Rollup protocols have recently received significant attention as a promising class of Layer 2 (L2) scalability solutions. By utilizing the Layer 1 (L1) blockchain solely as a bulletin board for a summary of the executed transactions and state changes, rollups enable secure off-chain execution while avoiding the complexity of other L2 mechanisms. However, to ensure data availability, current rollup protocols require the plaintext of executed transactions to be published on-chain, resulting in inherent privacy limitations. In this paper, we address this problem by introducing Calyx, the first privacy-preserving multi-token optimistic-Rollup protocol. Calyx guarantees full payment privacy for all L2 transactions, revealing no information about the sender, recipient, transferred amount, or token type. The protocol further supports atomic execution of multiple multi-token transactions and introduces a transaction fee scheme to enable broader application scenarios while ensuring the sustainable operation of the protocol. To enforce correctness, Calyx adopts an efficient one-step fraud-proof mechanism. We analyze the security and privacy guarantees of the protocol and provide an implementation and evaluation. Our results show that executing a single transaction costs approximately $0.06 (0.00002 ETH) and incurs only constant-size on-chain cost in asymptotic terms.

翻译：Rollup协议作为一类有前景的第2层（L2）可扩展性解决方案，近期受到了显著关注。通过仅将第1层（L1）区块链用作已执行交易和状态变更摘要的公告板，Rollup实现了安全的链下执行，同时避免了其他L2机制的复杂性。然而，为确保数据可用性，当前的Rollup协议要求将已执行交易的明文发布到链上，从而导致固有的隐私限制。在本文中，我们通过引入Calyx——首个隐私保护的多代币乐观Rollup协议——解决了这一问题。Calyx保证了所有L2交易的完整支付隐私，不透露发送方、接收方、转移金额或代币类型的任何信息。该协议进一步支持多个多代币交易的原子执行，并引入了一种交易费用方案，以在确保协议可持续运行的同时拓宽应用场景。为确保正确性，Calyx采用了一种高效的单步欺诈证明机制。我们分析了该协议的安全性与隐私保证，并提供了实现与评估。结果表明，执行单笔交易的成本约为0.06美元（0.00002 ETH），且在渐近情况下仅产生恒定大小的链上成本。