樂觀 Rollup：在被證明造假之前都假定誠實

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

// A drastically simplified optimistic-rollup contract on Ethereum (L1).
// The sequencer ASSERTS a new state root; it becomes canonical only after
// the challenge window passes with no successful fraud proof.
contract RollupAssertions {
    struct Assertion {
        bytes32 prevStateRoot;
        bytes32 newStateRoot; // claimed result of executing the batch
        bytes32 batchHash;    // commitment to the L2 tx data posted as a blob
        uint256 proposedAt;   // L1 timestamp when it was posted
        address asserter;
        uint256 bond;
        bool    confirmed;
    }

    uint256 public constant CHALLENGE_WINDOW = 7 days;
    uint256 public constant BOND = 1 ether;
    Assertion[] public assertions;

    // The sequencer posts a result WITHOUT proving it is correct.
    function assertState(bytes32 prevRoot, bytes32 newRoot, bytes32 batchHash)
        external payable
    {
        require(msg.value == BOND, "post a bond");
        assertions.push(Assertion(prevRoot, newRoot, batchHash,
                                  block.timestamp, msg.sender, msg.value, false));
    }

    // After the window closes with no challenge, the root becomes final.
    function confirm(uint256 id) external {
        Assertion storage a = assertions[id];
        require(!a.confirmed, "already final");
        require(block.timestamp >= a.proposedAt + CHALLENGE_WINDOW, "still challengeable");
        a.confirmed = true;
        payable(a.asserter).transfer(a.bond); // honest asserter reclaims the bond
        // newStateRoot is now trusted: L1 withdrawals against it unlock.
    }

    // Anyone may open a dispute during the window (the game is in the next section).
    function challenge(uint256 id) external payable {
        require(msg.value == BOND, "post a bond");
        Assertion storage a = assertions[id];
        require(!a.confirmed, "already final");
        require(block.timestamp < a.proposedAt + CHALLENGE_WINDOW, "window closed");
        // ... start the bisection game; the loser's bond is paid to the winner.
    }
}

# Interactive fraud proof = a bisection game over the execution trace.
# Asserter claims: running the batch takes state root A -> B in N machine steps,
# and commits to a hash of the machine state after every step.
# The challenger disagrees about the FINAL root, so they disagree about SOME step.

lo, hi = 0, N                       # the first disputed step lies in [lo, hi)
while hi - lo > 1:                  # ~log2(N) rounds, one cheap L1 tx each
    mid = (lo + hi) // 2
    h = asserter.stateHashAt(mid)   # asserter commits to the state hash at step mid
    if challenger.agreesWith(h):    # they agree through mid -> the fault is LATER
        lo = mid
    else:                           # they diverge at/before mid -> the fault is EARLIER
        hi = mid

# Now hi == lo + 1: they disagree on exactly ONE instruction.
# The L1 contract runs that single step on-chain -- the "one-step proof":
claimed = asserter.stateHashAt(hi)
actual  = L1.executeOneStep(asserter.stateHashAt(lo), program[lo])
if actual == claimed:
    slash(challenger)               # asserter was right; the challenge fails
else:
    slash(asserter)                 # FRAUD proven: reject the assertion, roll the root back