Prove Geth with Ziren

Transcript

If you don't want to give it to one person, you know, it's Do you have another camera there? Do you have a camera camera? Yeah. Okay. Okay. Um Hello. This is Steven, uh CTO of ZKVM. Uh today I'm going to talk about how to prove gas with Zener. Um yeah.

As far as I we know, um all of the ZKVMs right now, like SP1, risk zero, they are all focused uh even at the beginning Zener, they are focused on the uh wrist. That's the last guest of the etherism. And then no one yes really have done such a thing, but it's important. And Zener Zener is the MIPS based ZKVM. Um we started this project uh in 2023. Three.

Uh yeah, 2023. And um currently we already uh backed up some uh roll up projects like the go network. Okay. Um yeah, why do we need to prove gas? Okay. So, to be honest, it's um yeah, it's it's a really central topic um in the gigabyte CL1 ZK day 2025 in Berlin. Uh that's maybe that that's conference were led by Justin Drake.

So, first point is uh etherism is targeting scaling the gas limits to one gigabytes. Uh gigagas. And um So, that means the gas limit is still need to keep growing. But, at that moment I I would say no excuse to really would like to replay all the transactions. So, the answer is with the uh delayed execution under the ZK proof.

So, that means the one data just verify the proof of the blocks of the transaction and without replay all the, you know, blocks. Okay. And the another point is the uh the ZK year. ZK year means the ZK execution layer uh diversity uh the execution layer. Uh ZK year diversity means the different EVM guest that's running as a guest program inside ZK uh inside different ZKVMs.

Okay. So, first look at this chart. Uh we can see that guest actually uh is 41% of the total uh uh uh Ethereum nerds. Uh but, okay, most of the ZKVMs they can prove the Rust based uh you know, clients. Uh so, no one really have, you know, proving the guest um yeah. So, guest actually is a dominant execution layer, but uh most of the you may don't really do this this is a really I think is this is a really a gap to the ZK year diversity

philosophy. So, yeah. So, here we've tried to fix the gap. Um the sticker or the enabler is the MIPS. Okay. So, actually Go compiler or have a very nature, I have a very mature MIPS um backend. If you want to compare a Go program to the MIPS, you just need to set up the Go act to MIPS and then just run a Go build. And then there are no fork uh from the, you know, um toolchain compiler.

Okay. The second point is um MIPS actually is already battle-tested by the Optimism fraud-proof VM. Uh yeah, it's uh the it's already you know the Optimism have run the fraud-proof VM um on MIPS back um in production for many years. And MIPS is a very uh clear and well-understood uh answers and and have been uh used in production uh for 20 years.

Uh yeah, more than 20 years. I mean I mean for MIPS itself it's had been history of maybe 40 years. But the for MIPS uh 32 uh we are using right now is have been used for more than 20 years uh yeah, stably. And the ZKVM MIPS uh is the first ZKVM that implements the MIPS uh 32 ISO. And uh it's a general purpose um ZKVM for um you know, verifiable verifiable computing infrastructure for the unified statements uh across the different blockchain ecosystems. And uh we have a and uh ZKVM is very uh developer-friendly.

It's uh have a nice native support for the multiple high-level languages like Rust, uh Go, Lang, and uh we already have been audited by multiple teams regarding of the soundness, completeness of our sockets and emulator. So, before we introduce uh how we um you know, prove the guess, uh we need uh we have a framework about how to measure the performance.

So, yeah, it's uh the we define the lot of us. I I would think uh everybody make uh everything ZK-VM they have such a definition that's proving time equals to the um instruction counter divided by the proving speed. Uh the IP means the instruction counters um instructions numbers uh from uh program P that's um you know, compared to its uh YAF. And the proving speed means uh once we have the proving uh have the YAF, then we run the um then we uh we will run the emulator uh

we'll run the prover to prove all those uh YAF uh all those MIPS uh you know, uh instruction sequence uh execution uh are correct. Okay. So, for the for the PE, it's usually means how many instructions the prover can procedure uh um per second. And for the instruction count, we usually define uh we we we it's usually consist of three parts. The first part is the application logic. Like for the taking the EVM for example, it's included the EVM dispatcher, um IRP encoding decoding, and the roots um

state roots computation. Um yeah, and then for the runtime, it's usually about the language itself. Uh, as we know, Go has a very very complex uh run time uh compared to the ways uh rust. And it's also in consists of like the uh stack, like the gap uh garbage connection, uh routine scheduler. Yeah. And for the syscall, it's really the you know, the fats instruction uh instructions that's used in your that's in your uh guess the program, like the cryptography

operations, large number uh operations. Okay. So, in this topic, we focus on the um uh instruction or emulate set. Uh, okay. So, actually, it's very easy. Also, it's uh everybody can run it uh in your computer. Just clone your go-ethereum. Since we have some uh additional precompiles into the go-ethereum, so I fork it. Uh, of course, we already have uh keccak precompiles in the uh ethereum master branch.

Uh, okay. Uh, so, run those commands and you can use the flag execute to just uh execute it. If you don't uh use this flag, it's really approve it, but if you want to prove it, maybe you need a very powerful uh computer or server. Okay. So, this is the example of uh that block and with 407, it has uh you know, 524 uh transactions. And what I want for uh ask to focus on is the syscall counts.

You can take look at the syscall counts. Uh, it consists of most of them. The top three would be about the signature verification. And the fourth one is the catch hack for the hash in the, you know, try deep try try DB as their DB. Um okay, so that's also the hard part that we want to accelerate in the uh you know, in in this project.

So, before we really do So, first step is we want to decrease the count of the instruct count for the application logic from one hand for the, you know, uh pre-compilers. We So, we need some principles. Uh like one we don't do is we don't change the Go compiler. So, there's a typo here there. We don't change the Go compiler. We don't change the Go tool chain. But, we need we we But, we when we we patch the Go see the Go one time Cisco and the Go flags.

Okay, so there's three layers here. The first point is when we The first point is uh we how we patch the Go one time. When we load the year if of the Yeah, at the loading time actually not at the loading time Yeah, at the loading time actually we need to disguise the year if binary and find all the Linux API symbols. And then we put we we we we need to implement all those we need to make sure that all the KVM implement all those Linux API symbols.

But, of course most of this symbol most of the Linux ABI we just replace their implementation with immediate returns. So, yeah. So, like the file system file system operations like the network operation system and yeah, the second And then for the GC, we also disable we know up odds their GC enable and we deduct sweep on credit functions. So, that means we actually say allocate in Go line one time still works, but the memory

will never be connected, but that's okay because after we finish the execution of the block of each block, the Go one time will be um uh exits and the memory will, you know, reset by the operating system. Uh and then we also disabled the scheduler the scheduler. That means the Go routine in our our in the guest program will have no operate operating system to run against.

Okay, so for with this patches can reduce the, you know, the uh a lot of additional cycles. Yeah, the second one is the pre-compiles. Okay, replace the software crypt cryptography primitives with ZK-VM syscals. Uh yeah, we just add an additional tags for the guest like Go builder Zaira. So, that means we can use a same code base for both Zaira and the native execution. Uh okay. And this third one is also really starter parts. That means we actually we the MIPS ZKM is 32

machine and you know for native execution it's run on the X 806. So that means the the layouts of the memory and they you know they the length of the words are quite different. So we actually it's probably the hardest part of the engineering work when we do such a you know integration. Okay, this is one This actually this is all one I want to talk today.

We One thing is we can control the overhead. I mean the ratio of the gas over the rest to four X. That means the cycles produced by gas is just four times that's the rest produced. Okay, so this means it's really practical to realize the real time proving in the future with gas.

Okay. Actually we have run 10 Yeah, it's it's we we we run run this benchmark on 10 consecutive blocks and in Yeah, we have this chart from 10 consecutive blocks within 81 overlap blocks. Okay, so the overall you know ratio is four but for some blocks that without pairing is just about 7.8 8.

Yeah. Okay, so how do we uh actually patch uh the you know the zero uh guess? So, here is all the patch status we have right now. Uh yeah, we have the key chart 256. Uh yeah, it's the best uh it's the best line. Uh it's already in the master uh branch of the go Ethereum some codes. And the another one is um another biggest one is actually is the secp256k1.

Um it's uh from the uh ECD recover. And um yeah, we already we done it with some optimization with the Shamir's trick. It can reduce the sacks with number like 56%. And uh we also yeah, have the other the pairing operations over the BN254. Uh yeah, it's already work, but I think it's still a bit slow right now. And uh for more decks uh up to 256, yeah, it's already just takes seconds.

Okay. Uh so, if uh and if for the number that's uh that for the operand that's larger than 256, uh it will fall back to the go lang. Um okay, so for the KZG right now, it's uh the biggest gap right now because um it's uh we According to our experiments, it's still takes a very long time to finish the execution. So, actually we need uh more optimizations over these points.

And uh with the go run time like the um uh with a golden time. I mean the the timer like the golden times is close like the war time like you sleep. Uh we already patched it so the Cisco actually be saved to zero right now. Okay, so that's the what that's the path we uh achieve the 57% cycle reduction here. So the first part is we optimize the easy recover. Actually, it's also the summary from previous meeting with Phoenix.

Uh yeah. Okay, so some other parts is also saved a bit of off the cycles. And we still can that um yeah, the pairing is also takes 74% of all the uh cycles. So that's what we need to optimize in the next few uh in the next step. Okay, so back to proving Okay, back back to the proving time here. Actually, we already know the uh the the the cycles uh the instruction counters. We also have a number about the proving time. You can check out.

Actually, everybody can check out the proving time from East Proof and there are a lot of there are more than 10 equipment there. Also included the Ziro. Okay, so we can it still takes about 8.9 minutes minutes average in average to prove a block a minute block. Uh yeah, it's too slow, but of course, it's on one on single on single RTX 4019. We can scale it uh horizontally. And of course, um get back to the 4x gap um gap. I think we still need to look back to the uh IP here.

I would say for the guest, it's we already have a lot I have a patch is the GC scheduler, you know, the go routing. And so for next step, I think it the uh the EVM optical dispatch IRP decode is still have a lot of work to do because the width have a lot of ZK friendly optimizations over there. Uh for example, they use the sparse MPT. Uh their allowing IRP is very friendly to ZK proving.

So, yeah. And uh yeah, for the next uh uh for the you know, completion um completeness gap, we need to finish the proving of the BR S1231 more X that's operated larger than 256 bits. And then for the performance side, we still have a lot of skills to go on like FP6 and FP12 precompiles. Uh yeah, of course, we say we're collaborating with Gulami Phoenix at EF. We able to we we we aim to launch our, you know, one

of our 100 proving or use proof and then then then real-time proving next. So, all those things are open sourced. If you anyone of you are interested, can clone it, run it locally. If you don't have enough GPU resources to finish the experiments, can contact me. I can provide you, you know, our private proof network. Uh Uh, yeah, it's our Twitter, our docs, our medium. Yeah, thank you. That's it.

Thank you for presentation. Maybe uh anyone have a question? No? Thank you. Thank you. Yes. Yes.