DAPPCON 2019: Ultra Light Client: Incubed, Opinionator, and Piet - Christoph Jentzsch (Slock.it)

Transcript

so I will start this tell you more about the in cube client and some of you have maybe heard of it before some of you have not so after I've explained you more about this I will show you two of two developer tools who recently built and one of them actually just got released today but the first water speared we like to call the minimal verification client and I show you why we need this so much so to go to the next slides this was a quote from a free cherdon maybe some of you know him from parity is that if you don't stop relying on an for ha the vision of a theorem failed and in for as you know it's an RPC provider the centralized service which helps you get information of the

theorem chain for your decent lies application because of course this is a decent ice-t-- application if you rely on and for one so then we started etherium when i was part of the team in 2014 that's the vision we thought of we had a heavier p2p network everybody running a node and connecting to a chain this is how it should be but it's actually not what it is right now right now some use and for some use their own server but most of the decentralized applications out there have a server connected to the chain running a full node and the end user using their mobiles just connect to the server and that's something we are currently tackling we want to change so how would

a picture look like within cube it would be looking something like this you still would have some special in cubed servers which would serve n cubed clients which are running inside these centers applications but it would again be fully decentralized and distributed and I will show you also how to sniffers from what we thought would be the solution they may delight client when we thought about IOT and mobiles everybody thought the light client is a solution but I think if you speakers charrid which are spoke of status trying to put a film client and a Android application or iOS application is almost impossible meaning it needs too much resources especially

too much bandwidth of course the client itself is baking of all those problems so that's what we are trying to solve so what is sin cubed model it's not so what we do is we verify proofs such as milder proofs we verify blocks but in pain cube client is not part of the peer-to-peer network that's a very big difference to the like line and other clients the client itself is stateless mean except of some tiny information it doesn't store anything it does not really store the theorem state or even the blockchain it has minimum resource usage it's only for RPC communication it's completely decentralized and even blockchain agnostic meaning with the same in cube

client you can symbol tenuously connect to several chains that is because you are not part of the peer-to-peer network and because it is stateless it doesn't store any problem not much particular information about this chain you can actually see more tenuously speak to several of them and still verified results and verify the proofs that's the promise of in cubed so let's now go through how this works in the beginning there's a registry smart contract and in cubed nodes you could even call them servers they register and in this registry and are paying a deposit this deposit would get slashed if they would cheat or lie or say something wrong

for in cube client bootstrapping is similar to an a film client or a light client you have some bootstrap nodes and then once you're connected through the bootstrap nodes you're actually downloading their current registry or even a snapshot or some of the servers or nodes that you can find in this retro stream that's how you start and after that you're just updated from the nodes and you're keeping connected to touch in cube nose to get them more accurate or more current lists so that's the starting point so how is the process working for the proof-of-work chain so you start with some notes EF note a B and C each of them is an in cube node which has registered and paid a deposit

inside the smart contract they have an in cube he's the one who wants to receive some information so he starts with a request let's say it's just a simple obviously you request a nice Cole wants to know the balance of some address or something from the Asturian blockchain with the request he actually also sends a validation request and that's important he is choosing which nodes should validate having to come to this later but actually signing the block cache and he's choosing node ANC and giving this message now to B P is now connecting to a and C asking the for validation request of the current block hash and getting back a signed Pro cache and this is the most crucial part

actually because if you think about what a light client is doing the light line is just synchronizing the praça dos verifying the proof of work once this edge received the last little current block it can then verify a mobile proofs based on this latest block since we are not connected to the Pyramid p2p network how are we doing this how are we knowing what is the last current Block in curly we're just getting signatures of the last block Heche by two nodes which we have decided to node B is checking if the assigned pockets are correct if they are not correct then node B could go to the registry smart contract and slash that episode so because he knows what's the current state what's the current

block and just that's actually also the important part that this conviction can be done with in the registry smart contract because there's only one opcode actually of the etherium virtual machine which gives you some information about the past and this is the block head opcode you can retrieve the latest 256 block hashes that's what we use in a small contract to convict nodes which sign wrong block caches on top of this we also have watchdog that we just randomly calling those servers and asking him to sign block hashes and check if they're right or not and if not we can also convict them in the small contract so now this information is given back to the client so what is he receiving

he's receiving the Merkur proof of the request ahead visit of course needs the block header which she also receives and to know if this block head was correct or not he also gets a signatures from ANC who have signed this block hash so what's the security threat or security model of this a the ink you client has decided which notes to ask in this case anc and he knows how much deposit they have state so the security is exactly the amount of deposit in the small contract let's say note a has staked thousand euros note G five thousand so the security would be actually six thousand euros if it's was less than this I'm fine if it was more than this I'm not secure because they would lose that episode but could give

me a wrong response so I know I can actually measure the security by seeing how much deposit is behind this request so this is the cool principle of how in cubed works of course for signings at floor cashiers you need an incentive and that's the thing we are currently working on that the in queue client is actually paying node a in C and also node B for providing the bandwidth for providing those responses and for providing the assigned pleasures miss this you have a stable system and one where even a microcontroller can run suctioning cube client so this is the the Corvette so we have several version of the in Q climb we call the nano micro

and fold it can't just come with different features and if you just want to say verify transaction the nano clients actually not if you want to use all the EVM features yes then you need a full in cube client and we have implemented this and embedded C so we have written the etherion virtual machine in C to be efficient and to be small so to complete new implementation of the EVM if you now look a bit of the size of the client so if you look at guessing parity they around 50 to 60 megabytes big if you now look at the typescript version of in cubed about 5 megabytes and we have written one version in C and you can see it it's less than 252 and the 50 kilobytes and that's even including the operating

system we're using the safe here OS for IOT devices so it's really tiny it goes into a microcontroller it of course goes into your smartphone and you can actually ship the client with your app or decent lifestyle so the client just comes with it because it's just some kilobytes and that's enough to actually verify all the information you need so instead of relying on a light client or gas or parity you can to use an encrypted or micro fool depending on your needs okay just give you some code examples how you would include us include the in cube client so if you go for the typescript version you just create such an entry object and you can use the this out of f 3GS also the internal API or

the the functions which in cube brings with with it like send transaction or call function but you can also use the web switch yes as you do maybe now in your decent-sized application this this actually only change one line of code instead of getting the three object maybe from your trusted provider like in fula or your localhost it should change this one line plus you adding this in cube client object and you're done and everything should work as before just without relying on guess authority as a client so it's very easy to integrate in your decent last application right now just a couple of lines of code for those of you who are more into IOT devices and microcontrollers you actually may want to use the C or embedded C version of in

cube that you also have to bend up and this is how it would look in C I also create this a pointer for the in cubed object instinct you just basically install it you configure it which chain you want to use how much requests you want to have so some configuration then you can just use it like here is get blocked by number and getting this information as you would maybe with a JSON RPC client but this is all and C and can happen on the microcontroller okay this is just how you want to use this so how can you participate of course you can run an in cube node we have written an extension which you can run in parallel as your guest or parity client which makes your note and in

cubed node serving those clients for this wave actually written a IP one one eight six which got approved the IP is about a chase and obviously function called ECL proof which is now part of guess and also parity and of course you can use Incubus in your application okay just giving a bit of a road map where we are right now we started this in the beginning of 2018 we have released the MVP of the typescript version so you can currently download us under NPM before Def Con we hope to be done with the first better release of the C client which is actually the most important

step for IOT devices and we also have to release candidate for typescript in JavaScript so and by the end of the year we are working currently on getting the incentive mechanisms done using state channels so but it is not yet done therefore you can use it right now but just without the payment okay so as a conclusion what you have you have this client was a tiny footprint you can see one of those microcontrollers there for Nordic semiconductor and we actually run this client on this microcontroller and this is actually really amazing is about three dollars you pay for such a microcontroller it has just a little bit of memory and just 250 kilobyte is just

enough to run XD a client you have the full revocation to remove to proof we have to security through the deposit which would get slashed if you get a wrong sign block cache and you can simultaneously connect to several chains and you can defuse various platforms I just see types crypto JavaScript we are currently working also on Java Vargo and pies and bindings to the c library so you can even integrate it and your others your other applications within those languages and we don't need any coin for this which is completely app going free ok this is about n cubed maybe we can just make a little break for questions and in this time I can get a username and password for the for

network and we have maybe two or three minutes for questions until I get username password about in cube before we go to the next topic any questions about in cubed um okay so basically the question would be why did you develop this and what do you think it's gonna be used for first again what do you think it's going to be used for first and why was it developed by socket in the first place yes in the

beginning we actually build it because if you know the history of slow cat ba by working with smart locks and IOT devices connected into the chain you had to intend of running it on IOT devices that's why you've divided and C but actually the ones for currently using it because we actually have like almost I handle to 200 downloads per week right now is actually in mobile applications because they're using a typescript version like an for wallet or exchanges and so on so actually everywhere everywhere why you would currently use the like line actually in cube could be it could be doing the same job the only thing if you now would compare like client and cubed if you need a lot of verifications you know asking like every second or every minute then it's better to run your own

light client or phone out because they have a lot of requests but if you for example only needs something once a month or once a year then it's much much better running cubed process in the future will pay for those verifications if you have a lot of them it's better to run your own node okay and another question if not then thank you very much for connecting me I will now go to two other tools we have developed and just release the last couple of weeks first I want to show you a tool called p8 you can reach under p8 dots locket which is a smart contract structure analyzer this has been done by a haiku book heart and what does tool provides you you

basically load your solidity contracts even you can go through a github and just provide them with a github URL there the contract ought to be found we can just load them directly and it analyzes the structure and you can just look what's happening here so this is this is the tool on the pier Doc's locket it's just used the noses safe contract because it's a rather complex one you can show what the two is doing here so you see all the contracts used for knows a safe contract this is the no safe in itself you can see the inheritance graph how it's inheriting from master copy owner manager for Beck Nash Moodle manager and so on on this side you can actually look into the contract like what are the

state variables what are some functions let's just check here's one is called the profesh you can look in it was input 1 input by 3 or 2 you can then click code and basically just look at what a code of this single function is in this case a profesh or you can of course look at the ABI then you also see here to inherit head functions which are much more under step in that case the modifiers the events you can see and even the instance in this case it's actually a deployed version of the gnosis moody SEC at this address and for connecting I'm actually using in cubed here right now here you can choose which client to use the injected for example for meta mask or some other RPC or web

sockets or in cube form a net so I'm choosing of course in cubed I'm a nerd and inspecting this smart contract you can also look at smart contracts calling this contract and just look at what functions they have what function parameters go in code and many other things so I think it's a really nice visualization of rather complex smart contract architectures they don't just look at one contract but actually at how they depend on each other house to inheritance what's happening in function this was actually developed because we did some smart contract audits for other companies and they also had very complex contracts so if we build actually our

own jewel to analyze them and visualize what they are doing and how it all belongs together so this too is open source free to use for everybody just go under peer dots locket to use it to analyze your smart contracts or other smart contracts ok this is I think enough about pH you can also read in a blog post more about how it functions now I wanted to present one other tool that you just released today which we called the opinion atom maybe first the story behind us so governance in a film is actually hard topic we can spend hours and tons of panels speaking about how governance is done Miriam Unchained governance of chain governance housed or decisions to

be made and as you know I was heavily involved in the Dow in 2016 as the author of the smart contract itself and the discussion afterwards were really messy we are going on social media and reddit or Twitter and you could not really see what is what is the community thinking just by look only by those social media things which is not the best tool to use so yes they said let's use unchain voting so there was something like carbon vote they could say there's a poll and you can vote with your ether and that's a good start and form of at least we are using something which is more or less neutral but you're just it's basically a plutocracy whereas more money has more voting power but

it's about almost people think they can do on chain but actually there's more information on chain and chain you have the information about how much gas a particular ad versus used any of also information how much gas has been used by a contract someone deployed so I as a developer could say I am deploying a contract if it gets used by a lot of users this the gas they spent on my contract could also be counted towards my voting weight and of course also miners can be verified on chain you can see how much blocks he has created and so on so that's all the information actually available on Shane and we are creating a voting tool actually I would rather call it an opinion collecting tool or signaling tool to use all of

this to visualize votes so if you go on voting Lots locket or pinion a turtle's locket you find this tool they could make just very simple votes so here I just created one about programmatic flow of work VIP 105 seven now some people like it some who don't if you could discuss this now but here you can actually vote this year signing a message of your key and then comes the interesting part if I just want to show the results based on gas I could set coins and deaf to zero and just look at waiting boats based on how much gas they have used on aetherium if I'm now interested in only in how much either

they have the result looks very different this is now just the result both weighted by how many ether they have and you can also measure at least to some extent developers developer are measured by how much gas has been spent by using contracts they've deployed and you see this result of course you can also do any mix in between how you would like to weight such things of course this is also not a perfect tool because you could argue now some icos cameras who had tons of users now have a lot of boating weight as a developer yes technically they are not very different from someone who made a very useful contract so that's just a very neutral tool of course and we would most likely

have more features in the future where you maybe can have a filter on some votes you want to neglect because you know they're coming from someone but we don't care what he thinks but you of course can just look at everything but you can just configure it the way you want to see it but they're using all the information which is available on chain in the voting process to show you the result or to visualize it the thing that's at least better than what you currently have is a purely coin based boarding algorithm for visualizing this so you're more than invited or welcome to use this tool we just created two polls so the tool vent life today so it's still I would say in better there's still some UI improvements to be done

but yeah feel free to use it and see if this can help the iam community signalling what they want okay this is all I want to send to you thank you very much for your attention simu have a bit of time for questions if any hi thanks for the talk it was awesome I'm curious about the voting thing like isn't it a bit weird that now anybody could select the certain weight and have the outcome that they want for the vote that's why I don't like to call it

voting tool because just collecting sickness or pinions are like having if nothing happens because of this this is just people can vote or say what's the opinion by signing a message with yes or no and he visualized it and this is not enforcing the film foundation to Inc to take a samurai piece into the next heart for I mean it's don't see it used for voting just like getting information about yeah this is just providing information and you see what you want to look at and the outcome is totally open that's why it's not really voting because voting means usually something happens afterwards that's why it's called opinion ADA it's just collecting those signals or opinions hi I had a quick question about the like

micro client I I still don't quite understand how it improves the centralization because you're still dependent upon full nodes that have all like you know the storage data that you need to sync up and be able to verify in the first place correct so but everybody can spin up a node or what you may be what caused over the difference is right now I may be relying on in fuller for example now I can just spin up as many nodes and everybody can do this and the inclined itself also randomly collects from them so there is no single point of failure in the system per se and if slotted would not exist anymore the system will just continue to work oh okay cool so then the the main point that's enabling this is that that registry of staked nodes that are

enabling like these micro clients to do the verification right yes this this registry is just a smart contract living on chain where people can say I give some ether as a stake and then I have my URL that you can connect to me and in the smart contract you can convict me in case someone those watchdogs find I signed a wrong rakesh because you can figure out the blockchain at the blog hash form is in the small contracts for the EVM awesome cool in just one last final question how soon do you think that this might be integrated into something like meta mask or something like that that a lot of people use actually we have developers working on writing pull requests right now for meta mask pull requests for brave prowl and others and let's see if they merge the

pull request that it at least becomes an option I'm right now using it for example for a microp to a desktop app there you can choose your client you can also define local if you want an in cubed node locally okay a cube client sorry it just works for example is my cryptid after that awesome thank you so much okay interesting have you considered the abuse or an attack vector with someone loading a contract with storage and then getting to be found after voting could you repeat it I guess one just allowed a lot of storage

burning gas and then it gets rebound meaning rich is doing a lot of notes are devoting here so if you register I mean speaking about in cubed if someone registers a lot of notes for example they would all be owned by him what's this the question smart contracts when you use a lot of gas to populate the storage then use your statistics for voting and then self-destruct the contract and receive the gas we found if the contract is able to self-destruct you speaking about the registry contract right now there's no right any contractor boost my gas statistics oh you better the voting tool about gas

statistics yes yes you this is just going through like we have a back end of course for this application if we have a database that we just collect we run through the whole chain the whole history is the approximate how much gas you spend with one address and if you have deployed a contract how much gas has been spent on this contract if there is a library behind and which you are using and there's some gas spent on it this is a counter for the one who deployed this library for example there was a lot of echo I could not really sorry I just curious about the gas we found which gas refund yeah which can obviously happen after the voting but gives me some extra okay it's a good point it's a very good point after ask the developer who this was

actually done by Yunus Pinker how he is handling his edge case currently I think this is just is a credit for him as gas being spent and then he gets his back yes it's you can get some of your gas back even though you didn't spend it that's a good point I've seen this each case is not yet handled okay I'd like to go back to the in cube client for a second probably a follow-up to the question before so let's say this works out and in the best case we have like ten or twenty or any number of providers and no entities that run those nodes

in cube notes right so the data provide us basically and then they stake a lot right they I mean what would speak against staking a million dollars worth of eath because you know that you're going to do the right you're going to provide the right hashes and once the the unidirectional payment channel is in place you'll just get something like interest for your state either so I'd like to understand the risk model of the Staker so yeah they both what so would there be anything speaking against the bunnell of the a good meaning person to to stake a lot just to help those because I don't know anything else they could do with their either-or today do they have risks on their own yeah so the

risk for the stake us in the model so for one what will feel very quickly is that people won't will not sign the latest block because they're always micro Forks happening and it says there's a microphone you could lose all your deficit because it's her signed latest block which actually didn't make it into the chain this is one point you will pay back in history but the question is how much money you pay that put in of course there's some opportunity costs coming with it if you have more money in you will also request more money for signing those blockages the question is really is there a market for it so there is a free market from the clients who they asked to sign the blockages and they require a certain number of total amount of episode behind the signature and maybe someone just is

ten year old hundred yard house and or Millions and the price for signing such a blockhead should also differ so you as a node or for those Hesher those sign blockage has a certain price point this will be an open market and from a from a risk perspective yes there is some risk that there is for example a hard fork happening and you're on the wrong chain if you didn't design on this chain actually lose it episode on the other and that's the real risk that's also then people ask how is in cute clients how are they handling hard Forks they actually don't really need to because the notes are handling this they have to decide on which chain they sign because they will lose everything else on the other chains so they may have to make a decision what they think is the main

chain what client is asking for so therefore the client itself doesn't need to care about hard Forks but a notes too much I hope to stood answer the question okay