Plasma Scalable Autonomous Smart ContractsJoseph PworkVitalik Buterinvitalikethereum.orgAugust 11, 2017WORKING DRAFThttps//plasma.io/AbstractPlasma is a proposed framework for incentivized and enforced cution of smartcontracts which is scalable to a signi cant amount of state updates per second poten-tially billions enabling the blockchain to be able to represent a signi cant amount ofdecentralized nancial applications worldwide. These smart contracts are incentivizedto continue operation autonomously via network transaction fees, which is ultimatelyreliant upon the underlying blockchain e.g. Ethereum to enforce transactional statetransitions.We propose a for decentralized autonomous applications to scale to processnot only nancial activity, but also construct economic incentives for globally persistentdata services, which may produce an alternative to centralized server farms.Plasma is composed of two key parts of the design Reframing all blockchain compu-tation into a set of MapReduce functions, and an optional to do Proof-of-Staketoken bonding on top of existing blockchains with the understanding that the NakamotoConsensus incentives discourage block withholding.This construction is achieved by composing smart contracts on the main blockchainusing fraud proofs whereby state transitions can be enforced on a parent blockchain.We compose blockchains into a tree hierarchy, and treat each as an individual branchblockchain with enforced blockchain history and MapReducible computation committedinto merkle proofs. By framing one’s ledger entry into a child blockchain which isenforced by the parent chain, one can enable incredible scale with minimized trustpresuming root blockchain availability and correctness.The greatest complexity around global enforcement of non-global data revolvesaround data availability and block withholding attacks, Plasma has mitigations for thisissue by allowing for exiting faulty chains while also creating mechanisms to incentivizeand enforce continued correct cution of data.As only merkleized commitments are broadcast periodically to the root blockchaini.e. Ethereum during non-faulty states, this can allow for incredibly scalable, lowcost transactions and computation. Plasma enables persistently operating decentralizedapplications at high scale.11 Scalable Multi-Party ComputationWith blockchains, the solution for enforcing correctness has generally been having everyparticipant validate the chain themselves. To accept a new block requires one to fully vali-date the block to ensure correctness. Many e orts to scale blockchain transactional capacitye.g. Lightning Network[1] requires using time commitments to build a delity bond, anassert/challenge agreement so that the asserted data must be subject to a dispute periodfor participants on the blockchain to enforce the state. This assert/challenge constructionallows one to assert a particular state is correct, and if the value is incorrect, then a disputeperiod exists where another observer can provide a proof challenging that assertion before acertain agreed time. In the event of fraudulent or faulty behavior, the blockchain can thenpenalize the faulty actor. This creates a mechanism for participants to be encouraged toenforce if-and-only-if the incorrect state is asserted. By having this assert/challenge-proofconstruction, interested participants can be able to assert ground truths to non-interestedparticipants on the root blockchain e.g. Ethereum[2][3].This structure can be used not only for payments, but extended to computation itself sothat the blockchain is the adjudication layer for contracts. However, the presumption wouldbe that all parties are participants in validating the computation. In Lightning Network,for example, the construction makes it so that one can establish commitments to computingcontract state e.g. with pre-signed tree of multisignature transactions of conditional state.These constructions allow for highly powerful computation at scale, however there aresome issues which require the summation of a lot of external state i.e. summation ofentire systems/markets, computation of a large amount of shared/incomplete data, largenumber of contributors. This of commitment to multiparty o -chain state statechannels[4] requires participants to fully validate the computation, or else there are sig-ni cant amount of trust established in the computation itself, even in single-round games.Additionally, there is usually a presumption of rounds whereby the cution path mustbe completely unrolled before contract initiation, which gives participants the opportunityto exit and force expensive computation on-chain as it is not possible to prove which partyis halting.Instead, we seek to design a system whereby computation can occur o -blockchain butultimately enforcible on-chain which is scalable to billions of computations per second withminimal on-chain updates. These state updates occur across an autonomous set of proof-of-stake validators who are incentivized towards correct behavior enforced by fraud proofs,which allow for computation to occur without a single actor being able to easily halt thecomputation service. This needs to be able to minimize issues around the data availabilityproblem i.e. block withholding, minimizing the state updates in the root blockchainnecessary in the event of byzantine actors to prevent risk-discounted transaction fees on theroot chain, and a mechanism to enforce state changes.Similar to the Lightning Network, Plasma is a series of contracts which runs on top ofan existing blockchain to ensure enforcement while ensuring that one is able to hold funds2in a contract state with net settlement/withdrawal at a later date.2 PlasmaPlasma is a way to do scalable computation on the blockchain with the structure of creatingeconomic incentives to autonomously and persistently operate the chain without active statetransition management by the contract creator. The nodes themselves are incentivized tooperate the chain.Additionally, signi cant scalability is achieved by minimizing the funds represented in aspend from a contract to a single bit in a bitmap, so that one transaction and signature rep-resents a payment coalesced with many participants. We combine this with a MapReduce[5]framework to be able to construct scalable computation enforced by bonded smart contracts.This construction allows one to be able to have externalized parties hold funds andcompute contracts on one’s behalf similar to a miner, but Plasma instead runs on top ofan existing blockchain so that one does not need to create transactions on the underlyingchain for every state update including adding new users’ ledger entries, with minimal dataon-chain for coalesced state updates.Figure 1 Anyone can create a custom Plasma chain for smart contract scalability for many di erent usecases. Plasma is a series of smart contracts which allows for many blockchains within a root blockchain. Theroot blockchain enforces the state in the Plasma chain. The root chain is the enforcer of all computationglobally, but is only computed and penalized if there is proof of fraud. Many Plasma blockchains can co-existwith their own business logic and smart contract terms. In Ethereum, Plasma would be composed of EVMsmart contracts running directly on Ethereum, but only processing tiny commitments which can representan incredibly large amount of computation and nancial ledger entries in non-Byzantine cases.Plasma is composed of ve key components An incentive layer for persistently comput-ing contracts in an economically e cient manner, structure for arranging child chains in atree at to maximize low-cost e ciency and net-settlement of transactions, a MapRe-duce computing framework for constructing fraud proofs of state transitions within thesenested chains to be compatible with the tree structure while reframing the state transitionsto be highly scalable, a consensus mechanism which is dependent upon the root blockchainwhich attempts to replicate the results of the Nakamoto[6] consensus incentives, and abitmap-UTXO commitment structure for ensuring accurate state transitions o the root3blockchain while minimizing mass-exit costs. Allowing for exits in data unavailability orother Byzantine behavior is one of the key design points in Plasma’s operation.2.1 The Plasma Blockchain, or Externalized Multiparty ChannelsWe propose a whereby multiparty o -chain channels can hold state on behalf ofothers. We call this framework a Plasma blockchain. For funds held in the Plasma chain,this allows for deposit and withdrawal of funds into the Plasma chain, with state transitionsenforced by fraud proofs. This allows for enforcible state and fungibility since one is ableto deposit and withdraw, with accounting of the Plasma block matching the funds held inthe root chain Plasma is not designed to be compatible with fractional reserve bankingdesigns.Figure 2 Plasma blockchains are a chain within a blockchain. The system is enforced by bonded fraudproofs. The Plasma blockchain does not disclose the contents of the blockchain on the root chain e.g.Ethereum. Instead, blockheader hashes are ted on the root chain and if there is proof of fraudted on the root chain, then the block is rolled back and the block creator is penalized. This is verye cient, as many state updates are represented by a single hash plus some small associated data. Thisupdate can represent balances which are not represented on the root blockchain Alice does not have herledger balance on the root chain, her ledger is on the Plasma chain, and the balance in the root chain isrepresenting a smart contract enforcing the Plasma chain itself. Gray items are old blocks, black is themost recent block that has been propagated and committed on the root chain.Incredibly high amount of transactions can be committed on this Plasma chain withminimal data hitting the root blockchain. Any participant can transfer funds to anyone,including transfers to participants not in the existing set of participants. These transferscan pay into and withdraw with some time delay and proofs funds in the root blockchain’snative coins/tokens.Plasma allows one or a network of participants in a proof-of-stake network to be ableto manage a blockchain without a full persistent record of the ledger on the root blockchain4and without giving custodial trust to the 3rd party or parties. In the worst case, funds arelocked up and time-value is lost with mass-exits on the blockchain.We construct a series of fraud proofs as smart contracts[7] on the root blockchain whichenforce state in this channel so that attempts at fraud or non-Byzantine behavior can beslashed.These fraud proofs enforce an interactive protocol of fund withdrawals. Similar to theLightning Network, when withdrawing funds, the withdrawal requires time to exit. Weconstruct an interactive game whereby the exiting party attests to a bitmap of participants’ledger outputs arranged in an UTXO model which requests a withdrawal. Anyone on thenetwork can an alternate *bonded* proof which attests whether any funds havealready been spent. In the event this is incorrect, anyone on the network can attest tofraudulent behavior and slash the bonds to roll back the attestation. After su cient time,the second *bonded* round allows for the withdrawal to occur, which is a bond on state*before* a committed timestamp. This allows for a withdrawal en masse so that a faultyPlasma chain can be rapidly exited. In coordinated mass withdrawal events, a participantmay be able to exit with less than 2-bits of block space consumed on the parent blockchaini.e. root Ethereum on-chain in worst case scenarios.In the event of a block withholding attack, participants can rapidly and cheaply do amass-exit, with substantial cost savings versus other previous o -chain proposals. Addition-ally, this does not place any trust in a coalition of validator nodes Sidechain Functionaries,Fishermen.Figure 3 Exit of funds in the event of block withholding. The red block Block 4 is a block which iswithheld and committed on the root chain, but Alice is not able to retrieve Plasma block 4. She exits bybroadcasting a proof of funds on the root blockchain and her withdrawal is processed after a delay to allowfor disputes.Similar to how closing out Lightning is an interactive mechanism between two partici-pants to enable enforcible in nite payments between themselves, this allows for an interac-5tive mechanism between n participants. The primary di erence is that not all participantsneed to be online to update state, and the participants do not need a record of entry onthe root blockchain to enable their participation { one can place funds on Plasma withoutdirect interaction on-chain, with minimal data to con rm transactions when constructingthese Plasma chains in a tree at.2.2 Enforcible Blockchains in BlockchainsFigure 4 Plasma composes blockchains in a tree. Block commitments ow down and exits can be tedto any parent chain, ultimately being committed to the root blockchain.We construct a mechanism similar to the court system. If Lightning Network uses anadjudication layer for payments which is ultimately enforcible on the root blockchain, wecreate a system of higher and lower courts to maximize availability and minimize costs innon-Byzantine states. If a chain is Byzantine, it has the option of going to any of its parentsincluding the root blockchain to continue operation or exit with the current committedstate. Instead of enforcement of an incrementing nonce state via revocations, we constructa system of fraud proofs to enforce balances and state transitions of these chain hierarchies.In e ect, we are able to create state transitions which are only periodically committed6to parent chains which then ows to the root blockchain. This allows for incredible scaleof computation and account state, as we are able to only raw data to parent orroot chain in Byzantine conditions. Recovery from partially Byzantine conditions are cost-minimized since one can go to a parent Plasma chain to enforce state.This child blockchain runs on top of a root blockchain e.g. Ethereum and from theroot blockchain’s perspective, is only seeing periodic commitments with the tokens bondedin the contract for enforcement of the Proof-of-Stake consensus rules and business logic ofthe blockchain.This has signi cant advantages in maximizing block availability and minimizing stake forvalidation of one’s coins. However, since not all data is being propagated to all parties onlythose who wish to validate a particular state, parties are responsible for monitoring theparticular chain they are interested in periodically to penalize fraud, as well as personallyexiting the chain rapidly in th