Vitalik Buterin: DAO Lessons, Casper and Blockchain Interoperability (Episode 171)

Transcript

[Music] this episode of epicenter is brought to you by the Merkel week a blockchain conference training seminar and hackathon taking place in Paris from March 9th to 12th learn from leading experts and get certified on building blockchain applications designed to enhance organizational governance get your tickets at Merk week.com and use the promo code epicenter to get 30% off early bird tickets and by Jax Jax is a user-friendly wallet that works across all your devices and handles both Bitcoin and ether go to

jx. and embrace the future of cryptocurrency [Music] wallets hello and welcome to EP Center the show which talks about the Technologies projects and startups having decentralization and the global blockchain Revolution my name is Brian Fabian TR and I'm M Roy today we have we are glad to welcome vitalic butterin back to the show we'll talk about the do folk um Casper sharding interoperability ZK snarks and the application space of blockchain Technology with him generally we have our guests you know introduce themselves but I I think V alic doesn't need an introduction in our space so I'll probably just dispense with that

formality and uh perhaps we could just jump in and talk about uh the the do4 so um the do attack and the resulting folk of the ethereum system so from the outside like we have all seen what what happened and I thought it would be a good opportunity to know what was it like what were the what was that month like to be in your shoes vitalic so maybe if you could tell us your version of the story so um 2016 June 17th at 300 p.m. local time I was in Shanghai and it was just uh another normal day I was visiting China talking to a few of our local partners

and at one point I got a message on uh I believe Skype in one of our kind of semi-public skyp Skype getter channels that just said hey you know someone should check this out it looks like the the balance of the Dao is decreasing so uh someone should check this out and I immediately went and checked it out and you know the Ballance said it was a 9.5 million ether and I immediately got concerned I started looking and it definitely seemed like ether was getting drained fairly quickly so I uh sent off a message to some other people from our team and uh over the course of about 15 minutes like cou uh Christian Kristoff

and and a couple other people went in tried to see what was happening and it uh fairly quickly became clear that like yes this was very very bad and at that point the a fairly large number of people like in the ethereum foundation eore lock kind of came uh fairly rapidly started kind of talking to each other and trying to figure out kind of what was going on what was there any way to try to uh stop the situation like is there anything that could be done what was happening what would the consequences be you know like and just like get an idea of everything in general um so we had about

two or three hours worth of Fairly frantic uh calls and uh Skype discussions um at the end of that we uh that first blog post came out where we basically said what had happened we suggested the uh soft fork and hard Fork strategy um then after that um we uh the go developers uh started going on going off to actually implement the soft fork and I was kind of trying to be online and like trying to be as helpful as uh as much as I could but like even

still there was uh there were quite a lot of and there were limits to what I could do personally because I was uh first of all I'm not actually one of the gold developers and I don't have too much experience with either the language or the clients so that like I've made a a few online patches but I'm not the sort of person who' like actually be able be the right one to practically Implement like an actual softw workk patch so I know like Jeff and his team were working fairly hard on that for several days I mean I think like it was the basic kind of scaffolding was done in about one or two but you know as usual we spent quite a bit of extra time

test going over it and testing it and making sure everything works well and uh that was in parallel and we were trying to kind of get an idea of what the community thought that we should do and I remember there were at least initially some informal uh kind of polls that were happening on Reddit there was also poll that was happening in the Chinese community and you know being in China myself I quite a bit ended up kind of passing messages back and forth between like the various different like the channels on WeChat and Reddit and so forth um and like on both sides it seemed fairly

clear that there was uh at least initially something like 8 80 to 85% support for the soft fork and about 6 for the hard Fork so you know we basically took that as you know we have a mandate from the community to definitely try a kind of any non hard Fork routes to uh resolving the situation if if uh at all possible so we uh wrote up the code for the softw uh after about a week pushed it out and uh then at the same time there's a lot of other efforts that were happening with like developers that were trying to go

into like inspect the Dao code see if there's like some way of counterattacking try and like figure out all these other like strategies can you slow the attacker down can you kind of drain the the Chow Dao can the attacker drain the Chow Doo that you drained and so forth and the what we figured out basically is that you could potentially have this game but and if you had the soft Fork then you could prevent vent the attacker from retaliating until you could win but without the soft Fork like it was fairly un was like fairly kind of unclear especially initially and like it seemed like it might be possible to just keep the money frozen forever um or

it might be uh you know there's always the risk that like someone will discover even more bugs inside of it and you know me and G are basically uh started recommending against trying to kind of play those kinds of complex games and he started pushing for just you know doing a hard fork and getting getting it over with then the uh the post came out that basically said you know the soft Fork was uh kind of deemed to be unsafe and at that point the soft Fork effort was abandoned um it's uh in parallel I know the there was that one Chinese team that was working on building carbon vote and pushing it out and carbon vote I believe started

running at like roughly around the same time as the the soft Fork vote uh the or the soft Fork attempt failed and uh that was about two weeks in and after the softw failed there's still about three weeks left for us to do the hard fork and S of within that time people were scrambling to try to figure out the hard Fork specification plan the hard Fork fig like figure out what the consensus tests are figure out what else would need to be tested and uh do some extra Network tests because of you know just a because of the possibility that uh this this work would go less smoothly than

something like the transition from Frontier to Homestead if then you know the votes uh started coming in on carbon vote and uh I remember on Reddit it seemed kind of very chaotic um at least for myself personally um I mean I was surprised they actually didn't receive any like like serious death threats I mean I received a bnch a lot of messages from trolls and I still do but like nothing on the order of you know um like actually threatening to kill me which is uh I guess kind of a a nice Silver Lining um then you know eventually the carbon vot showed that result of about 8 5% in favor of the fork and like

that's a result that I kind of accepted because it also seems to roughly line up with like a a lot of the other polls that were happening at the time so like I saw mining pools were around like 75% in favor I saw support for the hard Fork increased after the softwork failed and uh so I like I I knew that the a strong a strong super majority of the of the community was definitely in faor in favor of it going ahead and we uh 3 days before the deadline so 3 days before the attacker would be able to make their next move to get uh kind of get the money out uh we uh released the code and

people uh installed the code and uh I remember when the hard Fork was just about to take place we were all in Cornell at a worksh workshop that we were organizing together with ic3 and a few zash people were present and at like 9:20 a.m. 40 minutes before the first day of the workshop that uh block 1.92 million hit and everything seems to kind of go through smoothly so that was the first part and then obviously 3 days later the whole like the uh whole kind of classic uh side of the situation started to kind of take hold and and it uh things kind of continued going from

there for a while so looking back on that the original promise one of the original thing was right you know this Unstoppable World computer you know no censorship no immutable you know there was some of the core uh Promises of of ethereum and and you know looking back on that today we have ethereum classic we have ethereum I have heard many people say this is you know irreparably damaged ethereums substantially damage ethereum I'm not sure if I agree with that personally but I'm curious what is your point of view do you feel like this is done lasting damage to etherum do you feel like it was mostly just a valuable

learning experience and ethereum is fine or how how do you look back on that event I me first of all I think a the m is definitely fine and I think like outside of a fairly kind of small uh you know group of people that are like really strongly into the sort of Purity morality of you know if it's stained once then it's gone forever I think like most people are even people who disagreed with the decision or many of them are kind of fine with it and I think like over time they're starting to see that you know the eum kind of a governance is stabilizing more and more and that the Project's continuing to move forward

but in terms of kind of less extreme consequ once as I think there's uh quite a bit of good and there's quite a bit of bad so I would say like on the good side I think the hack ended up doing wonders for the progress of a safe smart contract programming after that after that happened I uh noticed that you know within the next two months there were at least five teams that showed up that were all trying out various different approaches at improving smart contract programming safety whether it's better languages whether it's better development environments whether it's formal verification you know it's a it really was this kind of big huge sign to

the academic community that basically said look this problem is real and you know there's money at stake and this is a place where you can contribute you know with the knowledge that you've been figuring out over the last 30 years right here right now and I think that's something that's getting that's gotten quite a few people excited and on the negative side there was obviously a bunch of PR Fallout um I mean I think obviously on net negative but I think the great majority of the negativity is attributed to the hack itself and like and not necessarily any of the decisions that followed it so I was thinking at the time even when it was quite controversial you know was this a good thing was is a bad thing you

know some people were saying oh it sort of Damages this immutability idea and stuff but I I think if one took a step back and if if one isn't so deep in this whole crypto community and looks at this then it was very clear to me that the fork was the choice that would be looked at more positively than just letting the theft proceed right because otherwise it would have been a huge thing like another Mount gax 150 million stolen like this is much more like okay Community rallies together undo theft and that kind of sounds like a story right if he sort of from an outside I'm like okay maybe it's still not so secure but you know at least even in this

decentralized network they can come together and do something about something like that if you believe in like certain kinds of kind of Applied social Chaos Theory as you know at least some kind of modern sort of philosophers trying to explain things like the financial crisis do then you would say that you know a major crisis is in any ecosystem is inevitable and you know you also say say that you know the facts that our major crisis happened at a time when the community was well coordinated enough to basically like undo uh about like 85% of the theft is like actually a really lucky and amazing thing and you know realistically that's not an

opportunity that we're likely to have uh quite so easily in the future let's take a short break to talk about the Merkel week a blockchain training seminar conference and hacker on taking place here in Paris for March 9th to 12th the Merkel week is organized by Eureka certification and it's event that is designed to help entrepreneurs developers and decision makers gain practical experience using blockchain Technologies to build distributed governance in their organizations so it's a 4-day event and it's broken up into two parts first March 9th there's a full day training seminar featuring an impressive list of speakers including Gavin wood William mugar and Peter Todd

you can get the full list of speakers over at Merk week.com and as an attendee you'll get to participate in training courses and demonstrations for Bitcoin and ethereum and these are designed to help you build and test blockchain applications meant to enhance uh operational efficiency in your businesses and organizations then over the weekend from March 10th to 12th you can put all that knowledge to practical use by participating in the hackathon and here you're going to get to work with other developers designers and entrepreneurs and you're going to chem together and you're going to work on relive Bitcoin and ethereum applications under the close mentorship of those leading experts and by the way there's a

10,000 prize for the top three teams in the hackathon so come join us come spend the weekend here in Paris for the Merkel week from March 9th to 12th remember all you listeners in the UK that's only a two-hour trip on the Eurostar so don't miss out so get your tickets over at Merk week and be sure to use the promo code epicenter at the top of the checkout page uh for 30% off your early birth tickets and that offer is valid until March 3rd so we'd like to thank the Merkel week and Eureka certification for their support of enter we're going to park the topic of daos for the time being only to pick it up later towards the end of the show while the doo Fork was perhaps not

intended for the what you are intending for is a fork to move ethereum from proof of work today to proof of stake so let's let's kind of move into a discussion on why why that's the plan right so recently you published this article which which was called U which outlined your proof of stake design philosophy right and uh in in in that article you you laid out for basically the grounds for at least attempting the move to proof of Stak so can you explain why why you want to take such a transition in a network that is live and has over a billion dollars in

value sure so I would say proof of stake has a couple of major advantages so the one that people bring up a lot is uh that it really reduces uh one of the biggest weaknesses of proof of work which is the very large and kind of inefficient Hardware cost and electricity consumption so you know if you look at something like the Bitcoin Network like it burns hundreds of millions of dollars a year in capital depreciation costs electricity costs maintenance costs all um to maintain this network and the computations that these miners are doing like they're

basically just kind of pointless busy work right they're just problems that are created for the sake of being hard and you know like it's not really providing any kind any kind of extra value to society it's basically just doing this sort of busy work for the purpose of proving to the Bitcoin Network that the M the minor capable of doing the basic work exists and isn't like some kind some kind of civil attacker and uh I mean personally I've never really been comfortable with like that aspect of either ethereum or Bitcoin and I've been always kind of interested in seeing you know are there Solutions are there ways to kind of red efficient energy consumption and back in

2013 I was really interested in various things like proof of storage useful proof of work which is the idea of coming up with a proof of work algorithm that simultaneously does various forms of scientific computation like you could imagine a a proof of work that like simultaneously does some kind of machine learning or you know protein folding or whatever like there ideas their own like proof of Excellence which involves like coming up with uh proofs of uh like humans trying to solve like mathematical problems or like other things they're difficult for humans to solve and like there various other ideas and uh eventually I kind of came to realize that proof of stake is

just like the simplest and most feasible one so that's uh one argument and I mean it's also important to note that the the kind of arguments of avoiding waste actually has two sides to it right one of them is just the kind of social arguments that wasting electricity is bad wrecking the environment is bad and so forth and I mean on the environmental side I'd probably say that uh the external environmental costs of Hardware manufacturing are pro something that's underappreciated and maybe even worse than the external cost of the electricity consumption but the second side of the coin is that if you're not

expending as many resources on your consens algorithm then that means that the protocol does not have to issue as many coins and that means that the kind of cryptocurrency and a blockchain protocol can be more deflationary right and like in general people kind of like that yeah like there's a I mean there's definitely a trade-off because like you know if uh you don't have any block rewards at least in the context of proof of work then you don't have enough security to run the blockchain but at the same time like if you can come up with a way to have higher levels of security and not increase issu then

that's something that most people are willing to take so that's one side the other side which is also interesting is that my opinion is that proof of stake blockchains actually are more secure against kind of like very large and serious attackers and the argument that I raise here is that uh with proof of work like okay you know there is some cost to producing more asex than the rest of the network combined and um using those Asic to pull off a 51% attack right and that cost is like somewhere around $200 million now the problem is that uh there's if you can do that then for a

fairly small additional increment in cost you can do what I call a spawn camping attack which is basically an attack where you attack 51% attack the blockchain then as soon as it starts recovering you 51% attack it again and then you 51% attack it again and so forth and the end result is that you basically destroy all the trust in the system now generally when you bring this up to you know like Bitcoin cord developers they say oh well if that starts happening then you know we can just hard Fork to a new kind of proof of work and we can basically make all those as6 useless but the problem is then okay let's say I'm an attacker who has $250 million or whatever enough resources to

spawn Camp Bitcoin once well once you move away from as6 and then onto general purpose Hardware then I can probably spend another like h100 million like it's going to be less than 250 because like the hardware accumulation is going to start from scratch but let's see I'll probably be willing to spend another hundred million do to 51% set attack and spawn Camp Bitcoin again now the problem is though is that the second time around you you can't hard Fork to a different proof of work algorithm anymore because the second time around everyone is mining with general purpose hardware and so if you do another more hard Forks then like the spawn camping attack is going to be able to continue so the

conclusion of this basically is that realistically there actually is a finite cost that a well resourced attacker can pay to essentially kill off of proof of work BL for good right and in my opinion this is actually quite unsettling right and uh my opinion is that one of the really nice things about the kind of cypherpunk spirit in general is that it focuses on this idea of like attack defense a imagery and cryptography right so like if you look at kind of systems you know you know the world in general right now the cost of attack is generally much lower than the

cost of Defense right building a building costs $5 billion making an ID to blow it up might cost you know less than 50,000 and uh like most kind of adversarial environments in the world actually operate in this way but with a few exceptions and one of the major exceptions actually is cryptography you know like one of the really nice things about cryptography is that like I personally can sign messages with a public key and I can do this at a very low cost you know the signature costs like 0.1 cents worth of electricity to produce but uh the cost of actually cracking that signature is so large that

you know not even a major national government stands even a chance of doing it and like that's something that's like extremely powerful and uh but you know that kind of cyppher punk Spirit if you look at proof of work in sensus systems it doesn't carry over like at all right so the cost of attacking a proof of work blockchain is always necessarily going to be less than the cost of Defending it and like it can't be more and the reason basically is that you know if you want 51% attack on blockchain then that means you have to have spend more on Hardware plus electricity than everyone else combined but then you know oh wait that already means that if you can spend more

money attacking than the network is spent defending then you can win and realistically you can spend much less because like a large portion of those electricity costs have already been spent and you don't and you're never going to see them again so the nice thing about proof of stake is that I feel like it actually does come close to replicating this kind of Cypher Punk spirit because you instead of having this kind of Spawn camping vulnerability you know sure someone can 51% attack a pro steak blockchain okay fine now one of the Key properties that we're trying to design into Casper is this idea of what I call auditable bantine fault tolerance which actually does go a bit beyond bus default sols because

auditable absity default sols doesn't just say you know if the network broke that means that more than onethird of the notes are Byzantine it actually means if the network breaks then more than onethird of the noes are Byzantine and you know who to blame right so you have cryptographic proof that you can use in order to show that you know oh you know these no these validators are the ones that were responsible for the 51% attack and what you can do is you can just like coordinate a hard Fork on the community level and you can just like continue the chain and those validators can get their deposits destroyed and you and you just keep going from there right so the cost of the attacker would be something like you

know $100 million worth of ether of like all these deposits that got burned but the cost of the network would basically just be oh hey it's just an unexpected hard Fork like it it would maybe be two or three times as bad as what what would happen if uh or what happened back in November when uh we had that consensus failure between GE and parody but like it's not that much worse right like okay you know people would know what happened people know what to expect you know the blockchain would need to continue the these Val would get slashed and life goes on and sure the attacker can keep on attacking it again and again but but you know the attacker would have to buy another 10 million ether and keep on

doing this each and every time right so the equation is really tilted in favor of the defender here and like I would even say one of the other nice properties of this kind of approach is that because such a system would be able to just like honey badger recover from 51% attack so well I would argue that a 51% attack would actually increase the value of the underlying cryptocurrency because people would realize oh wait you know the the there's an attacker in this and suddenly a bunch of ether got burned and so the rest of it is going to be worth more right so because of that I think like the process of even trying to

buy up enough ether to pull the attack off would end up kind of ironically enough increasing the price so like kind of conjecture is that people would realize this and that basically no one would even try like doing at least that kind kind of attack Vector at all and people would focus their their energies on relatively cheaper attack vectors like I know Finding software bugs in operating systems that let them like hack into people's computers or you know whatever else people can do now so like that's the general thing that we're trying to go towards I me there's also obviously a lot of kind of specific things that we wanted to do so the one of the uh

things that we've been doing a lot in the last probably four months is we've been making a really serious effort at trying to uh understand kind of abstractly incentive compatibility in the context of cryptoeconomic protocols so just think in like a very abstract sense you know how given any protocol kind of how would you think about figuring out how to incentivize uh the participants and the thing that we realized is that me we came up with a method or like a combination of a couple of methodologies right where like one of them is this notion of auditable fault tolerance where you would try to create systems

where if the system breaks and you absolutely know who's at fault and you know that they unambiguously did something bad then you can just like destroy their entire deposit right because you know you can you know that they did something bad and you can penalize them if and if you're going to penalize them you might as well penalize them right all the way to to the max now that's one side of it right and designing it set as algorithms that have this auditable bft property is something that's fairly important now another um interesting um situation that we came up with is what if you have a situation where some validator or some participant in a consensus protocol caus the consensus protocol to either fail or

have reduced performance but you don't know exactly which one let's say that you can nail it down to one of two then the approach that we ended up uh converging on is in that case you penalize both right so if you can nail it down to one of n you penalize all n of them now the reason why this is nice is because like first of all it achieves this nice and S of compatibility property and um it also has the really good side benefit of being a very effective fix or or mitigation against things like selfish mining right because like basically you can show that if you follow this methodology then any um deviation from optimal protocol behavior

and by Optimal protocol Behavior like imagine like something like the Bitcoin or ethereum blockchain you know miners just always creating blocks one right on top of the previous right on top of the previous no stales no uncles just like a straight chain like you can show that if you follow this methodology when you design your incentives then any deviation from optimal Behavior will not be profitable to anyone like it will lead to anyone who might be at fault losing money right and so you know if you follow this approach then all these kind of large classes of attacks become something that you don't really have to worry about anymore and this is a methodology that you could apply to proof of work you could apply to proof of stake like you could apply in a lot

of contexts this is the methodology of incentive compatibility you're referring to well I mean incentive compatibility is like a generic game theoretic term that just basically means you know the mechanism encourages validators or what participants to act in ways that are that kind of promotes the goal that you that you wants to have but this is our methodology at trying to achieve its set of compatibility so this is obviously super exciting and I I very much agree that uh proof of work security model is kind of flawed and if you think in the the longer term it's really unclear how Bitcoin is going to be secure we did

yesterday or we recorded an episode with um about you know Bitcoin fee market and unlimited and how that's going to work but I think what's clear there right is that uh it's it's unclear how that's going to work um but what's the what's the timeline here when do we actually expect uh Casper to be implemented and what do you see as some of the risks again I guessing right now like uh like it's hard to tell but like start of next year seems like possible um like in general the kind of pipeline that we have to go through right is uh step one

finalize the algorithm step two make a test Network and simultaneously do a bunch of like academic uh verification and auditing of the algorithm step three once we're happy with it implemented across all seven of the the clients then probably brought another test De for with it for like 3 or four months and then finally release right so like each of those uh stages is something that takes time could potentially have delays has its own issues just as you know we went went through when we were launching Frontier back in 2015 and uh know each one of those stages has like some risks to it um I feel like right now we're getting close to the point where the research and like Al specification stage is kind of coming

close to resolution now I mean I know you had Rick on your show and like you know that was definitely a great episode and he talked a lot about some other fancy Casper features like uh like subjective consensus and uh like various other things that he and VOD were thinking about so one of the challenges is going to be is that we're going to have to come up with a red line where basically say this is a subset of features that we're happy with for now and you know some of us are going to focus on getting this into ethereum and like making sure that the real like live Network can benefit from it as soon as possible you know obviously subject to like safety constraints and so forth and

at the same time continue research on that if can we improve Casper and make it have more and more of these nice properties over time and like those are two tracks that have been kind of starting to happen in parallel already but and you know I expect defin probably going to continue happening so like in general I think our research especially in the longer term is fairly kind of multi-threaded where you know you have like some myself researching some aspects of Casper on one side V researching some aspects of Casper on his side then some research on charting happening then some research on protocol economics then some like you know things

like making correct incentives for managing contract storage size and general kind of state size account creation account deletion um privacy you know zero knowledge proofs and like all those other issues so like all of those are things that we're kind of thinking about at the same time I mean any of them I think have the risk that it ends up being a much harder problem than we thought um on the once we get to testing I me I think it's definitely going to be a challenge to um actually uh develop the test Network like uh run it make sure that it does

everything to our satisfaction like that's all of General more of a kind of software development and engineering challenge and then implementing it across all seven clients like running the test and so forth that's another set of challenges like once the we're confident buil the algorithm itself none of the rest is like has that much fundamental uncertainty in it it's basically just this kind of Fairly long and kind and kind of incremental slog that might take less time and might take more time today's magic Ro is stake that's St a k head over to letstalk bitcoin.com to sign in enter the magic word and claim your part of the listener reward one of the terms that one hears

uh related to Casper is this idea of consensus by BET right uh so so so generally like the way I tend to think is once you have a system where you can define a set of public Keys as validators of some some form a lot of systems end up taking the approach that they go to traditional Byzantine fall tolerance literature right uh like you have consensus algorithms like practical Byzantine fall tolerance and the families that are derived from there and so once you have validators defined you can use all of these traditional algorithms to implement consensus but with Casper one hears of this new idea which is called which is consensus by

bet and what we'd like to know is what is consensus by bet and is this a point of focus for you right now so the general idea behind consensus by bet is basically that you can think of validator signatures as being commitments that say I am willing to get some reward in in a history that has property X where property X might say you know it contains some particular block or contains some particular State Route in exchange for undergoing some penalty in all chains that do not contain X and the theory basically is that you can kind of both mimic proof of

work and including resolving proof of Works nothing at stake issues and potentially go even further by basically having a consensus algorithm that consists of validators having the opportunity to make these kinds of bets right and like in the original formulation you can think of a bet as basically saying plus X in Chains where that contain let's say some State root S and minus y in chains that do not contain that state and you can think of uh validators as having the ability to make these bets at different odds where you can think of the odds as being like the ratio between the X to the Y so for example if x is one and Y is a penalty of or minus one

then it would make sense to make that bet if you think that s has at least a 50% chance of being in the history that ends up winning but if you get a bet that's that's has you know X being plus4 and S being minus 16 then that would only make sense when you think there's an 80% chance and so the idea is that you give the validators the opportunity to make these bets and uh they would uh start making those bets now initially you know there might be a fork there might be or there might be like a choice you know do you choose State Route s or do you choose State Route T initially validators would be fairly confusing might only make 50/50 bets in One Direction or the other but eventually once it becomes clear which

one's winning validators will be able to make Bets with like progressively higher and higher odds on one of them and eventually they'd be willing to make bets at maximum odds that basically say in exchange for a medium reward in history containing S I am willing to lose all my money in all histories that do not contain s so they just like fully commit their money to this particular chain and that's when you know that that particular uh uh chain or like up to that particular checkpoint is kind of quote finalized so that was the original idea now we have been recently deemphasizing that and for a couple of reasons I mean one of them is that people in general are not comfortable

with or at least not fully comfortable with taking on this kind of risk that oh you know what if something really really unexpected happens and what if I made some bets that were 99.9% confidence but it turns out I was wrong and now I suddenly lose a bunch of money so you know it does imp pose extra risks on validators and in validators would have to be compensated for those risks so that was one concern the other concern is that one of the properties that we're trying to keep in our algorithms is this notion of bouncing the griefing Factor so what I mean by that is that like the the way the griefing factor is basically like a coefficient that says you know how easy is it to maliciously attack other validators in the system so if the

griefing factor is five then what that means is that there exist ways for malicious actors to spend $1 in order to make some some Target lose $5 if the griefing factor is let's say one half then that means that the malicious actors would have to spend $2 to make the honest actors lose $1 and what I realized is that if you assume an attacker that controls the majority of the stake then the griefing Factor on this kind of system could in some models potentially end up being very high basically because uh like the uh validators would start kind of expanding pushing out to infinity or or pushing

out their bets to toward kind of infinite infinite odds on one side and then you would suddenly come kind of with overwhelming odds and kind of flip the bet the the winning uh kind of uh State over to some other answer and then all of a sudden it it looks like there's consensus happening around the other answer but then there's people that may all their bets in the original Direction and they all end up losing a bunch of money so like for several reasons we ended up deemphasizing that approach and the approach that we're thinking of right now actually is uh one that is much closer to traditional butine fa Get Set this algorithms except that with a few different kind of changes to the

algorithms and a few changes to the security model right so one of the changes to the security model for example is that we don't just care about fult tolerance we care about auditable fault tolerance I mean there's also like a slightly different definition of liveness there's also a few other small changes but like that's roughly the approach that we're looking at so that's very interesting that you you're looking now more towards U traditional Byzantine fall tolerance literature um in order to finalize a consensus algorithm I thought one other difference that that struck me as as unique in in cast ER is that in in in much of the traditional Byzantine fall tolerance literature uh

pbft those systems prioritize consistency over availability so what that means is in in case the in case there's a network partition for example let's say the communication with China is broken off China and the West is broken off then if it's Bitcoin blocks will keep on producing on the western side and the Chinese side so that is a system that prioritizes availability over consistency system is still available but you have two different blockchains now and then traditional Byzantine fall many consensus algorithms are they prioritize consistency over availability which means no new blocks will be produced so the system grinds to a halt but the blockchain doesn't Fork

now now now with Casper what I keep uh hearing uh is that you want to prioritize availability over consistency can you like walk us through why you are making that choice and what part of traditional literature fits that kind of description sure so and the main reason I'd say why we care about availability is because me first of all in a public blockchain context like onethird of validators just dropping offline at the same time is a very real possibility like partitions Could Happen noes could just get lazy like lots of things could happen and saying that if that happens the network just like halts is

unacceptable so people we just really wants to have this property that of like maintaining what proof of work has where you know as long as there are at least some nodes that that wants to keep the chain going the chain keeps going now then of course there's a question of like how does that end kind of mesh together with uh traditional bft algorithms which r see consistency favoring and uh there's kind of two general approaches that kind of combining the two so in general I would describe Casper as being an availability favoring algorithm that also tells you how much consistency you have right so the kind

of nice thing of uh about that definition is that you know in some sense you do have kind of as much of both as you can get um you or as much of both as you know the AL things like the C theorem allow you to have but and uh the uh way that this ends up working is that well so once again one of two approaches where one of them is that you have some base algorithm that is availability favoring so for example if you look at like a lot of the older proof of stake algorithms that like rely on this notion of like proof of work style validators making blocks on top of each other that like that is availability f in right like that keeps

going even if there's only 1% of the nodes that are offline but it doesn't have any notion of finality and then basically you would take this availability favoring backbone and you would kind of layer a consistency favoring finality layer on top of it and the idea would be that if you have more than two-thirds of nodes that are online then both things would work and you know you would have your availability you would have your consistency now if more than a third of nodes drop off line then the consistency favor ing a finality layer would just stop finalizing you know it repeatedly try and try and try again and it would fail every time but the availability favoring chain would keep on going and what this means is

that the chain keeps going but clients on the that like users that use the chain and even applications like even smart contracts that are sitting on the Chain would all be aware of the fact that they were sitting on a chain which suddenly has lower guarantees of security at least past some particular point and they would be able to like make CH make their own judgments about how they interpret that so basically like individual applications would almost be able to choose what their own trade-offs between consistency and availability are now the second approach it has similar properties but instead of having two separate mechanisms it has one mechanism and in that one mechanism you would have what's called a subjective finality threshold so

subjective finality threshold basically means that instead of having a fixed like hard u in protocol threshold of like for example you need to have two-thirds of like of all noes sign a prepare in order for anyone to start signing a commit you would try to like make all of those things endogenous or or you would make all those things just like be choices that get made by validators or get made by users and so individual users would pick like how many prepares they're Satisfied by how many commits they're Satisfied by and and the idea here would be that if let's say all of a sudden 40% of notes drop offline and if there's

common knowledge of this or if there's approximate common knowledge of this then the chain can actually keep finalizing things in the sense that you have this guarantee that says that as long as the 40% that are offline actually are offline then you know people can lower their finality thresholds and within that context you can finalize things so we have a guarantee that says you know either things uh like the chain keeps on going consistently as before that sounds uh really uh really cool know that you have kind of both of those advantages right that on the one hand applications know what's going on and there can be risk assessments made and you know exchanges know okay we have to be

careful we have to wait we have to wait for extra confirmation etc etc but the same time uh the chain keeps going even when there's petitions even even when there's all kinds of issues I think that really kind of combines The Best of Both Worlds I'm really excited to hear that that's possible and that's the direction that um you guys are taking here let's take a short break to talk about Jax Jax is a multi-coin wallet created by the people at the central now in the past if he had a whole bunch of cryptocurrencies it was a pain to handle them you either had to leave them on an exchange which was insecure or you had to have all these different wallets which was a hassle fortunately now with

Jacks those medieval days of darkness misery and suffering are over Jack supports multiple cryptocurrencies and new ones are being added but it's not just storing cryptocurrencies you can do with Jacks but you can also exchange them directly from with inside the wallet thanks to their shape shift integration and since there's only one seat Jax makes it super easy to back up and sync to the other devices Jax works with Windows Mac OS Linux Android iOS and has browser extensions for Firefox and chrome so go to ja.io that's jx. to download the wallet and get started today we'd like to thank Jax for their support of

epicenter let's move on to to another topic that we wanted to cover so you wrote a really nice um short paper 30 page paper or something for R3 about chain interoperability and now chain interoperability I think is a topic that's become uh much more uh present much more uh much more attention on that we have a whole bunch of projects in this space I mean there's of course uh Ripple with interledger that has been uh working on this area for a long time there's also some more novel uh proposals like uh the Paul proposal by uh the eore uh team and and then also the one I I am partially involved in

which is is the cosmos uh Cosmos proposal so there's a whole bunch of different ones so would you mind us running us through just what what are the the main challenges and approaches to making blockchains really interoperable so that one can you know move value seemlessly around build applications that maybe involve components that live on different blockchains sure um so in general there as I described in the paper there's uh several kind of major ways that you can achieve interoperability and there's several major categories of things that you can use interoperability for and like you can think of those there's also

different ways of making the categorization so there's the kind of more computer science theoretic characterization which is about what kinds of relationships between events on chain a and events on chain BS he wants to create and then there's the more kind of application layer one of you know what exactly you're even using this for so then there's the kind of various different Technologies right so first they talk about notary schemes which are basically a kind of multi- federations and that's a trust model that's fairly simple to understand you know if you trust the majority of the people in the Federation then you can kind of trust that Federation to say what happened here what happened here if something happens here do something there if something happens there or do something here then

the second model I describe is this called concept of hash walking which is a generalization of the tier Nolan protocol from you know the Bitcoin kind of forums back in 2012 and 2013 and uh the uh idea behind hashw walking is basically you use this kind of scheme where you make an event a or you make an event on chain a and an event on chain B both be dependent on someone revealing a secret number that has some particular hash and the idea is that if the number gets revealed then you know either party would be able to paste the number in and make things happen on both chains and if that number doesn't get revealed then you know

neither of those things can happen and if you try to make the event happen on one side of the chain then the process of doing that reveals a secret number and so the other party can take the secret number and kind of transplant it into a transaction on the other chain so it's just fairly kind of simple technique um and it can do quite a lot so it can do cross chain exchanges for example but it does have one major limitation and the way that I describe the limitation is that it can't do like it can do what I call cross dependency but it can't do what I call causation right so a cross dependency basically says you make an event on chain a and an event on chain B both be dependent on some other event C and in this case C is

like revealing the revealing some secret number but what they can't do is make an event on chain a generally cause an event on chain B right so for example in particular if there's an event on chain a that's not caused by an individual it's caused by smart contract then you know smart contracts can't keep secrets and so this protocol can't really even work at all right so in those cases you have to move Beyond hashw walking into other constructions and like the third M major category of technology that I talk about is relays and you know we've already have BTC relay for about a year which is basically a Bitcoin light client that lives inside of the ethereum blockchain so ethereum contracts can

verify Bitcoin transactions and they can do things conditional on bitcoin transactions taking place and this allows for this other kind of kind of causal interoperability between the Bitcoin blockchain and ethereum blockchain where events on the Bitcoin blockchain can directly trigger events on the ethereum blockchain so I talk about all three of those Technologies in depth I talk about like what you can do with cality and what you can do with cross dependency so for example with cross dependency you can do cross chain exchange but you can't move assets across chains so like you can't do the equivalent of a side chain but with causality you can basically do everything um and you know I talk about side chains I

I talk about kind of fedcoin like in private chain contexts I talk about uh making a contracts or smart contracts in one chain that are connected to Assets in another chain and various other use cases one of one of the things you were writing about in there an observation you made in your paper that I thought was very interesting was your point that you know as soon as you start moving assets between chains there's always a little bit of a you know a little bit of a risk there right so uh there might be some attack vectors or something can be suppressed or one chain dsed or or you know maybe just one chain gets 51 1% attack so there's all kinds of things

and so in a way that the the security of those assets can get uh you know a little bit weakened and maybe it's not as strong on on the Chain where they're moved to as opposed to on chain where they originated on so what I'm curious about is what what kind of if you look really far in the future and if you think of thousands and thousands of assets issued on blockchains and there be kind of simless exchange between all kinds of assets do you see uh do you think those will be issued in lots of different chains that tend to be controlled by maybe the parties responsible for the asset or do you think that this this issue of moving uh assets and around chains is is big

enough that there will be a strong incentive to you know issue maybe many of them on on on some chains and Central chains that um maybe have a lot of security and and then moving others on maybe onto those chains or onto third chains but that there's a sort of an effect that we have assets and asset issuance in management concentrate on a few chains do you think we we will see that I think I first of all you have to distinguish between different types of assets so for example you have issuer backed assets and then you have kind of pure cryptographic assets like Bitcoin and ether and one of the things with issuer back assets is that there is an issuer and if there's an incentive do it

then the issuer can just issue the like many different versions of the asset on just about every chain that they care to support right like you can issue you know the gold backed tokens on ethereum on counterparty on Ripple on NXT on bitar and like on any system that supports like people being able to issue tokens at the same time and realistically you might as well do that for any system where you know the potential revenues for the issuer are greater than the costs of like basically doing the integration and teaching their customer support staff how to handle that particular chain so that's uh something that I think

issuers definitely are going to do now in the case of cryptographic assets obviously you can't do that and I think there are going to be some situations where like you don't want every cryptographic asset issuer to actually be in the business of of you know keeping track of and supporting all of these chains necessarily and I think especially for smaller chains the approach of like using side chain like techniques where you actually do have like portable assets and you can kind of move them from chain a to chain B and then back to chain a I I mean I expect that to be a paradigm that does end up having to as some Merit although in general I think there are going to be a

like large categories of assets that just have one home chain get used on that one home chain and no one really tries transplanting them anywhere okay and so we we just did an episode about Cosmos as well and you know the architecture of Cosmos is that there's kind of this Hub which is connected through essentially side chains to all kinds of other chains so do you think that's a uh model that will see traction that makes sense or do you think it will be more about having maybe bilateral connections between all kinds of different chains and not having this you know almost um Central Hub or sort of a decentral hub I guess in the middle so I think one very specific area where a kind of decentralized cross chain

solution is really needed and and is really going to have a lot of value is specifically exchange between kashan assets right so I don't even I don't mean Pro portability I specifically mean like trading a b like or ether for Dogecoin or whatever the reason basically is that you know right now we have centralized exchanges for that centralized exchanges get hacked easily they have fee fairly High fees they have all all sorts of annoyances to them and it would be really nice if we could just like have a decentralized solution right so I think that's something that's could be potentially very promising if done well and I mean I don't expect there to be one solution there to rule them all there I expect people to try coming up

with various different solutions and like some of them taking off in some contexts uh I mean to some extent there are network effects here because you know if you have one system then it's much easier to connect new more blockchains to that one system than it is to make an entire one use as from scratch but at the same time you know you have things like BTC realway that can just focus on one link and do it well so and I think we'll see some of both cool um so I I yeah the internet of blockchains is going to be like I think one of the one of the big themes in the future and remains to be seen how exactly it it plays out whether it's a hin Spoke model or chains interacting directly with BTC BTC relay moving on

from that topic I'd like to jump to the theme of applications now I think I think a few months back you wrote a Blog article in which uh you laid out your view on what applications are going to what things blockchain technology is going to be good for right and you had this idea of uh that blockchain technology would be won't have very large killer apps but will enable a long tail of small applications so I would like to uh revisit that idea and perhaps have it have you explained that idea in your own words first I'll just quickly answer

so first it's important to note that the reason why ethereum exists in the first place and why started working on it is because I realized that there is such a large number of different blockchain applications that you you can't just create a blockchain protocol just for every single one of them and like you can't try and like explicitly Target applications one by one and try and like Target a feature for each one the only way that you could really Target the generality is by taking the ethereum approach and just creating a programming language right so I would say the idea for ethereum even by itself start Ed with this kind of vision of a very diverse array of blockchain applications that are all

kind of Fairly individually uh or individually per not significant enough to be worth their own blockchain but collectively very important so I uh started realizing that you know there's uh all these different kinds of applications and uh ethereum of the project kind of became public and as people started discovering more and more things that you could do with it that opinion that I had just kind of kept on growing and at some point I realized that you know people ask me what is the killer app of ethereum I just realized there aren't really any good candidates and then you know if I started asking the question of

wait but if there aren't any killer apps then you know doesn't mean that a the I'm is worthless and that and then I realized that you know oh wait you know it's uh like the uh ideas that ethereum brings in or and the implementation of those ideas is valuable but the value doesn't come from any one single application the value comes from all the applications put together and the interactions between them and so you know it's about the facts that you can have digital assets on the blockchain and you can have your company shares be on the blockchain and once you have a digital asset on the blockchain and you have company shares on the the blockchain then all of a sudden it becomes trivial to do let's say an

equity crowdfunding by just like doing a smart contract that automatically issues shares and exchange for digital like let's say like dig gold or like some US blockchain based US dollars or whatever and you know if you look at identity management on the blockchain if you look at like certificate revocation on the Block on on ethereum and like all these different use cases you start realizing that like all of them really do seriously complement each other and like the killer app in some sense is this kind of combined vision of like all these things working together that like some of us call Web 3.0 yeah I would agree with that maybe with the one edition that money and and

the sort of digital gold and and electronic cash may be kind of a killer app on its own even without those other things although of course those other things also enhanced the the utility and power of of that would you see that the same way I'd agree I mean I think the the addition of uh the economic layer to the kind of the the set of things that you could can do in a decentralized way is is a very important and fundamental well vitalic we we are kind of at the at the time limit and we had a lot of other stuff we wanted to talk

about actually we want to talk about sharding and we want to talk about CK snarks and how those are coming to ethereum uh so we won have the time this time but hopefully we can we can have you on again soon uh to do that I also hope that uh the recording worked out well cuz there was a little bit of connectivity issues but hopefully with the local recording it should be uh fine so uh thanks so much balic for coming on and thanks so much for listeners for for tuning in once again so EP is part of let Bitcoin Network you find this show and other shows on let bitcoin.com and if you want to support the show you can do that by leaving us iTunes review that helps new people find the show and it's very much appreciated so thanks so much

and we look forward to being back next [Music] [Music] week