Zinc: developer-friendly programming framework for zero-knowledge proofs

Transcript

hi everyone my name is Alex I'm from Manalapan we will work on seek a sink scaling solution for aetherium and we so yeah because we all have a problem no matter what your interest in krypter is like defy building the apps invest in crypto startups doing any other things you will only have success if you can reach reach mass market like if we can scale crypto to to the mainstream adoption but not just bring it to a lot of people we have to maintain the properties which make ripped valuable such has it has to be

permissionless you should be able to verify all the transactions not relying on any other parties to doing it for you without like who you don't trust and it should be censorship resistant so powerful adversary should not be able to oppose it so you can try to do it with like layer ones have a difficulty to solve all of this at once at scale because they have to focus on security so maybe they will succeed maybe not but we in theorem we have a large ecosystem to boost traffic an ecosystem is difficult so let's see what we can do in an existing ecosystem like aetherium so let's look at layer 2 there isn't there's been a number of approaches of

solving scalability and layer 2 can we do it with side chains not really because they've been around for a very long time and they never didn't really took off because they require too much too much trust in like a lot of people a lot of people have to be trustworthy in order for side chains to work so if they don't work can we do it with payment channels or more generic state channels well here we have a number of problems I'm sorry it was the slide for months but essentially like they like really a lot of problems they are vulnerable to online attacks on the notes the people are running like lightning notes for

example do not safe because all the funds can be is like taking if the note is attacked they're very capital inefficient because you have to park a lot of capital open channels for each person and they're not generic you have to reopen the channel every time the capacity is exhausted and so on and there was no generic in the sense that you cannot have transactions from multi party to multi party so you really need something like a side chain but more Universal and more trustless so what about plasma or plasma was a very promising step in this direction but it turned out

unfortunately plasma is kind of dead right now so I'm referring to this great article by dragonfly guys who explored in detail but the thing was there was just too many Devils in the detail of implementation just technical pitfalls most important being the data availability issue so but what about the roll-up there is a nice successor of plasma well turns out a number of companies who were previously focused on either side chains of state channels or plasma are now doing roll-ups so I also believe that roll-up is the the most feasible way to scale aetherium today Vitalik is talking a lot about

this everybody is like oh ah this is the thing right now but there is a catch there are two different roll-ups the one is called optimistic and the other is called zucchero up how many of you know what's the difference okay not many people so I'm good I actually have an article about this where which goes indeed in great detail about the differences in technical analysis but I'm gonna give a high-level overview right now so let's start with optimistic roll up and I'm sorry about the formatting we just changed it to keno to power plant so the optimistic roll up to me it resembles a lot a caravanserai so

it's a fortress in the middle of desert where merge scum like it's an intersection of trade routes and you come there with your goods you enter you submit the goods to the guards so we have a few rolls here we have guards there fair or rather well maybe not so fair because they represented by three miners so whatever they do will be will be done so you kind of trust them because you're leaving this Empire anyway and if you don't trust the guards they I mean they can take anything from you no matter what you do so you submit it to them they are fair they're supposed to do what like if you give them fair evidence of whatever they will act on this regard and now there are people who actually own the

car once all right and you go and you make trades with other merchants and they help you they keep the track of all trades so you don't physically change the goods you just make a public ledger on some parchment and you just record like I give you two camels you give me five sacks of grain and so on and then at the end once you've done trading you want to leave the caravanserai and you go to the guards and tell them so this and this and these goods belong to me now I want to leave so what the guard does is they take the goods place it in one of the towers and in make an announcement and say like this guy wants to leave with his goods

you see okay shall I let him out and then anybody can come to the garden tell him no no he it's out right like look we have some trades here which do not go on he cheated he didn't get this stuff from me right the problem is it's not only from me like you actually have to track all the trades because maybe there been some trades like you gave me a camel we had the fair trade but you didn't know the camel in the first place right so you need to track it all the way back so we rely on these guys they should track it for you because it's a lot of work I mean anybody could theoretically go and check all the records on the rider but it's unrealistic nobody has incentives like think these guys they get the

profit they the only place so like if at least one of them is honest and actually does his job and comes to the garden tells him then you will be fine yeah if not somebody could just take all the gold and walk away one day because nobody is there to stop him so threes like this tricky balance of trust incentives you might decide to trust it you might not decide to trust it but I mean it's a lot tech technology would expect from a car monster I you know what you don't have better means but my focus is now on how it feels to you look you want to leave you have you cannot leave immediately you always have to wait certain period of time and in terms of a theorem it's

at least one week you cannot leave an optimistic row up until there's been some time to notify the theorems like somebody has to submit a transaction theory I made the jammed there might be like do you know of service attacks on the on on the role of operators and so on so one week at least so how does it compare to a Zika Rolla well-secured law roll up is more like this like it's a high-tech solution anybody can walk in make some trades purchase some stuff walk out with stuff or without stuff every single transaction is tracked but it's tracked in the non-intrusive way

and it's almost instant you just walk out and like if something was if you stole something it will immediately ring and you're gonna be stopped right so like this is the the comparison so obviously I'm biased I believe that this is what we should be doing in 2020 and this is why we built easy casing on the principles of secure all so you can think of the casing as theorem on layer 2 which is secured by zero knowledge proof but it has a number of properties which are different two theorems so what is same is we mirror the security of layer 1 so whatever is security you have on layer 1 you like your fonts in a

rollup as far as secure as layer 1 period like we we guarantee that unless there are box of course but it's gonna have a censorship resistance so if the operators do not like you you can always withdraw your funds no matter what but it has some differences so we will support visa scale throughput and we will have instant confirmations like there are tools which allow us to do this so here is our roadmap we spent the last year essentially focusing on the fundamentals of zero knowledge proof because the previous technologies which we had like the state-of-the-art proving system was girl 16 it required

application specific trans to setup and we cannot now think of an application specific trust to setup of anything but a test net so like the MVP which we're gonna launch very soon is gonna be based on probably unplug a universal set up system we had a universal ceremony done together with the odd stack I mean they initiated with will participated with a lot of highly permanent people also taking part in it we also have a redshift which is a completely transparent probe system and which is much more efficient for recursion which we need for smart contracts which we're probably going to use in the second step so this can be some combination of that

but now this part is done so we now have a very solid basis we can generate the proofs really fast and now we're gonna start with cheap air C 20 token transfers with an account based model like an ethereal so you move stuff you move your funds in and you can transact Lea cheaply with the same guarantees of security as a theorem the smart contracts privacy in distance lies governance comes later and if you're interested in smart contracts please come to my talk the day after tomorrow where I'm going to talk about zinc our smart contract like zqp programming framework which we're gonna use for smart contracts but I want to highlight

some UX properties of the casing like what's what what what really differentiates it now well first of all you will be able to use any wallet and you don't have to be online you just you open the wallet whenever you need it you make section and you walk away so it's just as good as the main at etherium you will be able to use any wallet because we integrated a secret derivation from the keys in the wallet but we actually have a do two-factor protection so you every transaction will be signed by the wallet inside the wallet as well as by the keys in the application which we have which is going to be double check so I can

explain technical details later but you like it's really hard to like it is somebody to to steal your funds will have to break a few things including your wallet now you are going to share the same address which you have on your on your wallet and and with wallets by the way you also can use Universal smart universal logging wallets something like argent or multi C quality to it all will work as well right so whatever address you have there you will have in the ZK sync and you will just have something like ZK eath ZK die ZK whatever as

separate tokens which appear in your account and under the same address then you can send them to somebody else and we promise you that the confirmation times are going to be really fast no matter how many transactions are there because we have now universal proof system we can afford to support multiple types of blocks really easily and we will have universal blocks so like all types of transactions in the block are mixed deposits exits transfers transfers to new accounts everything is mixed and like we just fill the block as much as we can and if the time timeout triggers we submit this box to be proven and

submitted to theory and what's really interesting that it gives us out of box gasless Matic transactions so you as a user do not need to own any ether or to make any transact on aetherium whatsoever in order to use the kissing so all you do is you have your wallet you connect you get an A or you don't need to connect you just take your wallet you see your address you give it to somebody they send you tokens in the casing maybe easier maybe tokens you see them in your account anytime you can just connect use it send to somebody else or send to your ethereal matarese all without doing anything on the theory on my net it's all going to be done as a

matter transaction inside the casing for you yeah so that's pretty much it the grief all the philosophy it just works it should just work so you have a demo please go check it out for yourself we don't have the beautiful designs yet there they are coming in a couple of weeks but it's a more simple version but it has all the functionality so it works and yeah please follow us on Twitter and that's it I'm happy to answer any questions [Applause] hey do you need spam protection on your

meta transactions not really because you're gonna pay for them you pay a small amount which covers the cost okay so you pay the you pay fees in the token which which has been transferred to B if it's died then you play some small sense okay and we also have a protection against overflow of addresses in in is your knowledge profits of all but eventually we will be able to support Universal accumulators which are which have almost infinite capacity like ethereal so it won't be a problem are there permissionless can I how it

works is you have operators or validators of Zeki sink so you always interact with them you send them a transaction which is signed off chain and they execute it for you they put they take your transaction and put it in the block then the this block when it's full or like this is just to some degree complete we generate the proof for you and submit it to to aetherium so when I say we I'm in the validators now in the first version we can no launch with just as being the single validator but eventually this is the part of the road map we have decentralized governments and we anybody will be able to become a validator so this is very very fundamental for us like this is one

of the core values this is why we're doing this thing we don't want a centralized solution we're building something which is going to be completely open you will be able to make an validator even if you don't want to purchase like tokens from from anybody else so there will be a way for you to completely permissionless lee become a validator in this case in framework networks are the answer but how do you decides what's listed how do you decide about the fees is it constant is it going to be somehow like a you know the team will decide so for now we're gonna operate at break even capacity so we're gonna the fees are gonna be comprised of

the cost of block production the general is your knowledge flow generation plus a small gas fraction which you always have in a row up so for us a simple transfer costs 16 bytes on the main chain so for each transfer we have to put 16 bytes there which is something like 300 gasps so we will have to pay for this if if the room gas goes up we will have to raise the prices with bit so it will be 0 something sent this your knowledge part is gonna be cheap and it's getting way cheaper with accelerated proving so who decides the operators decides in the

beginning we are gonna be the only operator while the like during the active development of the casing once we transition to decentralized governance we will give it over to the marketplace like essentially the miners will decide just like mine are so amazing so far some micro transactions in may not work I guess they will work why not I mean the game well if the cost of the transaction will be pretty big define micro transactions yeah I don't know fraction of cent it will be less than fraction of cent unless theorem gas costs go up so much that they will have to be compensated so you always have this 300 gas plus some fraction of the proof but it's gonna be amortized along

among thousand transactions so let's say 300 gas per transaction it's gonna remain this is the price for data availability we should pay which solves like so many problems this is what makes rollup different from plasma so I mean to confirm one transaction I still need to wait for a block on etherium years which will validate the proof oh this is a good question so you like the question is like if I want to follow up on the I mean continue to a second transactions which it depends on the past transaction I need to wait that this is great question you don't have to wait this is precisely why we have like we have universal blocks so you you you you you use the a transaction you get a confirmation instantly from the validators in the beginning while we are operating this I

mean like let's say in the first version this confirmation is just a promise from us we promise we like we're gonna keep our work we're just gonna include the next block once you have a confirmation you can immediately start using it so I send it to you you see it immediately you can immediately send it to somebody else and you can already try it out in the demo now in the future versions this promise is also going to be backed by obligation so you like you will actually have as strong confirmed like as strong guarantee that your transaction is going to be included as though you'd have confirmations on etherium okay how do

you protect about some Forks so let's say even though I received a continuation from one operator there's an operator who for some reason of a network partitioning decides that building is unblocked and indication inside the kissing or you mean on the interaction between layer one and the kissing okay so inside is very simple we're gonna have a separate consensus mechanism so we're working on a separate consensus where the blocks are going to be produced approximately once a second so we are gonna use a Facebook hot stuff we did some experiments with it we experimented with tender mint and hot stuff and we decided in favor of hot style because it's written in rust which

or all our code base is written in and also because hot stuff is better suited for for the type of consensus which we need because we are validators are good like they will have to need powerful resources anyway so hot stuff better adjusts to the net the network latencies and network partitioning than tender mint but eventually they will they just gonna come to consensus and you will have a confirmation from two-thirds of all validators and once you have that we can always Spanish the only the validators who equivocated not not the rest kind of related I guess the censorship

resistance depends upon having enough validators and the Zeki sync Network right this is also a good question so we have different kinds of times of your resistance number one is that you will always be able to withdraw two theorem so this is a given this is not a like this this this relies on the properties of a theorem not on profit of say kissing now you also want transactions inside the key sink not to be censored so we're gonna have number of validators but not as many as in tender mint so we're not gonna have hundreds of validators acting simultaneously at the same time which is not enough to guarantee censorship resistance because they could all collude so what we're gonna do is we're gonna have something

like a stake held by a roll which we call guardians so there's gonna be like a lot of users with very low computational resources like a normal laptop unsecured they do not need to be super secure because they cannot be hacked and then I'm never going to be slashed and they will vote who will become the validators so their interest is that they hold the tokens which are locked for a longer period of time so if they misbehave the value of the network will go down it's gonna be automatic so the the the the the reason why their

computers are unsecured or like not supposed to be super secure is the only thing they check for is censorship so if they see a transaction which is not included in in fact next couple of blocks for no good reason because the blocks are not completely at capacity then the validators who do this will not [Music] the the users will be able to attribute the fault to those validators because we always have this speaker listener dilemma that is it's subjective you cannot objectively attribute for of censorship but every user for themselves can know this and they will just stop voting for this validators now

while we can do this in the case sync is because our security does not depend on the trust of violators so we don't care even if you have one validator they can never cheat they can never create incorrect incorrect state they can never steal anything because it's all secured through zero knowledge proof which are verified on the theorem on the on layer one so you essentially like you can just have one so the only thing which we need token and the Guardians for is to prevent censorship we need it for to govern the participation in this anti anti censorship resistance no we

couldn't because we need an incentive for these people to act honestly so what how would you incentivize that anything he'll die die is not connected to the success of this network yeah so we would need to slash them and this will increase the barrier of entry this is what we see now with the validators like I don't know like violence comes and says we're gonna give you validation for free and a lot of people go to them because they are afraid to operate their own networks like Union you're not an expert in security you cannot protect yourself if it's running 24/7 in some cloud you know people have access to it so you will only operate your own like full node if it's secure for you so it's cheap and secure to operate a theory or

a Bitcoin fool no I mean it's not as cheap it's gonna be much cheaper with the casing because you don't have to verify every transaction you just monitor for a fraction of network traffic and if you detect something then you behave it's just gonna be your seat finally talking so you will be able to you will essentially stake on the theory I'm not on the kissing the stake on the theorem and then you get rights to put to produce blocks or you participate in a

concern for so she kissing no more questions okay thank you [Applause] you