The quick version. A layer 2 is a separate execution environment that borrows its security from the chain it settles to, rather than from a validator set of its own. The test is whether the base layer can verify or reject what the layer 2 claims, and whether your funds could be recovered using only the base layer. Rollups meet that test in two different ways. Sidechains do not meet it at all, which makes them a different thing wearing similar clothes.
The label is doing a lot of work
“Layer 2” gets attached to almost anything that runs faster or cheaper than the chain beside it. That usage describes an outcome rather than a structure, which is why it explains so little.
The structural definition is narrower and far more informative. A layer 2 executes transactions off the base chain but keeps enough of a footprint on it that the base chain remains the ultimate authority on who owns what. Its security is derived, not independent. Our layer 2 glossary entry holds the short form.
Everything else follows from one question: if the operators disappeared or turned hostile, could a user still recover their funds using the base chain alone?
What settling to a layer 1 actually involves
Two ingredients make derived security work, and both have to be present.
The first is data. Enough information about the layer 2’s transactions must be published where anyone can obtain it, so the correct state can be rebuilt independently. Without that, users are trusting an operator’s word.
The second is a way for the base chain to reject an incorrect claim. A layer 2 periodically posts a claim about its new state, and the base layer must be able to verify that claim or let somebody disprove it. How a system supplies that second ingredient separates the two main rollup families.
Making the published data cheaper to post has been an explicit goal of protocol work on Ethereum, which is why the base layer’s upgrade path matters to rollup users. We cover it in understanding Ethereum upgrades, and the underlying fee mechanics in Ethereum gas fees explained.
Optimistic rollups: assume valid, allow a challenge
An optimistic rollup posts its state claim and treats it as correct by default. Anyone who can show it is wrong may submit a fraud proof to the base chain during a challenge window, and a successful challenge causes the claim to be rejected.
The design is elegant because expensive verification only happens when something is disputed. The cost is time: withdrawals must wait out the window, since until it closes the claim your withdrawal depends on could still be overturned.
It also depends on somebody watching. The security argument assumes at least one honest party is monitoring, able to construct a proof and able to get it onto the base layer in time. Usually reasonable, still an assumption.
Validity rollups: prove it up front
A validity rollup, commonly called a zk-rollup, takes the opposite approach. Alongside its state claim it publishes a cryptographic proof that the transactions were executed correctly, and the base chain verifies that proof before accepting the update.
Nothing is assumed and nothing needs challenging, so there is no fraud-proof window to sit through. Withdrawals become available once a proof covering your transaction is produced and verified, trading the challenge delay for a dependency on proof generation.
The trade-offs sit elsewhere. Producing proofs is computationally demanding, the cryptography is harder to implement and audit, and some proof systems depend on a trusted setup, a property worth reading about rather than assuming away.
A sidechain is a different animal
A sidechain is an independent blockchain with its own consensus and its own validator set. It may be connected by a bridge, may run compatible software, and may feel identical to use. None of that makes it a layer 2.
The difference is where security comes from. A sidechain is exactly as strong as its own validators and no stronger. If they collude or are compromised, the base chain cannot help you, because it never had authority over the sidechain’s state.
The connection carries its own risk. Assets typically move by being locked on one chain and represented on the other, and the honesty of whoever controls that lock backs the representation. Bridges have repeatedly been drained when the parties securing them were compromised, a structural weakness rather than bad luck, and we go through the mechanisms in why bridges get hacked.
None of this makes sidechains illegitimate. It makes them a different trust model, to be assessed as separate chains rather than extensions of the layer 1 they are named after.
Safety: Before moving funds onto any chain that calls itself a layer 2, find out where its transaction data is published and whether you could withdraw without the operator’s cooperation. If the answer is not documented plainly, treat the deposit as trusting an operator rather than a protocol.
The honest open questions
Even systems meeting the structural definition have properties that are still maturing, and a fair explanation includes them.
- Sequencer centralisation. Ordering transactions is usually handled by a single operator. It generally cannot steal funds, but it can censor, reorder or go offline, which is why a route for users to force transactions in through the base layer matters.
- Upgrade keys. Base-layer contracts are frequently upgradeable, and whoever holds that authority can in principle change the rules governing your funds. Who holds it, and whether a delay applies before changes take effect, is a first-order question.
- Data availability. Some systems publish transaction data to the base layer, others to an external committee. The second is cheaper and changes the trust model, because rebuilding your balance then depends on that party serving the data.
These are not reasons to dismiss the technology. They are the things to check about a particular system, and the answers differ enough that no general statement about layer 2s covers them.
Key takeaways
- A layer 2 derives its security from the chain it settles to. If it relies on its own validator set, it is a separate chain whatever it is called.
- Derived security needs published data anyone can use to rebuild state, plus a way for the base chain to reject a false claim.
- Optimistic rollups assume claims are valid and allow challenges, so withdrawals wait out a window. Validity rollups prove correctness up front.
- Sidechains connect through bridges and carry bridge risk. Their security is their own validators’ and nothing more.
- Sequencer centralisation, upgrade authority and where data is published decide how much base-layer security a system inherits.
Frequently asked questions
If a layer 2 shuts down, do I lose my funds?
That is exactly what the design is meant to prevent, and whether it does depends on the system. Where transaction data is published to the base layer and users can force a withdrawal through base-layer contracts, funds should be recoverable without the operator. Where the data lives with an external party, recovery depends on that party.
Why do withdrawals from some layer 2s take so long?
Because optimistic systems accept state claims by default and allow a period in which anyone may prove them wrong. Until that window closes, the claim your withdrawal rests on could be overturned, so releasing funds early would be unsafe. Validity rollups avoid the wait by proving correctness before acceptance, so the delay reflects the security model.
Is a layer 2 as secure as the chain it settles to?
At best it inherits the base layer’s guarantees about state, and in practice it adds assumptions on top. Upgrade keys, sequencer behaviour, the correctness of the proof or fraud-proof implementation and where data is published all sit outside what the base chain enforces. It inherits a great deal and is not identical.
How can I tell a real layer 2 from a chain that just uses the name?
Ask where its security comes from. If it has its own validator set producing blocks under its own consensus, it is an independent chain. If the base layer verifies or can reject its state claims, and transaction data is published where anyone can rebuild that state, it fits the definition. The bridge is usually the tell.
Sources
Educational content, not financial advice. Crypto is volatile and high-risk; never share your seed phrase or private keys with anyone. Always do your own research.
Last updated Jul 25, 2026
