DAPPCON 2024: Ethereum Without ZK* - Nick Dodsen

Transcript

so I know uh first of all that a lot of you are probably pretty tired it's um hot and uh it's been really long day um so I'll try to make this as um as quick efficient and hopefully engaging as I possibly can um so yeah today uh and thanks to um uh no and and everyone doing dcon I think this is a is really great event um cool so uh this presentation um I'd like to just go over a concept uh something I thought would be a little controversial which is uh ethereum without ZK so um there's always so much discussion around ZK that um I'd like to actually try to imagine a world

where we just don't use it that much um and I think that this should hopefully describe maybe an alternative position in the community that um is something maybe not so considered and something that um might help us actually use ZK better or more effectively um you know in developing all these different uh technologies that we're that we're doing right now um so uh so the first thing is uh I do love ZK I think it's an amazing thing uh and even though I put a very controversial title um I do love it I think it's an amazing primitive the fact that human beings Can U produce these kinds of succin proofs mathematical proofs and create this kind of reality

that U that we have with crypto um but uh there's a few caveats uh to to using it um so the thing is um you know we love it uh it's very very useful um it's getting better all the time there's significant improvements all the time uh we use it across a ton of architecture um but uh there's a few things that uh kind of suck and I think that um the more we're open about it the better we can apply all of this uh in reality so some some issues uh so basically uh and don't mind the um the very bottom uh um uh it's supposed to say hard to beat optimistic soft confirmations um but uh

but yeah so um ZK verifying and proving is both too late in the process and also um it's really really expensive um and one thing that maybe we don't consider so much in a global context is um just exactly how the internet is wired and why doing things in the way that we're doing them now um kind of really sucks so some things to bring up uh Global ping times are not great um it's very hard to basically create a world where uh we have everything interconnected and it sort of feels real time um we're just not really going to get there which means that things need to be done ahead of time which means all kinds of different assumptions that are definitely not ZK assumptions um so

Global ping times um really make using ZK proving um uh kind of difficult as well um there'll be latency on markets um there'll be contention issues that need to be worked out before you actually do things improving uh as well even if we have fpgas and as6 which we will have um pretty soon and Justin Drake is like super excited and everyone's so happy uh we'll have it but uh bare metal racks are not really first class citizens at least in the way that the internet's wired and so there's going to be tons of latency even placing devices like that around Computing in general and where it is um as well we have a hard enough time managing non ZK nodes so just literally running

blockchain nodes is a giant paa uh that is so awful that if you only could speak with devops guys they would tell you wild wild things um and basically um you know we we're in this sort of weird space too where optimistic soft compr right things that we can just kind of do ahead of time because we know things are true because quite frankly a lot of the stuff we're doing with blockchain is very very simple um they're just really really fast and really really great for a lot of different reasons So Soft confirmations are like um something that's really really hard to beat especially with uh the ux that we're really looking for um so when you're thinking about like a typical sort of

pipeline um you you have the transaction going to builders you'll have you know sequencers and and this is again the ideal situation for rollups uh so uh you'll have like a sequence or hopefully a decentralized one you'll have rollups you'll have uh different kinds of bridges going back to ethereum optimistic and ZK um and you can see that it's already quite a pipeline and there's already going to be quite a bit of latency just within this pipeline alone and this is a pretty simple one this isn't even considering multiple different Builders or other kinds of things like that like it can it can get very very complex um and so basically you're going to be fighting uh as I was describing before Global ping times and if you really want to make a global

system where you have you know you're working out Global State contention then you're going to be dealing with overhead of like at least a few hundred milliseconds if you're actually going around the entire world um and that really sucks if you want to have this sort of amazing ZK proved system where everything is kind of interoperating and sending its ZK proofs and verifying them all over the place so this really complicates everything CU this is just going to create all kinds of back and forth latency and overhead between each piece um and it's really because uh you're fighting physics and the speed of light and you're fighting all kinds of Submarine cable issues and all sorts of things and if you want to make ethereum really Global and you want to make ethereum really something that really

does run and is protected and being built in all places around the world then unfortunately you're going to have to cope with latency and unfortunately that means a lot of interoperation between all these different pieces so complexity and overhead is basically a huge challenge even if we had magical ZK chip in our hand that did everything it's still an enormous challenge there's so much that you have to do ahead of time even to get there and fuel even though we're more known for actually doing the first optimistic rollup and that we focus on optimistic rollups as our technique um we actually use ZK a lot as a product like we use sp1 we use RIS zero we use all kinds of different ZK products because we're more agnostic

and um I can tell you firsthand that like uh it's cool it's really cool but it's not there yet uh it's very difficult to use right now especially in production it's getting there but it's difficult so um there's this overhead issue there's a complexity issue custom chips are really hard to build economically um they're hard to service too um and ZK is very hard to make economical for uh something that usually gets overlooked which is very small chains so you know one project one chain maybe they have their own User Group they'd like to interoperate with everything but they don't want to pay an enormous proving bill it's really really expensive to run they have to cut costs everywhere they can and this is really

not worth it for a lot of small projects that have a lot of volume so um you know why should they pay this proven cost just to prove to ethereum that what they're doing is valid which by the way if you just run a node for a lot less money you can show that it's just valid but you just can't really show ethereum very well that it's that it's valid so um so what tools do we have outside of ZK and by the way this is something relevant to both ZK projects and non-z projects because it's also relevant to what you do ahead of the ZK itself what what what assumptions or what things tools are you using either ahead of ZK proving or without ZK proving at all so some typical core mechanisms that um you know uh basically Engineers have thought

up over over time is honest majority assumption gadgets honest minority assumption gadgets Hardware based attestations bonded cryptographic assest stations and social slashing uh so not totally in in specific order in any way here but just to say these are some varieties of mechanism that we have to um construct things that uh allow us to work through building these kind of state transition machines um and so you know you have the typical like layer one designs you have side chains you have committees you have multi and that's in the honest majority category um then you have a very special odd category which is the honest minority assumption gadgets uh and these ones are really actually it's a very

small group currently uh it's just fuel V1 and maybe one or two other rups bartex in the room he'll probably be able to to clarify uh which ones really meet an honest minority assumption uh and then as well there's this gadget I released recently called um uh well I just called a fast finality optimistic rollup um so you can read that on um ethereum research uh and that describes a mechanism to build fast finality optim optimistic rollups such that you know optimism arbitrum everything can basically if everything works well can drop their um you know finality window down to one ethereum block or less um so basically alleviating that 7-Day window that's very very annoying while

retaining the honest minority assumption um then you have Hardware based adest stations which kind got a bad rap over time but they're actually super important so like Intel sgx uh got a very bad rap a lot of bad things about it but you know when you're really thinking about building these really complex provs and complex systems like at some point you might need to level with yourself and be like hey if I had something like sgx that really worked and that you know gave me a really good cryptographic attestation from this known Hardware device that's pretty great um it's not ZK but it's actually very very good in comparison especially when you consider all the overhead um sign bonded light clim proofs and other things are are really interesting um

there's a lot of mechanism designed there U and then you have some interesting like kind of social slashing and governance mechanisms um you can see with things like Igan Lair and uh and ethereum in the worst worst cases where you know we have like just tyranny uh um on ethereum itself so so these are the mechanisms we actually have and and these mechanisms are actually pretty amazing um they're not going to give you everything they're not going to give you a single succinct mathematical proof that things are true um but they are going to give you an incredible tool set to build some really really great things and if you can actually get things down to an honest minority assumption that's pretty great for most projects and it's virtually almost free if you can

actually manage it and the cost is very very low so what would ethereum look like if we just forgot about ZK for a second we just only had these other mechanisms so basically um optimistic rols would become commonplace as the primary rollup format um cross-chain Atomic execution will be done through Builder networks and outstations so Builders would be able to basically build on different chains but they can see the state of it and they would attest and then you would basically get some kind of cross-chain atomic uh processing that would sort of make all the existing alistic Roll-Ups uh feel like they're kind of one at least to a user um you would have assumption based sequencers so things like tender and

other things would be used to help sequence transactions as well there's also base sequencing that's something people are discussing um and then you would be using minority and majority uh and social slashing assumptions everywhere in terms of the mechanism design so um and probably with different levels of combination um is well intense which uh aoma is uh kind of known as like one of the major intent projects intents would be used everywhere uh basically to create a uh a different kind of user experience that you're not going to get if you're just trying to make transactions all the time um but instead you're kind of settling what you want outside of some of these chains um staking and um I was say reaking sorry uh staking and reaking can be done um on

uh primary operators as well so when you actually have all of this one of the biggest benefits of not using ZK is that it creates risk and unfortunately for human beings risk is such an incredible provider of yield and when you remove all of the fun of the risk you also remove all of the opportunities for yield and so a really big one that you know is sort of not really listed here but is something that I think uh is really really cool is that when you step away from trying to get absolute truth you actually step into a different reality where well how much are you willing to risk uh and with ethereum you could put billions of dollars on it it's got like 90 billion of of economic security like that's pretty great and

even if that whole 90 billion was corrupted tomorrow like we would as a community sort of socially fork and probably fix it so like this is a pretty amazing effort in the sense that ethereum is running on this majority assumption and you know we just kind of have this social contract at least as a as a community so basically um what's really wild about thinking about ethereum without ZK for a second is just that we're getting to a place where well it's creating all these kinds of new risk oriented opportunities that you would remove if everything was just perfectly mathematical um and I think that humans actually prefer this and the markets probably prefer this over just making everything risk-free uh at

tremendous cost um and so when you look at like the pipeline again you can see that there's different assumptions that are going to have to underpin different areas of rollups themselves um and this is a very stacked assumption uh in General uh for security so you know as opposed to just like uh like a single monolithic chain that has only one assumption that you're really going with yes you're sort of stacking them up over time but at each one of these layers you're actually creating a tremendous point of value creation that I think is really really interesting and and remembering that we don't need to rebuild honest majority chains all the time we have rollups we have ethereum to prove things which means you can have

honest minority uh assumptions and you can create all these kinds of bonding and staking and slashing um criteria with those but with much better guarantees on security um so it's really actually a very fruitful Universe if you look at ethereum without ZK and I think that um that's you know sort of a different angle so so again the benefits with no ZK are that um you know you just don't have this giant overhead that we're always thinking about all the time and it is getting better every day but it's still just an enormous overhead and unfortunately uh I'll be the you know the uncomfortable customer in the room being like I don't like this yet uh it's

very very expensive um but you know it'll it'll progress and get there over time but maybe this is a little bit of a reality shift for at least ethereum itself so again no proving uh overhead is well um cross-chain Atomic execution can be done by attestation or can be done by even honest minority Bridges um is well you know there's just way more opportunity for cryptoeconomic risk- taking which is awesome uh and that proving times are no longer an issue because the second the computer validates its true then you're either going to build an attestation out of it you're going to vote on it you're going to progress it um and remember that with all the latency that ZK will have you'll still need to do things ahead of time anyway so some of these things will still need to be there um and as well

one last thing that we don't really talk about is that um there's just no complex overhead on the auditing surface level so you're really only doing the transactional level and that's it um so there is some pretty awesome benefits um some downsides of no ZK are of course you've introduced new assumptions uh and new bonding you've introduced more bridging and interoperation risk um and as well there's challenge windows and gadgets that you know we'll need to overcome um but uh even with my fast finality Gadget that I released as well um and I'll release a part two of that Gadget um there is ways to actually overcome the re uh the reliability of those things if you know what I'm

talking about um and that'll be a very exciting uh post that I'll that I'll do later so what does this look like in the end uh at least for fuel and what we think of ZK is that we take a position of pragmatism with ZK so uh call it ZK pragmatism so there's certain areas in our build that we really like using ZK and that it's really really good at so compressing data and witness information um fraud proving enforcement um in the pessimistic cases veral trees and state minimization um proving low throughput rollups um is definitely a possibility unfortunately for fuel which is a high throughput rollup it's going to be a long time I think until we really see that to be very very efficient um and then as well predicates which are

something unique to what fuel does and what certain ecosystems do which allow for monotonic uh processing um in sort of a massively parallel way um these are great moments for ZK and we definitely want to use them for those um what we don't like it for is interoperation between rollups and proving High throughput uh you know uh low uh low low value uh rollups these are very uh tricky in terms of um proving itself so um of course always open to re-evaluate as the uh Angry ZK customer in the room um and you know fpgas and as6 will will reevaluate those as they come out um and re-evaluate all kinds of ZK in in the the high throughput setting but for us

we're we're definitely more on the pragmatist side when it comes to ZK um we love it we love all the different ideas that can come from it um and we use it in our designs all the time but we just don't use it to prove everything because quite frankly for most of our users they just wouldn't want to pay for it and you know even if it's for interoperation or security they still wouldn't want to pay for it and they wouldn't even want to lose the opportunity to generate all the yield off the risk of producing u a new chain anyway so um so anyway a bit of a controversial odd presentation but hopefully that was uh hopefully that was interesting and yeah thanks thanks everyone thank you Nick good to hear some real talk about ZK proofs uh we

have a few minutes for questions for Nick if there's any in the crowd thanks for the presentation uh I think I personally um share with you most of the comments just not the conclusion um so a question for you uh assuming uh we we live we lived in a world without zero knowledge okay yeah um how would you see challenges working for systems uh like you know I lay or similar where basically at the end of the day you need a challenge to be able to solve disputes uh as with many of the other approaches we are saying also if we decide to exclude sgx and other te based attestations yeah um so I think

that um so ethereum provides us the most incredible platform to um witness State transitional machines that we've ever created so ethereum is the best platform ever that humans have created to adjudicate something computational at least so um so in a sense ethereum provides us with an amazing platform to to adjudicate but I think that the best assumptions that every mechanism should work over is probably an honest minority assumption meaning that any one particular party on planet Earth if they run the machine can challenge that there's something invalid and I think that when you get different designs down to that level it just becomes such a an

interesting world because uh you could have like you know out of a validator set of like 300 people you could have one person who's just maniacal who can defend the entire system even even outside of the cryptoeconomic uh um uh like criteria for like a rational actor um so I think that like um the ivg games we have that are between like bold and um and what optimism is doing with Canon like those those mechanisms are fine to adjudicate computation on ethereum they're not really great and quite frankly we prefer using ZK to do those fraud proofs because it's it just makes more sense um but uh I think that um the most interesting world that we haven't

lived in yet is building everything with honest minority assumptions around ethereum and I think that that's actually a very very crazy world like there's no honest minority Bridges really there's no um you know challenge-based honest minority gadgets being used all in different kinds of ways and what I don't like about Igan is it assumes majority assumptions too much and for me my favorite designs are to just assume that ethereum is your only honest majority assumption and then build off of that with honest minority assumptions and to me that Garners such a high LEL of Security even we've seen the trust and arbitrum and optimism to you know produce these systems and gain the tvl that they have that I think that um for most cases on planet Earth for

most human beings building your chain with an honest minority assumption is like probably one of the best things you can do and it's not exciting it's not sexy like uh ZK would be if it was all magical ZK but I think that that narrows down the security profile and the risk profile so low that like it's really it if you can do it um so so with fuel and some of the gadgets we'll we'll be producing um code for you'll see that we can actually achieve really great fast finality properties while retaining a minority assumption and a permissionless validator set um and building that off of ethereum um and showing that it produces really great as I was mentioning opportunities for risk which

creates great opportunities for yield and I think that we shouldn't ever understate that especially looking at the success of stake eth and the success of some of these uh designs that we have in the space so that would be my preferred world is that everything is an honest minority assumption that makes sense uh except for ethereum that needs to be a majority probably yeah thank you so much Nick thanks everyone we'll get started in about one minute