MEVM: Private EVM Computation for MEV

Transcript

[Music] what's up hello hello good can you guys hear me sweet um yeah thanks for coming uh despite uh the uh fancy title I'm mostly here to show you on a new transaction type and uh overloading of uh Json RPC that we're using in Suave uh at flash Bots and we think could be useful um as like a a comp sort of like a a paradigm in um rollups and other l2s um yeah so what's up I'm Dan I am uh

self-proclaimed uh credible Auctioneer at flash Bots uh if you're unfamiliar with the credible auction problem definitely look it up none of your auctions are safe right now um cool let's get into it so yeah where do we start the evm and its output the blockchain they're entirely public and this has many consequences um the inputs to evm computation are also public um and so at flash Bots we design a lot of technology and pipelines to ensure the uh inputs are private um but outputs are just like an entirely different story and really the entire pipeline has like multiple points where um private computation can

be useful so what are the comp uh what are the consequences of this well naturally uh one of them is me if you've never heard of it uh I I won't go on uh too long about it but it's the idea that uh people can take advantage of your information when a it's in the mempool OR b when they are the person responsible for constructing the blocks such as the block Builder or um the proposer or you know before the merge this was uh the minor um so you know your typical use case here is you know you want to make some type of transaction on Unis Swap and um you know you set a slippage that allows you to uh you know allows your trade to move

the price up to 20% of ideally where it is there are these Bots that live in the mempool and they can basically monitor this and then push you up until your slippage amount even if the conditions at the time of you submitting it didn't uh necessarily uh indicate that this was like the result of the trade you were going to get so this is naturally like one good place for privacy but the question is like how can you add privacy to this portion without centralizing the infrastructure related to um handling this this type of computation um and then additionally surveillance becomes like very easy when all of this information becomes public I think this I I I won't really touch on surveillance

but this is like a whole another aspect that I'm sure any of many of us in the ethereum ecosystem are concerned with cool so what do um there's currently a couple privacy preserving options um and these aren't all even like mutually exclusive or exhaustive um first one is like ZK evm this is able to hide like a lot of the intermediate computation because what you do is essentially uh you make a claim of like say for a ZK rollup uh that like the state rout of the rollup um is being changed to a new state route and you provide some proof um so this sort of hides a bit of the intermediate Parts but uh not all of it because you're

still like you're you're still making a claim and this claim reveals some information uh FHM is like probably I think the most exciting there's some other projects working on this I think Zama is one of them um and there might be another one uh this is the idea that you can encrypt an input uh you know add it to another encrypted input and it's output of of this operation is also encrypted but um it still like actually makes sense um which is like really exciting uh and then another example is zcash which you know uses like ZK technology um but this is more of like an application specific approach um I think the sapling circuit is like one of the main ones eash uses and this is like mainly for

transfers um cool so another Trend that also relates to this is like computation is moving out of the consensus hot path so today in ethereum uh you know the the world computer you make a request and every node on the network processes it and um that's really cool that's like how we ensure that the computation is um correct and that all nodes are um doing it uh the the results are in sync um but as you've seen with rollups and other ZK technology like the computation is slowly moving to the edge where you users or parties on behalf of users do this computation and you submit it with

a proof of its validity um I think what's really interesting in this sort of scenario is that like you can actually view me as like State conflicts in this computation you're doing at the edge where you know if you're just doing it by yourself no issue but if six other people are all actually like Computing on similar State then that is where like a conflict happens and this is like another way to look at cool so yeah what what do we do what what have we built um so I'm going to talk about the mm or the Mev uh whichever way you think it's pronounced let me know uh if you have an opinion uh see me after I'll give you a swab sticker um yeah so this will start

pretty swab specific and then I'll try and uh explain later on in the path how this can become more generalized so that anyone can use it um so today the mevum uh or mm is basically just a modified interpreter I think um current right now we're uh like a fork of gu it's called swab gu and I think it's like a 50 line diff to The Interpreter in gu um and there's two core things that it uh allows for one is confidential data to be passed in with your request so you can basically encrypt data and send it in with your request and then uh an execution Nam space so this uh if you're solidity developer this is uh how you would interface with this is basically

your smart contract has a pre-compile where it is it can access This Confidential data store do some computation and then emit the result and um the key part here is that like none of this computation goes on chain and we'll I'll get a little bit more into how this works in a second um but yeah we we also have this thing called the Suave execution backend which um is additionally like a very small death from gu um and uh like very easily portable we have a spec coming out very soon that other people could incorporate this um so yeah how how do you actually interface with this is like the next question um this is what we're calling a confidential compute request and this is

where we think like uh the interoperability with other chains is like uh highly relevant so yeah this like uh this may be the most smooth brain talk here at the evm summit I think there's also a lot of really cool uh work being done and uh but we're basically just overloading a Json RPC request and adding some pre- compiles but it it allows for some pretty cool things so if you're familiar with the idea of a transaction carrying transaction that's essentially what this is um so first we have a something called a a confidential compute uh record and so you can think of this as basically I I'll start with the Suave specific case of suave as it exists has

has a chain where you can deploy applications to uh like that do offchain logic today if you're familiar with like orderflow auctions or um rpcs um the these are all like offchain and they have like they have various modified logic and so you can develop these and deploy them onto Suave but um the key here is that the confidential compute record points at um some type of program whether it's on Suave or some other rollup and this specifies is how the transaction within your transaction gets computed and once this computation is done it's all subed into a swab transaction which we hope to generalize into something else and you can see that

in the swab transaction we have a confidential compute request we ALS uh from which is essentially this which specifies how it should be handled and then the confidential compute result and then there's some type of compute proof which right now could be uh just a signature from a verified party or eventually it could be like a ZK proof or some other technology um this pair is really nice with view functions so i' mentioned that we have to uh right now we're deploying these transactions uh these programs onto the swapchain but you could actually just Implement them as a view function on any of your own chains and the really cool thing is that so in this example we're like building a block from a bunch of transactions that it was

given um so what happens then is that this this is done offchain and the block is built but we only return select information from the Block uh and this is really relevant to the block auction that happens in ethereum called Mev boost right now um so validators need this to basically decide which uh block to pick um so yeah let's let's go through the the flow really quick it's like really simple so a user just sends one of these confidential compute requests to a node uh right like a regular gu node well a slightly modified gu node um it makes a request to some type of you know compute box it's just like an abstract concept it could be a network as well uh it will then return that result put it inside of the transaction

type and then it will submit that to the chain um and so one of the one of the thing one of the reasons we think this is like applicable to other rollups and um basically blockchainbased Computing environments is that it allows for a pretty natural upgrade path um so right now our compute box and Suave is sgx and you know uh you can go at length uh about the uh you know the trust assumptions associated with an sgx and I'm happy to talk about that afterwards but essentially it's a box with a private key that was put in there when it was manufactured and you can't pry it out without destroying the machine so it will then run this computation uh you

encrypt all of your data to this machine it will run it uh and then sign a proof of the computation and then send all of that back to be put into the transaction type so this provides a really natural path to uh you you could swap this in with like a ZK circuit so you could have some type of prover or even aover Network that is able to um do this computation for you and submit a result and a proof um there are some interesting like privacy considerations with ZK um and when you actually like expand this to a network that I think are a little bit less clear than like the sgx case but this is like something we're researching and hoping to move towards uh and then lastly you could even imagine like MPC and you could even

do like MPC with FHA if you wanted to as well and so right now MPC is like very slow to compute uh I think like a like a batch auction with like 20 uh bids I think it's like something like 20 seconds so this technology is still like far away but it's like a really exciting path to slot in here and just to hit home again on this point of like the transaction type is very unop opinionated about this computation and that's like what we like because we don't foresee ourselves using um trusted execution environments or sgx like forever um cool and then I'll go into one quick case study so ZK Unis swap it was developed by a um EF research fellow Diego his Twitter is at the bottom um

and if you see the the quick description ZK Unis swap is a proof of concept a fork of un V3 that uses ZK VM to compute part of the Swap offchain and again that's the important part here everything's moving a lot of computations moving offchain when a user starts a swap a swap request is made on chain the request is picked up by relay that makes the computation offchain and posts the output so it's we we are seeing in the wild this like exact use case of uh basically offchain computation and so by creating this transaction type and This Confidential compute request we're able to create like a stronger Providence or uh Clarity into like the supply chain of where your transaction goes and like that's basically it and that's why my my take

is it's it's quite smooth brain it's just a new transaction type um yeah and then open problems this this is the end uh resource pricing it's a little unclear how you could convey with this transaction type to this network how to actually pay for things um I'm not sure this totally needs to be solved in this Paradigm you could pay upfront or maybe the network pays for proving costs um encryption to these compute boxes also uh is an open question um we need like a generic and standard interface uh and then yeah a standard interface so like how can I communicate to both an sgx or a ZK prover or an MPC um is is the question that we're like

thinking through and would love any inputs on cool that's it uh thank you very much for listening uh hopefully I've uh pilled you on confidential computation offchain and how we can make it a little uh more provable [Applause] thanks okay we've actually got five minutes for questions if you have if you'd like to take any questions from the audience or we can break now yeah uh if if there's any questions happy to nice so if anyone has questions there should be a microphone okay I'll bring the microphone thank you hey Dan so my question was why do we need a blackbox ZK processor if we would like generate

the proofs for the computation that we want to perform locally like what's what are we gaining by offsetting that to a third party yeah totally yeah that yeah local computation is definitely like a very ideal end State it's just how How likely is that like that your phone is going to be able to like compute these proofs in the in the far future and then additionally um in the example of like State conflict so you could be generating a proof for your own swap locally and everything's like fine you just take the recent amm price but what's interesting then is you have 100 other people that also computed the same proof and they you know are like oh um my swap looks fine of course but then when you combine all of them together

you get these conflicts that uh are a little bit harder to resolve like locally makes sense good question though okay I think that's time thank you very much cool thanks