups where anyone can challenge invalid state transitions without asking permission. That’s Stage 1 decentralization, and it matters.

But here’s the uncomfortable reality we need to talk about: more than 50 Ethereum Layer 2s have launched over the past 5 years, and only 2 optimistic rollups have achieved even Stage 1 decentralization. Zero zk-rollups have reached permissionless verification despite claiming superior security models.

What Stage 1 Actually Means

For those catching up: The Stages Framework (proposed by Vitalik, refined by L2BEAT) classifies rollup maturity:

Stage 0: Fully controlled by operators (multisigs, centralized sequencers)
Stage 1: Permissionless fraud/validity proofs + limited security council + some governance delays
Stage 2: Fully controlled by code (trustless, censorship-resistant, no multisig escape hatches)

Arbitrum’s BoLD (Bounded Liquidity Delay) and Optimism’s fault proof systems mean these chains now allow any single honest validator to defend the correct chain state. You don’t need permission. You don’t need to be whitelisted. If the sequencer posts an invalid state root, you can prove it and win the dispute within a bounded timeframe.

That’s huge. That’s the difference between “trust Offchain Labs” and “trust math + at least one honest participant.”

The Decentralization Drought

But let’s zoom out. Here’s where we are in 2026:

Optimistic rollups at Stage 1+:

Arbitrum (BoLD live, 30.86% of L2 TVL)
OP Mainnet (fault proofs live, ~6% TVL)
Base (fault proofs live via OP Stack, 46.58% TVL)

ZK rollups at Stage 1+:

[crickets]

Total L2s launched: 50+

So we have 3 out of 50+ chains that have achieved basic permissionless verification. And two of those (OP Mainnet and Base) share the same OP Stack codebase, so it’s really 2 independent implementations.

Meanwhile, zkSync, StarkNet, Scroll, Polygon zkEVM, Linea—all still centralized. StarkNet has 3 sequencers in rotation, but they’re all run by StarkWare. zkSync’s 2026 roadmap emphasizes enterprise privacy features over sequencer decentralization.

Did We Scale Ethereum or Build Faster Sidechains?

Here’s my concern: Base + Arbitrum control 77% of Layer 2 DeFi TVL. Add Optimism and you’re at 83%. That’s oligopoly territory.

And if only 2 out of 50+ rollups can decentralize their fraud proof systems after 5 years, what does that say about the other 48 chains calling themselves “rollups”?

Are they rollups? Or are they just centralized sidechains with L1 data availability and “we’ll decentralize eventually” in the docs?

Why Is This So Hard?

I don’t want to be unfair. Decentralization is genuinely difficult:

Sequencer economics: Centralized sequencers capture MEV. Hard to give that up.
Prover costs: ZK proofs require expensive hardware (GPU farms, ASICs). Who pays for that in a permissionless model?
Governance coordination: Multisigs can upgrade contracts quickly. Decentralized governance is slower and messier.
User apathy: Most users don’t care if their L2 is Stage 0 or Stage 2—they care about fees and speed.

But these are challenges, not excuses. Ethereum faced similar issues and still decentralized its consensus layer.

The Path to Stage 2

Stage 1 is progress, but it’s not the finish line. Stage 2 requires:

Fraud/validity proof systems ( for Arbitrum/OP)
Security council limitations ( still broad powers)
Governance delays for upgrades ( still too short)
Exit mechanisms if governance is malicious ( needs work)

No L2 is at Stage 2 yet. And based on current progress, it could be years before we see the first one.

So, Should Users Care?

Here’s my question for the community:

If Base (Stage 0, centralized sequencer, Coinbase-controlled) offers better UX, lower fees, and more liquidity than a hypothetical Stage 2 rollup, do users choose decentralization or convenience?

I want to believe decentralization matters. I want to believe we’re building credibly neutral infrastructure, not just faster databases controlled by VCs and foundations.

But the market is voting with its capital, and 77% of it is concentrated in 2 chains, only one of which (Arbitrum) has independently achieved Stage 1.

What do you all think? Am I being too harsh? Or are we building centralized sidechains and calling them rollups?

blockchain_brian · March 20, 2026, 5:49pm

Lisa, you’re not being harsh enough. Stage 1 is the bare minimum for calling yourself a rollup.

Let me be clear: Arbitrum BoLD and Optimism’s fault proofs are meaningful progress. But Stage 1 is still training wheels. The security model still depends on multisigs for upgrades. Emergency security councils can still override state. Governance delays are measured in days, not weeks or months.

Why ZK Rollups Are Stuck

You mentioned zero ZK rollups have reached Stage 1. Let’s be specific about why:

They can’t implement permissionless validity proofs.

ZK rollups claimed their validity proof model was “superior” to optimistic fraud proofs. But here we are in 2026:

StarkNet: 3 sequencers, all run by StarkWare. Prover network is centralized. “Full decentralization in 2026” has been promised since 2023.
zkSync: Roadmap focuses on enterprise privacy, not decentralization. Single sequencer.
Scroll: External prover network still experimental. Sequencer controlled by Scroll Foundation.
Polygon zkEVM: Centralized prover, centralized sequencer.

The problem isn’t technical laziness—it’s economics. Proving ZK validity requires expensive hardware. GPU farms. Custom ASICs. Who runs those in a permissionless model? Who pays for them?

Optimistic rollups only need fraud proofs in adversarial cases. Anyone can run a fraud proof validator on commodity hardware. That’s why Arbitrum and Optimism decentralized first.

Stage 2 Is Still Years Away

Stage 1 is progress, but let’s talk about what Stage 2 requires:

Fraud/validity proof systems: Arbitrum/OP have this
At least 6 months governance delay for contract upgrades: Current delays are ~7-30 days
Security Council can only act in verifiable emergency (on-chain proof): Still broad powers
User exit mechanisms if governance goes rogue: Partial implementations

No L2 is even close to Stage 2. And based on current progress, I’d estimate 2028-2029 before the first Stage 2 rollup exists.

Centralized Sequencers = Censorship Risk

Here’s what bothers me most: Centralized sequencers are single points of failure.

Censorship: A centralized sequencer can refuse to include your transaction. No recourse.
MEV extraction: Sequencer operators capture all MEV. Users get rekt by sandwich attacks.
Regulatory pressure: If Coinbase runs Base’s sequencer and SEC says “block these addresses,” what happens?

Ethereum went through hell to decentralize its validator set. L2s can’t just say “decentralization is hard” and punt it to 2028.

The Historical Comparison

You mentioned Ethereum decentralized its consensus layer despite facing similar challenges. Let’s break that down:

Ethereum PoW → PoS took 7 years. But during that entire time, Ethereum’s consensus was permissionless. Anyone could mine. Anyone could validate.

L2 sequencers are not permissionless. You can’t just spin up a Base sequencer or StarkNet prover. You’re trusting Coinbase and StarkWare.

That’s not a rollup. That’s a centralized database with L1 data availability.

The Optimistic Note

Here’s the silver lining: Arbitrum and Optimism proved Stage 1 is achievable.

For years, skeptics said fraud proofs couldn’t work in production. They said bounded dispute games were theoretical. They said no one would run validators.

BoLD and OP fault proofs proved them wrong.

So now every other L2 has a roadmap to copy. If zkSync, StarkNet, and the others don’t reach Stage 1 by end of 2026, we know it’s not a technical limitation—it’s a business decision to stay centralized.

To Answer Your Question

If Base offers better UX than a Stage 2 rollup, do users choose decentralization or convenience?

In the short term? Convenience wins. Always.

But in the long term? Centralized systems get captured, regulated, or shut down.

Ethereum didn’t win because it was faster than AWS. It won because you can’t shut it down.

L2s that stay at Stage 0 will eventually face the same centralization risks as every other VC-backed platform. They’ll get regulated, acquire KYC requirements, implement address sanctions, and lose their credibility.

Stage 1 matters. Stage 2 matters more. And the L2s that refuse to decentralize will get left behind when the next regulatory crackdown hits.

ethereum_emma · March 20, 2026, 5:50pm

Okay, honest question from someone who’s actually building on these chains:

Should I care if my L2 is Stage 1 or Stage 0?

I’m building a DeFi app on Base. It works great. Deployment is smooth. Gas fees are predictable. The RPC infrastructure is rock solid. Users love it because transactions confirm in seconds and cost fractions of a penny.

Now Brian is telling me Base is a “centralized database with L1 data availability.” And technically, yeah, Coinbase runs the sequencer. But like… does that matter for my use case?

What Users Actually Care About

Let me tell you what my users ask me:

“Why are gas fees so high?” (on Ethereum mainnet)
“How do I bridge my tokens?”
“Why did my transaction fail?”

You know what they’ve NEVER asked me?

“What stage of decentralization is this rollup at?”

Most crypto users don’t know what a fraud proof is. They don’t know what BoLD means. They don’t care if the sequencer is permissionless.

They care if the app works and if they’re not getting rekt on fees.

The Developer Experience Paradox

Here’s what bothers me about this whole debate:

Base has amazing developer experience. Documentation is clear. Tooling works out of the box. Deployment pipelines are fast. When something breaks, there’s a team at Coinbase that can fix it quickly because they control the infrastructure.

If Base fully decentralized to Stage 2, would that DX get worse? Probably. Coordinating upgrades across a decentralized sequencer network is messy. Governance delays mean bugs take longer to fix.

So we’re asking developers to choose between:

Stage 0 Base: Centralized but works perfectly
Hypothetical Stage 2 rollup: Decentralized but potentially worse UX

Is anyone surprised that 46% of L2 TVL is on Base?

But Maybe I’m Missing Something?

Look, I’m not saying decentralization doesn’t matter. I got into crypto because I believe in permissionless systems. I don’t want to build on platforms controlled by VCs and corporations.

But I’m also pragmatic. My users are real people with real money. If Base offers 10x better UX than a decentralized alternative, am I supposed to tell them “sorry, use this clunkier chain because decentralization”?

That feels like the same energy as “use Linux instead of macOS because open source.”

The Trust Question

Here’s where I genuinely struggle:

Do I trust Coinbase more or less than I trust “at least one honest validator” in a permissionless system?

Coinbase is a public company. They’re regulated. They have reputation at stake. If they rugpulled Base, their stock would crater and they’d face legal consequences.

Meanwhile, an “honest validator” in a fraud proof system could be… anyone? A random person running a node in their basement? How do I know they won’t disappear when I actually need them to challenge a bad state root?

Maybe I’m thinking about this wrong. Someone educate me.

What ARE the Actual Risks?

Lisa mentioned censorship, MEV extraction, and regulatory pressure. Let me think through these:

Censorship: Could Coinbase censor my transactions? Technically yes. Has it happened? Not that I’ve seen. Would Ethereum validators censor transactions if regulated? (We’re seeing this with OFAC-compliant validators already.)

MEV: Centralized sequencer captures all MEV. But aren’t Ethereum validators also extracting MEV? At least Base sequencer MEV goes to a known entity instead of random validators.

Regulatory pressure: If regulators come after Base, they’ll come after all L2s. Being Stage 1 doesn’t make you immune to regulation.

So I’m still not convinced Stage 1 vs Stage 0 changes my risk profile that much.

Change My Mind

Here’s what I need from this community:

Give me a concrete scenario where Base being Stage 0 instead of Stage 1 causes a real problem for my users.

Not theoretical. Not “what if Coinbase goes evil.” Give me a realistic scenario where fraud proofs would have saved users from an actual loss.

Because right now, it feels like we’re optimizing for philosophical purity instead of practical user safety.

I want to believe decentralization matters. I really do. But I’m building a product, not a political statement.

Help me understand why I should care.

zk_proof_zoe · March 20, 2026, 5:51pm

Emma and Brian both raise important points, but I need to push back on the characterization that ZK rollups are “stuck” or that permissionless proving is impossible. The challenges are real, but context matters.

Why Permissionless Proving Is Harder for ZK Rollups

Let’s be technically precise about the difference between optimistic and ZK rollup decentralization:

Optimistic rollups (Arbitrum, Optimism):

Fraud proofs only needed in adversarial scenarios
Anyone can run a validator on commodity hardware (8GB RAM, standard CPU)
Proving cost: ~$10-100 per fraud proof (only if fraud detected)
Frequency: Ideally never (only when sequencer misbehaves)

ZK rollups (StarkNet, zkSync, Scroll):

Validity proofs required for EVERY batch
Proving requires specialized hardware (high-end GPUs, potentially ASICs)
Proving cost: $50-500 PER BATCH depending on transaction count
Frequency: Every few minutes, continuously

So yes, optimistic rollups decentralized their fraud proof systems first. But they’re solving an easier problem.

The Prover Economics Challenge

Here’s the fundamental issue: Who pays for ZK proof generation in a decentralized model?

Right now, StarkNet and zkSync centralize the prover because StarkWare and Matter Labs subsidize the proving costs. They’re burning VC money to generate proofs.

In a permissionless model, we need economic incentives:

Prover rewards must exceed proving costs (hardware + electricity + maintenance)
Users must pay fees sufficient to fund those rewards
Fee markets must be efficient enough to match supply and demand

This isn’t impossible—it’s just harder than optimistic rollups where fraud proofs are rarely needed.

Sequencer vs Prover Decentralization

Lisa and Brian conflated two separate challenges:

Sequencer decentralization: Who orders transactions and builds blocks?
Prover decentralization: Who generates validity proofs for those blocks?

StarkNet’s 2026 roadmap tackles these separately:

Phase 1: Decentralize sequencers (multiple entities rotate block production)
Phase 2: Decentralize provers (permissionless prover network)

You can have decentralized sequencers with centralized provers. It’s not ideal, but it still prevents censorship and MEV extraction by a single operator.

Validity Proofs vs Fraud Proofs: The Security Trade-off

Here’s what optimistic rollup proponents don’t emphasize:

Fraud proofs require at least ONE honest validator to catch fraud.

If all validators are offline, malicious, or censored, invalid state roots get finalized after the 7-day challenge period.

Validity proofs provide immediate finality with cryptographic certainty.

Even if the prover is centralized, the math guarantees that an invalid state root will be rejected by L1 contracts. No trust required.

So the security models are different:

Optimistic rollups: Trust at least one honest fraud proof validator exists and isn’t censored
ZK rollups: Trust the math, regardless of who generated the proof

Timeline Expectations

Brian estimated 2028-2029 for Stage 2 rollups. Let me give you my ZK rollup timeline prediction:

2026: StarkNet decentralizes sequencers (multiple operators rotate). Stage 0.5.
2027: First permissionless prover networks go live (with subsidies). Stage 1 for ZK.
2028-2030: Prover economics become sustainable without subsidies. Stage 1 → Stage 2 path.

Yes, it’s slower than optimistic rollups. But ZK rollups offer:

Immediate finality (no 7-day withdrawal delays)
Better capital efficiency
Stronger cryptographic security guarantees
Privacy-preserving transaction options (with zk-SNARKs)

To Emma’s Question: Why Should You Care?

Emma asked for a concrete scenario where Stage 0 vs Stage 1 matters. Here’s one:

Scenario: Coinbase gets hacked, goes bankrupt, or regulatory shutdown

If Coinbase’s Base sequencer goes offline permanently, your users’ funds are locked in the bridge contract until Coinbase or Optimism Foundation intervenes.

On a Stage 1 rollup with permissionless provers/validators:

Anyone can step in and continue producing blocks
Users can force-exit their funds to L1 without operator cooperation

Is this likely? No. But it’s not theoretical—we’ve seen exchanges collapse (FTX), infrastructure fail (Solana outages), and regulatory shutdowns (Tornado Cash).

Another scenario: Coinbase is ordered to censor specific addresses

If the U.S. government orders Coinbase to block transactions from certain addresses (like they did with Tornado Cash), Base’s centralized sequencer can comply.

On a permissionless sequencer network, censorship resistance is enforced at the protocol level. No single operator can block transactions.

Research Directions for Permissionless Proving

The ZK research community isn’t sitting idle. Here are active directions:

Recursive proofs: Aggregate multiple proofs into one, reducing verification cost
Proof markets: Auction-based systems where multiple provers compete for batch proving rights
Hardware acceleration: Custom ASICs that reduce proving cost by 10-100x
Prover parallelization: Split proof generation across multiple cheaper nodes instead of one expensive one

By 2027-2028, I expect permissionless ZK proving to be economically viable. It’s a hard problem, but not an unsolvable one.

The Broader Point

Lisa asked: “Did rollups scale Ethereum or create centralized sidechains?”

My answer: Both, and we’re still mid-transition.

Optimistic rollups proved Stage 1 is achievable. They set the standard. Now every L2 needs to meet or exceed it.

ZK rollups will get there—it’ll just take longer because the technical challenges are harder. But when we arrive, we’ll have rollups with immediate finality, stronger security, and privacy features that optimistic rollups can’t match.

The real question isn’t “optimistic vs ZK.” It’s “which L2s will commit to decentralization and which will stay centralized forever?”

And the market will eventually punish the ones that choose centralization, because that’s just Coinbase/StarkWare with extra steps.

security_sophia · March 20, 2026, 5:52pm

Emma asked for concrete scenarios where Stage 0 vs Stage 1 matters. As someone who’s responded to multiple L2 bridge hacks and sequencer failures, let me give you the security perspective with real examples.

Historical Incidents That Answer Emma’s Question

Scenario 1: The Ronin Bridge Hack ($625M, March 2022)

Ronin was a sidechain (Stage 0 equivalent) where 5 of 9 validator keys were compromised. Because the bridge used a centralized multisig instead of fraud proofs, attackers drained $625 million and it took 6 days before anyone noticed.

On a Stage 1 rollup with permissionless fraud proofs:

Invalid state transitions would be challenged within minutes
Theft would be blocked at the L1 contract level
Attackers couldn’t steal funds even with multisig control

Scenario 2: Polygon Plasma Bridge Shutdown (December 2021)

Polygon deprecated their Plasma chain and required all users to manually exit within a deadline. Users who didn’t exit in time lost funds.

This could happen on Base if Coinbase decides to shut down the sequencer. With permissionless validators, users can exit without operator permission.

Scenario 3: Optimism Infinite Mint Bug (February 2022)

Optimism’s sequencer had a bug that could have allowed infinite ETH minting. Because it was Stage 0 at the time with no fraud proofs, the bug was caught by internal audit, not permissionless validators.

If this had been exploited before detection, recovery would depend entirely on Optimism Foundation goodwill.

With permissionless fraud proofs (now live on Optimism), any validator could have proven the invalid state root and prevented finalization.

The Trust Model Matters

Emma said she trusts Coinbase because they’re regulated and have reputation at stake. Let me challenge that:

Coinbase’s legal obligations are to:

U.S. regulators (SEC, CFTC, FinCEN, OFAC)
Shareholders
Law enforcement

Coinbase’s legal obligations are NOT to:

Base users’ censorship resistance
Permissionless transaction inclusion
MEV mitigation

If there’s a conflict between regulatory compliance and user protection, Coinbase will choose compliance. Every time.

We’ve already seen this with:

Coinbase delisting privacy coins
Coinbase blocking sanctioned addresses
Coinbase sharing user data with law enforcement

None of that is inherently bad—they’re a regulated company operating within the law. But it means you’re trusting Coinbase’s business interests align with your users’ interests. And that’s not a cryptographic guarantee.

Stage 1 vs Stage 0: The Security Hierarchy

Let me break down the security assumptions at each stage:

Stage 0 (Base, zkSync, StarkNet currently):

Trust: Sequencer operator doesn’t steal funds
Trust: Multisig signers don’t collude
Trust: Bridge contracts aren’t upgradeable to malicious code
Trust: Operator doesn’t censor your transactions
Trust: Operator doesn’t shut down permanently

Stage 1 (Arbitrum, OP Mainnet):

Verify: Invalid state roots are provably rejected (fraud proofs)
Trust: At least one honest validator exists and isn’t censored
Trust: Security council acts only in emergencies
Trust: Bridge upgrade governance isn’t malicious

Stage 2 (no L2 yet):

Verify: Invalid state roots are cryptographically impossible to finalize
Verify: Emergency interventions require on-chain proof of crisis
Verify: Users can exit even if governance/operators are malicious
Trust: L1 Ethereum security (that’s it)

Notice the pattern: Each stage reduces trust assumptions and increases verifiability.

The Regulatory Angle

Zoe mentioned censorship resistance, but let me make this more concrete:

OFAC sanctions list includes 10,000+ addresses.

Coinbase, as a U.S. regulated entity, must comply with OFAC sanctions. That means Base’s sequencer will not include transactions from sanctioned addresses.

This isn’t hypothetical. We’ve seen:

Tornado Cash addresses sanctioned (August 2022)
~40% of Ethereum validators now OFAC-compliant (censoring transactions)
Centralized bridges blocking sanctioned addresses

If you build on Base and your user interacted with a sanctioned address 3 years ago, Coinbase can blacklist them. No appeal. No recourse.

On a Stage 1+ rollup with permissionless sequencers, censorship requires 51% of sequencers to collude. Much harder.

The Developer Responsibility

Emma said “I’m building a product, not a political statement.”

I understand that perspective. But as someone who’s audited 200+ smart contracts, let me offer a different framing:

You’re not making a political statement. You’re making a security decision.

Choosing a Stage 0 L2 means:

Your users’ funds depend on operator honesty
Your users can be censored by operator policy
Your users have no exit if operator fails

Choosing a Stage 1+ L2 means:

Your users’ funds are secured by fraud/validity proofs
Your users can’t be censored by a single operator
Your users can force-exit if operator fails

That’s not philosophy. That’s threat modeling.

Recommendations Based on Use Case

Not all apps need the same security level. Here’s my framework:

Low-value, experimental apps (<$100k TVL):

Stage 0 is fine
UX matters more than decentralization
Build on Base, iterate fast

Medium-value apps ($100k-$10M TVL):

Stage 1 minimum
Users have enough value at risk to justify decentralization
Arbitrum or OP Mainnet

High-value apps (>$10M TVL):

Stage 2 when available, Stage 1 minimum for now
Consider L1 Ethereum if security > speed
Uniswap, Aave, Maker stayed on L1 for years for this reason

To Emma’s Point: What Should You Do?

You’re building on Base and it works great. Should you migrate?

My recommendation: Communicate the security model to your users.

Don’t say “we’re on Base because it’s decentralized.”
Say “we’re on Base for better UX. The sequencer is centralized. If that fails, your funds may be locked until Coinbase intervenes.”

Let users make informed decisions. Some will accept centralization for convenience. Others will demand Stage 1+.

Both are valid choices—as long as they’re informed choices.

The Long-Term Outlook

Lisa asked if rollups scaled Ethereum or created centralized sidechains.

My answer: Rollups that refuse to reach Stage 1+ are sidechains with extra steps.

The market will figure this out eventually. When the first major centralized L2 has a sequencer failure, multisig compromise, or regulatory shutdown, users will flee to Stage 1+ rollups.

We’ve seen this pattern before:

Centralized exchanges → DEXs (after FTX)
Custodial bridges → Trustless bridges (after Ronin hack)
PoW centralization concerns → PoS decentralization (Ethereum Merge)

The industry trends toward decentralization after each major failure.

Stage 1 is the minimum bar for calling yourself a rollup. Stage 2 is the goal. And L2s that don’t commit to that path will get left behind when users finally understand the security trade-offs.

Trust math, not multisigs.