DappCon 2023: Learn Noir in an afternoon or get your money back - José Pedro Sousa

Transcript

so I'm I'm zedro I'm uh the real engineer for Aztec clubs uh you probably know what Noir is but still we're going to start with the basics of Noir what it is and so on um I'm very glad to be here uh I was here last year was a great conference and I'm very glad to be here as a speaker this year so this Workshop will consist B in um four chapters but first of all I'm going to present uh a little presentation before the workshop the workshop is meant to be interactive so you go and play with your own machines

um so let's see how that goes um first I'm going to talk about ZK what is ZK you probably know if you're here but still this is a um a layer one let's say an a layer one uh conference I'm going to talk about Noir um why are we doing this what is Noir what's its purpose I'm going to talk about the project that we're going to build here um and finally yeah let's finally hack something try to do something with this so we know that zero knowledge proofs are powerful uh you can prove things without saying what they proving and

this is huge for not on a blockchain but pretty much anything you can think of that you can keep some privacy um but with great power usually uh comes univers paranormal commitments uh basically and this is one of the problems that I can't understand that some people do I don't and so that's that's uh basically the problem and that's why you need a usable univers veral ZK DSL so zero knowledge domain specific language basically something that can run your zero knowledge proofs and for that we need a syntax and we

like rest so we basically choose rest to copy and literally copy the syntax of rest so if you try to find the difference between rest andir you will find some but not a lot of them especially if you write a Noir circuit and then you comp with with with whatever dressed it you're not going to find much a lot of differences and so for example this is an example of an nir program and if you try to Spot the Difference well yeah that's kind of on me right because one is blue another one but yeah they are literally the same um what we want is for you to write code and not circuits so write the code and

then it will compile with something that you don't need to understand uh it's highly abstracted once you start scratching the the surface it's completely different but the syntax at least it's just the same uh and this allows for both things that happen on for beginners uh and also for pros basically people that just want I just want this ecdsa signature verification I don't need I don't need to write the whole thing okay Noir has this module I can can just use it I don't need to write the whole thing and I don't need to think that ZK is just for me uh ZK is for everyone and we need this to be usable for

everyone and so our build plan is going to be basically how to learn no in an afternoon uh or I I won't get you your money back sorry yeah that was bit of an oversell so we have like what we what I call like three or four chapters most probably we're going to only have time for three but basically I'm going to introduce what is nargo what is the Nar syntax uh how to write tests how to S to generate proofs and then how to import some and use some standard Library hash functions uh how to use another libraries external libraries how to generate smart contracts and how to deploy and verify and how to wrap them in your own smart contract so you can

use them for your games or for DUI apps whatever you you are building uh yeah some things will not work uh yeah like verifying proofs on chain sometimes it's a bit tricky so be with me if it doesn't work that's just how it goes it's live demo it can it can break it any time um yeah so let's let's eventually go and and do something so I'm going to I'm going to ask you so you maybe pick some of pick some of pick your camera and maybe at least the workshop resources they could be useful for you if you don't trust me and you shouldn't so so yeah but you don't absolutely need this Workshop res

resources it's just because some there are some links in there that you can copy and paste to start running Noir app and nargo in your own machine so yeah it's uh it's useful I'll stop when I don't see phones in the air okay yeah it's a it's a GitHub it's a GitHub link so you can just go on Noir Noir half Lang slash n in and afternoon with happens and and yeah there you get uh GitHub you don't need to clone the

repo um sorry yeah yeah Noir L yeah what Noir in an afternoon yeah cool so no phones in the air so um cool I'm going to sit down so I can actually type something and yeah so basically it's an hour in an afternoon yeah this is the this is the repo um yeah cool I'm going to start a new app new terminal I suggest that you

follow along if I'm going too fast please tell me just shout um and our objective is imagine you're like Brad Pit and you are an owner of Fight Club he wasn't the owner right I I don't remember if it was was he was Brad Pit the owner of the fight club yeah yeah yeah he started yeah so imagine IM your your Brad Pit probably not not as pretty as Brad Pit but imagine you are one and and you are the owner of a fight club and you want to only enter someone that knows the password to enter the fight club and also you want to only allow people that that are at least 18 years uh of age you don't allow allow miners obviously in

your Fight Club right so so this is basically our premise here um let's start with installing warab so yeah yeah sorry uh how do I do that oh here better yeah Okay cool so you should install norab first if you're fam familiar with and and you do that so I you do that with this line on the repo you just copy and paste it you can trust me trust trust me bro um and basically if you're familiar with rust up or Foundry up that's basically a very handy CLI tool you can use to uh

install Foundry or install uh Noir uh rust and this is the same for Noir it will install Naro you see cargo nargo yeah kind of yeah kind of the same and so you install nor up you run this this command line I'm going to do that as well just copy and paste it it will download it and you probably should like quit your terminal and start a new one because of the path variable and then you should just you can just go and run marup and that's that's it and he's going to install uh nargo and you're going to it will

probably take a little bit more time because it will install the inite SRS can take a little bit and then when when you finished you can run Argo version just to be sure that it's on your path and this will get you hopefully 0.1.3 and I'm hoping that this version is works fine cuz yeah sometimes have breaking changes yeah cool so I'm assuming that's that's okay everyone has it or at least the ones that are following this cool so in that case let's start with nargo new and let's call it Fight

Club AR Go new Fight Club and this basically creates a new project in this um folder and let's just see what it is it's very simple it just has a Naro Tomo with a bunch of things that you need to specify like name type whatever and then you have a basic circuit this circuit is really really simple basically you provide um two variables you privacy Norm privacy is normal right so you only say what you need to be public everything else is private and that's how it should be and so that's that's the way you just you just say what is public and then you

just keep everything else is going to be private and this circuit just checks that one value is different from from the other one so for example if you input one and two they are obviously different so we are proving that you know a value you know the value X such as X is different from y okay this is the probably the most basic circuit you can you can write you write it just as just like rest with FN um syntax you need to provide a main function because that's like the point of sorry yeah why do you have no in as a code um

Colors oh okay you mean the syntax highlighting yes yeah it's a it's um an extension you can install uh Noir that's a very good question uh nor language support so you can install this but for now it should be good I mean you can install it it's very very easy um but yeah good question so you have the variables you just declare just like like you would do in uh in your um in your rust code if you're like if you have an array the size needs to be needs to be known as compile size so you

make just an array and you say how how many values you have that that's just like that for every ZK language you need to know stuff at compile time um and you declare whether those are to be public public or privates in this case for example it could be public this wouldn't make sense right if you're proving every things that everyone knows but you can have like circuits that prove things that no one knows and have two private variables that's okay um for return values um you basically you could do it like this but this doesn't make much sense I mean how can you return something if it's not public it needs to be public

okay so it will complain if you don't put it public because the way it behaves it's just like if it would say return P field and then if you provide a return value it will just say like uh let's say that you have um Z value let Z X+ y for example um it would just assert that that Z is different from the return but this is it's not okay no return because it doesn't work but yeah um this is not so cool right so that's why they implemented like something that's actually called return but this is important because if you're providing uh an input to your circuit you also need

to provide the return value so you need to kind of calculate what's the return value and then send it uh along with the circuit but yeah that's basically how how it works um another thing that we should say it's just just like in R you have mutable variables so let's say Z it's X+ y um you just can't go and say Z then is z+ one you you can't do this you need to declare it as mutable like mutable Z okay so there's there's there's a yeah just just like just like in rest I guess

uh you also have like Shand operators so in this case we have Z equals z z+ one you can just have it like z um Z Plus equal one you you can have like the the shorthand uh operators you also have some control Loop uh sorry control flow things like Loops uh so you would do it just like in R you would say like for uh for I in just like it says like thanks good GitHub uh just like that it's just you can do it a loop but you also need to know the size of the loop in compile time and the reason why you didn't to do this because Noir will then unroll your

Ro Loop so it will be huge um and so you need to know because it needs to know how many Loops it needs to unroll um you also have some like if else statements uh so you can say like um if uh if x equals uh in this case X is a is an array but yeah if x at one equals whatever you can you can just do uh else just like just like with rest right you can do the same thing you can check also the the documentation here just like in the links that I've shown in the beginning if you need to know

basically all the language Concepts that I'm introducing here that's why I'm not going to deep dive into this um then there is the assert keyword that you've already met uh assert X different from y this is the original circuit and basically this is uh it yeah it will basically say yeah this this circuit will prove or it will verify if this is true um and so yeah this was known as con strain in the pr previous versions of Noir if you tried it now it's assert because it's it's an assertion uh another thing that's very

useful it's struct so you can have like struct uh person and you can have like an age uh that will be like a field I'm going to talk about fields in a bit field for example and then you can initialize this this uh this light Z is a person and you initialize it with h X for example and you can do all kinds of things that you usually do with with strs and in the latest versions if you if you try to use a nightly version you can also there's a like a yeah some support for implementations as well so you can you can have like imple imple trades uh basically have trades for strs like like you would do

in in rest yeah but it's just in pre-release version so don't expect them to be any kind of yeah be uh stable just of now um test basically this is a test um you just usually there would be I don't know why why there isn't but there would be some cod lines here so you can can run test run test to run that test but you can run this test for example um just go back uh sort X different from Y X from y you can run and run Naro test and it will uh sorry fight CL and run nargo test and it will run

this test um so yeah if you make it equal it will fail because it's ation basically fail that's it um so that's that's how we run tests one thing that is would be really cool to have is test that are supposed to fail but that's that's that will come at sometime um cool and that's basically just um a little primer on Noir and circuits um sorry I have some notes here because yeah any questions so far how can you run it oh you can run the test but how can you run the yeah sorry I forgot that part yeah you you should you

should run your you should get to proof right otherwise it doesn't mean anything it's very easy you just go and and run Naro proof and and oh yeah sorry you need to run nargo check first because you need like a approver under the verifier here like prover verifier and as you can see like the verifier doesn't know X doesn't need to know shouldn't know actually so let's put some values here like one two and then you can you can run Argo proof and this can take a little hit in this case it shouldn't take yeah it's kind of fast um and it automatically will populate your verifier and you see one of the problems it's like yeah it will pad with 32 bytes so

that's something that we need to improve uh but yeah um basically you can then R run Naro verify and you get your your proof so you can do this this proof it's kind of not so human readable um but yeah this is a proof you can basically Witnesses the witness if you want the witness you go and run onaro uh execute it will execute your witness uh yeah if you want if you want specific one uh the witness I think you need to uh I think you need to get get it um yeah here if you want just a witness

you you have it here um Che sorry yeah yeah it's uh yeah when when you X is X is private so you you only verif you only provide the Y which is the the the public part yeah so the verifier only needs only needs to know the why and then have the proof and the witness and that's it basically I am I am also is it is it isn't it supposed to be

a snark so it's succinct because the proof is like a lot of B yeah I think this is this is okay um yeah it's fairly suin I guess I don't know I kind of I guess it depends on what yeah it's that's a right yeah I I I I don't like Starks they are usually much bigger uh so yeah I mean it's easy enough that you can you can send in an ethereum transaction transaction which is the goal so far um yeah I was expecting more like a uh no yeah not not

yet cool so let's explore a little bit uh This and like let's explore um the standard Library so basically just going to check my circuit so um so you go to if you go to nor.org you get the documentation and you get nor standard Library you have some stuff here uh you have some hash methods some scalar multiplication signatures e signature verification is a big one it's really cool uh and you yeah you have also some uh Merkle tree um you can compute Merle trees and and and verify this uh like proof of inclusion in Merle trees

stuff like that I'm going to just focus on the basics which is just hashes basically and I'm going to pick you have some hashes here if there are otheres that you know how to implement and you want to contribute please feel free um we have some we have a gr Pro uh program as well so if you if you find some interesting hash to add um yeah just just talk to me in the end um I'm just going to basically talk about one of the hashes which should be posidon so posidon is a is a very it's a friendly it's a friendly hash ZK friendly hash so it's a hash that's it's

it's okay to proove on your on your ZK circuit doesn't take too much um like a lot of gates a lot of circuit size and one one way you can know that is just by running Argo info and it will get you the number of AC up codes and backend circuit size so I'm going to go on attention here about what is this Acer thing so when you run a nargo program what you actually do is just compile it to another Intermediate Language called a abstract circuit intermediate representation and basically you fit that into your different back end so you can have like for example Noir

outputting a here and then you have that a you feed it to one prover or to other prover you can fit it to in this case we only have Halo to back end and barenberg back end which is the default but you could potentially like fit it to a plunky to back end or whatever you can do all kinds of uh nice things so in this case it will tell you how many up codes do you have in your your intermed intermediate representation and then what actually matters which is how big is your circuit in your back end in your in the back end that you chose which in the default is brenberg and so yeah you it's fairly small circuits as as you can imagine and so one way of

knowing which hashes are more friendly is just by trying to run them again you don't need to know how they are implemented I know that bidon is more efficient for ZK than than kch for example I don't know why I just I just know it but I could just go and try it and see oh this circuit is more efficient than the other so so it w it won't stop you if you don't understand any of the cryptography and and so yeah let's start with posidon and just and Implement our fight club finally so let's go and use the dependency uh standard Library um and then uh I have I I copied here how how should supposed to be called and so

let's define a struct uh this struct is going to be a person which is a fighter and I just want to know it's age actually I don't need the wall struct I'm just here just to show you that you can use struct um and you can also have like globals Global in this case Global minimum age and I'm going to call it it's a field so I'm going to say the minimum age is 18 uh because you're in Europe I guess in the US it would be 21 I suppose I don't know some sometimes it's 21 I don't uh so um so yeah um Global is basically yeah just just as it says it's a global to the to the our wall program

um and so in my in my what I want to check I want to check the age and I want to check the password so I I I want age to be kept private so it's going to be a field a field is basically a big integer okay you're I'm probably wrong at many levels here but that's how I think about it and and no one has told me that it's completely wrong so it's okay uh so you can think of it as a as a n you can make some arithmetic things with it you can make some comparisons with it and it's basically just a point in a finite field and we are going to use Fields every uh sometimes we would use uh you

you wait we're going to be using those and yeah so just for now it's fields for posidon and and the next example will be with with the U so there's a password as well for entering the fight club and that's it's just we don't have support like we have some support for Strings but not it's not great so I'm just going to basically just fit it five integers and that's the password and and we also have a password hash password hash and so this is basically the hash that everyone knows so no one knows what the password is but everyone knows what's the hash of the

password you want to prove that you know what's the what's the password without saying which one it is that's the that's the beauty uh and so my people that will join my Fight Club they they I can tell them the password or they know the password I can prove at interest that they know the password they can they can send to me the proof that they know the password but I they never tell me what is the password and they will send me proof that they are of a certain n

just like I start here okay cool just like I start here I'm going to say that hash is posidon with this curve and the hash of five um of my password so I'm going to pass the password the the array that I have defined here and I'm going to assert that the hash that I computed in my circuit is just the same as the password hash that user has provided and then I have a person um yeah that's that's correct thank you GitHub um and it says like a person is has a certain age basically and then I can check that person H is uh higher

than minimum age it will complain but let's let's just try and and run this I'm going to I'm going to get like the the main this is going to be 18 the password I have it somewhere maybe not the [Music] other ah no it's not here sorry uh uh I think this one let's just say password is one two not sure this is going to work um because I have a different different one here in my my private repo um and this is the this is the posidon hash of that um if you notice in

the other repo you have some utils folder with the posidon and cack file that's basically if you don't trust me that this is the hash of that you can run it so let's try and get Nar go test and it failed and oh yeah uh one two three 4 two three four or just maybe just go and say has password test yeah again it says that Fields can be cannot be compared so that's that's in in this case you just going to say you just compare with as you wait

and the reason is uh I guess they kind of wrap around so you just compare them directly you need to you need to range check them and that's why I'm casting this as U u8 uh it could be u32 whatever just the small the small the smallest one for this case so you in this case the the nargo test will hopefully pass Okay cool so it knows that my posidon has that I calculated here it's just the same as my password hash that everyone knows okay so I was going to give you an example about the posidon about the kchu but I won't have time so uh let's just

go and run nargo info to know what's the size of the circuit and you see theop codes and then you have the backend circuit size if you do KET it's going to increase massively like 10 times or more uh because kachak is a nice hash but it's not so ZK friendly and so it uses a lot more of resources um but yeah if you want to try it sure it just just um go on the documentation and check the KCK and just yeah use this it uses you uh yeah un sign integers as well um yeah so we need to cast them or just provide them uh

differently so yeah this this is an example implementation cool and they will see that yeah backend size uh backend size will will increase massively question when you have is this did you define every single function in the library or is it like some magic yeah I think there's there are like um it's like magic numbers like hash2 HH three hash4 five will build CC Bas name fun yes yeah you need you need to you need to have that beforehand maybe there's a better way of doing it

it doesn't seem to yeah doesn't seem great but I I don't understand why and so I can say if can be optimized I have no idea but yeah good question so any other questions yeah sorry is there something like no no uh what there is is unconstrained functions and those are very interesting uh but I I I can't I I I would spend the rest of the time talking about them but you could you could basically use a constr

functions to break to uh return early but other than that no it will unroll the wall Loop and execute the wall Loop just as much as if you have an if and an else case it will basically run run both cases and then just choose choose the path that it uh that it uses but it will run the wall circuit anyway so if you have like huge if and huge else it will run both of them um yeah again it's not perfect cool um so let's just um prove something and just basically copy this um this hash and just put here in like uh sorry H right uh H 18 and then

password one two and then password hash is this hash I think it needs to be in double quotes Okay so I'm going to go and run arle proof to get a proof um because we're going to use it later Bic uh as you see it will download the KN this is basically the phase one so if you're familiar with with zero knowledge proofs you have to have a ceremony to have your uh circuits um in this case because we're using plish constraints you you only have one ceremony that works for all your circuits and it's different from for example growth 16 where you have to have a different uh ceremony for each of your circuits

uh which is not cool um so for our smart contract we're going to use um Foundry so I don't know if you use Foundry but if you don't uh I invite you because it's a great tool so I invite you to just go and and run this this little uh Foundry uh command it just like norup it will install Foundry All The Foundry tools which is I think are oh sorry it will install Foundry app and then you call Foundry app it will install the for yeah Forge cast Anvil and chisel um we're going to just use Forge and cast and

envil yeah not chisel uh I don't even know what chisel does yeah cool uh first of all before I forget I'm going to run an envil network uh what is the nille network it's just an a blockchain that runs on your machine and this is very useful and I'm going to pick up a private key here uh just first one it has a bunch of money in there so I can use it no problem it's very easy just going to put it here because I may need it later yeah I run sorry s envil yeah um and I'm going to start a new I'm going to leave this running because I'm going to deploy on it so I'm starting a

new terminal um and I have I have to CD into my directory and I'm going to say nargo code gen verifier and this will generate um a smart contract that has your verification key and basically can verify your smart contract uh your Z zero knowledge proof and you can deploy it very easily and that's what we're going to be doing so those of you that are familiar with with solidity and Foundry you're not going to find this any diffic don't find this difficult but it's very simple it's just like another smart contract uh that you can use in your own uh project so yeah this is this

is written for from someone way more smarter than me um and so I don't know what this is right this is yeah I I admire like people that have wrote this but the relevant function is verify function uh and I'm going to actually copy this um function signature because it will be useful later on and so this is basically what you're going to call to verify your proof copying this Okay cool so then I'm going to create a

forge Forge in it a forge Plus project Foundry project here I'm going to pass the force because it wants a new a new folder and I don't want it I'm just I'm lazy and I'm so lazy I'm going to delete the test folder because right who who needs tests um I'm also going to clean up this a little bit probably going to put like the the same the contracts in the same place so they are easy to refer to one one another and yeah that's that's it basically so now we can develop our smart contct just like we usually do uh I'm going to import my verifier from here import um it's in the same folder that's why I put it there plun VK and

that's it I have my what what do you want file import ah yeah that's all cool thank you um so yeah I'm going to yeah remove all of these I I don't care um I'm going to write a Constructor so basically you are very you are used to to do this I'm just going to say Ultra verifier uh public verifier even even GitHub knows Constructor uh yeah not that's not that could be that's okay that's it uh not address that's why Ultra verifier verifier and here is my Constructor so if you're you are probably used to this

you you have your verifier here um you are passing it to your contract so when we deploy this we're going to need it basically um we're going to pass the address here and one thing yeah then we're not going to use this so let's say that you you want to call the increment function and you're going to say the proof is going to be I think it's btes uh let me just check the function yeah byes called Data proof and yeah this is this is what I'm going to be using and I'm saying verifier verify

proof uh and then public inputs yeah public inputs I'm going to take care of that so public inputs maybe it will be cool I don't know how I did it in my reference example but I think I think it I just pass it in my in my Constructor yeah yeah basically so byes 32 password hash because everyone knows the hash that can be on on your smart contract uh probably want to pass it every time uh yeah to save some gas to not start it on the contract or maybe want to start on contract because anyone can pass whatever password

yeah sorry yeah this one uh yeah it's an array of of 32 byes string 32 btes yeah okay yeah I mean it it I'm going to just pass it here so that's why I'm saying yeah yeah it's called Data okay yeah so yeah I'm GNA I know this works

so cool so yeah so this password hash and I'm going to yeah pass it in the Constructor just like just like I did um so it has to be Memory because it's byes it's a it's a byes two memory yeah yeah uh sorry uh password hash yeah yeah it's uh it's confusing I I because it's yeah it's a public inputs I call it password hash but it's it's the public inputs actually um so you're going to see how it yeah basically so so yeah basically and now I'm going to password hash this is the

this is the mess that you're referring to so hopefully this will work um let me just check if I'm missing something probably I am and go say Forge uh create I'm going to say the private key that I store in there okay sorry oh sorry first of all I need to uh deploy the verifier so I say contract contract not reference it's Fight Club and plun VK because I need to deploy the VK usually we'll do this in a script but I'm I'm I'm too lazy so I'm just going

to say uh Ultra verifier and this hopefully will deploy compile and deploy okay so I have my verifier contract here this is the address and so now I can basically pass this along with public inputs into my uh contract contract um and so yeah I'm going to say um Forge create private key it's the same and say Fight Club not B PK it's going to be counter right it's counter counter.

Sol um counter please let me know if I make any mistake or typo Constructor ARS I'm going to pass the it expect expects the the address and expects the public inputs so basically um I'm going to go here it's already here I know what's what's the password hasher I don't know if it's the same here in my test yeah it is right yeah of course it is it was autogenerated so I go yeah I'm passing it and just let me sure yeah it's an array so I need to pass it uh here and Okay cool so now I have my counter

contract here and so this is the verifier and this is the counter and now I can call that contract and say cast call I'm going to call this contract I'm going to say what the function is the function is function is not not verify it's uh increment right increment and say here and public yeah and my proof so proof I have it here right where is it yeah I have it here my proof so yeah it's an ex exod decimal string so I need to tell him

that here's my proof so it's it's a right it's a sorry it fits yeah it fits in the call data and so yeah uh I'll take this zerx as as okay right means that it it uh it didn't rever uh so it executed uh the function uh correctly so basically you can use this verifier you can use it in a modifier for example to safeguard your your your uh oh good good one uh it's a view fun it's a view function it no it's not no it's no increment yeah yeah I did increment

so I don't know it's probably this one the latest one last one yeah it's it's less than I imagine actually I I was expecting like 400k it's not cheap right but it's a start so and that's basically it uh just Mar and afternoon uh the fourth chapter will be how to basically do this proof for and smart contract calls in your browser but I will not have time I'll leave these four minutes for questions if you have uh other if not I'll just give you four minutes back three minutes back you change the

Comm uh commitment scheme I no no no it's uh this is what we [Music] are yeah the SRS the eite it cere or it was generated via ceremony but it was a long time ago before thek money was was de pled in production so I guess 2017 no later 2019 Maybe uh yes uh there is a there is some there

is uh command line for for that if I if I'm not mistaken uh yeah you can you can un yeah but it's okay right it's uh it was it was distributed you can you can trust it yeah um any other questions you scr yeah yeah because it CS the function signature directly so it doesn't yeah that's why it says that it's not it's unused yeah but it's it's a view function which is useful you could you

could use it uh you depending on what you're trying to do you could not use G actually which is always always useful if you want to just hit the not I have kind of an advanced question that I don't know if that's possible with no or uh is it is it possible to do a kind of Mer free of the state of a contract so you can set that you can check the state of that contract that it's in another chain from an2 or something like that uh yes I guess yes you can you can just uh use a Mer tree depend on Mer tree just go and add it and then notify when it's found in

another another L2 yeah so like like a ZK bridge I suppose which would be the path to go through that because I think that it's kind of way difficult but which should be the resources that I should use in order to do something like that go the documentation is there something else that any other rep or that you can think of that already did something like that uh no what I me is if I have these tokens on Main I want to know from optimism that they have these tokens the balance of the tokens from another yeah you could could basically commit to your

tokens on your L1 and then prove verify on L2 that you have those tokens on L1 and then nullify them so they don't get proven twice like claim it twice on your L too I guess I guess so I would have to think about it but I guess I guess that's that's that's one thing but now if you trust the I mean then there is problem of rears and everything that you could have to be aware of L L1 rears L2 re uh yeah rewinds so that could be a problem well you could commit that uh it it is like three like a lot of blocks before so and

and and it has already been finalized so the reor are not uh thing um yeah yeah I guess I guess you could yeah I guess you could do something like that I think that the use case is very important because uh of course you you can you can say I have these tokens at this moment in time mhm anywhere yes so it can be used for voting on any other chain yes yes I mean you could use this as as like storage proofs which is something that we're working with like we had a resarch Sprint to to basically have storage proof so the proof that you know a crypto Punk that you that you own a crypto Punk without saying who you are

or which crypto punk you have that's what I'm interested in that's that they can use uh yeah you should should join the Discord uh the just come back I should I put that in the first thing actually the the Noir Discord you should if you're interested in Noir just join the Noir Discord and make your question there because yeah we have we have some resources that you can use like for this kind of ethereum storage proofs but they are not cheap uh yeah because yeah the merco tree like the the state tree the world the world state in in ethereum it takes a lot of kak hashes and as I said they are not very ZK friendly so you need recursion basically because otherwise it would not fit in your wasm 4 gig uh

limit um what does it mean that much it to compute to to compute it's okay you can do it on a laptop but to verify it's it's not I mean you can do it in laptop if you use a recursion um yeah and you can verify it on chain as well if you use recursion but yeah that that that's that was a problem that we hit when we accepted the challenge of of eum storage proof we're like yeah it's it's cool just verify this number of hashes each hash should be this and we were completely wrong and then we had to start developing more like Ultra plun implementation of ultra plun so we could use recursion and to make it cheaper and yeah we have it running but it's really

not like you don't get easily with nice bindings GS bindings or anything you don't get yeah if if I am running the verification on an going to be cheaper so probably as long as it fits your your block like your guess G limit and you're you're you can pay it I guess it's okay I don't even know how much I mean this this amount of gas how much how much money is this but it's probably a lot yeah so yeah that's that's not cheap 100 is it yeah it's it's it's almost three three 300K

yeah maximum yeah so that's it's it's it's it's not cheap in any way not cheap but it's but it's it's it's okay it's okay again if you if you're going to do it on El or something because on ethereum it's not that's that's really that's really unbearable yeah it's not cheap for yeah to prove that have tokens yeah yeah so we have some examples if you go to on the no uh you can you have Noir starter which is basically a boiler plate for you to start with and you have also Noir examples with some examples that the Deval team has put together uh one of them is voting and another one is

um an air drop a stealth air drop which is not safe okay because of ecd I say you insure malleability but but yeah it's a it's an example uh yeah I think I think it's here that says not safe yeah this is unsafe yeah cool um another thing Noir is going to be used for Aztec Mar contract so that's a pretty good reason to start learning Noir basically because that's that's language you're going to use to to the ASC chain and I'll be glad to talk about ASC chain uh later on because I'm overtime here says yes but that's including any chain

verific justy Pro yeah of chain yeah yeah yeah but it's it's it's really cool yeah yeah it's pretty complicated but they are really good yeah have some more basic understanding issues we provided the proof to the smart contract M and the smart contract does not know what c this belongs to it just proves thats this Pro yeah when you when you yeah when you generate a smart

contract it is specific to that to that circuit so this plunk VK so basically the the the contract that we generate with nargo code gen verifier it's specific to that circuit so it contains the verification key yeah the ver the verification key and so if you change if you change a circuit and then run and and run with other values it will not it will not verify because it it says yeah you're trying to use a different a different so this verification key doesn't work for that for that circuit so every time you make a change to the Circuit you need to generate a new smart contract and redeploy it hope that hope that was useful what's the size

of uh what the size uh we can we can try to get the yeah uh so yeah I only have two transactions here so I would say that this is probably the the two the two contracts that we we deployed so yeah this is the size in any case this was the first one so this is the size not again not small none of these is is cheap you don't get privacy uh it's not you don't get cheap privacy yeah uh until we get to elastic chain cool yeah we're gonna four minutes okay cool thank you yeah can iate um good

question yeah you could yeah I could maybe using like ffi or something probably yes yeah yeah Naro test only yeah it it it only runs like the code literally so yeah I guess so I guess you could do that the idea is that there are blockchains that are it oh you you mean like the smart contract the verifier smart contract in R yes you can but we don't have it yet but if you're interested in building a a verifier smart contract please reach out

because uh this is something that we really want we we are not like ethereum uh maximalists we are okay with any other uh L1 so if you're like oh I want to I want to verify on on SOL be my guest unfortunately we only have solidity for fire contracts but yeah if you have if you have the knowledge and the the wheel uh we will be glad to to talk with you to to have this to have this done yeah and for or any other Shain basically yeah cool uh I guess this is it right no other questions so I'll give you two minutes

back yeah sorry thewhere will push it somewhere uh you mean uh yeah I can I can uh make public my my my uh like the reference contracts this reference examples from this workshop and you can have a look yeah sure there's there's just only has some some notes for me to not forget and I still forgot something you said you have

recursive yes you the verifier uh verify is a regressive proof so you you make a you make proof and then in another circuit you verify that proof so you kind of prove that your other circuit is correctly verified isn't that what he was asking no he was asking about uh verifying the the verifier contract be written in another language for another chain yeah R for yeah for example for solena chain not R this yeah this is this is Sol yeah this is uh this is solidity yeah saying like in that verier is ver uh yeah yes yes yes you could get it from there yeah I

guess so yeah I'm probably liking the specifics but it makes sense yeah I mean Noir is written in in in but but the recursive the recursiveness is implemented in the back end which is C++ so yeah again Noir doesn't do anything it's just compiles to AC and then you run the Acer and so this is what we call the blackbox function so if you go here and you give recursive proofs here given an example it says this is a black blackbox function and this basically says that this this is provided by the back end so if you get that from the back end which is

batenburg uh at least the default back end that's going to be the verifier is going to be implemented in C++ so no trust what are the main differences between and the main differences uh why should I not use yeah I mean there there're they're different I would say that Mar is very powerful because it's very easy to write and yeah that's that's that's basically it's the the the main I think it's a matter of like IDE ology what do you think about it uh but circum is a great language as well is like for our purposes we wanted something that's

really really easy to work with and circum it's not uh yeah it's I mean it's okay but but it's it's not as easy as as nor it's like us composing Hardware yeah it's more like right yeah it's more like writing circuits like I used to draw to draw circuits and then connect the wires to make circum um and this is a way of thinking that it's not common to to engine like like Engineers to to programmers and so and the differences between uh and because they are very very similar

yeah they they have they have similar goals I would say right but I'm Maybe I'm Wrong here but I would say that Carri is more for suc because it's it's basic for for starkware for Stark it and so it's not the priv is not built in maybe maybe maybe there's some kind of Plug-In or something you can use it but it's not the it's not built in in the language like in our okay yeah we need to close cool thank you thank you for coming and I'll be glad to talk later