Why ZK is the Endgame? by Alex Gluchowski

Transcript

this one hello everyone thank you yes I'm coming from matter Labs which is a company behind uh the creators of the Z sync protocol obiously we're building things in ZK uh for a very long time we build the very first ZK rollup on ethereum and I want to give you an intuition why ZK is the end game like why why it's such a transformational technology uh and uh I'll start by saying say that uh just reminding you that ethereum is very um young age it's going to get 9 years old this year and ethereum is the um um representation of the web 3 this new generation of the internet and if you remember or maybe kind of like imagine

how the the the web one looked like when it was 9 years old uh it was quite unsafe it was very inconvenient and it was very slow and uh this Probably sounds familiar to how things are currently in our world in crypto and all of that gradually improved we got faster modems we got better browsers better JavaScript Frameworks people started building more usable applications but there was one thing that kind of enabled the internet as we know it today it was very important it was like a a small change a small like specific protocol that kind of like made a tectonic shift like a paradigm change

from from what was possible what was not possible in web and to explain it we have to remember that the internet cannot run on a single server it's a connection of many networks run by different parties you know you can be in Dubai connecting to the server in New York routed through Europe you don't know who operates all those servers right if you want to connect to your bank or to some medical database or or your work database with some sensitive data um you need the Integrity of communication you need to make sure that no one in between can mess with your connection read your data but more importantly write data on your behalf

and like transfer all of your money somewhere or like use your credit card which you're going to put on your web shop and to achieve that you needed a cryptographic protocol and it came with https it was not on day one the early web like in in early 2000s many websites were not https protected and it was dangerous for this reason right and uh https TLS SSL revolutionized the web and while the web 3 today is also quite unsafe inconvenient and slow and all of that is improving we need something similar because the the web cannot run on a single oh or like the just like the

internet cannot run on a single server the internet of value for fundamental reasons cannot run on a single monolithic blockchain I I I hope that we all agree on this like it's just technologically not feasible but also socially not feasible to have like one single all sides fits-all solution for all communities all businesses to just agree on okay we're going to be building on on this one single um single configuration uh blockchain so there must be multiple blockchains like a multi-chain world but it must be seamlessly connected just like the internet is connected without

having to worry without having any additional trust assumptions about all these people in between like this is not how the world of uh multichain works today if you want to connect from like ethereum to salana and send some messages or send some value you you rely on trusted Bridges also known as multi6 so you just rely on some people relaying the the trust for you and maybe you kind of like you take two blockchains and and you trust the people who run the bridge in between you cannot really extend this trust like to the next hop to the next hop like to to multiple like Bridges connected multiple chains and the future is where we have like hundreds or

thousands of permissionless chains that need to be operated all in parallel and and all be connected and so we need something uh that will enable this world where the users don't have to think about where they are don't have to think about bridging in the first place all they do is like they have their account with wallet on like they have some assets on chain a because you cannot you know you think think of chains As Cities you are you can only physically be present like at one point of a time in one city or your car can be in one city you can move it over Bridges roads to other places but like at any given point of time it's in one place same with value your value can be only on one chain right so once you have it like

let's say like on on like roll up a on ethereum all you what what you want to do is you want to interact with the dep on some other chain you should be able to do it in just one click right like confirm in your wallet and it goes transaction goes there does something automically and comes back with a result and to get that there we need trust free interop at arbitrary scale just like the internet you don't think like oh internet can only run 1 thousand servers no you can add more servers more data links you can expand it indefinitely without losing this seamless connectivity because https sols it for

you right like no matter how many hops or connections are like servers are between you always operate end to endend encrypted and end to end authenticated and we need the same thing here and the the native approaches as as I said like want just don't scale trust they can scale something but not really trust and we need a transformative invention and here these your knowledge proofs come to to to to the scene because Zer knowledge proofs how many of you are familiar with Zer knowledge proofs okay great so you probably know about the Privacy aspect of it and you know about the the 16 proofs of computational

Integrity uh computational Integrity is much more important property of of the proofs we basically compress computation we can perform very large array of operations produce a proof and then anyone can verify it in less than one second from a mobile phone and and this way you kind of you do very small computation but you verify a very large result and this enables like if if evm is HTTP of the blockchains then ZK is the https of the blockchains because you like in the world of blockchains you need to scale trust in computation like what blockchains do they those are like

decentralized databases decentralized authenticated databases that operate on on like a large State computationally and then anyone can verify them it's verifiable computation right so in the with ZK you extend this trust like indefinitely to as many chains as as as you need uh and if you want like I also want to give you an intuition how this works just like internally why why it's possible uh through recursion how many of you are familiar with recursion great so let's start with a simple transaction on on like on on a z rollup we can produce a proof like the

transaction can be large it can be doing some like complex things but then we can produce a short proof of verifying the operations all all of the logic of this transaction including signature like sender balance recipient balance correctly updated all the logic of smart contracts executed Etc we have this one single proof then we can take proofs of all of these transactions and generate a proof that verifies multiple proofs together which is quite a simple thing because verifying the proof is also computation then you can repeat this process then you can take the proofs of proofs and generate the proof of them and you can repeat it more until you get

the single proof of a block and then you can repeat it further until you you like for for multiple blocks until you combine it uh into a single suin proof that verifies all of the blocks of all the rollups that send settle on ethereum what you can do next is you can verify the ethere ethereum execution itself ethereum's block and you produce a single proof which you can verify from a mobile phone and voila we turn all of the Mobile smartphones in the world in ethereum full nodes like you have 1 billion not light clients actual full nodes that verify every single transaction on ethereum

from Genesis and on all of the rollups ZK rollups that settle on ethereum and they can all trust each other because they don't trust people they trust math and code yes if you have a like error in in the in a protocol or in the code of course it's going to be a problem so you want to go follow security practices but like as long as the code and and the protocol is safe it's like bulletproof it's just math it doesn't matter what incentives people have who is compromised who is not compromised how the keys are managed all of that does not matter you trust pure math which is very very powerful and this is what I call ZK Singularity a single ZK proof that verifies everything from your

phone in one second and this is happening this year and it's time to build an ZK thank [Applause] you do you have time for questions we have any any question do we have any questions uh if you can just raise your hand yeah uh thanks for presentation I'm just curious uh so I think one of the challenge that zops are facing today or you can tell me if it's challenge at all not is the gap between producing the roller block and actually producing a

proof which is why many of rollups they actually bundling many blocks into single proofs but from users perspective as your for example with mobile phone it actually might look like well first they send transaction but then they need to wait for some time between this um or when this transaction will actually be verified when there is a proof actually put on ethereum we also need to take into account that uh ethereum finality is slow um and also maybe to reduce this Gap we need to add more Hardware uh to compute this faster but then it actually gets very expensive uh to generate these proofs I don't know uh how ZK sync team is

solving these challenges basically reducing the Gap and reducing the cost of producing a proof yeah thank you those are great question so let's start with latency the latency is today um some minutes to generate the proof it's going down to seconds like we have the new generation of the protocols uh and better Hardware the the proofs like from the moment you submit your transaction to the moment you have a proof of some checkpoint of some block to this transaction the by the end of this year it's going to be like 15 seconds right so like that and and then from there there are teams working on Hardware acceleration like um what they call vpus verifiable processing units specifically for cryptography also like

general purpose like like gpus for graphic you have vpus for cryptography it will bring it down to like basically close like in it like let's say two years from now it's going to be real time ZK is going real time like synchronously with generating transactions you will be generating kind of like almost like with a lag of like one 2 seconds you will be generating proes now um but like even if you have to wait 1 minute this is nothing than uh comparing to optimistic Roll-Ups where you have to wait 7 days for objective verifiable finality on layer one so that's that's with regard to latency with regard to like you have to wait for ethereum finality um today the finality of ethereum blocks is roughly 10 minutes

this is going to change and we're getting to single slot finality so it's going to be like something like 12 seconds but like how is it different from any other transaction on ethereum you know if you send any transfer any like interaction with smart contract on ethereum you are subject to the same finality limitations so it's it's it has nothing to do with ZK like ZK does not kind of affect it in any way like optimistic ZK rollups all have the same problem because we all depend on ethereum so like with single slot finality with 12 seconds it's probably going to be sufficient because what what's going to happen is the l2s like ZK sync for example is working actively on decentralizing the sequencer we will have we already have a test net with a

with a decentralized sequencer running on hot uh hot staff consensus with less than 1 second blocks so from a user perspective when you submit a transaction you will get in like close to instant confirmation like in less than one second that transaction is going to be included in the next block and it's going to be signed by the majority of the stake or like the Quorum of the stake of this decentralized uh sequencer so they cannot really revert it without being slashed doesn't matter what happens on ethereum they already promised to you that it's going to be included so most likely if your transaction is like on a small scale like like some like up to a mill

dollar it's probably sufficient for you to know that the slashing is going to be much higher if they revert this and remember they can never do anything in valid they cannot mess with the state they can only like revert like reorg the blockchain right worst case is a reor just like on ethereum so your anterior guarantee is backed by the stake uh but if it's like really large if you want to send like $1 billion then you probably want to wait 12 seconds for for ethereum to confirm right so like it's it's your subjective uh uh decision on how long you want to wait for finality now coming to the hardware and the cost of Hardware it does not matter how much

Hardware you need to add because you only add Hardware you throw Hardware at the at the computation if there is something to compute so you only need a lot of like if you have like 100 or thousand times more transactions sure you need th thousand times more Hardware but that's that's logical just like if you scale any Cloud computation if you have like thousand times more users you need thousand times more processing power but those users will be paying for it for like all like all what matters is the cost per transaction not the total cost right like and the cost per transaction is small like look at L um

like um L2 fees as a bad that Source it's not very reliable but if you go to grow the P or to gas fees. they have a really nice visual comparison of the costs of rollups ZK sync is like one of the cheapest rollups like with with like slightly more expensive than arbitrum slightly less expensive than optimism and base with like one or two cents per transaction on average right and so this is already this is this this takes the onchain component into the account plus the computer computation you have to pay for computation there the computation is very cheap and it's getting like by the end of this year it's going going down 10x and with vpus it's going down another 10x and it's going to be I mean

it's never going to be negligible because your marginal cost is always important like go going from 0.1 to 001 to 00001 makes a huge difference for financial applications for D5 for high frequency trading because they can do like more trading and and like lower margins and you Bots can always exploit any additional reduction in the order of magnitude of the costs but it's going to be like negligible compared to the cost of data availability on rollups so like definitely better than optimistic rollups because we can do better compression ZK sync and ZK sync and Stark net are the only two rollups that do this we use the state Delta uh

approach to to to publishing the uh the state divs to basic we don't publish every single transaction on ethereum through ethereum data availability Network we publish the outputs of the transaction only like what changed after each block which which storage slots changed and so it enables us to make the uh the footprint like the the cost of data availability is like 50 time 50% cheaper than optimistic rollups and you could see it in the cost benchmarks uh before EAP 4844 like very visibly we were cheaper by 50% than any optimistic collup cheaper than arbitrum cheaper than optimism like all of them now with the AP for for four because of this like 1 cent like less than one cent

computation costs it's it's it's hard to see but it's in there and when the gas prices on ethereum will go up optimistic rollups will be more expensive again and this this is going to happen more questions anyone else yeah thank you for your talk uh uh so you sort of uh pull the analogy of uh ZK as an equivalent of https but uh https is like a bidirectional thing in which you know two uh entities would uh create a connection and uh from their perspective

what they're doing is sort of symmetric uh but for the Z Singularity thing that you later describe it's not symmetric as in there are uh there is asymmetric nature of data source or data availability so that the prover has all of the data and the verifier verifies the last step but the verifier may not be able to generate all the data and do all of the intermediate steps should they require it so my question is isn't there going to be uh multiple layers of Trust on data sources as well and what

is your comment on the B directionality uh Visa V uh your analogy to https this is a great question so we this is a rough analogy because obviously those are very different protocols they operate in a different way you could also argue that https can be asymmetric if I just browse a website on H with https I download the data from this website but I don't upload anything right and it can actually be like in the protocol itself like you start with asymmetric key where you like for oh here's a better analogy like um the the website has a certificate of

authenticity which I can verify through the root of of of the uh certificate chain but the user does not have and does not need one because the website does not need to authenic this user unless the user becomes a user like gets an account and so on right so also in HTTPS it can be asymmetric and the uh uh and it's a good thing you can communicate like let's say like you have two two different users or two different blockchains the message can be like one directional uni directional from one from chain a to chain B you can reciprocate a send them message from chain B to chain a but you should not need to know all of

the data of chain B if you operate the chain a and vice versa and and a good example of the use case where you actually want this asymmetry is um banking chains or Enterprise chains so we are in conversations with with a lot of financial institutions um Banks like trading companies like B big Financial providers what they want is they want interoperability but they don't want to disclose privacy of their own users so they actually want this property they want to be able to prove that something that affects you happened correctly but not disclose anything that happens to

the other people and honestly you also don't want to know not because like you know irrespective of privacy aspects you should not need to Main maintain the state of everyone else like imagine that that like the monolithic thesis is is right and like everything can be done on a single chain let's say I don't know like salana or or something like you know that means that you as a full node operator need to maintain the state of all the applications that run on this chain all of the games all of the meme coins all of the like uh you know whatever applications people are building there and the more people build build like we have 10 billion people in

the world we have millions of Institutions millions of developers building stuff all of a sudden you have to maintain all of that you have to verify all of that like P put throughput of of data for all of this transaction why do you care about them you should not you should only care like is my data correct like is my account like can I verify that whatever new next block was produced did not affect my account in any negative way right and that's what Zer knowledge proofs enabled like you only care about the state that you care about and ignore everything else and this is a beautiful thing I mean this is not like this is a this fundamental enabler of this internet of value

otherwise it's just invisible like everyone cannot verify everyone else's data and state and and computation Danel uh my question is uh so if the uh operator of the RO up becomes uncooperative then can the users themselves uh exit the roll up to uh layer one and if so what happens to Smart contracts that are on L2 it depends on whether the ZK chain is a rollup or a validum the difference is how you handle the state of this chain you in both cases you use your knowledge proofs to verify validity and and like block transition and guarantee that the

validity is basically secured by ethereum 100% like nothing can be wrong there right uh with in the case of a rollup the state is published to ethereum always so anyone any Observer from ethereum can can reconstruct the state you can run a very simple program which collects like picks the all the outputs and applies them together and then you get the new block the like the state after the new block which is a easy very lightweight operation unlike optimistic rollups it's like it's very easy to do so if the operator becomes uncooperative and in our case in in Z sync as when we have decentralized sequencer it means like let's say the majority of the stake is compromised

right and they just stop producing blocks fine then the rollup then the users can start putting their requests for transactions on what we call the priority Q so you can just like enforce your transaction from layer one and the oper s have the validators of this chain have to take the transactions from the priority queue and execute them and if they don't do this then the chain will enter an emergency mode where anyone can produce blocks on layer one and they again they have to take transactions from the priority que and execute them now and and it's always possible on a rollup you pay to ethereum the transactions are more expensive

every single transaction is more expensive but they give you this property it's basically the same security as ethereum itself no other protocol can fulfill this but ZK olops only ZK olops can like have mathematically guaranteed 100% the same security properties as ethereum optimistic rollups cannot do this because you uh you still depend on on on your ability to submit the fraud proof and it still can fail and you you know like whatever but zaps have the 100% disability now let's consider validium in a validium let's let's imagine you have a banking chain you have an account in a bank the bank operates the data they store it on their servers they don't publish it to ethereum they still

use ethereum to verify Zer knowledge proofs and they generate Zer knowledge proofs for each block so they cannot do anything invalid there but they can like just withhold data for for all of the users and like or for you personally right so what what you can do you can still use the priority que to submit your transaction and everyone else can and if the bank or like whoever the operator of this validium will not observe the priority CU will not push the transactions from there then the chain will Hal for everyone and that's your ultimate like failure mode you cannot recover from that but you can also guarantee that this censorship is not targeted you cannot Target one specific

individual user you can like either serve everyone or shut it down for everyone and in which case like all of the state all of the money in a validum will be frozen but so will be the stake of the operator so it's kind of like a self- hostage situation it's like you can blow up the car but you blow up with with the car right and rational actors won't do this because they will lose money irrational actors like motivated by some other external political motives could do this maybe they're forced by by some legislation so this is a risk factor if you want to operate on a validium you have to take into account that this can happen but this is much better than a side chain where the the The Operators

can just steal money so they have a lot more incentive they they like they don't have skin in the game here they have skin in the game but yes this is slightly less secure I or significantly less secure than a roll up and we hopefully we scale ethereum completely with ZK rollups not not like validium for some specific sometimes you have things that um uh don't require valuable State like maybe oracles you only want to push them and do computation so like for that valum works perfectly or Evolution I I think we have one one more question uh yeah we can take one more yeah thank you great speech uh let's imagine you know we have a future

as you mentioned that every bank has a separate Network let's imagine one B bank has an zop Network work and another optimistic growup and it's linked you know through ccip for example protocol so how uh and I would like to for example I'm tokenize my deposit I transfer it from One Bank Network to another Network so how do you foresee really you know how first of all ZK rollups can impact this future and how you foresee overall because that's more let's say futuristic view because you know if on one side will be the optimistic rollup on other side the ziky

syn or the it could be for example our fre recorder for One bank or Avalanche subnet for other net Bank networks so how it will work let's say together so and so what's what's is really the future in your view um very simple answer like a great question uh the I don't see the future where optimistic cups exist like in all honesty like everything is going to all of them will have to upgrade to ZK or become irrelevant because the the the way like imagine a uh like rollups as Islands you have like different activity there so to connect Z rollups you can build Bridges like actual highways you

know like think like the Palm in Dubai is connected with the bridge you just take a car and you drive there right now optimistic rollups can only only be con like connected with fairies and those will be steamer fairies like it's a it's an island where you can only reach like by seven seven days sailing to this island so like to connect it to like so sure you like you will have the zop ecosystem with like this highway bridges connected and you will see these far islands of optimistic craw ups with like daily sailing Steamers going there and back like in in seven days uh interval right will this coexist maybe I mean like we'll have like the buzzling

economy of the Z rollups and these like um far islands all right um if you'd like to contact Alex it's uh Gluk 64 on Twitter yes or ZK sync on Twitter or ZK sync uh yeah so let's uh give him a welcome again