Joe Andrews & Zac Williamson: Aztec Protocol – Bringing Scalable Privacy to DeFi #405

Transcript

this is epicenter episode 405 with guests joe andrews and zach williamson [Music] hi welcome to epicenter the podcast where we interview crypto founders builders and thought leaders my name is sebastian and i'm here with dave oja who's a new co-host on the epicenter team so dave is the co-founder of osmosis he works very closely with sunny he's been working with sunny for several years on like sikka and other projects so dave welcome

welcome to the epicenter host roster can you tell us a little bit of yourself and uh introduce yourself to the audience thanks sebastian uh i'm dave so yeah as smash mentioned i'm a co-founder of osmosis with sunny yeah there's also another epicenter host you should probably know i also like run the proof stick validator sikka which mainly validates cosmos chains and that's i've been working with sunny for a number of years with that i used to work on tendermint core in the closet sdk and i guess i'm now working both these actively again osmosis prior to osmosis i was like doing a lot of research on how to improve snark recursion and like how to build starks with uh alessandra pieza and like many other great folks at uc berkeley so privacy and snarks like you know very near near to my heart so uh

i'm pretty excited to podcast today with aztec yeah and it's uh i think it's really fitting that you're here because today we're speaking with joe andrews and zach williamson uh head of product and cto at aztec protocol and so we had zach and tom another uh team member on the podcast in march of last year and uh so we're here for an update today thanks for joining us guys it's a pleasure to be here yeah thanks for having us so before we talk to joe and zach about aztec and uh the evolutions for that project since we last had the bond i'd like to tell you what our sponsor is for this week with paraswap you can beat the bear market price with every single block it's fast and highly liquid and they've

just integrated with ledger so if you're like me if you're using a ledger device you can now swap directly in the ledger live app so this makes it really easy to do swaps without having to connect your ledger to the browser so check them out at paraswap.io are your assets sitting highly in your wallet you can start earning rewards and contribute to network security by staking with course one as a staking provider securing over a billion dollars in assets on over 25 decentralized networks including solana cosmos and ethereum it's one of the most trusted staking providers in the ecosystem if you're interested in running your own branded nodes they have a managed white label node as a service offering which leverages courses highly available and proven infrastructure enable you to

participate directly in decentralized networks head over to chorus.one to start your staking journey today so since the last time we had you on how's the company grown and you know what's been the evolution of aztec uh in the last year or so yeah it well quite quite a lot has happened in the last year i believe the last time we chatted uh we just published our um latest uh cryptography research planck and since then we've put it into practice by releasing the first private layer two on ethereum using that research it's a network that allows users to shield ethereum and other tokens and

send it privately and that's been the the main uh the main focus of the company for the last year and now we're now that that's done we're moving on to uh bigger and slightly more ambitious things that we yeah happy to dig into yeah as well yeah i mean the last time you were on we we talked a lot about you know how uh the shielded transactions contract worked and like how that works for the user and also under the hood um but we did talk about defy a little bit and i think that you know you know looking at what you guys are doing now that's definitely like more on your radar how has the growth in d5 in the last year or so like helped shift your focus uh has it you know was it was it an accelerator in shifting your focus more towards defy or

you know were you already sort of on that track tell us about that journey yeah definitely so i think the explosive growth of d5 really shifted our focus from focusing on kind of more web to use cases and it's created a market uh for privacy on web3 um so when d5 was only kind of low tens or hundreds of millions there wasn't that much of a need for privacy but now we're in the kind of 50 to 100 billion of market capital locked inside d5 there's a huge need for privacy there so it's definitely shifted our focus and the product offering as well uh and the network's capabilities to focus pretty much entirely on d5 with the upcoming release cool so for people who are not familiar with

aztec give us the high level overview of you know what you guys are working on and we can kind of go from there surely plastic uses state-of-the-art cryptography to enable users to hide their identity when transacting on ethereum right now one of the main pro we believe one of the main problems with transacting on blockchains is the fact that everything is public which means that everything that you do everything every transaction that you make is viewable by the entire world now this this isn't a necessarily much of a problem and you know people that are doubling around with cryptocurrency but when we're we're moving to a world where more and more financial transactions are being moved

on chain because of its value as a settlements layer it started big our problem is going to be in our opinion the problem over the next few years with regards to blockchain and so uh and and we're here to solve it we use um a niche branch of photography uh called zero knowledge proofs to enable users to prove the correctness of their transactions without having to actually leak critical information to the wider world things like their identity the amounts they're transferring the assets they're transferring we're yes we're steadily building out our technology and architecture to to support more and more use cases what what kind of use cases does this open up because like shielded

transactions are are cool you know and you know there's lots of different people working on that recently we had tornado cache uh although they've got like a i think like a quite different approach but you know what does a zero knowledge like a zk zk roll up effectively what is what does that enable in terms of new types of use cases i think this culminated in march with the the release of ck money um and zk money is the front end on top of our zkz roll up and it enables for the first time an ethereum transaction to exist fully privately so you have ironclad privacy guarantees very similar to the zcash protocol the

circuits kind of use a similar underlying kind of set of nullifiers to get strong privacy guarantees but for the first time that transaction is actually cheaper than a layer one ethereum transaction so for for us it's this seismic shift where users don't have to choose between privacy and kind of uh being on ethereum and being kind of in a world where lots of people are building applications you can have kind of your cake and eat it so to speak you can have a privacy but on on the chain where there's the most developer activity i can expand that a little bit as well with regards to the zkc kerala at the core of um approaching this action is the idea that well instead of sending to the blockchain like the basic information about your transaction you

know who you are who you're sending has sending crypto to instead you serve you send a zenon's proof so basically you say well here's my old encrypted banners and here's my new encrypted balance and i can prove to you mathematically that uh i follow the rules of the blockchain you know i've deducted something from my balance and added it to somebody else's balance but i'm not going to tell you who i am who i'm sending my money to or how much my money was however zero-waste proofs are very computationally expensive to check um requires a lot of like niche um cryptographic operations which means that it costs a lot of gas so the question one of the questions is how do you get well in general how do you get cheap transactions on ethereum but for us the question is how do you get cheap private sectors or ethereum

and the solution is um is uh a little bit of inception-esque but you you go on a little deeper instead of um sending zero-knowledge proofs to the blockchain which represents private transactions you create a zero-knowledge proof which proves the correctness of a large number of zero knowledge proofs and allows you to send one kind of mega transaction to the ethereum blockchain that proves the correctness of hundreds if not thousands of individual private transactions that's what a zkzk roll-up is we take into calling it a private roll-up because it rolls off the tongue a little easier so like you're doing one uh zero knowledge proof of a bunch of transactions but those transactions are themselves like using zero knowledge proofs to like be valid or like get privacy

exactly correct yeah it means that the the the entity creating that meta mega zero proof doesn't need to know any secret special information so like isn't this process like uh starts really expensive so how is this being done or how is like you know this irrigator or ice uh sequencer uh doing it like being able to do it without uh high fees well that's been that's been uh that's the question um and the something that we've been spending the last uh two to three years focusing pretty intently on and and we have to make several relatively significant advances in in the state of the art when it comes to these kinds of crypto systems to get there and specifically we needed to create a xero animals proving system

that was fast enough that you could make these gargantuan proofs because uh yeah um generally if you want to create a zero knowledge proof of the computation the act of making that proof is going to be about a hundred thousand to a million times um slower than the original pre-construction so so actually verifying zero knowledge proofs and societal proof is one of these kind of um computation enlightenment one of the one of the advantages that we have is um as as a company is what we our chief scientist is uh arya gabazon he's one of the best in the one of the best cryptographers in the industry and together we've um not just published the crypto system which was one of the which is one of one of the an extremely fast um ziggy snark but we've been able to um

modify and update and mold our probing system to to engineer it to be to be tailored towards our specific needs and so that meant that we have a lot of agency to um make the preview system particularly good for things like verifying zero knowledge proofs and doing um very quite advanced to difficult computations and that's that's really why why we've been able to to create this kind of construction on ethereum i believe currently the it's the um this this representative that we have is the only one that's actually that viable on the ethereum blockchain given the limited uh cryptography you can do inside a smart contract super cool i've definitely been following the story of plonk i remember when the paper first came out i made like such huge waves during a what a

snark timber of that year yeah what's the story of the name plonk like it's such an interesting name interesting one way of putting it yeah um so it originally was a placeholder name um so we ariel and i were struggling to come up with the dec the name for the paper and and i i suggested plonking as a bit of a laugh um partially because as you said it was this this month's not tempered like over the last few months in that in the year 2019 and quite a lot of um seminal cryptography papers have been released and one of them had like um like ambitious names you know like um powerful names things like you know um sonic and darks and starks and marlin and and and i i just i felt like uh it would be yeah i thought basically i

thought we'd be funny to name it um it's british slang for cheap low quality wine um and i feel like uh there's a lot of similarity because you know understa you know get getting getting to the bottom of flunk requires making questionable life choices a bit like a bit like you know real plunk and and you know gives you a headache if you spend too much time with it so basically okay so basically we call the plot we publish the earprint generally eprint takes like a week or so like this big um like like um a website that is a repository of cryptography papers and generally takes about a week or so to um approve a paper for release so we thought analysis published it now deal with the name later um but they published this one overnight and then people started tweeting about it and

saying hey what's this punk thing and so basically the kind of word got out about it and we figured it was a bit too late to change it and you know it was kind of funny so here we are today but it got kind of like backwards name right there because oh yes yes yeah so yes um i think one of the only useful um well not useful one is one of the one of the main skills that i picked up from a degree in particle physics was uh elaborately named actinism so it stands for permutations um over the lagrange base that's the p and the l for uh ecumenical um would mean all the encompassing non-interactive arguments of knowledge and the a is silent that's great

i love it i hope we can push for snorks as a word instead of starks i don't know if you've lost this one though ecumenical instruments i mean it's it would be nice wouldn't it um yeah we've got a few years of inertia to push back against unfortunately so so last time you were on we we we talked about d5 before we did this interview i i listened to to that episode and you know one of the things that we talked about was you know privacy and defy and you know you you mentioned that uh privacy makes d5 paranoid and the way you describe that is you know by by using uh by using uh maker as an example

could you elaborate on what you meant there and you know how privacy you know more broadly or at least privacy technologies break certain applications in d5 yeah absolutely so um so yeah to expand on on that um uh paranoid so what basically the question one of the questions which is relevant when it comes to privacy private transactions how how on the blazes do you make a private d5 protocol because it'll be really nice to have a private version of make it that way you can make a cdp and nobody knows how much it is uh and it'd be nice to do things like have a private fully private decentralized exchange where you have a private order book but you can still

match trades but the problem with these approaches is that in a private world you can't have public state because modifying a public very public state variable leaks information about what you're doing for example things like uniswap you for your assault you need to understand the total amount of the total supply you have a bit of an asset to perform to the house liquidity you have and so if you deposit into a liquidity pool then you're changing the total amount of liquidity that's public variable so people can see what you've deposited that's not private um similarly for make a dell if you create a uh collateralized debt position that's private that means it's encrypted and so how in the blazers is anybody supposed to figure out if you're becoming undercollateralized and

if they are how are they supposed to liquidate your position because it's encrypted only only the cdb creator knows how to decrypt it and they're not going to help you liquidate that position so that's one of the fundamental problems um with with privacy uh and the paranoia comes from for example you could create a private make it dial where you know you have a cdp where the where the cb creator has to constantly kind of send effectively proof of life they have to continuously prove that their cdp is over collateralized because then any person can create this proofs and if they don't serve the proof this proof of life in you know like a day or two then they get then there's something bad happens to their position and so there are ways of getting around this we we wouldn't be doing what we're doing if

we didn't think that we could uh we could provide practical and valuable privacy to defy the the holy grail solution is um to use multi-card computations where for example if you want to if you want a for example a decentralized exchange with a private order book but you can still match trades amongst people in theory you can do that through multi-party computations where you have like a ring of individuals they all have their own orders and prices that are all encrypted and they slowly engage in these npcs with one another to kind of um drip feed information about their orders to counter parties that have matching orders and in aggregate you can you can achieve a very high quality high quality priority with those kinds of approaches however

the complexity of these approaches is absolutely enormous and we know we're near the point today where you can you can bootstrap these kinds of these kinds of protocols you know hardly any there's hardly anybody in the world who can who can develop them um to be efficient enough to work and and so you don't you don't have that kind of that mass appeal that you have a theory where you know anyone can code up a smart contract but we do have a much simpler solution for privacy uh when it comes to d5 um which uh we could expand on um if that would be uh i don't want to preempt any questions there please go ahead explain so yeah so how do you okay so how do you how do you how do you get private d5 well the the the simple answer is you don't

um basically you leave you make you keep the defect but it goes public you know you know swap make it out you leave them where they are you hang out on layer one completely public everyone can see what's going on and what you do is you make the assets private you ensure that individuals have that their holdings of various cryptocurrencies is anonymous so if for example let's consider the make it our position again imagine you know you know make this public so you can see when a cdp is created you can see its value you can see when it comes down to killers and liquidated but you don't know whoever holds it and that's very high quality privacy because of that i mean it could be anybody and so the most important thing isn't in an operating to make the the the the d5 protocols private it's not to

make the the the um this is effectively like the sites which interact with the value private the important thing is to make the value holders private and give them an anonymity and and that's how we're planning on doing and on on achieving privacy so it's like uh you have you hide all the addresses then you kind of publicly when you do a trade it's what's public is that uh this amount is going from some address that has some the right thing does public action and it goes back to a new like exactly yeah so you can see you know you know you can see like you know 10 10 for example like you know 10 ether has gone from address question one question my question mark has gone into unisop i've gone out a bunch of door and that's going back to address question my

question my question mark and um so that kind of quite we think quite effectively solves the problem you know these these protocols can can still exist in all their magnificent complexity um without having to kind of rewrite rewrite themselves to be private but you still get the benefits of privacy that users care about i've got an analogy if it'd be uh helpful for the listeners internally we call it the d5 bus um so you kind of see the the aztec roll-up contract as being like a bus station and there's all these buses that have kind of tinted windows and you can see the front of the bus it says i'm going to uni swap to sort of beef die and people can get on the bus um and you can't see who's getting on the bus but it will go to uni-swap take the eve to uni swap and then it

will bring back a load of die on the return journey of the bus and give it back to the users in the aztec network and so it's a i think it's a good analogy for kind of uh showing how this network interacts with the rest of the the d5 ecosystem and whilst whilst giving strong privacy guarantees to everyone who's on that bus or in that transaction so from a user perspective i just want to like walk us as i understand it walk through the transaction flow here i want to trade on unit swap in order to do that let's say i want to trade like eat for die i send the eth to the aztec contract i get into the bus effectively then that trade gets made and then i'll

get say die back at some point couldn't someone just be watching my address and see that i interacted with the contract i interacted with as you call it this unit swap bus and just deduct that i've just made a trade on unit swap i mean so it's a bit more it's a bit kind of if you did a direct deposit like that um in the same transaction there would be kind of a way to link your layone address to to that trade but the flow actually is a bit more um it's kind of one more step so users have funds already on the aztec network so they're already shielded um so you would have uh in a separate transaction you would take your leaf and you would make it zke eth and then you have uh these encrypted

utxo notes on aztec and you can use those to interact with any l1 smart contract through our default bridge as in this case you'll choose interac interact with the union swap east dipole so you kind of send a transaction that says i want to put one equal into the next bus going to the to that pool uh and the owner of that eath could be anyone who's ever deposited eth to the aztec smart contract so your identity is completely hidden throughout that process uh the roll-up provider will then bundle all those transactions with any other user who wants to do the same trade uh so say zach also wants to trade two weeks and a few other people are also getting on the bus so we'll send an

aggregate then transaction from the roll-up contract out to uni swap say five even total and we'll bring back dye to uh the aztec roll-up contract and that will then be dispersed in zero knowledge notes to the holders who participated kind of in in that transaction so you're actually not getting the proceeds of the default interaction on layer one you're getting it in encrypted form on there too uh which is how the strong privacy guarantees uh kind of maintain through that i think it's quite a interesting way of doing it and zach can talk about the actual cryptography because it was a bit of a breakthrough moment for us to actually get the the identities hidden through the process okay so it uses the same note system as like the previous version i think that's

what i missed uh the new system's actually not graded form because the the old aztec uh just had confidential notes so here uh both the balance and the owner is encrypted um so that's what gives us kind of the the anonymity we need to to do these transactions how is this looking like from a user perspective like you know right now uh as a connect bed and masking yourself website and i just press above to do a transaction so is it like uh is it still pretty similar where on um on like the aztec uh site there's still way back to my wallet and just do the trade that the transaction like does all these three steps like go to l1 swap and go back to l2 yeah so so we have a kind of

we call it ck money and it's kind of like a showcase of what's possible with the aztec sdk um so in the next kind of three months the the main venue for these trades will be ck money uh and you'll be able to connect metamask kind of it will show you either if you have on layer one or if you've already kind of used the aztec network it will show you your zk and you'll be able to kind of do these various uh default interactions and yeah all of that will be abstracted from the user uh via sdk the kind of three to six month goal is um the sdks integrated on a lot of these l1 front-end protocols so you can actually just go directly to uni swap or rv or some of those protocols and perform uh have the option

to perform the interaction privately very cool i i feel like this general approach is like the future of like practical privacy for d5 things it's often like if you want public information like you know constant product market makers or cost function uh then you have to like have the swaps in public 100 yeah i think it's kind of the best of both worlds because you get the kind of the transparency of layer one d fire which is kind of what's made it grow to be uh so popular but you also don't have to sacrifice what a lot of people take for granted in the web 2 world is just basic transaction privacy um no one can see my robin hood account no one can see kind of my revolut account so i think this

allows new types of kind of user experiences um that give you the best of i think l1 d5 but also strong user privacy guarantees yeah sorry i just want to like stay on this defy topic a bit so in that case then uh you you need to create i mean a unisop would need to add a uh like uh aztec eth uh aztec die uh pair i suppose and if you wanted to trade those assets that's one of the one of the key parts of our approach is that um we're looking at the the kind of the evolving layer to landscape and right now kind of the the impetus is on having split liquidity because if you want to

benefit from the um the fee reductions that you get from what operating on layer 2 you've got to move the actual default protocol into the layer 2 and it has a currency pool that has its own liquid asset pairings et cetera but for us we we felt we wanted it to uh be very much felt like what users want is to leave the the actual source of the quincy on layer one because that's where they're gonna get the best prices but interact with it cheaply and so even if you if you have shielded aztec assets and you're using rd5 bridge to interact with it with a smart contract like unisop you're still talking to the uni swaps layer one liquidity pool so the easter egg pairing that you're getting and the associated price it's still

you're you're it's still based around the global uniform pool so in order to perform in like a performing integration with aztec you you you need a first you need some kind of facility ability to shield user funds using the aztec network but that won't materially affect the the price that they're getting from using our protocol okay interesting what about um collateralization how how would collateralization work uh using aztec for cdp's do you mean yeah like make like uh like a cdp for example yeah it's so there's two there's two methods really you can have a zac uh kind of uh mentioned earlier on like a unique cdp for you where you you don't

really benefit from huge gas savings but you have a strong privacy guarantees or you could have kind of tier cdp's so you can kind of have a system where uh we all agree with a load 100 other users that we want to enter into a uh three month term uh cdp and and the ltv ratios can be kept at a certain um amount and then everyone's kind of doing the same thing so you can get really strong uh gas savings as well as privacy savings from doing that so it depends on kind of the the end user product um we're starting to see a lot more fixed rate kind of protocols come online in d5 so i think that's where i think the kind of uh retail users will end up is kind of on on more structured products

rather than uh wild these worldly swinging um pools um that that's kind of i think the approach that we take with um plateauization of loans sorry i think i didn't i didn't quite fall like are you imagining that the collateral is held like come just like one big collateral pool held by the uh contract or imagine that there's someone like uh and like my share of the pool is private but handled on the roll-up side yeah so you could have like a aztec uh q4 uh e cdp uh and you could have different uh clatterization ratios so this would be the 150 percent quantization ratio we'd all enter on a certain date and it'll be a three month term uh and kind of that would be one approach to doing it um and then in that

case you get like a a much better uh gas cost per user um of actually taking out that uh form of um that form of debt or you could have the case where if you're a large user and you don't mind paying uh kind of the l1 gas fees yourself you can just have free flexibility by entering in kind of uh any cdp of your choosing but you wouldn't get any batching in that uh circumstance you'd still get batching on the cost of privacy um so you'll be able to have your transaction matched with other um xerorage snarks that are doing different things that you would pay the full cost of the entering the cdp position um so you get kind of a bit of scaling in terms of privacy

oh so it's still fine to like hold the collateral in this uh or sorry you have the low end amount being you know it's private uh aztec l2 but just collateral has got to be on chain since uh yep you need liquidation to be able to see it or yeah so in that case it would be like in a single user case it would be like a smart contract would end the position and that's what contract would be like a crate to opcode so you'd have kind of a a new smart contract for every uh kind of cdp that was created where there was just one user uh kind of behind that cdb it's just the source of funds that do the initial categorization are coming from the aztec network not from kind of a tainted l1 address very cool

on this like privacy idea uh so i remember like zcash there's this problem of people would go from the transparent pool into the shielded pool and then it kind of almost immediately go from shielded full back to transparent or in this case it'd be like shielded pool to uh you know swap trade the exact same balance how how are you thinking of like uh mitigating like the linkability there like just exact amounts you know it's it's like we use the full amount yeah it's it's it's a big problem and it's part of it's an educational issue and part of it is a ux and design issue um because what it what because this privacy take is so relatively new i think a lot of users don't fully understand how it works and that you but effectively or by when you shield your

tokens your um the active of that of depositing into the shielded pool is public so they can see for example that you know dave puts tennis into aztec and um but and then and so if you then immediately withdraw it's very easy what's happened you know if you see uh you see dave's deposited teddy intonatic and then in the next block davis draws tennessee through my tickets i mean yeah it's it's kind of obvious but um what you really need to do is deposit your value into aztec wait a little bit and then withdraw to a different address you're the one you originally deposited from because let's say because we we try to encourage um through our ui people to deposit and relatively fixed amounts like 110 eth so

the way it would ideally work like if you're if you're for for an educated user is you deposit 10 ethan to aztec you know you wait a few hours and then to a different dress you withdraw the tinnitus aztec and that 10th could have come from like anybody who like you know from from now to the dawn of the pro star star critical deposited to anything to aztec or acquire 10 within the asset network somehow perhaps through d5 but most of it i think it's just making sure in the in the in the user interface that the user is informed of what they're doing and so that if they're um if they do this this flow where you immediately deposit withdrawal then the ui goes you know hey you sure you want to do this and joe i think you can you can expand on that a bit

yeah there's a few cases um but we're kind of touting this idea of a privacy score um so kind of just really helping to inform the user of how private a transaction they're about to do is and as zach was saying that can be anything from hey you're you're unshielding to the same address you deposited from that's that's not private um or there's a high linkability risk there or things like if you're kind of unshielding to a very large significant uh number of decimal places um then that's also kind of can add to the linkability of those transactions the great thing about the kind of the default bridge it doesn't fix all of these things but it it's the first step in in the road is that privacy kind of starts to become by default not opt-in

and i think the that the issue with some like other privacy systems is that when you have to choose between privacy and not having it traditionally the user experience has always been worse or always been more expensive so it's always been the incentive is to get out of the privacy shield and what we're trying to do with with the next couple of versions of aztec is change that and flip it on its head so that users should be comfortable keeping their funds in the aztec network and then those kind of opportunities for a privacy breach should become a bit more reduced but you still have to kind of be a bit careful when you're interacting with the default bridge if you kind of deposit i don't know 90 of one token to the aztec network and then there's a default bridge trade for 90 of that that

token uh you can kind of start to figure out uh what's happening but where where the d5 bridge i think comes into its own is if if you have kind of smaller uh trades that have drip fed into the market over time if that trade is kind of um pretty uh homogeneous compared to like the the normal size of a transaction on the network for that asset pair you have great privacy and and that's what uh the ui will kind of enforce um and try to guide the user around with a privacy score oh it's very cool so you're like detecting these uh cases where you think it's easy to like you know link back and then giving a warning right then and saying look this transaction uh is likely linkable maybe you want to break it up or wait some more time

yes that's the idea and i think like on on day one it may be kind of just like one of those password indicators uh that's kind of like strong weak uh uh or kind of uh extra strong but um we're working on kind of the metrics to put into it right now but i think that's i think that's the easiest way that to identify the user of a potential issue um because a lot of this is just user experience it's you haven't had to think about this um in a web too well because uh you have kind of privacy from everyone except your service provider but in a web 3 world there are kind of these different cases where you do need to kind of be notified and users have to kind of accept different norms and i think it's on apps and applications to start to

think of better user experiences to notify what data's public and who can see what and this is just one thing we're trying very cool and i guess uh this is also sort of thing where uh the amount of warnings you get really goes down over time as more assets or more historical records are there to be like selecting from definitely yeah um yeah as the kind of privacy set grows um you should see less and less warnings and uh yeah the the kind of network effect around uh privacy and estimate would grow stronger and i think also the the amount of times you want to kind of leave the aztec network will also kind of shrink uh so you should kind of have less of these these opportunities to accidentally break up privacy i think we can we can talk a bit more about like

how we get past kind of d5 and the longer term goal and that would kind of explain a bit more about kind of how noise it's into all of this and and how uh long term we think a lot of lot more applications will happen within the network so there'll be less and less chances for those privacy breaches yeah sure uh just john talk about how you're imagining uh noir and uh more privacy or more applications on the private side yeah so this is this this kind of default bridge thing we're building is is merely the the stepping stone to our of our kind of our grander aspirations and uh it's an architecture that we're calling like the working title is stick three where right now

with what we released in march you can shield cryptocurrencies you can still run privately in the universal way which is it's useful but it's it's it's um doesn't really tap into the massive ecosystem of innovation that's happening in in the blockchain space which is where the default bridge comes in but even that only provides um it provides good access to public layout protocols but where we think privacy really starts to shine is that it opens up a whole new category of interactions that just can't exist today on the blockchain because of the because so many so many applications and for example like traditional finance or payments or um like um the kind of use cases that like everyday individuals desire

require strong user privacy guarantees and so what we want to do is effectively recreate the ethereum smart contract ecosystem inside aztec but where privacy is preserved so that to give developers engineers uses the ability to write their own smart contracts that have privacy baked into the core so that you can just so not just so you can't it's not just that you can have a private token but you can decide how it's transferred who can own it how to mint it how to settle it because what this really enables and what this what really excites us is that this is the first time that you can meaningfully put your identity on chain and

link it to your cryptocurrency accounts without splashing your personal information all over the internet it means that you can conditionally prove parts about yourself without revealing that to anybody else in the wider world um for example you know you can have um you know an identity token um that you that you can have some some a cryptocurrency that's conditioned that's um holding a conditional having one of these identity tokens or if it's more um like more you it also opens up like more other innovative spaces like for example um private nfts where you know you can have some data fields that are private but you can like um prove parts about your your private nft um to other people under certain conditions um you can have it opens up a

whole um innovative trash of blockchain based games where you can have meaningful where you can actually have information asymmetry so you know the players of the game actually can um not know things about their about their counterparts which isn't really the case with with the fully transparent setting but all of these things require programmability it requires the the community to decide how they best want privacy to be used in their applications and to be and to have the tools and ability to program it themselves and that's where noir nasty comes in noir is our highly efficiency it's not probably language beheaded by um by kev um and it's um it's a rust-based syntax language that compiles directly to highly optimized uh

plot circuits and we're planning on using that in the in in a in the kind of the next iteration of our protocol design where instead of our kind of zkzk rollup verifying the same transaction type over and over and over again this list is like private transactions private justice and private actions instead what the role of verifies is a um a xero knowledge proof that's over has come from a from us one of these circuits that's been written in law and uploaded into our network by anybody basically it's it's the nasdaq keystone technology which allows us to create a fully permissionless private programmable cryptocurrency network and

that's yeah that's pretty much what once once we're once we've put out the decoy because that's where we're that's where we're heading um with all our energy and attention resources oh very cool i want to unpack it because there's a bunch of components there so like for so the programmability idea is like i want to be able to put my it's kind of is it like the sexy model where uh i guess you're from there there's a couple of things trying to do that where you have a public or you have a program on chain or on the invastech chain that users can interact with in sort of a private manner where this the contract can maintain both the public state and private state and you know every interaction just updates both of these yes exactly um

but where where i think things things differ is is the fact that what we've been very much trying to um uh structure this architecture to look a lot more like a a systems platform that would be more that would be familiar to software engineers so um it like to kind of eight familiar blocking concepts like you have a when your equations actually have a concept of a call stack you have contracts i can call the contract you can have one contract with multiple functions and you can kind of have um reasonably like somewhat arbitrary trend like um transaction depth so you can have uh you know contract you pass people calling contracts calling other contractors called contracts over and over and over again you don't have the um some of the restrictions that that other systems have like sexy because of

the um well their restrictions come down to the fact that the the protocol was designed for this kind of um limited recursion technology that was available at the time and i think things have moved along a bit like a little bit like there's been a lot of development on these like long cycles of the curves uh with this halo recurrent system with the stuff and assets doing which means you can have this kind of arbitrary depth recursion where um where you know you can have you know z z aggregate verifies you give yourselves you know all the way down and this enables yeah it enables you your your zk snark circuit to encode an algorithm which starts to look a lot like uh vm based cryptocurrency critical where you don't have to like learn new and like kind of a dif oblique

different types of transaction semantics in order to program it oh cool so it's like starting to look more like base layer eth where it's solving the old problem of uh i could really only interact with one contract or like a small set in one transaction because just limited uh proving tech for certain curves but now you're saying like with the aztec unbound recursion and if this is like fixed you can now uh in theory i'm gonna throw my hands okay we've not built it yet so um the the the mission for our company is putting this in practice over the next 12 months cool i guess a question maybe this is a bit technical for folks but like uh how does the proving work here where essentially you're you're having uh supposed to have this like says you want

multiple transactions interacting the same contract per block but they all affect state do you have some like out off chain aggregator like bundle these together and make one proof or is there some parts that are like available to the block proposer for them to do the proofs to get money transactions to one contract per block no it's a good question because you do run into some some so-called like race conditions when you're where you're dealing with these kind of off-chain aggregation services particularly with private um with when protecting privacy where if you have um multiple individuals who want to talk to the same contract then they're kind of that they want to they're effectively modifying the same

database and you can kind of get into problems with yeah you know lots of people kind of it's been like lots of people wrestling over the same the like over over over a single piece of cake and going you know i want this kick out i want this cake um i don't know that's a great way of describing a race condition but um there's there's a fairly straightforward way of solving um that which is basically to have this aggregator be the entity performing state updates so that um when individuals send transactions to the aggregator they they request state updates to be made on their behalf um and if they're private then they'll be encrypted at that public they won't be but it's actually the the the aggregator who's doing doing the mechanical process of putting these variables inside date inside the

database modifying those database values um so yeah i think i think at this point it's a relatively solved problem okay so it's not really a privacy leak in that the aggregator already accessed the private database so like the private state so that's like there's no new information they're getting exactly there i mean if they're going you'll you'll basically um when you create your privacy proof um that that proof will spit out a bunch of um variables but they're all encrypted um and those variables need to be added into a database but the the aggregator doesn't have like doesn't know anything about those those variables to them and they just look like random numbers oh they don't need to know these random the actual uh data entries to handle state conflicts

well the idea is basically you don't you don't have a state conflict so well this may be getting into the weeds but um dealing with private state and public states um uh they need to be treated differently so with private the way the way one has those private state modifications is you well um using um this kind of this bitcoin unspent transaction object the idea is uh instead of having a like a like an account where you you have um like something like a balance which you can modify over time you instead have um these these notes that you cannot be created or destroyed and so the base so this makes the the state model quite simple because a note can either exist or doesn't exist it can't change value

um and so if you want to perform a state update um for if as a user you want to create some private state variables then you basically you basically you want to create a bunch of these utxo nodes you want and you want to delete um a bunch of existing utx internets and so basically you go to aggregation you go hey i want to make these utxonics and i want to delete this these other like utx inits but the key thing here is that they're all encrypted um the the notes you'll be being created unencrypted and the notes you're destroying they are they're they're encrypted too but they're encrypted but that this is really getting used to the reason i think maybe is i'm going to struggle to explain this properly uh in the time you have available but um this is the idea is

when you want to destroy um a note in aztec the way we might we record a notice of being destroyed uses a different encryption algorithm to the way that we record a note being created so basically the mark on our in our kind of ledger which says a note has been destroyed uses a different encryption algorithm to the market letter which says a note has been created so you can't ever um link it like a destroy notification to a create notification oh cool so it's like you're making everyone has to do utxos these private contracts define like validity predicates the utxos but then when you do a transaction the new utex also get created but you break the linkage like intra batch between inputs and outputs yeah exactly i mean

it's a very it's extremely similar to how zcash handled it um i think they were very much kind of trailblazers on this with this regards cool so okay so then like nor spinning into this by uh making this like dsl for uh folks to be able to write these uh contracts like art in this utxo model and compile to programs exactly so so nora's um going to have quite a lot of layers to it um because like the first the first thing that nine needs to solve is that um these programs that people are creating need to be turned into extremely efficient zero knowledge proofs because one of the main problems with zeological photography is constructing these proofs is generally quite slow as i said it's like a factor of 100k to a million times slower

than running a computation now one of the ways that this is can be solved is by delegating proof construction to third parties so a lot of scaling solutions that don't that aren't private um take this approach because it's a bit of a no-brainer you know it's hardcopy issued we'll just send it off to so you know 132 aws machines and then it'll you'll get it done in a few seconds but because we've had we're dealing with private transactions you can't delegate pre-construction for third party because then you're leaking information secrets to that third party so and so effectively all of these programs that are being created in noir they're also being turned into xerox proof set where the pre-construction is happening be made directly by the user you know by people with old laptops crummy phones um and so

you're very constrained in in how much horsepower you have available which is why it needs to be efficient which is why we developed a ton of like um advances with the with our cooling systems and then so but then you've also got to make this thing easy to program which means you've got to have the abstract kind of uh smart contract semantics state modification semantics um you know uh and all of that associated paraphernalia that's easy to understand to to the user and so that um to like to be transparent that is still very much a work in progress i'm not gonna i'm not gonna be arrogant enough to say we've solved that problem yet but um but i have every confidence that we will i mean i think the first step is is abstracting the cryptography from from the developer and then the second step is kind of

baking in more functionality and that's where the kind of the bit we're working on but at the moment you can kind of use more to just uh kind of write a snark circuit um but it doesn't really fit in with the rest of the kind of aztec roll-up ecosystem so that's kind of the next focus of the company post devo bridge is to build that that part of things but the the actual language kind of early syntax is written and we're we're actively getting feedback on it right now as kind of a a new way to write snark or plonk circuits how important is is all this to uh i mean it's sort of broader adoption of zero knowledge technologies you know in and outside of crypto i guess um or like

privacy preserving technologies like i think if you take the average web developer like or even iphone developer or whatever a lot i think a lot of these these developers have very little understanding of how zero knowledge technologies work and how to implement them and so how important you think this this work is to sort of broadening the scope of use cases for for zero knowledge deck i mean i think it's foundational i mean we just just have to we have just a look at why ethereum became so successful it was because anyone could write a smart contract um you know you had this incredibly powerful technology this just distributed ledger that suddenly stopped by coming it wasn't this kind of this this this incredibly um difficult concept to wrap your head

around and difficult to to to interact with but instead when you went from that to going like you know here's how you make a cryptocurrency token in three lines of synergy code or however many it was um and it was very easy to access and i i think it's absolutely essential to propagate zero knowledge proofs and this kind of cryptography to a wider audience you've got you've got to explain it in terms that people understand that are familiar to them and you've got to abstract the cryptography away as you said people most people are probably quite rightly like incredibly intimidated by this chromatography um and uh you know there's the the very common authority you know don't worry about it don't roll it on crypto it'll end badly and i i see it as a cryptographer so creating an abstraction layer which

presents very complicated cryptosystems as easy as time programming languages with clearly understandable semantics where the where you know that whatever you produce the cryptography behind it will be sound and secure is absolutely essential for the for the widescreen adoption of this technology and what are the risks here because you know we've seen in in crypto that you know uh the bugs can be catastrophic um we've also seen so the cascading effects of you know layers upon layers of dependencies you know breaking like large-scale applications on the web like recently with like all this npm

kind of stuff uh stuff happening around there for for a developer i'm speaking mostly like developers outside of crypto but even the people coming into crypto and who are like some background of development how do we ensure that you know they use cryptography responsibly and that they're using the right that's using libraries that are you know vetted and audited and you know even if they're developing at a higher level of abstraction but that you know someone doesn't use like a cryptography library and like to build i don't know some kind of messaging app for example and like exposes everyone's messages uh or like something catastrophic like this right like what's the what's the right balance of like expertise to

general availability or that we're looking for here the second question and i'm not sure what's wrong with it with a particularly easy answer because like the risks are real i'm not going to try and trivialize what what we're doing here i mean the complexity the amount of complexity involved in these advanced crypto systems is absolutely astronomical and then if you add on the the complexity of a very complicated systems level architecture that someone's building using tools that have been developed to turn it into a into a like into a journal streak then there are certainly risks there but um i think that it's it's go it's going to be an evolving process you know i do think that it's obviously there there are so there are some basic things you can do right i mean like you can make sure that

at every layer your your technology stack has been fully audited and that you know has been written by the people who are the experts in their fields you know like we're we're very lucky enough to have ariel gabazon as like uh you know to be able like to able to put to help us with like internal uh audits which to be honest before we release that um our primary didn't reveal um several security issues that we've done that were resolved because i guess this is complicated leading us stuff and it's very very very easy to get it wrong so i do think that there's going to have to be about a a period of time where once these kind of these these advanced abstraction layers these these programming languages start to become easy to easy to use and more widespread that they will need to be approachable

precaution because uh i think like like we've seen with the adoption of ethereum sometimes the only the only cure is time right like a lot of like i don't think i'm i'm being uh unfair when i say that like the solidity smart contrapting which is widely considered to be you know somewhat insecure like it's not if you were to do that if you're going to rewrite a three-molar bring it from scratch you would design solid in a very different way to make it a lot more secure to program but obviously back in 2015 you know gavin will be doing this for the first time you know so it's so nobody was aware of the issues that would result but that being said today in 2021 i would argue that if you're going to write a smart contract literally is the best language to write it in because it's been battle tested

and these biology sex policies problems that have been um you know found out unfortunately sometimes through through hacks and attacks but it means that you have this this large kind of anthology of uh security practices and principles to draw on now we don't have those for for zika style programming languages because they're completely new in their infancy and that book will have to be written and there's a question about like how many how how much of that book is going to have to be written is going to be written ahead of time through thoughtful and um careful deliberation of how these assistants are built and how much of that book is going to have to be written effectively you know in cash from people losing money through hacks in exploits uh and yeah it's something that's very much on

our mind but i think the the only thing you could do is order everything develop things thoroughly you'll be very very considerate about the tank about the what changes you're making to your cryptographic architecture and you know getting the best people in the industry to work on it you know sometimes even auditing isn't good enough or is questionable like because for example like with the kind of cryptography we're developing you know like hu who can who can audit advanced ultra plunk circus i mean like you know i can count the number of people that i trust to do that on the fingers of both my hands and they're all busy with their own projects so you know i i think it's i think it's one of those issues that's that can only really be solved with time and attention i can have one thing as well it's it's

about the the amount of the protocol for kind of if you if you take the iphone developer example like how much of what they're building needs to be in noir and requires those kind of like fundamental privacy guarantees like how much of it is can be written at layer one um kind of in in terms of like just written a solidity um and it's about assembling that kind of stack of that uh i guess different uh kind of languages and and different pieces of technology to get the end product that the users need i think trying to do that all in kind of more on day one would probably lead to a lot of catastrophic bugs but doing bits of it um in noir to give the privacy that's required bits of its ability bits of it don't need to be on chain and i think um

there's a lot of kind of learnings in the space generally from 2017 where people were planning on putting social networks on chain and all these things that were meant to be built on a blockchain that don't need to live there um so i think it's about kind of careful design of what needs to live where in in the stack and um that will kind of evolve over time and more things will be in the private end that's kind of our bet but it's about making sure the right things are in the right place um to kind of do damage limitation in case something does go wrong oh cool like trying to mitigate the foot guns that you're aware of like you know but they'll make it harder to make an accident that uh i guess actually a question this that appears a lot like the snark dsls is

that uh like how much do you expose like snark optimizations like uh in the language like do you exp uh just what the big ones like non-determinism or like if i know the answer to an if statement do i just how can i use that instead of computing the answer but i guess in your case it's actually a lot more like with all the uh turbo plunk and look up table work so it's a general approach that you want to hide this complexity or you want to like give it as available to like advanced developers the first step is to hide it away it produces a simpler language we can then move from that to the next phase which is to gradually expose the some of the inner workings to to

advanced developers who want to play around with it the approach that we're currently taking is in-house we we're writing for the common algorithms that people use snarks for so you know things like binary arithmetic arithmetic um you know hashing algorithms elliptic curve arithmetic um digital signatures that kind of thing we're writing our own highly efficient optimized gadgets that use the latest trunk and look up table techniques that have a very very small number of constraints and then those are getting exposed in the language as um primitive or like like primitive upgrades so you know like in while you can you can do ashanti five six hash of a string and that charges five cisco will go be piped directly into our optimized widget and so that's that's kind of how we're abstracting

with the complexity but by giving people these these common building blocks that already got pre-optimized and the idea is then that the the all of the complex heavy lifting is done by optimized widgets and um what's actually pregnant noir is more it's close to blue logic that ties these components together oh cool that makes sense then like yeah hiding complexity by you building the expensive components that people are tempted to rewrite themselves exactly yeah we saw it a lot i mean a lot of projects kind of um would have their own hash implementations and kind of it's it's everyone doing the same work um and having a reference implementation i think longer term is definitely the the right approach here um but it needs to be open source it needs to be kind of

reviewed by everyone and and we're we're getting to that step um for it to be kind of trusted so what's your call to action to our audience and uh where can people find you yeah i think um right now if you if you want to do private transactions head to head to zk.money and over the coming uh six eight weeks we'll be upgrading uh the ui to enable you to do all of your favorite d5 interactions with strong privacy guarantees so we're looking for kind of uh feedback on on the early version of that over the coming months and uh for developers uh we've also got a test net if you're if you're keen to write out uh your own d5 bridge contracts then head over to our discord um put links in the uh in the description um after and we

can uh kind of provide you with some docs to help build some of these d5 bridges to make these private interactions possible yeah we'll be careful i could decide you know head ahead to our discord headshot github um check out nora play around with it uh we're always searching for more feedback well thanks a lot for coming on and uh we'll look forward to uh are you having you guys on again at some point in the future to uh dive deeper into how things are progressing thanks a lot it's been a pleasure thank you very much for having us it's been great and dave congratulations on your first uh on your first interview uh how did you like it thanks it was really fun i mean uh aztec's one of my favorite projects it was uh very cool to learn about more of

the details of how uh they're getting privacy underneath right now it's fun being on the side of a podcast yeah well you did an excellent job so we'll hopefully be able to do this many more times thank you for joining us on this week's episode we release new episodes every week you can find and subscribe to the show on itunes spotify youtube soundcloud or wherever you listen to podcasts and if you have a google home or alexa device you can tell it to listen to the latest episode of the epicenter podcast go to epicenter tv subscribe for a full list of places where you can watch and listen and while you're there be sure to sign up for the newsletter so you get new episodes in your inbox as they're released if you want to interact with us guests or other podcast listeners you can

follow us on twitter and please leave us a review on itunes it helps people find the show and we're always happy to read them so thanks so much and we look forward to being back next week [Music] you