Scaling Ethereum with Plasma - Joseph Poon | Silicon Valley Ethereum Meetup

Transcript

Joseph boon Joseph of course Joseph of course is one of the co-inventors of the Lightning Network and is also running a new blockchain which is gonna tell us about all yours thanks Dan um so as a show of hands how many people here yesterday so I don't want to be too redundant oh great not that many so I can just repeat the same slides I'll put in some new stuff but okay so how many people have a general idea of how it works or like read the paper or descriptions okay well 30% okay cool so as a background I think it's important to sort of understand and

reason about the motivations behind plasma so as we all know the security of blockchains are derived from everybody validating what you see on the blockchain and not trusting what other people tell you so your code verifies what you what you what you receive the blocks you receive and the information you receive to ensure that you know all the data is correct because there's no single trusted Authority of the correctness and that essentially creates upper bounds in the amount of computation that you can do because logically if you need to verify you know for example all the financial

transactions in the world on chain that creates a lot of expense and this is especially true and magnified for computation if we want to be able to compute complex contracts then everyone else would hypothetically have to compute these complex contracts so there's a lot of emerging work with channels and other technologies to be able to reduce the amount of computation necessary to be able to do that and if the blockchain is sort of the ground truth of the world then we should minimize the amount of truths being asserted to it and you really don't want to disagree about this ground truth because if you disagree about this ground truth

then you know the system sort of breaks down it's sort of like if you had sort of like two supreme courts that disagreed with each other and you sort of didn't know which was which was which which to build case law upon then you know you can't really build some some system which we can be able to reason about and build contracts are on and on a technical level that means that state synchronization across the participants becomes imperative you have to enforce the current state with global data it's easy because everybody has access to the current state you know everyone receives the blocks every one analyzes and processes the same blocks and therefore you all have the same sets of data when you don't have global data then that

issue becomes a little bit more complicated and it's going to be sort of a central theme of a lot of the work around scalability it's sort of the you know the other side of the coin when it comes to reasoning about CL ability and in this case withdraws or withdraws a sort of a misnomer but it's sort of when you're moving funds or moving the state between the different chains that becomes essentially you're saying okay we have this global state we're pre committing some amount of funds to it and this is true for any channel type construction your pre committing funds to it and when you pre commit funds inside you you have local agreement between two participants on

who has what within that fund right so if you had 1/8 and you're splitting it up point six point four between you and you and some other person and then updated to point five point five in order to move forward you both need to have sufficient data in this case the data is the other person signing off on on the new state if you don't have access to the data that you can't prove the current state and that becomes a huge problem and in this case it's resolved just by forcing hard synchronicity between two parties well hard over time eventual synchronicity between two participants whereby when you move to the next stage both parties

both signatures each other signatures and at that point you sort of okay you have you have the data available using this construction becomes increasingly complex forcing synchronicity across all participants because when you have complex contracts that means that you're gonna have a lot of participants who may not be online at the same time and may not be able to compute all of the data at the exact same time this creates constraints around you know liveness whereby you know liveness is basically everybody has to be online and it creates incentives towards halting

the system so if you if you have you know some computation between 10 parties then if like three of the parties stop computing or signing off on things then they can sort of halt the system very easily so you sort of face this like you sort of face this you know challenge whereby you choose either you know greater robustness around keeping the system operational versus security additionally you want to minimize the amount of ledger entries on the chain but really the data availability problem permeates all of this so what is plasma I'm gonna run through this a little bit shorter compared to the presentation

yesterday you can watch it online if you want to see a little bit more in depth but I want to give more time towards reasoning about the economic models and we sort of use cases for this so plasma is a construction of block chains and block chains so you have this you have some block chain and then you have some which spawns a child block chain which can just want further child block chains and that's sort of how you how you reach scalability and it's functionally a set of smart contracts that runs on the blockchain above it or in the root block chain actually which everything else derives from its security from and this smart contract effectively defines the consensus rules of the child blockchain

as the form of fraud proof so it's not actually your not actually directly running the blockchain on the on the root blockchain in this case aetherium in your only actually computing things in the events of disagreements about matching consensus so if you violate the consensus rules a proof is given on the root chain and that block gets rolled back and we go into that in a second and by constructing things in a set of nested chains in order to do computation across these nested chains you have to reason about this in a different way because you're dealing with many different systems so the standard way to deal with disparate systems is to use

something called MapReduce so MapReduce is functionally when you split up the work you have a map function and when you combine the work there's a reduced function so that's a way to distribute work and sort of understand the result from many different computers plasma is compatible with on chain scaling solutions such as sharding various block size constructions so essentially if you have better capacity on the root chain that should be able to increase the robustness of plasma as well so if you increase the root chain gives you you know some x factor plasma can run in that and give you a further you know why

factor and above that you can run channel constructions such as lightning so when it comes to the design goals the design goals of plasma is to show that it's possible that blockchain the blockchain can encompass a huge part part of the world's global transactions not just financial track directions we're also talking about computation in general it's I think it's really gonna be possible to put a lot of you know data storage computation web services all of that on the blockchain and it's I think it's technically feasible to do so even with the technology we have today

we just need to write the code and then it'll get done post metropolis no further changes are necessary on aetherium and this can get you you know payment and ledger scalability ledger scalability is an interesting one because you know if vitalic says you know blockchain wanted one of the key components of a blockchain is you know the data storage component and you have computation on that storage well you don't want to have too much data storage on the route blockchain otherwise it becomes a little bit cumbersome for anyone doing full computation so this can give you scalability on you know the

state as well so what is plasma really look like it's really just a set of libraries and you add on some business logic so this business logic can really be anything you can by default let's say you have a payment's chain is like the default and then you wanted to add on some social network like crud your components to it and you can do so and suddenly now it's it's it's a social network chain you just write the code upload the smart contract onto aetherium and then now you have some social network and as long as you design the economic incentives correctly it'll perpetuate and exist and the operators of that chain are economically

incentivized to run it you can run create you know decentralized applications such as a decentralized exchange or you can run you know your own private blockchain running on top of a public network so the this construction allows you to create applications which you and a set of participants are able to verify and enforce on the route chain if you're not if you don't care about the results if you don't care about the computation let's say you know not using the social network decentralized application you don't really need to look at it at all you're not really computing much at all you're only computing very very small

commitments on the route chain and that creates great efficiency for not only people using the system but also you know everyone else on the network because they sort of don't need to pay attention and you know when you really look at all that's just a bigger picture so what type of data is committed on the root chain in most circumstances in nearly every circumstance in this case do I have access to a mouse oh fantastic I do you guys see that oh great so when you have periodic commitments to the root chain when you create a new block in the child block in this plasma block number one there's some

transactions that occur inside there's some state inside and they commit a hash of that block and it's signed by the block creator and it gets submitted to the root chain and the root chain and everyone else running aetherium doesn't really do anything with it you just like the data stored it's okay whatever because you're not actually the data isn't actually stored on the root chain when it comes to you know let's say there's one eath in this plasma block mmm you know like it's just one eath is just stored in the contract there's no accounting of like who actually owns it it's accounted inside the inside the plasma block itself and it's only when it's either withdrawn or disputed that

there's enforcement of correctness and in this case enforcement of correctness is the most important when it comes to withdrawals because and this is a bigger picture of that so so essentially let me backtrack a little bit Alice when she is she holds funds inside plus this plasma block and the only thing being submitted is let's say a hundred bytes or 200 or so and this in this block can possibly have like millions of transactions in a single block and ideally not millions let's say like hundreds of thousands but you can

get net millions and you only submit you know 100 bytes and it's enforceable and we can go we'll see how later how it's enforceable so here's the issue right if only a small amount of data is being emitted to the root chain what happens when there's an invalid state transition after all Alice you know the creator of the next block could say well you know it's not Alice's money many more it's Mallory's and I'm friends with Mallory so I want the money to and Mallory is giving me a cut so because this data isn't on the root chain what happens then right well in this case if you're Alice and you have block data number 4

available block number 4 data available what happens is that you can submit a proof on the root chain because a smart contract in plasma is going to say but he's gonna allow you to submit proof that block number 4 is invalid and as a result block number 4 gets rolled back so this is sort of what happens there before it looked like there was gonna be block number 4 but anyone that has observed block number 4 can submit a proof on the root chain which includes you know local proof that you know this was included in block number 4 and then perhaps the transaction itself which you

know let's say didn't have a correct signature and then and then everyone on the etherium network processes that and says oh yeah this didn't have a correct signature and the smart contract said it must have a correct signature so then what happens is block number 4 gets rolled back the creator of block number 4 gets heavily penalized so because of this penalty you're going to be economically disincentivized from propagating invalid blocks but here's the problem let's say and here's a fundamental problem around you know when you're dealing with interactions between

multiple block chains and want to move funds between multiple block chains is that in order to prove fraud you must have access to the data remember earlier I was talking about how data availability was sort of the fundamental problem that we're thinking about and the reason for that is because with fraud proofs you need this block data and what one what the attacker can easily do is submit the block hash sign it and not tell anyone and after a while they can attempt to withdraw your money because you know the withdrawal proofs will look legitimate and no one else will be able to prove fraud so what you do is you pre construct the design so

that if if you are not able to receive the block after any blocks after some set of time you can withdraw some withdraw your funds so the interesting thing is you can't actually prove on chain whether data is withheld or not easily you know it's sort of like a he-said she-said situation because it could be a situation where it's like okay you know alice is like well I didn't get the block data and let's say Bob is the block creator and Bob says I gave Alice the block you know like there's no way to really prove that via a very very expensive interactive process and which basically requires dumping the block of a blockchain so you

that sort of always been this like weird wrinkle in designing these systems so what plasma does in the solution in in my view for these types of situations is you pre design it so that you can exit after some during some like time window where during this time window if you haven't spent the money and it creates this challenge game if you haven't spent the money you're gonna be able to exit and by broadcasting a transaction on its parent so this is sort of a bigger picture and the idea is that let's say Alice only has access to block number three she doesn't have access to block

number four and it's suspicious and concerned that there's a state transition here where you know let's say Alice sends her money to someone else and she doesn't have access to this block data therefore is unable to prove fraud she submits an exit on the route chain whereby she says I'm going to exit from this blockchain and has to wait some time period in order for that exit to be fulfilled however that requires Alice to be able to have space to submit the block as submit the transaction on to the chain so in order to make that economically efficient what we could do is construct it instead as a nested set of trees with possibly disparate sets of participants so it's possible whereby you know

there's this first tree depth this is Bob and this is run by Carol and this is run by Dave if you're Alice and any one of these fails you just go to the other ones in order to you know juggle your position around and in this case this is sort of the example of that whereby if this one fails the one in red you broadcast on the first tree depth and then you move on to the second tree depth and that way the transaction doesn't get broadcast on the route chain of course if all of these three failed you then thereby do need to broadcast on the route chain and you know provided that there is block availability the fun part about this is that if you hold

funds on let's say this third tree depth in blue you only need to watch its parents because its parents are the ones enforcing your state and you know let's say the second tree depth you know some submit some invalid state transition you're able to prove fraud on its parents but essentially if the other ones in grade don't affect you directly you don't need to watch the chain so this can create significant efficiencies when it comes to scaling up on the validation and light client-side so if you're a client you can do possibly full node validation of the first second and third tree depth because you're not actually having that much that many

state transitions you could imagine this nesting out to thousands of different block chains and you only need to worry about the state transitions perhaps which is happening you know maybe there's only hundreds of transactions occurring per day and there's only commitments occurring periodically to its parents so as a result you are probably only processing data and perhaps the tens of megabytes in order to whereas the entire network itself is processing you know men many many gigabytes or terabytes of data because we are constructing things in Chains like I said earlier you may want to be able to use be able to do computation between these states and MapReduce is you know a pretty standard

construction there's a lot of literature on it there's a lot of literature talking about how to do different things like sorting like various you know basic computing out algorithms whereby you can just use that and plug it in it plug the algorithms in and use it to be able to reach scale on block chains the only the only difference in this case is that we are merkel izing the commitments of the states before and after of the state transition in order to make proofs of the state transition so it's basically a provable Map Reduce in a certain way that way compact provable that way when you send work to a child chain you know

in a map function you are committing to the data being sent to the child chain and then when you do the reduce function you are also committing to the end state of that to the parent chain and this allows you to reach scalability and be able to reason about how to delegate work across these different block chains so when it comes to future work there's future work on mechanism improvements so creating more incentive for operators to incentivize correct exits minimizing block withholding attack incentives so more mechanisms around that right now the mechanisms are fairly

robust so that if you're you as an individual are able to get your money out provided that this block space however you want to minimize the incentive for the operator to attack the system even if you as an individual are able to get your money out and one way to enforce this is if recursive snarks or starks exists then then basically you just punt the problem away but ideally I strongly believe in defense in depth and ideally you want the system working robustly with just an open system with like very simple math so you know one can reason about the long sort of in the long term how people reason

about block change security you know the first line of defense could end up being hardware security modules or by you know you just say okay if you're a block note operator you have some HSM but I don't want to rely on HSM s because you know I strongly believe in open source and they kind of suck because they sort of create centralizing effects when it comes instead of like because there's strong network effects around that the second line of defense could be something like ZK Starks or Starks and the third line of defense could just be an open open mechanism game between between the blockchain whereby you can submit data in time for disputes and stuff like that which is sort of the core design of

plasma ideally you have the system work with just that component and the other ones are just a convenience so additionally there's some additional research necessary for token incentives especially token incentives between the child chains and you know additional aspects related to you know hybrid proof of authority proof of state consumptions so what does this get us I believe I think like it's it's interesting because I think it creates a way to reason about the the sort of future of blockchain scalability and it sort of rhymes with the way our society works today we we

sort of have a court system and if you view the blockchain as in your Jude occation layer the the highest mo child chain is sort of like the district court of the local court and then its parents are sort of like the Court of Appeals whereby if you know your district court messes up you can sort of like go above to its parents and if the dissing if the court of appeals messes up well you go to the Supreme Court in this case aetherium or the root blockchain is the Supreme Court it's sort of the source of ground truth and that's sort of where you submit you know your smart contracts that's where you know everything is sort of like that's that's the true consensus layer but you don't want to clog up the true consensus later you don't want every court case going to the Supreme Court

that doesn't really work you know it's just a couple old guys you know you don't want to you don't want to like they're old enough already you don't want them doing too much work so that's sort of you know like taking that analogy you don't want everyone in the world computing it you know like my computer doesn't want to do that right it's a little bit old - oh that means I'm going overtime okay let's just run through this you already read it so what I really want to talk about is like what this means when it comes to proof of stake economic incentives on the second layer in this case we're talking about Bob creating all the blocks right but you can also do something where a lot of

people create the blocks or a set of participants create the blocks you know instead of Bob it could be Bob Carol Dave creates the blocks and they each take turns or they can do you know some type of majority construction you know there's a lot of different like there's a lot of different distributed systems literature on how to split up the work the fun part is because this is a second layer you can sort of punt on the problem because things like creating time stamping you just like okay the parent chain does the route chain does it time stamping etherion does the time stamping so you sort of like punt that problem away so actually proof of stake on the system becomes really really easy in comparison but on the other hand the constructions you design on top of here may not be applicable for you know proof

of stake on the root chain which the etherium foundation is doing like amazing research on so what's interesting is that you can connealy compatible with a lot of you know new models new economic models when it comes to tokenization currently a lot of people talk about use tokens you know like you you buy a token in order to you know use some functional functional thing on the blockchain this is more closely aligned with proof of stake tokens so it's similar to like you know using some type of token on some route chain i you know eth or thing like that eventually if you can do

ETH bond your ETH and do proof of sake on that then you can get some return for holding ETH and then the two reason about it with you know the gas stuff it makes a lot of sense so what you could do is you could be paying ETH fees for the transactions on the route chain and the disputes on the route chain but the transactions going on inside this plasma chain the person that gets to create the blocks are the token holders so what happens is that it's a proof of stake of the token holder so you issue some ERC 20 and by issuing some ERC 20 the owners of that have a write on a proportional share to be able to generate blocks and the person that generate blocks of

course collects transaction fees so there's an economic incentive to be able to you know collect transaction fees and to run the blocks and what's interesting is is that you know you have a situation which is not the similar dealings of the principal agent problem with that we have with securities right with securities you're delegating trusts to another party to act on your behalf and because you're delegating trusts you know you you sort of you know like you sort of have to trust them to be able to operate correctly you know we'll the CEO you know operate my company and not just like take all the money right in this case you are directly taking action on the system so by having a specific stake you know is some some let's say you own

like 5% of the coins you can create 5% of the blocks or solving some or collect 5% of the fees if you take action which is incorrect you get penalized if you take action which is correct or your you know transaction selection or algorithm is better than another you can collect more fees so it's a different construction than what we deal with today in society but you know by owning perhaps a portion of you know the tokens you can construct a model whereby you're creating a decentralized network that nobody really has full control over right imagine if you created a social network on top of this you've created you know let's say a reddit clone or something like that you write the smart contract code

upload it on to etherium and then issue some tokens and it's the token holders and assume the tokens are widely distributed among them among society well it's a token holders creating blocks and they're gonna keep creating blocks right because like they're economically incentivized to collect transaction fees who really owns this system at this point right it's a lot it's very similar to like who really owns aetherium who really owns Bitcoin well I mean I guess it's the token holders but like you know the guy who like uploaded the smart contract code he can't like call if he said like yo guys let's let's let's shut this down the token holders gonna be like no right like if italic was like hey if the

areum's done like how about we just like close off everyone's gonna be like no no we're keeping this running right so like it's going to be a different dynamic that could exist and as a result you're sort of removing the trust entrusted institutions to be able to operate on your behalf and this is sort of like a new model that can exist on top of aetherium that is that has significant scalability and there's some use cases [Music] sorry for running over time why don't we take one question while Vitalik gets set up yes please this is completely unrelated so the question is how does

this oh sorry yeah the question is how does this relate to other consensus algorithms this is not inherently a consensus algorithm in that sense you can run whatever consensus algorithm you want in terms of the proof estate mechanism you can run a proof of authority where it's just one guy signing the the key design here is that designing around exits under a child chain construction and how to reason about with blocks base availability when it comes to data availability when it comes to ability to enforce fraud proofs when it comes to being able to scale up from you know from you know allege the ledger containing the the memory state

and to be able to abstract that away into specific applications and to be able to create decentralized applications whereby you know we're talking about potentially billions of transactions per second with incredibly incredibly low costs okay great thanks okay