Episode 213: zk-SNARKs meets Optimistic Rollup with Zkopru

Transcript

welcome to xero knowledge i'm your host anna rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online this week i chat with juansab lim an applied developer in the privacy and scaling exploration team at the ethereum foundation he is also one of the authors of the zcopro protocol in our conversation we explore zika peru and how it uses optimistic rollups and zk proofs to create an optimistic private l2 but before we start in i want to say hello to all new subscribers and welcome

this is a new year for the zk podcast and it's actually the start of our fifth year as a weekly show there are a lot of exciting events and initiatives on the horizon and sometimes it's a little hard to keep track i try to mention as much as i can at the beginning of each episode but if you do want to keep track of what's going on be sure to join some of our channels maybe follow us on twitter definitely subscribe to the show wherever you do get your podcast here are some additional highlight channels you might want to check out we have a telegram group it's currently on fire the some of the best zk researchers in the space are debating all of these really cool kind of nuances of different protocols it's definitely worth checking out there's also the zk community board this

is where we can actually do kind of deeper dives into the research in the space there's also a zk jobs board so if you're looking to jump into the space professionally that's where a lot of zk teams are actually posting their jobs it would be a great place for you to start on your job searching journey so we're shaking up the format a little bit and starting this month i'll be inviting my producer tanya to start reading the ads for the show we realized when she was a guest on the zk hack wrap up episode last month that she has a fantastic voice for podcasting and that we should definitely use this for our show so i want to say hi tanya and yeah so tell us a little bit about this week's sponsor so for this week's sponsor we want to thank our friends over at aztec

aztek aims to be the privacy layer for ethereum they believe that unlocking programmable privacy is the next frontier for blockchains aztec is also the first zero knowledge roll-up built from the ground up for anonymous payments and defy transactions you can already start sending funds privately on zk money that's zk.money so thanks again aztek and back to you anna cool so now here's our episode all about zico prue [Music] today i'm here with one sub lim an applied zkp developer who is part of the privacy and scaling exploration team at the ef he's one of the authors of the zikopro protocol

what's up welcome to the show ah thank you so much thank you so much for having me on the show now this project has been one of those projects that i've been chasing for a little while once up i've been asking you to come on the show for i think almost a year yeah to talk about the project i'm very glad that you have come on um you actually spoke you gave like a short i think it was a lightning talk back at zk summit six this was at the end of 2020. so that was sort of my first introduction to this project tell us a little bit about what z co pro is yeah okay so zika pro is a private transaction protocol that uses zika snark to preserve the

privacy and also uses optimistic role up for the scaling cool yeah so you can send some erc 20 and your 71 and either privately uh in a cheap way in a cheap way that's really cool um before we jump into the projects i think that's going to be the bulk of the episode i actually wanted to talk to you a little bit about your work at the ef so you're part of the applied xero knowledge proof working group i guess which is this privacy and then like the subgroup is this privacy and scaling exploration team yeah what is that team like what are you guys doing what's it like to work there i'm just very curious about what you're doing there yeah actually in the private school and

exploration team we have a lot of people there so some of them are um developing some bls wallet or some of them are developing some peer-to-peer finding protocol using some zkp in a private way and also some of them are um developing this kind of private transaction protocol like zikopro and we are one we are one of them i've always been curious about like the applied zero knowledge working group like is it is it quite large at this point are you talking like 60 people or is it like a more actually i can tell that how many people are in the team because

we work uh very separately so i don't know the total number of the team members but actually there are a lot maybe i can i guess more than 50. wow i'm not sure but yeah a lot of people are working what about your team what about the privacy and scaling exploration team how big is that uh so my team is also my team is a secret pro team in the privacy and scouting exploration team i see okay so how big is your team then let's find out uh yeah ziggler team is we are a including me okay cool yeah one last question about the sort of ef's applied working group i mean actually is the zkp applied working group which is

what i've always understood the group to be is it the same thing as this privacy and scaling exploration team or is it so okay it's you you've probably changed the name and i have sorry about that yeah okay cool is there a philosophy like from what what i've seen it's often been like research projects research papers early implementations and then they're kind of like spun out like they're kind of like a team will run with it and start to implement it so what is the philosophy around creating some of these ideas like how does that idea come to a team and what happens with it so actually i think that uh we usually try to do some discussions between us as much as possible and

actually the key philosophy of the team is that we are developing a public goods so we do some projects uh in a with a good wall and we are not trying to commercialize the projects because these are all projects are funded by ef and actually that means these these are the public goods so we are focusing on the research and just trying to just spread these research outputs to the whole uh developers in the ecosystem very cool yeah

so let's dive into zcopro zcoproo is a protocol or is it a product actually this is a protocol and maybe we are thinking this is this is a reference implementation i see so you and maybe let's go back to the start of this how did the project start what is the paper like like what was that whole process yeah so actually this project started from 2019 and at that time i just traveling around the world with some friends and just was shocked a lot uh because they my friends were following my ethereum wallet

because before actually i just sent them some thai because we just shared some dinner so yeah yeah so actually some of my friends were tracking my ethereum and a year later maybe yeah a few few months later i just uh get some liquidated at the maker though and they just told me that oh i show i saw that you'll get liquidated at the maker dial like like that so i just thought that oh oh my god actually we have really no privacy no yeah so that's wild oh man that's so personal though that's such a personal story of like

your friends being like saw you got liquidated yeah right so that was the reason why i started the privacy solution so i just started to build it from the 2019 around june and had a talk at the defcon at osaka so defcon 5. and barry uh barry whitehead he just saw my paper on the 8th research and also the defcon talk and we just started the talk that actually my first project was also some using some ckp for the privacy and also using

optimistic role for the scaling but okay barry had a better idea for about the protocol so we had a lot of discussions and we we started to improve the protocol itself so i just maybe barry's idea improved the protocol about five times better cool yeah so i guess so what you're saying is you already had the mix you had the idea of doing an optimistic roll-up uh plus zero knowledge proofs kind of as the privacy component but i guess you remade it how did you change it like what was what was it before and what is it now at first actually i tried to use mimble rumble protocol

is also a ckp but actually the pro problem with the mimbal wimble is that we can just keep track of the transaction i mean uh actually mimble is not a full private protocol so i need to add some kind of uh kamehameha nullifier scheme to my vulnerable so it's a modified mimblewimble okay but actually minimum is kind of a multi-party computation but barry's idea was that oh we don't need to do the multi-party computation for for for the transaction i mean that number will always need uh the sender and the receiver uh community communicates at the same

time to be online at the same time yeah right yeah and that is a big problem for the user experience so uh various suggests to me that oh we need to change it just like c cash to make it more like this shielded account kind of model we're just using snarks i guess yeah right so actually our zico pro design is kind of implementing zcash on ethereum oh wow okay so it is so you do have that when you say z cash you do actually mean the shielded unshielded yeah right so we have a viewing key and we have spending key so yeah it ensures the compliance that's the

compliance makes sense but i mean like do you have so as a user i'm going to try to picture this like would i go main chain over an optimistic roll-up bridge kind of thing to a new chain which is public but then you go into shielded or do you automatically when you go over that actually every transaction is our shield okay so it's a fully shielded all right l2 for some reason i had in my own notes sort of this idea of like zk roll-ups and optimistic roll-ups blended into one but would you say that it's quite distinct like the actual l2 mechanism is just an optimistic roll-up as we understand it fraud proves yeah so this is actually this is not a mixed roll-up

so okay it only uses dk before the privacy and then the altitude solution is just run by optimus roller i see and is it like which what kind of fraud proofs is it based on because i know that there's the camp or the school of thought that optimism came up with and the school of thought of arbitram what's it closest to actually um optimism and arbitrary made for general purpose general state l2 but actually our zika pro is a special purpose layer to special purpose optimistic roller so we have a lot of some challenges uh codes so for example the challenge code number one is that

uh the coordinator submits a invalid transaction route okay in the header so we have it maybe i just guessed that we have 40 types of challenge transactions so we're just covering all kind of some possible situations we did do episodes with optimism and arbitrary but like how are they doing it differently do they also have that kind of thing are the codes different are they four different edge cases or is it like yeah maybe just flesh out a little bit that difference between the two because i i kind of don't remember how they do it so i'm having trouble totally seeing why this is different actually yeah actually i i also don't don't know exactly

the difference with optimism and our protocol i see okay yeah yeah but you just know how you're doing it so it is yeah right so it's the you come up with like ways that people could produce some fraud and then you have checks for that i guess yeah right because it's like a the challenge the implement fraud proof is just like implementing the protocol itself i mean that in the protocol we have a lot of statements like maybe the protocol statement is like the state route should be changed like these if we have these kinds of transactions

right so just the broad proof implementation is just implementing this protocol itself i see but do you also have this like seven day waiting period or like is what's is it the same as that it's like the sort of one could challenge that and then what would happen exactly or is it's rather like transactions going between main chain and the and the l2 will need to be delayed because there needs to be a period when fraud proofs could be submitted yeah so we we wait seven days for the fraud proof cool i feel like like in this in this conversation i'm realizing like man i gotta revisit the uh optimistic rules because i can tell i'm a little fuzzy on like

exactly how they're working but um okay so but i see some similarities there i get i guess what i'm trying to understand is is there any part where like the zero-knowledge proofs change in any way the way the optimistic roll-up is implemented or would you say it doesn't need to like the optimistic roll-up does its thing whatever is happening underneath the hood like whatever if there's zero knowledge proofs or if there isn't it's kind of acting the same way um i think in the optimistic rollout the most important thing is only the core data size so if the zkp needs a big size of proof then it is very

unbeneficial uh for the protocol because it costs a lot of some call data yeah actually it depends on how ckp works okay well let's move on to that side did you have to implement your zero-knowledge proofs in a very specific way for them to work within an optimistic roll-up i i don't think so because our transaction itself should be valid by the ckp and actually it does not depend on the role of technology is optimistic role or skill roller so yeah cool and then you mentioned that it was like the the z cash model so you're basically if you're doing transactions on this roll

up you'd be also attaching to it as like a snark proof i believe and that's kind of what proves it's the validity of each transaction yeah actually we uh gather all the transactions including the ckp together okay and we just pack that as a one block and submit it to layer one and we do not run the execution of the validity of the each transaction but we can just submit a challenge that oh the seventh transaction of that blog is not valid how would you do that though like how would someone identify like so let's say that again you in z

cash each transaction was like there's a proof attached to each transaction yeah right what you're what you're describing is is it also each transaction has a proof yeah right it does okay but then you batch them together and these are written to maintain through this optimistic like the way that most optimistic roll-ups are so there's a sequencer i guess yeah we have a coordinator and yeah it's yeah it's like a sequencer okay so you have you have the coordinator that is basically putting and maybe tell me i think it's putting together these blocks like what what do you use to kind of compress them into something that would go on the main chain like in zk roll ups you often will have like the proof and

then a verification in the smart contract here what is the sequencer doing exactly or the coordinator in your case yeah so the coordinator receives the transactions from the client and the transaction in a batch i guess right okay yeah so receive the transactions and create a badge oh they create the batch okay yeah they create a badge and submit that to the layer one smart contract so they have a batch how do they make it a small thing that you could put onto the main chain so actually we just submit this batch it's solved to the layer one actually this is our next step to just compress the all the proofs into one secure roll-up so you know this is kind of a

recursion right ah okay so what you're saying is let me see if i can map this so you have a zkp attached to every transaction it's then batched together but then do you know do you then take a snark to make that into one proof no we are not passing the probes into one zika snark what's your p you're not doing that so you're not using recursion yeah right we are not using recursion and okay actually recursion is our next next step okay so recursion might come okay we'll leave that for future then we'll revisit that one okay but so but i still don't really understand how like it to me it would seem like a lot of data

this is where i might also my my fuzzy understanding of optimistic rollups as i'm just realizing i have um i kind of forget how they compress it into something that's small like do you hash it do you like like you must be making it into something smaller i imagine um actually we are we are not just comprising so you just think that a one transaction has a data of about uh 256 bytes okay and also if because we are using growth 16 so its proof size is 250 16.

so one transaction has a data around 512 bytes of data and call data guess price is around 8 000 guests okay for one transaction for one transaction and we do not execute the verify function in the smart contract because the verify uh it consumes around maybe 200 to 300 000 gas per month the expensive part okay yeah so we just skip this okay another question about this that might help me understand it does does the roll up does this actual

roll-up have a state are you basically like doing a checkpoint of the state of the roll-up is that what you're actually writing to the main net when you talk about batching and you're putting these things together because like i guess what i started to imagine was like if you have individual transactions and you're trying to write them to main to the main net then i'm thinking like well that's a lot of that's still a lot of gas yeah but if you're just showing the latest state at checkpoints is that kind of what you're doing yeah you're just storing the latest checkpoint the blog hash on the smart contract you don't do anything and you're not doing the verification which would be very gas intensive and just storing that small

hash of the latest state is not that expensive either i guess okay and then you have the seven day window so there it's like if someone submitted a fraud proof proof of fraud basically would it be like a bad transaction or would it have been the bad behavior of a coordinator what are you testing for with this fraud proof it's a bad behavior of the coordinator because if the coordinator accepts a an invalid transaction then it's a bad behavior i see yeah because that's what they're supposed to be checking for yeah right okay so actually we have an episode about that um we are now running test

net on the growing network and our previous coordinator software was accepting invalid transactions so the testing coordinator was got slashed wow did did you do that on purpose or did you find it you found it afterwards yeah right it was just fun there just on the test net damn so you actually got to see the fraud proof in action yeah right i feel like the fraud proof is always kind of like this like theoretical future thing that you don't get to see because because it wouldn't make sense for anyone to do it would be so dumb um but that's cool you actually said that is encountering a lot of some uh slashing conditions we've never expected are in our development progress

development stage yeah okay so i think i'm following this more clearly now and this is what you mean where there's no like i think the non-verification on chain actually helps me to understand why this is not gas intensive um i do wonder you know we talked about sort of transactions but are you z copro only for transactions or does it also deal with any sort of programming like is it purely like i want to send privately or is it also like i want to compute privately actually this is uh only for the transaction like bitcoin i think we are supporting a some um a few features like

autumn swap and maybe the only um special feature of the protocol will be the atomic swap so i have a ear system to one and you have a 10 die of years 20 okay then we want to exchange this each other yeah on sql pro network then we can exchange in a private way so anyone does not know that i suspend my i have a ear system to one and you have a 10 die of years 20. okay then we want to exchange these each other yeah on zico

pro network then we can exchange in a private way so anyone does not know that i just sent my either stamped one to you and you send your attendaite to me anyone anyone does not know this is a private atomic swap how are you doing that though because i know that that's been like sort of that's the uh shangri-la that everyone's trying to find i think that's the wrong metaphor but and that's the sort of like goal of so many of these like private dexes are you not are you not susceptible to the same kind of like you know leakage of information um actually uh we just thought that there are two kind of approaches to uh achieve this goal and the first one is using mpc multi-party computation

and the second one is just using a memo field using a memo field actually we can just declare that i need a paired transaction which gives this note to me so when we try to do a private exchange between us then i just tell you that oh anna please create a note which amount is 10 and the currency style and the owner is one sub then i'm gonna create a new node which includes a year 71 and the owner is anna and let's make these two transactions

and submit this pair to the coordinator this is how the atomic swap works in sql pro is atomic swap is this a concept is this a dap is this a part of the protocol itself is this like something oh wow okay so you have this built into the entire thing so it's the the optimistic roll-up the zkp's on on like the inside kind of being generated and then making everything private and then you have this memo field phenomenon is that something that any protocol could easily do or is that like very interwoven in what you're doing i'm also wondering like is that memo field also hidden is it also hidden by a snark or is it public it's a public

so actually using the body party computation is using snark and we can just make the automix swap part uh as hidden but we just choose the public way so i mean that actually in the private transaction we generate outputs of the transaction we have inputs and outputs of the transaction right ck transaction and automatic swap is just having a we have a swap field of a transaction and it means that we need a transaction of at least one transaction in the batch we which have

an output which is exactly same oh with my swap field oh okay so you're kind of like you're doing both sides like it would one account kind of do i'm trying to picture how can you can you actually walk walk us through how this would actually look like for each so say there's two accounts there's two users yeah and they're trying to they're doing it with each other right there's yeah is that how it's usually happening yeah and now and what's up okay so yeah why don't you just say what each of us is doing exactly because i didn't quite follow how the memo like what exactly we'd put each into our memo fields yeah okay let me clarify a little bit so

uh our zikr transaction has a memo field and also swap field oh i see okay yeah okay actually the memo field is out of protocol but soft field is a part of the protocol okay yeah by the way usually when i create a zika transaction then i spend my note and create two outputs and the two outputs are the hash of the note and the data of the note will be like the amount is 10 and the owner is anna okay and if i use a swap field then uh actually this is a kind of paired

transaction but am i putting i'm not putting both sides in right i'm just putting one like i say i have 10 die you have 10 either wow okay weird trade yeah oh yeah okay you're a bad trader okay so okay so you have 10 ether i have 10 die so what are we like what am i putting into the memo field if i can die so let's say that we are trying to trade five die to five either okay then uh i spend my ten either note and create two notes

and one is one is five for me and yes and one five they're for you okay cool okay and but i i actually i have to get the five die from you right yeah then i uh just use the swap field and just fill filling the data with the hash of the desired note that i want oh wow yeah okay okay so you also create you also spend your attendance and create two notes and one is five that for you and was five died for me and the five time for me the note for for me uh should be equal should be should have

the handshake yeah yeah of the swap field and what is public then is the hash could one view the hash on chain on the l2 yeah anyone can view the hash i mean okay anyone can see the hash of the outputs okay so swap field is just a just the hash of the output yeah that i want from you so you see that like is that visible like if you had an explorer could you actually see it yeah okay what could i learn from seeing this hash what you can learn from that is that it is paired or not okay you could tell that two hashes had been made and somehow swapped together yeah right so your transaction and my

transaction should have each swap field and it's just fast fuel should be one of the output of the opposite transaction if you knew the hashing algorithm you're using could you not decipher how much it was or something else about it actually we also have a salt value inside the note so actually that is not possible okay if you want to decide for that actually you need the salt value what's salt okay i don't know about that yeah is that something you guys came up with or is it a comment is it common yeah common terminology by the way let's say that uh we are using ketchup to 256 and we using ketchup and

we are hashing a data which is zero then we will have always same hash right but if we put a another data with it then we can just randomize that i see so the salt is a random an extra random number yeah right but then if you're making that on both sides like how would you get the same salt because you still need the same hash so for the exchange we need to communicate with each other yeah so we should share the same salt together oh you but you do share salt oh i see okay so even though okay that's that's actually this helps me understand why it's like especially impossible

the leak is if you knew for some reason someone's account number and chose a few different kinds of amounts kept hashing that without the salt could you accidentally run into the same hash i don't think so still would be too hard because you did because the account the account number that they share with you is maybe not the one that's been hashed behind the scenes if it's possible then i i mean maybe i already had vitalik's account yeah okay okay here everyone can hear that like you know and anna's knowledge of hashing is is rusty as well apparently well it's the new year you know anyways um okay okay so i guess i think i

understand now so this like this atomic swap idea though is that built or is that like still a conceptual thing is it is already built in the current protocol okay and you also mentioned though that like these erc20s but like how do you have erc 20s if it's only transactions like it to me an erc20 is a smart contract that uses a specific kind of formula to create itself which is the erc20 part of it so it's a new token but it's usually done as a smart contract and this actually leads to another question like does z coproo have like is it evm compatible does it have like an evm like it doesn't have smart

contracts on its side it sounds like not yeah it doesn't so actually you can deposit your years 20 or year 71 or either into the zika smart contract then it automatically converts it to a zika pro note got it so will each of these have its own unique code within the rollup so like the erc721 will mean something else in there so it will have like the pro version of itself like on your on the zika prune side of things okay yeah and then and this is what you mean when you're doing these kinds of swaps you're like you're gonna have internally a different like in your roll-up there's a different code name for what these are i

guess like you're going to have a unique type of token that represents that erc20 but actually how do you do it with erc 721 since each one of those are unique yeah actually yes m21 is one ear sent to one becomes one note okay yeah every every note is unique oh wait uh but are you saying but how okay sorry let's take a step back say you have 20 dies and somebody else has 100 die and they both like want to move on to the roll-up they deposited in the smart contract but do you create on the zico pro side very different notes for both of those even though it's the same erc20 type yeah so

if then we we can have two two notes and because they have same um address yeah your standard address we can merge them into one note okay so they do so and then would they get like i forget what number i used like 20 and 100 or whatever but it's like the person who put in 20 would they get 20 of these notes or would they have one note that says they have 20 of this thing when you say note is there 20 notes plus 20 notes or 100 notes that go out or is there one note that has a new value to it that's sort of what i'm not clear on yeah one note that has a value okay and so there's one note created

on the roll-up there's values underneath that in that yeah and 20 of that note type will go to one person and 100 would go to the other person on the rollout and what if later someone came with another 50 die like i'm basically trying to understand when you say note do you mean like type is that like a currency type like would all dies on the because it's all the same contract right so it's like the same erc 20 contract on the main net would that reflect a single note type on your side and then there's only one of those notes but only and what you have underneath the note is kind of like the balances

um actually there's we have only one type of note and each note have a some fields and the first first field is amount and the second field is the address and the third field is like is it nft word now like that okay yeah and then what's that but how do you decide between different erc20s yeah so we have address field inside the node and when you say address field you mean the contract address yeah right contract okay okay okay got it okay yeah i think when you said address i thought maybe it was the address of the the owners uh yeah address yeah also the owner and the address of the year's jenny okay so

that's sort of what i'm trying so you have amount so the person who had put in 20 to the smart contract on mainnet now has 20 like it has this note that says you have 20 with the contract for die like the ad the address of the die contract so it's like tells you what type of currency it is or what it you know what it reflects and then their own address number as well as like this is the owner of this note yeah right actually the public key of the owner so you'd have the private and the public on the note or not yeah actually to use psdk transaction on sql pro you need to create your own sql pro account

using a private key then it will give you a public key okay yeah where are the snarks created are they created by the person making the transaction yeah they are okay so each each time you send something you're also gonna be generating a snark yeah all right so if you want yeah if you understand some transaction then you need to create a snark okay and what kind and you said it's graph 16 yeah but is it what like size it must not be too big if people are generating their own like yeah tell me a little bit about like how what the snark looks like what what is it similar to yeah actually our smart circuit is not that big it only contains a logic about

the mercury proof and the ownership proof and a little bit of some protocol implementation inside like range proof so actually not not that heavy not that big yeah is it similar in size to like what tornado cash used because i know there's this pretty pretty similar but the difference with the tornado cache is that uh ternary caches um have different pull for different years 20s for each tiers train but we have a one one integrated pole what if somebody had a really weird erc20 that isn't like well known have you chosen which ones have been

able to be replicated or is it like free-for-all anyone can send any tokens yeah anyone anyone can register their own token and anyone can use zika pro and actually very uncommon years training also can be protected so but maybe because of the small set of the years that ears 10 users so it sort of reveals the privacy a little bit yeah yeah there is a little bit of privacy leak but yeah protocol itself protects every kind of beer series okay but in that case wouldn't the erc721s also leak because like they are unique and each one would be like is there any

way that each one would be traceable yeah but let's say that i deposited cryptokitty and i just transferred to you and you transferred to your friend and your friend transferred to some other room and that guy withdraw that you'll see these two you but you would see that it on the main net you'd see like itself it's almost like flipped over here without a trade yeah yeah we just can see that i deposited and whose name is call with through the cryptokitty but actually we don't know the

trace of the transfers throughout it how like are there any uis or interfaces already for this like is there any like how would i'm trying to kind of picture how i mean i know how zk sync looks i know so far i mean i don't know how the the new versions will look but like i i kind of know how they're often these l2s will build sort of interfaces so that you can actually like understand that you're set you're locking something and you hit like i'm locking it you you know accept the transaction or signature whatever on metamask then you have this new interface this new place where you can like do things like trade things have you built out any of those interfaces or

started to think about them so actually we are we already have a ui that supports transfer right them but we are currently building the private exchange and also we are building a merchandising oh what's that like so i just thought that we support private exchange so it means that you can open your own store and you can sell your own nfts accepting years 20s wow the private way that also ensures the compliance wow so you know i've been trying to find the zk nft projects but it sounds like you you have sort of a

a potential model there yeah all right so it's like a it's like a web three people wow is this part of zcoproo's like goal is this the team that's actually building it too yeah right so as takamichi in the team is building the private exchange and robbie is also building the merchandising tool that uses this private exchange wow that's exciting that's an amazing use case that's actually one of my questions because like i mean one of the things i did want to ask is like there's a lot of roll-ups and there are like aztecs doing privacy on snl too but with private computation and then you have you know a lot of like the zk roll ups even if

they're not private right now definitely have like a play for privacy so how are you seeing yourselves kind of being different yeah so actually the i think the final goal of this project is um giving the merchandising tool uh to the ecosystem i mean the to the people and to achieve this goal what you have to do is implement the private exchange actually the private exchange is also a little bit difficult because it also uses blind fine to find the the peers to trade together and also it uses a socialist millionaire protocol that to find the exact matched order between the seller and the buyer and so

just like this we need to implement a private exchange also we need to implement a merchandising tool so actually there are a lot of some milestones for the team that you have to do yeah that sounds awesome though um i just realized i wanted to double check something so earlier in the episode i asked you if like the state was written to the chain but now i'm realizing and it's kind of i'm remembering like z cash is an o like a utxo model so is this and the word state i don't know if it maybe there's a different term for this like i always think of state as like state versus so so state model yeah anyway maybe we should just clarify that because now i'm realizing like just so i also walk away a bit more understanding

what's written to the main chain is it a utxo type state i don't know what you call it or is it like a evm type state what we store on the main chain and what we store on the layer one is uh the root of the merkle tree of the whole output okay so which what does that mean though i mean that this is a uh root hash of the unemitted pole of the anonymous pool but like is it this is actually kind of also might be interesting for me to understand if cash ever wanted to like connect to another org but like what is the output of a utx is it a utxo actually that's the question so is it so yeah it is and in the tesla model

we have inputs and we have outputs but in the zika transaction actually we have nullifiers instead of the input so so we can just cut the link between the inputs and the outputs by using the nullifier and the thing that you're ha like mercalizing and then writing to chain is the outputs of a utxo type model yeah not state state was like probably the wrong term okay cool cool so what we proved using the zkp is that oh this normally fire is actually one of the leaf of the moccal tree got it

thanks for that sorry it just took me it took me like talking about use cases to like remember that oh maybe um i did want to ask you there is one other project that i'm aware of that's doing something similar which is a roll-up and an optimistic combined and that's ey is nightfall is it is it similar or different to what you're doing have you have you seen what they're working on yeah i have seen what they're working and how they're working and i really like that project i i think maybe their products and our products have a very very similar uh approach but i think what i found what i found uh that the between difference between nightfall and our protocol is

they're supporting es1155 too and i think that should be our next step too and very thankfully uh the authors of the nightfall just credited credited us the secret protocol ah cool yeah because so there's a link right there there's a connection between these two works okay cool yeah all right so maybe i think uh we're just giving some good in good influence together nice how do you imagine this l2 working with other l2s because we've talked to some of the other l2s about bridging between themselves like not only like needing to go to the main net main chain and then off like that

that's i've sort of been thinking about it a little bit that way where it's like the main chain in this regard becomes the bridge where it's like you go from your l2 to the l1 back to another l2 and that's like the bridge but you could do a more direct bridge does that actually not work in your system because it's so private because of the way it's built or do you think you could bridge yeah to be honest at first um in the privacy and scanning exploration team actually we have a lot of teams that handles their rollouts like secret role and optimists roll up so actually from 2019 we've uh discussed how to a bridge between the roll-ups together but

actually currently we're just only focusing on each roll-up itself for now so uh what i think uh in the future is that i don't think that average transactions in the ethereum should be private so maybe some of the transactions uh should be private and so i just imagine that zico pro will be on ethereum and also will be on orbit from and also over on optimism or we will also own another zk evm roll up do you almost picture them like a roll roll-up of a roll-up is it like it would be working because they're evm compatible

so they have you could basically deploy the z-copro on like the z-copro um smart contract on their evm on the l2's ebm yeah yeah sure wow would it all link back to the same place though would it all be like into a single l2 or would it be like maybe yeah they're they'll be all separated because i just believe that pro is built for the privacy itself so it can be used for this kind of merchandising or just transfers between some friends like that so if i am using optimism then i think there should be another merchandising

tool on optimism and i think we can use zika proof for that would it not be easier to make like a private dap on there like kind of how would you compare this type of project to a tornado cache i know that their model is different but i mean like could you not build this model as a as a dap using smart contracts or do you feel like it needs to live as an l2 actually i always think that every layer to or adapt really yeah i guess they are they're smart contracts right yeah right because sincerity is a blockchain which is implemented on smart contract so actually definitely they are adapts

wow actually yeah this is the first time that someone said that on the show i think um maybe i'm maybe i'm forgetting somebody else saying it but i like first time it's landing for me yeah but that's true they are yeah smart contracts that's cool that's what i'm thinking about about the future of physical proof and that's why you think of like you could then anywhere there's evm compatibility because it's written the i'm guessing the smart contracts yeah i mean they're solidity smart contracts so you have them already you could just redeploy this and since the entire like the entire logic of the roll up is in those smart contracts right yeah so then you could just redeploy it and it would actually just the only trouble would

potentially be like adoption or like having enough people using it so that the privacy is preserved but yeah that's interesting yeah definitely and i don't think that we need to use optimistic vola for the scaling uh forever i mean we're just developing the protocol so at the end maybe there will be a possibility to use the ck roll up and also like we can use recursion and uh maybe other protocol maybe other other technologies techniques um to improve the protocol cool yeah i mean that was a question i had we kind of pushed that off this idea of like future work

and what you have planned are you also thinking potentially of ever like changing your circuit or do you think for now that's going to stay as it is actually for uh maybe for now we don't we we don't have any plan to have any modifications about the circuits because we just did the trust stresses set up and writing a new in these a lot of some security investigations so but uh definitely we are just trying to yeah we are trying to would you do you think you'd ever use something like plonk instead of groth 16 yeah so for for the recursion maybe we need to use planck and also

actually we also want to support es1155 too and for about there we need to get some uh for about the circuit and yeah sorry sorry you said erc 115 or whatever yeah 11 55 yeah oh yeah okay cool nice well once up thank you so much for coming on the zero knowledge podcast finally uh you're so glad you sat down with me to go through all this yeah i'm also really happy to to be on the show and yeah actually i was really nervous but uh i think you just let the let me yeah i i just can't just say

whatever i'm thinking yeah totally yeah always you're always welcome to come on the show and tell us what you're what you're up to what you're thinking about thank you so much well thanks again and i want to say thank you to the podcast producer tanya the podcast editor henrik and to our listeners thanks for listening [Music] you