Tackling Pain-Points with Optimistic Rollups with Jeremy Clark | a16z crypto research

Transcript

welcome everybody we're really glad to have Jeremy Clark here today he's an associate professor at Concordia uh so I've known Jeremy for about 10 years since he was a postdoc and I was a PhD student and he worked on the Bitcoin textbook and a course with us he's done a lot of great work all over the Bitcoin space and he's also this year's FC program chair so keep that face in mind to complain too if your papers don't get in absolutely thank you thank you uh yeah yeah so I was actually going to put a slide at the very end encouraging you to submit to FC I forgot to put the slide in but uh this is your uh welcome message to sending your papers I know a bunch of you that I've already talked to are considering it

okay so since I'm here for the rest of the week I thought I would just give you kind of a quick overview of the kinds of things I work on so we can have some conversations and then I'll get into the actual main body of the Talk itself so I cut my teeth on cryptographic voting so this is where you can have a proof that your ballot is included in the final tally it wasn't Modified by anyone but you still have some sort of balance about secrecy or ballot privacy we took these systems and we tried to make them like a real world system that you could actually like humans can vote on uh not computer scientists but actual voters so we ran a municipal election uh in Tacoma Park which is outside of Washington DC

and anyway so I've done a bunch of other stuff on voting more theoretical results uh blockchain intersection in terms of taking traditional voting and putting on blockchain I'm kind of on the skeptical side but in terms of doing on-chain voting for on-chain things like Dao's I think that's really like a cool application of voting and I know that that's some of the stuff so of the uh government thing this is what I'll say I won't give you the long technical answer I'll give you the fun answer uh I and I kind of sold this from benedita but uh when you want to do cryptographic voting or just voting in general you have like 10 problems that you want to solve okay so think of them and blockchain solves like the eighth problem on your list so it's not like

completely useless uh you can use it it gives you a secure bulletin board uh but but it's not like your top priority when you're thinking about all the same things that you need to do for voting oh yeah yeah so so actually uh Tacoma Park elections are sitting on Bitcoins blockchain so a lot of people don't know that this is a government U.S like a binding U.S uh election and the election data for it is on bitcoin's blockchain from back in 2011 uh because it actually kind of solves a security problem that we have that I won't go into but you can ask me about it later okay uh what else uh so now we do a lot of things uh mainly on ethereum students

like ethereum uh there's good tooling and things like that so we try and deploy things on it uh We've looked at some things that are like kind of purely cryptographic so like recently we put a multi-party a publicly verifiable multi-party computation on ethereum super expensive doing a single gate is like going to blow the gas limit but anyways it was a fun project uh and then we do more like finance things so like on-chain order books uh stable coins lending protocols that type of thing uh we also like protocols that aren't on the Chain but the concern blockchain assets so with Joe we looked at proof of solvency we've also looked at different uh like upgrade mechanisms how do you get a contract that's immutable but you

still want to upgrade it and so there's it's actually a very interesting field and then there's a couple of attacks we wrote the first paper on crypto jacking which became a big thing and other stuff on proof of solvency I'll just spend your year for 30 seconds about it I think this is still an interesting problem so it kind of went away and then with FTX we've seen a kind of resurgence in it uh I've heard from multiple people that we need standards uh part of that is motivated by the fact that what exchanges are doing now is insecure so they they just kind of roll their own proof of solvency and uh most of them are also not strictly a proof of solvency says that your liabilities are okay and your assets are okay as well most of them just prove the liability

side not the asset side and I also think gets interesting to apply like ZK snarks to the problem uh you can obviously do it at the circuit level that's fine you can do anything in a circuit but in order to make like a custom IOP for this particular problem I think that's interesting in particularly um on the asset side because your assets like say it's a an ethereum asset then it's an ecdsa key it's not a pairing friendly group it's not the same cryptographic group that your snark is in and so you have to like figure out how you're going to do some sort of translation between groups I also like sok's systemization of knowledge so these are papers that are kind of like surveys a little different that we try and look at things we look at the

history of things as well I like reading old papers so we had like in in terms of the Bitcoin textbook we did this type of thing this was one of our popular articles bitcoin's academic pedigree it shows all the different kind of streams of thoughts that predated Bitcoin that get merged uh into Nakamoto consensus uh then we've looked at other things so front running even before Mev uh we we did an SLK on front running uh stable coins oracles uh auditing like a traditional Financial audit we uh my research here is sponsored by an auditing company so we think about those types of issues as well and then there's a bunch of non-blockchain things that we've looked at like https and encrypted email secure email pgp that kind of

thing I also like time anything that has to do with crypto and time that's like something that Joe and I like both are kind of obsessed with um so the the uh election thing that I mentioned earlier the reason it's on uh bitcoin's blockchain is it has this carbon dating property which I won't go into love beacons uh we did a recent paper on short-lived signatures and uh zero knowledge proofs so these are proofs that are valid for like say an hour you can parametize it any way you want and then after an hour you don't believe it anymore or it's a signature that if you are able to check in the first hour you believe it otherwise it kind of dissipates naturally there's no like second round you don't have to like

send a message to kill it or release a key or anything like that it just naturally decays uh and then we looked at something called one-time programs as well uh recently I've also become more involved in uh Central Bank digital currency so I'm sure you've heard of the fact that lots of central banks want to do some sort of digital currency the area that we feel we can contribute the most is on privacy it's very unclear what the Privacy model should be for a cbdc how you balance the interests of law enforcement with privacy enthusiasts with uh data Brokers that want to commercialize financial data and so there's a bunch of like kind of ad hoc cryptographic kind of stuff where people are like oh you should have

accountability but if it meets this rule then you know law enforcement can have access to it and so we are kind of critical of the rules because we think they're like way too simple for a realistic cbdc like you can't actually solve crimes with the kinds of rules that are in the literature and so anyways this is like an ongoing discussion and we're working with people at like different universities and and central banks as well or the bank for international settlements which is overseas central banks uh we also do fun projects uh so one time we read 400 using security papers we looked at just the first sentence of the paper and we were interested in how is it that the author like kind of draws the reader in you know what what is it

they say uh is it some boring thing like since since ancient time you know humankind has like sent messages um you know or is it are there interesting cases so uh you can uh this is kind of like the the map of so the bigger the square is the more like popular that type of category was and I think Joe's paper one of his made the top five I didn't know it so we we picked our favorite five uh like blindly and then he said oh that was one of my papers um so anyways we have a blog post as well you if you don't mind read the boring academic paper and you can see all of that uh stuff okay so yeah go ahead start yeah so we actually spent a long time so

let me uh let me read it to you um so we say what makes the writing style of an academic paper stand out so it's a question and actually a lot of papers don't start with questions so questions is this little yellow box here okay so there was only I think one other paper in our whole sample that started with a question um the one I like is narrative so you like kind of tell a story in the first sentence I think that's interesting it kind of like draws the reader in and then uh yeah there's there's lots of different things could you pick this other conferences that go to where you just we've gotten 400 copies of legibe graph right right right right right yeah yeah yeah yeah so it'd be interesting also to run this not for using security we just picked

something representative for our field but yeah and see if like the writing improves across different conferences and or it gets worse okay I can I can spend the whole hour on this if you want I can show you lots of examples but uh maybe I'll I'll move on to this okay so I want to talk to you about uh fast withdrawals from optimistic Roll-Ups I do a lot of crypto this paper has zero crypto so I apologize to some of you who are are more on the crypto side um but this was the one that I thought I picked it's kind of work in progress so it's not published yet so if you have feedback on it I welcome uh the feedback and it's a collaborative work uh so my PhD student Massa masabi who's also an engineer at off-chain Labs uh my former

graduated Master Suite Medi salehis at off-chain Labs uh their colleague Daniel Goldman and then myself now everything I say is going to be about arbitrum but it could be about optimism so there's there's zero maybe like the small technical details but basically none of this uh is specific to arbitrim but I'll use arbitrim as the running example okay so before getting to the problem we want to solve let's think about what's the problem that optimistic Roll-Ups try to solve and it's basically the scalability issue that we have with blockchain protocols and the scalability issue if you want to reduce it down to something really simple you can think about it as a compare in comparison say to cloud

computing so in cloud computing you also have a big Network there's lots of nodes I have some method I want to run and what I'll do is I'll just pick the nearest node to me or the system will give it to me and then that node will run the method and I'll get my results back by contrast when I broadcast to a blockchain network every single node has to run that computation okay and then they have to run a consensus mechanism to make sure they all agree that Zed is the proper output and then if that's not bad enough even nodes that will join in the future often will have to go historically through every transaction to recover the current state of the blockchain so all those nodes are going to run my method too okay so there's

lots and lots of people that are running this computation that I want run and you can see why this just sort of is categorically different than kind of like a cloud computing thing regardless of what kind of scalability solutions you have in mind it's going to be a tough problem to make this competitive so there's a couple basic approaches again these are high level glossing over all the technical details but you could try and have some subset of the nodes run so this is called sharding uh another idea is you could have uh one node actually run the computation figure out what the result is and then issue a proof that this is the correct result pass the proof to all the rest of the nodes and all the rest of the nodes now

just have to check a proof as opposed to re-running the computation if it's some sort of snark it's going to be a lot faster to check the proof than it is to run the computation and so in this case the purple node is doing a lot of work and the blue nodes are doing almost no work okay so it depends on the ratios of purple nodes to Blue nodes and how much work it is for the purple node to figure out whether this makes sense or not but usually for most scenarios involving blockchains today this makes a lot of sense like the economics workout and it's it will actually save you computation in the long run amortized across the whole network okay then optimistic roll up so what's the deal with optimistic Roll-Ups so optimistic Roll-Ups are are also the

idea that you'll send your method to like say one node on the network but instead of them issuing a zero knowledge proof that it's correct what they'll do is they'll just stake an amount of money and say I certify that this is correct and if it's not correct then you can dispute it and if you dispute it then I could end up losing money okay so all of the nodes in this case they simply record the output they don't compute it itself so they didn't recompute the output to figure out what the output is they just record it and then they just sit around and wait and eventually if no one disputes it then they say okay this is this is considered final and so we'll go through those details uh in a bit um so arbitrim is is one example of an

optimistic roll-up this was a using security paper quite a few years ago and now it's a company they have a product that runs it's in the space of layer twos it's the one that has the most successful by a lot of different metrics including the largest market share of total value locked and recently there's actually more transactions flowing through arbitrim than throwing through flowy being executed by ethereum itself okay so anyways um okay so let's think a little bit more about this optimistic roll-up idea so it kind of breaks down like this uh I come to you and I say here's an output of a transaction this is how the state changes as a result of this transaction and you want to know

whether it's correct or not okay so how do you do it so there's a couple ways so you might say I believe it because I ran it myself so this is kind of like the default mechanism that's used in blockchains everyone just runs it for themselves and see whether they agree or not uh you might have it where lots of people signed it and said this is correct and because you trust the people that signed it then you trust that the result is correct even though you didn't run it yourself so we call this proof of authority some mobile wallets that can't run every transaction for themselves they'll say I see the transaction and I see a bunch of blocks have extended it and no one would waste all that like proof of work effort to extend some block that was fraudulent so I'm going

to believe it because someone invested a lot of time into extending it so that's called the SBB protocol and then uh it could be that I got a mathematical proof so this would be like a ZK roll up and then it could be that somebody is taking some money on it and uh nobody else is disputing it so I think that it's correct okay so optimistic rollups as labeled are basically five but in practice they can also be a bit of two as well so there is like right now for example in arbitrim there's an allow list of validators so not anyone can be a validators basically the party that you're going to give the the transaction to and actually execute it the one that's going to post the stake and all

those types of things okay um so so there is a bit of um a proof of authority in that sense uh eventually the long-term plan I guess is to make it pure a purified solution but this was seen as a stepping stone uh to getting there uh why yeah for completeness is there also uh I believe I just trusted Hardware assigned it yeah sure sure so that's that's good so yeah uh you can maybe squeeze it under two like because there's the whole like you have to trust Intel argument but uh yeah so tees might give you another option and certainly people if you look at the academic research tees are considered a separate category and there's lots of papers including papers

from people in the room uh that have looked at te based stuff uh and and yeah we do consider it slightly different threat model on the five versus two points yeah does that extend the Frog proofs as well like do you have to be on that white list for participate so you yeah so the the the person that pushes the initial like this is correct we call that the validator you have to be on the list to be a validator then I might look at the validator and say that's wrong right so then I can push a dispute and then the dispute can be pushed by anyone so you don't have to be on a list to dispute it so fraud proofs kind of capture both both of those parties interacting um but anyways you have to be on the list for the first thing and not for the

second thing yeah is there any empirical like study or evidence of like how much people actually check these things like it sounds like it could be a case of like tragedy of the comments where everybody's like I don't want to check it myself I'm sure it like other people have checked it to make sure but I don't want to do it right right okay so this is an interesting problem uh there's no empirical evidence because I can't think of a way of measuring it um it is something that people are aware of there's actually a cute cryptographic solution that Ed Felton came up with uh called attention proofs and so basically uh the the details are a little hazy but you can look it up there's like a simple

blog post if you're interested in it and they never implemented it in fact it never got any real like traction that I saw but when I read it I was like oh that's actually a really interesting idea um but basically what it does is you can prove that you checked it uh and somebody else can't copy your proof like I could wait for you to check it and then you issue your proof and then I take your proof and say oh I checked it too and so you have to make the proof kind of specific to the person um and then there's no way that you could issue the proof if you didn't check it so those are kind of like the two security properties and there is a like a little protocol that that does that and by checking it uh yeah so so the only way to check it

is to rerun it that's correct yeah yeah would you uh uh require someone to check it at least one other note to check a proof because at the moment it sounds like you yeah if someone has a feeling right or something like that but if you actually made a requirement okay okay so in this case in category five first off I I might have said the word proof fraud proof was a term that was turned around these are not actually proofs they're just assertions and so you absolutely should check it because there's there's nothing like there's nothing concrete backing the assertion other than the the fact that the person might risk losing my writing problem in terms of food checks it because correct correct so that was the other point I think as well

yeah yeah so tragedy comments rewriting so like like why should I check you know there's a dollar bill on the on the ground you know I'm not going to pick it up because if it was real someone else would have picked it up right it's that sort of argument yeah so the the basic or sorry it's just attention there's another thing called basic attention token but uh attention proofs are maybe a solution to that so I think that's an interesting open problem actually it could be something that someone looks at in this room yeah stay competitively said or how how do they determine okay so right now because we also have a flavor of two the steak is super low so it's set by the protocol and I asked my uh student she said it was like one eighth so it's like very

very low but that's because a lot of the trust is just that they're on the list of validators um later when you open it up you're you're gonna have to worry I I think the stake is going to have to grow a lot proportional because if you look at the total value of everything that's on arbitrum which is this number here where is it so it's five billion dollars right and so to have one eth you know having assertions over the entire state of arbitrim which has 5 billion locked up it seems like kind of disproportionate but yeah okay uh what else okay so the idea is that uh if you want to dispute it you also have to stake and then uh you're one someone's going to

lose money you now have two people there's a disagreement and so one person is going to win they're going to keep all of the money and the person who made the Spheres dispute is going to lose and then the question is who resolves the dispute and the answer is ethereum okay so we're going to go back to layer one and have them resolve it and then you're like oh wait a minute this whole thing was about avoiding ethereum having to execute anything right so now we're like if every transaction is disputed then ethereum's just gonna have to run everything anyway so are we actually getting ahead here and so what they do which is actually the cleverest part probably of the protocol is they make the disputers like pinpoint exactly when they start to disagree so they're like we all ran these transactions and we are

in agreement we're in agreement and this is the exact op code where I get one result and the other person gets the other result and all ethereum does is it executes that one op code and says okay we're either going down the right fork or the left fork okay so it's super cheap um there's a bit of interaction back and forth to isolate where the dispute is happening but then to actually resolve it is super cheap for ethereum to do I guess I would say this is like a really great optimization but fundamentally you're hoping these disputes happen almost never right yeah anyway vanishingly even if you did it in the naive linear re-execution correct correct correct yeah yeah so you

hope that the stake itself takes care of it and generally when we like in crypto optimistic is a term of art so we say oh that's an optimistic program it means exactly that you you hope or there's there's really no reason why it shouldn't go wrong but you you still want to cover the case that it does go wrong and so in this case yeah if you wanted you could probably do some sort of game theoretic analysis right here yeah never almost never doing frog Food Insurance yeah exactly exactly so I think that's also interesting and probably an open problem at this page I think people have thought about the game theory but like in a kind of informal like discussion level like on message warts rather than actual papers yeah it's like nice right up I've seen a

while ago where they hinted at the tension between the people's verifiers checking the proof and this game theoretic outcome because if we know that nothing is going to go wrong like in the equilibrium then why should I even like put the effort to check it because no one will submit invalid things but then people start submitting invalid things and like there's basically like this probability that there will always be some error and then to get rid of that I think they introduced this uh this new tool you mentioned okay to force people to check it's a mixed strategy yeah and in mixture there's a probability of error that's positive yeah but it gets checked okay let's break out the Whiteboard and we'll work this out right now once and bro

um okay okay so let me uh try and get through all this okay an optimistic roll up how does it work so you're going to have some stuff that lives on what we call layer one so the example here we're going to use is ethereum but it could be any layer one and then you're gonna have some stuff that's off chain uh so we're going to use uh our arbitrum and they they call their like evm equivalent arbos uh and so it's going to live off chain okay so on ethereum you're gonna have three basic contracts uh so the first two are called the Inbox and the books and you can tell I'm Canadian by how I say out um okay so inbox and outbox uh this is just about executing transactions okay

so that's the main mechanism that you want to do the other thing that people might want to do is let's say you have some tokens and they're on layer one and you want to move them onto Layer Two you can do that as well but the inbox in notebooks is outbox is not sufficient uh you also need a another contract called the bridge and it's basically about managing assets so for what we want to do is we're going to touch the outbox on the bridge and we won't really touch the inbox okay so the way the inbox works is you come along just like normal you have your ethereum transaction you want it executed uh you send it to the Inbox and what the inbox will do is it will simply record it it won't execute it okay so layer one is not going to execute this

transaction it's just going to put it in memory it does even put in long-term storage it just puts in call data it's enough to register it on the blockchain so there's a record of it being on the blockchain okay uh there is a slightly different version that's actually more popular that most people use but it doesn't you don't really have to understand it but you can send it first to what's called a sequencer which is offline or off chain and then the sequencer will put it in the inbox so the idea of the sequencer is from the user's perspective they don't have to pay any gas because this is a web service you just tell the transaction over the web uh and then from the sequencers perspective they can bundle a whole bunch of transactions together in a block so they can make it

efficient by packing it and then they can reduce the overhead cost of gas because every transaction requires a set amount of gas before you actually get to the content of the transaction itself so they can pass it into a theory into the inbox which is on ethereum uh with with less overhead uh and then if you want to do something about Mev like Fair ordering or something like that this is also a place that you can do that so there's a lot of interest arbitrim and optimism doesn't do anything about that to my knowledge but there is a lot of interest in now in trying to think about how a sequencer could Implement some sort of fair ordering or something to do something to do with MEP could be commit revealers or something like that okay so anyways back to the just the

direct uh based idea uh so you drop your transaction in the inbox then you a validator that's sitting off chain uh they execute it they update the state of all the contracts uh and all the account balances basically the evm equivalent in arbitrim land and every now and then they'll issue a state update and push it back to the main chain okay so this is called an R Block and it goes in the outbox then what you do is you sit around for seven days and these are pipelines so you don't have to wait seven days for the next R Block okay but for every individual R Block uh you're going to have a dispute window it's also called

the fraud window um withdrawal window there's a couple different names for it but you're gonna currently in optimism and arbitrim at seven days that's kind of like anyways I'll come back to that um so it's seven days you're gonna sit there you're going to wait and if no one disputes it after seven days then you're gonna say it's final and the outbox believes it okay now let's think about depositing and withdrawing assets so let's say I have some tokens and I want to put it into arbitrum I'm still going to use the inbox but I'm not going to use an ethereum transaction I'm going to use an arbitrim specific uh transaction so I'm just going to say hey I have 10 each I want to deposit it so the inbox will take it it will send it over to the

validators and what they'll do is they'll create 10 eth out of thin air in arbitrim okay so that and then it gets deposited in my account and then the real eth that's on layer one they're going to put in escrow on the bridge so the bridge is going to sit there and it basically has all tokens that were ever moved across okay then what this allows is uh the opposite so we can now withdraw so if I want to withdraw I basically submit it to the inbox it gets executed on arbitrim so they check and make sure that that my account actually has the right amount and I can actually withdraw it and things like that so all those conditions are checked in arbitrum if they are fine I actually have 10 East to withdraw then what they'll do is

they'll burn the 10 eth in arbitrum okay remember they just made it up anyway so they can burn it as well uh and then they'll push that in a state update it will get pushed to the outbox uh inside the R Block along with all the other stuff that's in the R Block same thing applies you wait seven days and then it's finalized and now what I can do is after it's finalized I do a second transaction so I walk up to the outbox and say hey there's this R Block it just finalized and there's an exit in there an exit is a withdrawal uh in arbitrim language um there's an exit in there and it belongs to me okay uh and so the outbox will check the R Block it will make sure it's there and if it's okay then it will

send a message to the bridge and tell the bridge okay release layer one eth uh to this user uh because they exited from Layer Two okay any questions about this I kind of went through it fast what use do the tokens on the L2 have so would you want to bridge them too right right so basically anything you want to do with tokens on L1 you could also do on L2 so let's say you just want to swap you can do uniswap on layer one the idea of Layer Two is it's going to be cheaper because it's more efficient the gas costs are going to be a 10 of what they are on layer one so instead what you could do is you could Bridge the token to Layer Two

uniswap also runs on arbitrum and then you can do the swap there at a tenth of the cost and then withdraw now most people don't like go end to end where they'll put the tokens in do something and withdraw it's usually like there's a whole bunch of tokens that people in the past have kind of moved over and so there's a pool of tokens that are kind of on arbitrum and they're using them in D5 protocols and then every now and then you have some reason that you want to pull them back to L1 so that's kind of more the right mental model but but basically you you do on L2 what you would do on L1 just for cheaper okay uh yeah and so this works for any token it can be erc20 it can be another token standard there's a bunch of red tape

around this that you have to be careful of do you need to trust like that these 10 eats are going to be created like for example can it happen that I submit a transaction to the Inbox and then my funds just get locked in the bridge but these extra 10 tokens on L2 are just not created yeah so that that would be part of the R Block so I didn't show it on the deposit side but the fact that that this was minted and this state got updated made its way into the R Block which got synced back to the outbox and at that point you could dispute it so if there's a dispute around these tokens and where they went and things like that that you're also eligible to dispute those things as well um so if there's a dispute in this architecture because like everything on

the L2 is it seems like that's also kind of executed in like a contract of sorts right yeah does that mean you're kind of like implying that the code is incorrect on one and not equivalent to the code on the other yeah so that that could be that could be a reason why an R Block is wrong is because either the validation code isn't working correctly or maybe there's different clients that people have and so when I look at the set of transactions and you look at it we get a different uh like arbos update at the end of the day so yeah yeah so those are those are the main reasons yeah okay so now let's go to the problem that we're interested in uh so withdrawals basically takes seven days it might take longer if

there's a dispute so there's never been a dispute yet in the history of arbitrim that I know of um but uh if they did happen then it would extend it you get a bigger bigger window in order to resolve uh the dispute uh there is a lot of talk it's an active like thread on all of these uh like arbitrary research and things like that about shortening the window um and so seven days is kind of arbitrary but everyone sort of agrees that it can't be minutes or hours okay it's got to be kind of on the order of days if it's three days as opposed to seven days it's still a long time to wait uh for your tokens not definitely not being always uh so the thing is that if there's a dispute you you need to recognize it you

need to file a counter dispute yeah and the the problem is basically whether someone could denial service you uh into not and into not filing dispute on time that that's the main mechanism yeah okay now here's another just empty your minds of everything I just told you and this is just another problem to think about okay I just sent a transaction uh is this transaction eventually going to be finalized okay so it's a question you might ask of any blockchain okay and so if you're talking about ethereum or Bitcoin the answer is maybe maybe not right it you can see that it's in the mempool but that doesn't mean that it's going to make itself into a block there might be a double spend or something like that that causes it not to

now conversely let's say that you see it in the inbox or in our in our block okay so it comes back it's in an R Block you're looking at it in seven days is that going to be finalized yes or no and the answer is if I validated if I'm running an arbitrary validator and I validated that R Block I know I'm basically 100 guaranteed that that's going to be finalized there's no like miners that could step in and reorder things or there's no competing thing that could replace it if I checked it and it's correct and the protocol works right then it's going to be finalized okay so we call this eventual finality and this is going to be an important property for us because what that means is that even when I've

withdrawn it and I'm sitting in the window waiting for seven days I do know for a certain it's going to pop out the other end after seven days okay so that's very unlike what we're used to uh in in normal like transactions just releasing them uh to a blockchain okay and the reason is that it's already in the inbox so the inbox has all the transactions and note that at any time you want you can recompute the entire state of arbitrim just by looking at the inbox because the inbox has every transaction it's a blockchain in and of itself it has a record of every transaction so if you start at the top of the Inbox and go all the way down you better end up at

this at the update there's there's nothing that goes into the state update that didn't come from the inbox um so it's all completely deterministic once it's locked in the inbox okay so the idea basically is is pretty simple which is I had my eth I withdrew it I have to wait seven days until I have it in hand what if I can withdraw a claim to that eth first and then I can go Trade It so maybe I need the eth today so I'll find somebody else that has eth today that's already on layer one it's not locked up I have eth that's going to show up in seven days and we do a swap okay so that's what we call tradable exits okay now tradable exits could be solved

tradable access isn't the only solution to this problem another thing you could do is you could think I have ethon arbitrim I want eth on ethereum so we call it eth L2 and ethyl one uh so you could actually use any exchange that you want to so here's a couple ways of doing it so you could use a centralized exchange like coinbase and just say you know have one type of Ethan ask for the other and coinbase supports this kind of thing you could use some kind of like Atomic swap protocol that works cross chain a more kind of nice Advanced version modern version is called hop it makes a couple different assumptions to make it kind of assembly trusted uh and then you have what we're trying to do which are tradable exits and not

okay and so uh just going through this table really quickly if you get a DOT here it means you're decentralized we want something decentralized so coinbase is kind of out uh if you get at least one dot you don't need both of them you're faster than the seven day window okay so you're doing something about the seven day window if if you're somewhere in getting a DOT here so arbitrim the Baseline doesn't get the dot but everyone else does then if you take a close look at Atomic swap uh there's a bunch of weird things that happen in atomic swaps basically one party has a window in which they can decide whether to finalize or abort and they can also watch the price of the asset they're swapping for and so it

gives you basically a way to take advantage of the other party where if the price moves against you you might abort and if it moves for you then you might execute it so people call it a free option because it's like an option contract and it's European in the sense that you can execute it or not execute it at any time that you want to so you can choose the timing of when you execute it um so anyways these are not like favored we don't have that type of problem the main thing that we want to solve is oops I already exited on arbitrim I didn't know about this seven day thing and this is like so many users on message boards they're just like I can't get it for seven days I didn't know this was going to happen what do I do now okay so we want to be able to

bail them out all of these Solutions require you to know in advance that this is what you want to do and if you exit first then it's too late you're already locked up for seven days so that was our main idea and then I really don't like tables where I give myself all the dots and so I want to show that there are other properties that other people care about that we don't care about so one for example for hop uh is that they they'll do Layer Two to Layer Two uh transactions and so that's something we don't touch okay so we're not saying we're a replacement for hop we're not better we're not worse we're just we're trying to solve one problem they're trying to solve it different there's a bit of overlap in terms of what we're doing okay so Alice has an exit uh for let's

say 10 East L2 uh it's going to be pending for seven days uh so we're going to give her like a transferable token that represents the claim and just in terms of notation we're going to call it ethx uh so XX just meaning like it's sort of in this state where it's not on Layer Two it's not on layer one it's locked up uh for seven days um let's say Bob has 10 East that's already on L1 and they want to swap okay so that's that's fine that's then Alice gets her eth out right away essentially okay so there's going to be a couple problems uh with this there's a couple reasons why Bob might not want to do this swap okay the first is he looks at ether xx and says I've never heard of

arbitrim I don't know what that is how do I know that I know it has this eventual finality property but I don't know whether that R Block is valid I'm not writing a validator okay so if we can sort of split Bob into two people one that's running a validator on arbitrum and different Bob that has the liquidity on L1 then we can kind of solve this problem without any one party having to be both the second thing is would you pay 10 East like 10 each that you can use today 410 East that is locked up for seven days you're not going to pay right it's it's going to be worth like 10 each that's unencumbered has to be worth slightly more than 10 each that has this encumbrance okay so we have to think a

bit about like how do we price ethx and then the final thing is uh we're going to actually implement this for real on arbitrum uh Nitro and make sure that it doesn't like blow up gas costs and things like that okay so let's do these uh problems one by one so Bob needs to be an arbitrary validator to believe that the 10 East will finalize and so the way we're going to solve this is basically with an insurance policy so we're going to show up to Bob and we're going to say hey it doesn't matter if you don't know what arbitrim is we have this insurance policy that basically covers the fact that this R Block fails and so you're going to get paid either way okay so if either it goes through and then you get paid from the bridge or it doesn't go

through and then your insurance policy will pay you the equivalent um and the way that we do it is we're going to set it up as what's called a prediction market so this is something that you know Joe and I and others have been thinking about since way back in 2014 before ethereum was even deployed blockchain we wrote a paper on how to do uh prediction markets that were decentralized uh before auger before nasus and and all that type of thing so this is like something that that we all are like kind of super interested in you don't have to use a prediction Market we just like it because we understand it and so we're going to do a very simple prediction market so if you don't know prediction markets this is one way that you can do it that's probably the most simplest um so you have some Trader they have 10

each they put it in a contract and they get two tokens one token is called fail and one token is called final uh fail will be redeemable for 10 eth if the R Block fails and 10 uh the final will be redeemable for 10 if if our block succeeds and then conversely the other one will be worth zero okay so you get both of them you have both outcomes covered okay and then what you can do is you can sell one uh the one that you don't think uh is is going to be true uh or you can um or not now one thing you might notice if your astute is 10 final PM is redeemable for 10 eth if our block succeeds that sounds a lot like 10 ethx that's also

redeemable for 10 eth if the R Block succeeds and you have to wait seven days to do it so did we just like kind of push this around in a circular way the answer is kind of yes and kind of no so they're close but not exactly the same we think that you'll draw more of a pool of people that are willing to buy these tokens and these tokens uh ethax is tied to a specific user in a specific exit whereas your prediction market share could be for the whole R blocker it might even be for a batch like the next 10 R blocks or for all the r blocks on a particular day or something like that and then it's only circular if you're trying to withdraw eth so I use that as the running example just because it's

simple but if you start withdrawing other kinds of tokens but your prediction Market is running in each uh then then it's not you're not solving the same problem then these Shares are are different than the token that you're trying to withdraw so anyway there's lots of there's a couple paragraphs in the paper trying to explain this I don't know if I did a good job in in 30 seconds but but anyways XX the issue is you can't really treat those as fungible is that right yeah so there's a question of how fungible they are and so we're thinking of them as non-fungible there's also the issue of can you split it so like do I have 10 each like I can give you five and give someone else five or is it like one exit

which would be like one Atomic unit and so right now our thinking or like the implementation is just like it's an atomic it's a non-fungible atomic unit so it's just that one exit you can't split it up uh ethx isn't really 10 effects it's just like an exit that's worth 10 10 each is the way of thinking it but there probably are other solutions that that could you could use to make them either fungible or splittable you have one instantiation of the prediction I mean I asked that question because in Simpsons the obvious thing to the first thing that comes to mind is just throw up an A M am right yes like Ethan Steve you can go back and forth with a little bit of discount to the same thing here right so if it's not fungible then like how many prediction

markets do you need you need one prediction Market Per what okay good good good question okay so can you use an amm no because it's non-fungible right so amms you need lots of liquidity and so that kills that idea uh the second thing is it's a trade-off that we discuss so our vision is that you want to get the most liquidity possible and so it's better to make your prediction Market broad so you could make it you could do a prediction market for an exit is this exit going to finalize or not that's like the finest screen the largest screen would be every exit in this R Block or every exit and even this batch of our blocks and so we think that would be more that would be better so as long as every R Block say across an

entire day uh finalizes that's the kind of prediction Market that you could set up right and it would still cover the case that this exit as long as this exits in the batch then then it's insurance for them did you still set it up as a binary prediction Market or um so what would the third option be well you could actually keep track of so if it's binary right you say like this pays off if all 1000 R blocks fail and so all right sorry succeed right everyone fails and like everybody's toast right right so that seems undesirable right possibly yeah so it's more I see it more as a bet on arbitrim as to a specific R Block but uh uh you

uh but yeah you could anyways yeah so our thinking is just of it as a binary prediction Market we didn't think deeper than that on it yeah uh okay so so people basically you have people who either this is actually a good question so I'll spend a minute on it or so okay who would buy a final token so final tokens are attractive to anybody as long as they sell for less than 10 each like say the send sells for 9.9999 each or something like that right it's going to be close to 100 because it's basically guaranteed if you're a validator and you're running a validator anyways you might as well buy these tokens

yeah so that's who's going to buy the final side the fail side is either going to be the people who are exiting because they want the insurance policy so the insurance policy is the fail side of it so there's a market for that and then there can also be speculators who think arbitrim will fail or they maybe they want to hedge against arbitrary failing in the long run and these things are super cheap right they should be like worth less than a cent uh and uh so you could just buy them anyways and then if some Black Swan event happens an arboretum fails then you're rich and it doesn't cost you a lot to maintain that short position so there should be much liquidity in these markets because there's not that much desire for insurance then because like otherwise you could get a no trade

theorem whether like No One's Gonna bother buying anything because like why would you accept that I'm just like thinking to like this could be a transaction cost to run these swaps on yeah right and it's like yeah the insurance is selling for like less than a penny right well that genuine enough volume compared to like transaction costs yes exactly so I actually have some numbers on that I'll show you in a second but yeah it's the right point so if the uh if the exits aren't worth enough then the gas costs are going to eat all of this up and it's not worth doing uh yeah okay uh okay so just down here so you can

sell one or both shares uh if you ever get a collection of shares a pair back you can redeem them right away you don't have to wait for the market to close that's just a feature of the prediction market and then normally the problem you have to solve with the prediction Mark is what's the Oracle how do you know like whether it resolves or not but in this case CR block is on L1 okay so this is in the outbox contract and so as long as the outbox contract will tell you whether the R Block was confirmed or not which it doesn't currently so that's one of the changes we had to make to make it prediction Market friendly is we had to expose that but basically you can do everything on L1 you don't need an oracle it's a do you have an opinion on the

um implementation of the prediction market like the middle of the book versus amm or yeah so we first off we we sort of sidestepped it for now we implemented something that's simpler than a prediction Market just to get some gas costs uh and then the idea of what we would plug into gnosis or into um like auger or something like that to actually we wouldn't try to reinvent the wheel uh order books I've done a lot I did another whole paper on order books they basically don't work on L1 uh and we did implement it on arbitrim as well uh to see and you still have like a pretty low like cap so like on arbitrary sorry on layer one once you get about 80

trades in the order book then you run out of gas uh yeah and then on L2 you can blow it up to like a thousand ten thousand or something like that and so it might be feasible but it's still expensive to do so an amm is is just the reason people like amms is not because they think it's better than an order book it's just because it's constant time operations for everything and yeah otherwise you run out of gas even something as simple as like I want to cancel my order you have to walk through the data structure and find it and cancel it right or you want to insert it in the right price priority like these little small linear operations they kill you with with order books when you try and do it on ethereum yeah and I forget the details of auger

and gnosis but like is there a solvency issue like if they're doing a m style things you've got to be ready to lose money right yeah so I don't even know the current status myself so I feel like they both pivoted so nasus now they have this nonsense chain thing and uh um auger I'm not sure but I anyway prediction markets I checked about a year ago to see like could I actually I want to like play in a prediction market and there's basically nothing on ethereum so I think the software is sitting there but like they're not really using it that's my understanding but I'm not I don't have like up-to-date knowledge yeah so prediction markets everyone was excited about it like back in 2014 and

then they it kind of it it feels to me like the idea like didn't find a good use case it could be hard to get them to work that's kind of like pressing you on it yeah yeah and a totally different approach would be like let's let's tie ourselves in knots instead so it's more of a fungible thing that we can then right sort of trade using mm style stuff so yeah yeah I'm trying to get a sense for those trade-offs okay and then one other just like kind of tidbit for you trivia is that uh amm's actually kind of came out of prediction markets so like I think it was the NASA's people that uh had that first idea of the like the basic scoring uh there's like on the prediction Market side there's Market scoring rules and then they saw a connection of like you could Implement

an amm with the constant product or what's what's the real constant summer concept product or whatever uh that rule uh they they pulled out of the market scoring literature which they wanted for prediction markets in the first place yeah so there is actually a direct connection between amms and and prediction records okay uh next question this might be interesting to some of you uh so how much is ethx worth ethx is again seven days should be worth less than eth that you have now can we even think about how to price it and so our observation was this actually looks a lot like a Futures Contract so we can look at how Futures contracts are uh our price and then we

can see if we can kind of use the same variables at least as them okay now there is one difference in a Futures Contract if I buy oil in five days or corn in five days and I will pay in five days okay so the contracts were zero today and then it either takes on value or loses value depending on how prices fluctuate in this case you're paying your 10 East today for each that you're going to receive in seven days so the the variables basically become negative instead of positive to account for that so if the equations look weird that's why but before we get to the equations just the intuition is obviously how much eth is worth is going to be a determinant and the idea is uh as you get as the window gets smaller

and smaller you get closer and closer to the seven days being over then you should have convergence uh between the price of epexx and eth L1 um you can look at the difference between storage costs so this is a big thing if you're storing corn you have to like account for how much does it cost to store corn as opposed to storing the money that I'm going to use to buy corn that's not a thing here that we can see they're both tokens so they should be the same price to whether you're storing each one or ethx you can look at what can I use the E4 can I earn something with it and so now there are D5 protocols they'll let you earn yield on it so we're going to assume that ethx because it's locked up you're not going to be able to earn anything with it but

ethal one you could so you have to forego what you could have earned by buying ethx okay so that's going to Discount uh the price of beef X um there's no real exchange rate because the token is the same but if we think about withdrawing a different kind of token and we do this deal today then the prices drift apart then exchange risks will come into it delivery cost is is something that exists big time in Futures like like what's the cost of like getting the corn who's paying it the buyer seller you know where are you putting in that type of thing it also is a big deal in uh ethereum because this is the gas costs so the gas costs are kind of equivalent so if I have this ethx I have to go back to the contract and I gotta submit it

and then get my eth out I'm gonna have to pay for that right so that's a gas cost and so we have to account for that I have to go ahead and buy insurance I have to go to the prediction Market I have to buy it I'm paying gas so we have to like consider all of these gas costs as well and then there's the settlement risk of like what if the worst happens in arbitrum you know fails and the R Block doesn't doesn't actually go through okay so you can kind of throw these in an equation and this is like super uh back of the envelope uh so literally on the back of an envelope but anyways the equation looks like this I won't walk through it but like these are just some sketchy ideas so let's say that we have six days left

an Arbok failing is one in a billion uh let's say there is a bad R Block but no one's paying attention we'll say that's one in a million uh let's say that your validation software is wrong so even though you are paying attention and you run the validation software it gives you the wrong result false positive or false negative uh we'll say that's one in a million um we'll say that uh the the gas costs converted to eth so normally we'd say it in way but uh or gig away but here I've convert it to eth so the gas costs of all the prediction markets off the insurance stuff uh the exit and all of that stuff we'll put at .008 and that's more or less like accurate uh then I just pulled off of compound or something like how much uh interest you could get

and so across a year you might get point two for ethe isn't very lucrative uh and ethx we're gonna assume you can't earn any money for it okay so just back at the envelope but just to give you an intuition this tells you that uh if I have 100 ethx so 100 ethics 100 each that will emerge in six days you should pay 99.665 for it okay so where did you get the API on YouTube it just seems like a very low interest like annual interest yeah so I tried to look on like something like compound and I picked something conservative as well uh so yeah but you're right like it maybe it's more like five percent or four percent or something like that right just to clarify

you're not actually nobody's executed trying to spec it's probably gonna be yeah yeah exactly exactly yeah and then okay so the earlier point was well this gas is going to be the same if I'm withdrawing uh a hundred each or I'm withdrawing one eighth or I'm withdrawing .001 if I'm still paying this amount of gas okay that's fixed the gas doesn't care how much money you're withdrawing and so that's an overhead fixed cost and so if I withdraw a lot less then this gas is going to account for more it's going to start dominating uh the equation and so if you see if I pull out a very small amount like half an eighth then I'm paying actually a very heavy I don't know like 20 30

percent like fee basically in order to pull it out okay so this kind of works it works mainly uh it works uh mainly for large amounts of eth it's not so economical for for smaller amounts uh the other unfortunate thing is we have to run all of this on L1 so you know even though we have our return at our disposable and it could run a prediction Market very very efficiently we because the R Block is on L1 we have to run the prediction Market where the R Block is and so that that's also an unfortunate thing so we're paying like ethereum uh gas costs now I haven't rerun this since like anyways in a while so I know gas prices have I think they've gone down recently so these numbers might be a

little stale but um okay uh okay so really quickly we did implement it uh so we changed the outbox the gas consequences basically not marginal um and then we change the bridge as well uh we expose the fact of whether an R Block is pending or confirmed uh in the upbox so that a prediction Market could walk up and get that information so it wasn't exposed before um we didn't implement the prediction Market itself we're looking into it we might try to use auger or nasus in order to do it and then there was a whole bunch of engineering details that that you can read about uh the code is all on uh the on the GitHub um so yeah and the student did that so

that's why I'm not talking so much to see transfers and exits in the units of way unexpected gas yeah sorry sorry say again I'm surprised that the units there are gray yeah yeah right right so I pulled this out of the paper so I guess we did a conversion in the paper itself so I don't remember no I absolutely don't off the top of my head yeah so you're right it should be it'd be better to it would be more less time sensitive to replace gas yeah yeah yeah yeah so apologies for that um also it costs a lot the first time because you have to set up these data structures so the first person gets hit with it and then the second and third person to to transfer their token they

don't they don't have that overhead cost so we could look at different ways of engineering that but that's the way that we implemented in the first time ever like someone uses a like juices flip from afxx to ethyl one and was it off a specific like bunch of our blocks so it's the first time somebody for an R Block will transfer their token to someone else so regardless of whether using a prediction Market or something like that if I can find someone that wants my ethx I transfer it to them then you have to set up a mapping to like take care of it and there's a bit of overhead costs yeah and it's per our block you wouldn't have to do it per hour block you could have a giant mapping for every swap ever uh the problem with it is that you can't

garbage collect you it's hard to do that anyways on it ethereum these are this is in the engineering details admitted but yeah okay so uh I'm exactly at time so in summary uh the basic idea is that uh you want 10 eth uh you're in this unfortunate position of having your eth locked up for seven days and so we're going to give you an exit uh that lets you get out early uh the basic idea would be that you would have 10 of these fail tokens in 10 of your your tradable exit now and you would give it to Bob for more or less 10 each maybe a little bit less so it's completely hedged for Bob the the important thing is also like why why do we care about Bob like he's

not a validator on arbitrum blah blah blah blah blah but the important point is that Bob can be a smart contract okay so a smart contract absolutely doesn't know what's happening on arbitrum okay so it can be a dumb contract it doesn't know what's going on arbitrim and you want to be able to give it ethx and it's not going to get screwed because the R Block doesn't uh that fails to finalize okay so that's that was the main motivation that maybe I should put at the very start of the talk um but but anyways so so you don't have to think of Bob as a person it could be a contract itself uh you can work use it for any token so it's not just for eth uh and then we showed that you could actually implement it for real okay so that's it

and I'll take any other questions that you have yep can I run the prediction of different Altru on a different how to uh you can run you mean like for this scheme itself uh so you okay so the prediction Market has to run on L1 because the outcome is dependent on something that's happening on R1 which is the the R Block the R Block is going to be finalized in the outbox contract which is on L1 so that's why you want the prediction Market you could use an oracle so if you had an oracle that would feed the R Block status from L1 to L2 then you could run it on any L2 that you wanted to at all but yeah we want to

sidestep the Oracle problem yeah if you are sort of an arbitrary validator that is publishing these uh our blocks to the contract yeah then can you like on purpose do a fake uh our blog that most like if people are not checking that they just believe it's true and then that kind of messes up this prediction Market because most of the people in the prediction Market will think that the eth will finalize but then you know better because you just constructed about okay so there's a deeper question under your question which is um is it kind of dangerous to set up a prediction Market that's betting on the outcome of these R blocks because now you can profit from having a bad R Block

right and so validators like a malicious validator could go buy a bunch of fail shares they're super cheap because everyone thinks it's going to succeed and then they could actually profit by pushing a bad R Block right and so our answer to that is that you can never deal with all the sort of external like incentives and things like that like any blockchain even off-chain like people might be like oh we don't like arbitrim the company we want them to fail and so we have this huge financial incentive to like get in our block to fail or something like that so there's there's no way to like make all of those incentives like kind of androgynous I guess is what people say economists say yeah yeah sorry

all right well thank you [Applause]