L2 on Bitcoin

Transcript

[Music] all right this mic is not on check check yes there we are okay and we are actually back with the program so please find a seat um and get yourself comfy because we are continuing with a lot of very nice talks I know that was intense um please also stop any chitchat that you're having in the back because hello uh that can be disturbing for the speaker so yeah please find a seat and join us here I am super excited to announce the next speaker it's AIU he's

the CPO of starkware and he will explain how recent breakthroughs with Stark verification on bitcoin might actually allow to finally unlock large scale computation on Bitcoin in form of a Bitcoin layer 2 so please give it up for [Applause] [Music] him okay hi everyone I hope there is not too much Echo if there is just Mark me and I will say do like this and not like this okay great um so hi my name is ail I work at starkware um oh thank you okay can someone take this out

okay um so today I'm going to speak about this weird topic that is how to build an L2 on top of Bitcoin um there has been a lot of discussions this topic came back to be an interesting one but at least for me I haven't really seen something that is structured and explain how this can be done and so this very short talk is going to try and explain exactly that okay so what we will do is I will give very little bit of motivation on why do we need l2s on bitcoin and then I'll just spend the rest of the time explaining you how this

would work um I hope you stay with me I assume you have very little to know knowledge about Bitcoin altogether so don't worry if you don't remember what is a utxo okay nope you want to click it for Me Maybe I we'll see what's happening okay enjoy the silence for 10 seconds

have to wa for the get exactly 10 minutes Oliver I hope you don't count this for me it's working now okay yes can we see the

slides okay we are back so one slide about motivation I promise I'm not going to talk more about this um why do we want elt on bitcoin so I mentioned three things all three are very very important the first one is very simple and you could all guess it already um when we talk about scalability we want cheaper uh higher throughput transactions of BTC and that's something that you can't get on Bitcoin today in a reasonable way we want expressibility which means I don't know if you ever tried to write in Bitcoin script if you did you would understand that this is language is very incapable and very hard and we want to

enable Bitcoin developers to write in a reasonably good language that can express logic in a reasonable fashion uh so for example we want to enable developers to use Cairo or rust on top of Bitcoin and the third point is maybe the most important one is flexibility so far Bitcoin is being used for very limited number of use cases and if you want like the more Rich uh word of use cases that ethereum has you need more flexibility in what you can do on Bitcoin today okay I hope that I convinced you um and now we are moving to the slightly more technical part of

how this can be done okay so uh Crush course about l2s what do we need what does an L2 need from L1 so basically I would claim that it it needs four things um it needs State agreement which means it needs some ability from L1 to agree on what is the L2 latest state so L2 State finality that's the first one it needs data availability so it needs to know that the data of the L2 is available somewhere for everyone who wants to interact with it or to progress this it needs um the L1 want to verify the state transition of the L2 so I need to know

if I saw a new state I need to know that it's a valid one and I also would require a trustless bridge for L1 native asset so in this case I want to be able to move my Bitcoin from the Bitcoin Network to my L2 in a trustless fashion and next slide okay if you don't know what is a sovereign rollup it doesn't matter just ignore it all I'm saying here is that most of the l2s that you see today on bitcoin they don't have all those four things uh together they maybe have some of them has one or two and many of them are relying on a centralized or a multi- or anything like that and I'm going to

focus on mainly on uh talking about the state because we don't have so much time but it was very important for me to show that those four things together Define the L2 on top of Bitcoin let's let's move on next slide okay I'm also going to assume for the rest of the talk that it's possible to have uh Stark proof to be verified on top of Bitcoin I'm not going to talk about it at all it just this is a black box because it's a we're going to treat it as as such okay my jokes are uh I was doing this presentation on very early morning on a flight so expect this kind of jokes uh uh later so we're going to

assume that we have Stark proof verification on top of Bitcoin and we are not going to talk much more about this next slide okay maybe you saw it when you were young but I'm not sure you saw it ever since so what is the state of Bitcoin basically the Bitcoin state is made up of what we call utxo which is unspanned transaction outputs in short in Bitcoin this is a Bitcoin transaction and what you see here is there are some inputs and the nice uh white squares there are the outputs of the transaction and to create a transaction you need to

have inputs and outputs and generally to have inputs you need to provide some information that only you know for example a signature um to some locking script this locker and if you know this information you will be able to provide it to the transaction and you will be able to have inputs and then you will generate new outputs and the whole thing when we say Bitcoin State it's very different from ethereum we just think of unspent transaction output so those white squares on the side which is very weird uh if I can get for to the next slide because when you think on ethereum state you usually think about smart

contracts and when you think about smart contracts you like a normal developer you have persistent logic of the smart contract and you have state and the state is changing with whatever the smart contract is doing but the logic of the smart contract remains it stays at the same place and it's always the same logic in Bitcoin we don't have like we we don't have a place where we store code that is persistent in one place and state that is changing according to this code with we have like this weird unspent transaction output that doesn't work together with accounts but what we really want to create in this talk is

this we want to create the can I get the next slide we want to create this um this immutable persistent logic okay so what what can I do with utxo and what can't I do um utxo means that you have onetime logic and state you have this transaction you have this outputs you spend it bam it disappeared no State anymore and you can enforce rules on who can spend this uh utxo by by the knowledge but you really can't decide for them what they will do with it think

about the the equivalent that I have in mind it's a crazy one but um when you go to Unis Swap and you trade with Unis swap pool usually ually come to the pool and you say I want to trade a for B and okay if you have a the transaction will succeed you will get B but the pool will stay there in Bitcoin if you if I take the equivalent it's like you if you create script that even Implement some some complex logic like a pool then the equivalent is you call the script of the pool but then you can do whatever you want with all the money of the pool so it's not really enabling you to do anything smart like smart contract in an easy way it's like you can take the pool and make and turn it into a kill it's

not something that you can work with and the problem is it's what written here I don't know if you can see it is that changing the state in Bitcoin is based only on knowledge anyone who has the knowledge can can change the state or their particular state to whatever they want you have you you can't enforce rules on how they change the state and this is exactly what we want to change next slide next slide yeah can you skip another one okay so how do we do that how do we create smart contract on

bitcoin I'm not going to get too deep into how this works so just a little bit um and let's see if I can explain it uh real quick in reasonable minute remember I want persistent logic so I want to be able to control not only on who can spend a transaction but also on how can they spend it so here's the suggestion let's build something that we call covenants covenants uh works the following way this is the the locker is the Locking script you want to spend it okay one of the rules that the locker will have is that it will need to receive some information about all every box that uh that has a purple arrow

pointing at it will the information about this box will need to arrive in the hint so for example I would like to know about those two boxes and those two boxes and once the locker will get those four boxes information it will enforce whatever logic it has on top of it and then um it will be there we will have the ability to say okay output one we want you to look that way output two we want you to look in a different way and this gives us the ability to say not just who can spend but also how can they spend it next slide okay so we understand that in

order to create what we want we need the locker the Locking strip to to be aware of the transaction data now how can we do that so the idea is that the spend who wants to to move the transaction to the next state it has all the transaction data and it can provide it to the locker now the question is okay that's great but how can we know that he provides the right data what if he says that the right data is a and in fact the right data is B so there is a trick which because of the time I won't get to it almost at all so you will have to believe me but the nice thing is that we have signatures in Bitcoin and signatures they're basically

signed on the entire transaction data so in particular they have some attestation to what is the right data of the transaction and if we can extract this information we will basically be able to know that we have the right data of the transaction can I get a click next slide okay this is some math if you don't understand what is behind me it doesn't matter at all what important to understand is that the transaction data is some part of the signature so if I'm able to read the parts of the signature I'm able to verify the transaction data which let me give me the ability to enforce it next one next slide okay the I know that uh this

sounds weird but this almost work the main issue is that in Bitcoin today we have no ability to do any string or element concatenation so as weird as it sounds we could get a transaction data and verify it's the right transaction data on in Bitcoin transaction but the one thing that we don't have is string concatenation and so we cannot really extract this information we cannot say here's transaction data let me reconstruct the signature verify it and compare it to the real signature because we don't have this concatenation okay so why am I is standing here and talking if this

doesn't work why am i showing it to you next slide because after a long time where uh Bitcoin did not have this uh primitive of concatenating strings there is now a proposal on the table and it's also activated in Signet that enables this amazing capability of connecting concatenating two elements on the stack next side when I when we show this is this was the reaction of one of our lead Engineers shakar papini when he found out about this

fact um so basically it sounds insane but uh if we get string uh or element concatenation we would be able to do very beautiful things okay next slide so now I'm going to show you how I take all those ingredients whether you followed or not and build some sort of smart contracts on bitcoin um so here's the construction and it doesn't matter if you don't understand exactly how it is done because the conceptually I think it is interesting to understand how it looks like so here is an example of what I claim to be almost a smart contract on

bitcoin how does it look like we have this Locker or locking script and the locker script the Locking script is basically the logic of the smart contract whatever you want to put in the smart contract will be in this Locker okay and the first thing that the locker will enforce is that the next transaction that spend it the first output will be the same Locker so this already gives me persistent logic thanks God I don't need to delete my logic every time now I know that my smart contract will remain even after the next transaction which is great the second output I'm going to use for the

state and this is changing so I know that I don't want to have the same state every time what I want is that if I change the state I want it to be persistent with the logic right so the next thing that the locer will enforce is that the relations between SNS tag are following the logic that exist in the locer and there is also some technical details about this uh the amounts that lives here they also need to have some enforcement I'm not going to get into that uh we sometime call it pay to waking or uh state kabush but in fact this this is really the in my mind this is already smart contracts on bitcoin um

the only thing that it doesn't have is that it doesn't have Global State meaning in order to call the smart contract you need to know the smart contract state so it can only be called sequentially okay next slide now I'm going to claim that the previous smart contract was still bad why because it forces you to operate on the state with the script language of Bitcoin which is and we don't want that so here's a proposal to do it without ever writing script in your life again and how this would work um the locker script will need to know a stark

verifier but if it knows a stark verifier then now I don't require the state to be store but in fact I only require some commitment on the state some state route of am miricle Tree on the state and the way I will enforce valid State transition will be now with a proof that incorporate all the logic of whatever smart contract I want to have and on chain it will be always the same Covenant always the same logic of Covenant always the same locker but the only thing that will be different will be the the program that the verifiers verify so basically in this construction you have a smart contract on bitcoin

where you don't need to write script to Progressive State the state sits often somewhere and you can write the logic of the smart contract in whatever language you want as long as you can prove it so for example here you can write smart contract in Cairo on top of Bitcoin without touching script which is a powerful thing if you think about it for 10 seconds okay last slide um this should be Bitcoin there so I'm going to go over one example which will will be basically how an L2 will look like um and I don't have time for

questions so come to me after if you want and we can talk about it some more but basically it will look the following way this is an example of how you Pro progress a state of an L2 transaction on bitcoin it looks the following you have the tvl it's sits always where the locker is and the locker protects the tvl of the L2 so it can have a lot of Bitcoins but but it's protected by the locker and every time you want to progress the state you need to show a valid proof that says okay my state now moved from in this example State T minus one to state t or from State T to state t + 1 and the state route change according to

the rules of my L2 and in addition if you want to and you want to enable bridging you can include deposits and withdrawals and the deposit and withdrawals will also need to follow the rules inside the L2 so inside the proof so basically we will ask the locker to enforce both the amounts that the tvl nobody stole it except withdraws that were allowed by the L2 and enforce that the state transition was valid meaning the proof was valid and that's it now you saw that that we we have no more slides you don't need to transfer anymore now you saw how conceptually here's a proposal to EV actual L2 on bitcoin if you have just

this small tiny thing of string concatenation thank you cool thank you so much okay we will be back as per usual in one to two minutes with the next talk so stay tuned [Music] you