What a layer 2 inherits from its layer 1, and what it does not
Rollups borrow data availability and settlement from a base chain, while sequencing, upgrade keys and withdrawal delays remain their own risks.
A layer 2 is a separate execution environment that publishes enough information to a base chain for that base chain to be the final arbiter of its state. Users transact on the layer 2, which is faster and costs less, while the data and the proofs that make those transactions checkable are posted to the layer 1. What a layer 2 inherits from the base chain is a matter of exactly which guarantees that posting preserves, and the list of things it does not inherit is longer than the marketing usually admits.
The definition that matters is where the data goes
Every system that calls itself a layer 2 processes transactions off the base chain. The distinction that determines its security is whether the base chain receives enough to reconstruct and verify the resulting state. A rollup posts the transaction data itself to the layer 1, so anyone can rebuild the rollup's state from base-chain data alone, which is why data availability is the load-bearing concept rather than throughput.
A sidechain, by contrast, has its own validator set and its own consensus mechanism, and posts nothing that would let the base chain adjudicate. It may be connected by a bridge, but its security is entirely its own, and a user holding assets there is exposed to that separate validator set and to the bridge contract. The word layer 2 is applied loosely across this boundary in practice, so the useful question about any such system is what the base chain would be able to prove if the operator disappeared.
Two ways to prove the state is right
| Optimistic rollup | ZK rollup | |
|---|---|---|
| Default assumption | Posted state is correct unless challenged | Nothing is accepted without a proof |
| Evidence | A fraud proof submitted during a challenge window | A validity proof verified by a layer 1 contract |
| Withdrawal delay to layer 1 | The full challenge window, typically about a week | As soon as a proof is verified |
| Live requirement | At least one honest party watching and able to challenge | Correct proving system and verifier contract |
| Main cost | Delay, and the assumption of a live watcher | Computation to generate proofs |
An optimistic rollup assumes published state transitions are valid and relies on a fraud proof to overturn an incorrect one within a challenge period. A ZK rollup submits a validity proof, built with zero-knowledge proof techniques, that the base chain verifies before accepting the new state. The names mislead slightly: the zero-knowledge property is used for succinctness rather than privacy in most rollups, and users' transactions remain public.
The sequencer is the part that is usually centralized
Someone has to order transactions on the layer 2, and on most live systems that someone is a single sequencer operated by the team that built it. A single sequencer can reorder or delay transactions, extract MEV, refuse service to particular addresses, and go offline, halting the chain. It cannot steal, because the proof system or challenge process prevents it from publishing an invalid state, but the difference between cannot steal and cannot censor is exactly the difference between what a rollup inherits and what it does not.
The mitigation is a forced-inclusion path: a user submits a transaction directly to a layer 1 contract, and after a delay the rollup must include it or halt. Whether such a path exists, how long the delay is, and whether a user can exit unilaterally when the operator stops responding are the questions that separate designs. Censorship risk at this layer is operational, not theoretical.
Upgrade keys, and why they can dominate everything above
Most rollup contracts on the base chain can be upgraded, typically by a multisignature wallet held by the development team, sometimes behind a timelock. This matters more than any proof-system detail, because a proof system that can be replaced by key holders is only as strong as those key holders. Admin key risk and upgradeability risk are the terms for this, and the relevant facts are the signer count, the threshold, whether signers are independent, and whether a delay gives users time to withdraw before a change takes effect.
Bridges deserve the same scrutiny for the same reason. Historically, bridge exploits have been among the largest losses in this field, and the common thread is that the assets were secured by a small operator set or an upgradeable contract rather than by the chains on either side.
What is inherited, and what is not
Inherited by a true rollup: the ability of anyone to reconstruct state from base-chain data; final settlement of the rollup's state on the base chain; and the base chain's own reorganization and finality behavior, which means a rollup cannot be more final than the layer it settles to. Not inherited: liveness, since the sequencer can stop independently; censorship resistance of ordering, since the sequencer chooses; governance, since upgrade keys belong to the rollup's own operators; and correctness of the rollup's own contracts, which is ordinary smart contract risk.
Reading a layer 2's numbers
Total value locked on a layer 2 mostly measures assets bridged in and held in its contracts, so it is a measure of deposits at risk as much as of usage, and it double counts nothing only if the bridge accounting is right. Daily transactions and throughput describe activity but are not comparable across chains with different transaction granularity. Fees on a rollup include what it pays the base chain for data — costs that fell substantially once Ethereum introduced dedicated data blobs in a 2024 upgrade — so a rollup's fee revenue and its margin are different quantities. Comparing market cap to TVL across layers without adjusting for these differences produces numbers that look like ratios and are not.
That closes this track. For the systems built on top of these networks, continue to the tracks on applications and risk, and use TVL data, the fee pages and risk pages to see how individual layer 2s are classified here.