ZK HACk istanbul: Exploring o1js: Build Web-Native zk Applications with Ease

Transcript

[Music] yeah hello everyone Welcome to our o of one Labs 01 JS um Workshop it will be more of a I guess quick talk giving you quick introduction um there won't be anything to to follow along with like code or anything so you don't need to like um type in your computer just listen and be able do questions at the end awesome and yeah there's a cat over there if you are a fan of cats I like cats a lot that's why I used it so yeah um what do we actually do um just giving a bit of background of on laps is a blockchain company that's why we are here I guess um we have originally

incubated Mina protocol and we are still actively contributing to it um over our overall mission is we are dedicated to catalyzing a new generation of applications powered by Z knowledge cryptography so um we do a couple things we have a couple products um besides Mina number one being OJs which is our typescript SDK for writing Co knowledge proofs and CK apps on Mina and we also do other work so for example we are building a ckvm for the optimism CK stack proving the fault program so if you're interested check that out um in order to give a bit I guess like background like what Mina is and like bu

01 GS is a thing let's just briefly talk about Mina so Mina is a very light blockchain it uses Z knowledge proofs to sort of like prove the state of the blockchain rather than requiring all the transaction all the block data and just like rerunning it um that makes the entire thing like very scalable and very trustless because of again like rerunning the entire chain you can simply prove a z knowledge proof which is like very quickly um in addition to that we do have something called ccaps which is our sort of like quote unquote offchain execution layer for like smart contracts which enable you to do privacy preserving applications on top of mina um just briefly comparing the execution models of like other chains

and Mina if you look at ethereum you know that there's like code on chain and a user sends a transaction describing their execution of a smart contract to the chain and every node of the ethereum network will then have to run that computation more or less so that is a I guess what we call onchain execution model um looking at Mina it's the exact opposite what we do is we compute offchain the user computes a proof offchain in their browser maybe no JS and simply sends a small proof with a list of State updates to the Mina blockchain and the Mina blockchain only verifies the proof so that gives us a couple of very cool benefits the

blockchain stays scalable through succinctness um we achieve user privacy for Z knowledge and we have unlimited ex execution and like offchain computation that we can simply tap in on demand um you may Wonder but when this thing is like happening I guess so currently there's like test World Mission 2.0 ongoing it launched a couple weeks ago there's like regular calls to like hard for on Discord so we are currently um in like test net stages of this entire thing and if you're interested check out the protocol Twitter and the Discord server join the call so if you are interested in the protocol itself so the actual topic of the presentation is OJs

which is our typescript SDK and it's a Zer knowledge framework and it is typescript we also like to call it general purpose embedded SDK um the reason for embedded SDK is because it's literally typescript not a typescript is type of thing that you have to compile it is a circuit based approach so it's not a ckvm but it's a circuit approach which mean you simply write your applications circuit in typescript um you can do sort of like two things with it thing number one being writing Mina smart contracts C CS but you can also write offchain peer-to-peer zero knowledge applications using recursion and when I say it's typescript I mean it's literally

typescript so um it inherentes a lot of ecosystem from the typescript and JavaScript Community there's a lot of developer tools that you can tap into it is easily accessible to like web 2 developers because it's only typescript um there like easy integration into like existing web 2 Frameworks and like stacks and stuff like that just beginning plainly with like um typescript IDE vs code but also runtime environments like node you can use it on the front end with view which is my favorite and also tap into like mpm um which gives you like access to a lot of packages a pre-built ecosystem and stuff like that so like easy onboarding easy integration so off 1js the core technology behind it actually has been

around for a while so it's already like battle tested nothing that be sort of like cooked up on like a beak and heaphone I guess um which doesn't mean it's a bad thing but yeah so it kimchi is our core proof system it's a blish proof system that also Powers our ckvm for optimism um it supports a rich set of like custom Gates but example like posidon range checks X or rotation forign field and more on that later there's support for lookups um no trusted setup of course there's like all sorts of stuff in development and last but not least our infinite recursion protocol that actually Powers Mina is called pickles and it has been in sort of like production main net since the

launch of mina which was like two years ago so like I mentioned ESS is a very rich standard Library you have access to custom gadgets bitwise operations comparisons integer types there's like posidon and Native signatures for like more cryptography use cases um there will soon be ecdsa sh 3 lookups and more um there's also all sorts of protocol features that I will talk about in a second um and there's another thing that I will talk about in in a second it's the CK program which is a very interesting abstraction for infinite recursive circuits so yeah and that allows you to build like peer-to-peer applications which are

executed in the browser proven in the browser and just sent to your friends all to the blockchain so yeah if you want to get started with OJs if you're looking at it if you're interested in it you can simply install the CK app CLI it it's a tool that we built to like let you bootstrap your application you can choose a list of pdy and UI Frameworks that you want to work with and it's a simple comment so it has like also sorts of things you can do with it also deploy to the network lets you create examples gives you some debugging information so that's definitely the go-to thing that I would recommend if you're interested in working with 0js so yeah um let's look at the actual smart contract API that we have if you

go through the entire CK app CLI I guess like bootstrapping phase this is an example contract that the cki app CI will give you it's a simple addition contract right so you can see I I showed this earlier it is simply typescript you simply extend the smart contract API which is given by OMS and that enables you to like Define your own business logic um there's a couple fields on this basic um example um a State field so on Mina blockchain we can have some State onchain at is public St State and we can have up to eight field elements um there's also other things that you can use utilize to get access to more state

for example Merkle trees that can reference offchain State then there's the inet method with which lets you initialize your contract with default state if needed and then there's the the actual important part of the application which is the the which are methods so methods are like any other smart contract methods um they give you they let you execute some code update the chain State and in addition to traditional um smart contracts they also generate a proof so the method keyword decorator is used to declare functions on a smart contract as provable methods um here's important to mention that all the inputs into the method here for

example the x of type field they are all private so these are data types and inputs they stay private on the users machine in the browser they do not become publicly visible when the transaction and the proof leaves your PC um you have access to onchain State you can query the onchain state you can get it you can make assertions with it you can then add to the onchain state and finally set the onchain state using the dot set um method on the object so yeah that's pretty much a very basic smart contract that you will have access to as soon as you spin up the calap I go through the the tutorials and there so but there's more actually um there's something we call CK program

which is a sort of like light bait and Powerful API sibling of smart contract um it allows you to write circuits directly without any I guess like protocol features any auxiliary data types that you need or like any access to like the Mina protocol itself um it also allows you to verify proofs recursively so you can either build recursive chains like Mina where you prove each block individually and then merge them or you can build sort of like reducers like map reduce or like binary rores and always verify two proofs at bonds so that enables you to do all sorts of like peer-to-peer applications and these proofs that you generate using theck program can also become private

input to Smart contracts which is very powerful and yeah I mentioned it earlier this is like a very powerful tool if you want to build peer-to-peer applications in your browser or also in combination with smart contracts so to give a better understanding of how this thing works recursion let's just simply look at Fibonacci sequences I think everyone should know what it is but just briefly going through the I guess idea of Fibonacci sequences that was too quick um so it's essentially a secret a sequence that follows a certain I guess like function definition it's FN equals FN minus one plus FN minus 2 so what that means is we start with two numbers at the very

beginning F0 and F1 both equaling one there's also definitions where F0 is zero and F1 is one but we just go with these St values um for n greater than one and we simply apply the formula at the very top and this allows us to like generate a sequence so looking at the table below it's just a a quick um quick example going from F0 to F5 we simply take the always the previous two values and add them together to get the next one then we go one step ahead take the previous two again and add them together and we just keep doing that so how can we actually fit that into like recursion relatively simple we actually have two

cases number one being the the base case I guess where we initialize the first two values fub1 and F0 we set them to one because that's how we defined it and then there's a recursive case FN the recursive case has to do two things it need needs to verify the correctness of FN minus one and FN minus 2 and it also needs to calculate the new FN which simply means adding the two numbers together and then return the the final value so how does it look like we can simply use the CK program API to define a recursive proof we add two methods to it number one being the base case where

you simply split out a one value and then proving the sequence which is the recursive step where we always take the previous two inputs and then go further and further generate a new output and continue doing so so our base case is simply giving us the value number one and yeah that's pretty easy we simply return a field element that has the value one going to the recursive case we now need to verify the correctness of the previous elements the pre previous two elements and calculate the new one and then simply return the value so that works very straightforward um we have

two private inputs the private inputs being the proof of the previous iteration we simply verify them. verify um which literally verifies the previous proofs recursively we add the two inputs together and we return them so everything together gives us a very basic fibon sequence recursion example and we can simply call do compile to compile the CK program we can simply call base case or do proof sequence with the inputs which simply generates a z knowledge proof of the inputs using the computation and we can also very easily verify it directly in the browser or directly in your node.js

environment or any other onetime so there's other cool protocol features that are more smart contract related that I still wanted to mention in case anyone is interested in using them um there are something called custom tokens which are obviously tokens they are native to the blockchain so you can utilize them to build all sorts of like token like behavior um there's something called actions and reducers which help with concurrency and and state interactions so they are quite valuable there's events events are simple they're just like events and solidity there's permissions for smart contracts there's time locked accounts so there's like all sorts of things so you really have access to your full

stack of um I guess like features like you're used to with like solidity or other applications so just not a quick Outlook um there a kategan um some things we are working on um gadgets so we are currently actively working on gadgets but what are they they are essentially low-level building blocks like Hardware acceler for like cryptography for like meth and all sorts of stuff and they are building on top of custom Gates so there's a couple of things we have just very recently finished for example all sorts of bitb operations bitb gadgets and xor shift rotation and not and these allow you to build like foreign I guess

cryptography algorithms like sh 256 or sh 3 and other algorithms very efficiently because they are sort of like lowlevel Accel ators in the proof system there's other exciting things we're working on Foreign Fields which are work in progress which will allow us to do foreign field arithmetic man multiplication addition and other algorithms and with Foreign Fields we will have access to foreign eliptic curves or rather elliptic curves that that are based on Foreign Fields um and that will then eventually unlock very soon ecdsa verification and and things like that so that's a very very powerful primitive um um we also very actively working other improvements and

performance chunking will be a big one that will massively increase the amount of constraints that can be proven we are currently we we just have recently finished Prov and winess generation performance which we have landed um but there still more work to do um we have just recently finished um implementing Prov artifact caching so you can compile your um prover artifacts there's folding coming which we are working on which will be a big and interesting feature and more so briefly going into like examples and use cases to give you a couple of Interest interesting ideas so private Dow in governance is a very important thing you can build privacy um privacy based voting applications survey

applications there's like a I guess an idea about safe interoperability between blockchains or like State channels that is a very interesting one um simply using recursive peer-to-peer proofs to verify computation between two parties or between blockchains there's a defi in real world data Oracle case you can prove data offchain you can verify it onchain it could be all sorts of like defy real world data use cases um there's an entire thing about CK rollups and infrastructures which you can do and there's also a big part about like anonymized proofs kyc identity of gen information that's also a big one I'm waiting a second so everyone can take a picture that's like planned in into the

talk it's a very big very big important thing it took me a long time by the way like getting all these yeah so yeah um now we are talking about challenges um I actually originally thought challenges would already be announced but I think they're being announced in the intro talk soon um we have set five challenges starting with number one CK gaming so the idea is for you to build a game like a game mechanic using over Jaz or maybe even some sort of like anti-cheat mechanism um a couple of examples are listed there but you're not limited to these examples we are we hope everyone is like creative we are open to new

ideas just giving you a couple of um yeah ideas so there's like hearstone card games like poker is like a big b chess as well then um C voting like I mentioned previously just simply build a Bo application or survey application using zero knowledge you can use CK for either scaling either privacy you can even prove the telling of the boats so there's a big thing there um there's a crypto primitive challenge which um sort of like is about building and implementing popular crypto cryptographic Primitives for example you can use the bit voice gadgets that I introduced earlier to implement sh 256 um but not limited to

sh 256 there's a zero knowledge data structure um challenge which in which you can build things like Miracle mountain ranges rate limiting nullifiers mutator sets so like a lot of stuff there's actually another one um which is a free form sort of like thing just build whatever you think is interesting um and yeah if you want to get all the information about the the challenges the bounties take a look at their fol you I'm sure they will be introduced later at the um intro presentation as well and if you're interested come to our booth we will have like things QR codes where you can learn more so yeah it is time to hack check out the QR code it it leads

you to a notion page where you can see all the challenges the introduction I guess steps how to get where where to find B where the community and all these things so yeah you see I think we have time for questions if anyone wants to take pictur of the other cats I can go back there's like no limitations are there any non catch related questions or catch related actually I don't mind uh thanks Floren when the ecdsa stuff lands will I be able to use

ethereum state in ZK apps so yeah um what you can do with ecdsa is verify ethereum signatures um another thing that people may be interested in is using kichchu like Char three to verify ethereum data structures so for example there could be some data on ethereum you could like build a miracle proof of it using sha um sha three or like kak or anything verify it with an Amina proof and then in combination with ecdsa verify ethereum signatures look at the data in ethereum transactions and and and stuff like that um could you go through a little

bit more on like the flow of making one of these apps using typescript so like how much do I have to like commit like some State on the Mina blockchain before I have to actually run my website or yep so so let me just go back to the very beginning to the example contract and and the prompt for your cat pictures as well that's great yeah okay so let's say you want to start building a smart contract like this a very basic add smart contract which simply like takes an input a private input applies it to some onchain State and then commits the onchain State

back to Min now so what you would do is you would go ahead download the ckf CLI um go through the prompts the I guess like introduction choose what framework you want to use view no um whatever we have available and this will like spawn you with some like predefined contract um there's onchain State um it's only limited to eight field elements so if you want to reference more on chain State you should tap into Merk trees we have tutorials on the on our docs so there's like all sorts of tutorials on the docs not only about merries but also other stuff very introductionary um tutorials getting started more advanced things so you would start writing your

smart contract and depending on your I guess application you can reference onchain State you may want to use Merk trees to verify or like reference more offchain State you can then go ahead and construct transactions which I didn't which I didn't add in this talk and then like simply send them to the blockchain where they are like verified you generate a proof of it and yeah I I hope that answers your question are there any limits or constraints When developing with the OMG ssdk because as we know like in KIRO or in sirom you are limited to like additions or multiplications and you have to split that which is annoying but like in the o g ssdk is possible to

freely develop like the fullest as developers need yes and that's a very good um question so we provide you with all sorts of like standard Library access um the most basic ones are obviously addition multiplication you have access to things like assertions greater than less than a third equal um but you also have access to like more advanced or like yeah more advanced Primitives like posidon hashing schnor signatures and all these things and now also with custom um Gates and gadgets you have access to bitb operations and stuff like that you can pull in other libraries that already have done some sort of like rework for you you can use these if they're 1js compatible so

you're not limited to like only addition multiplication you have access to a a very Bast um standard library with which provides you with all sorts of computation right so essentially there's like I guess like no limit to what you can do um you can do like any application that or like any logic that you imagine it is really just like writing typescript right so you're like not limited by only two I guess Primitives or two operations also like it's known that CH 256 is pretty inefficient while like developing with ZK uh like in circum it used to be like 150,000 constraints but like I'm wondering with OMGs how

efficient it is and what makes it efficient also yeah so I mentioned earlier that the implemented Gadget ggs and gadgets they are like cryptographic accelerators um which in within our CK um SDK they are based on custom gates in our plish proof system and that simply means certain operations like not xor shift which you all need for sh 256 uh 256 um they're like much much quicker they only need one constraint instead of like thousand right so if you wanted to implement sh 256 you simply go in these into these bitb operations and or not shift whatever and utilize them to build

your algorithm right um it wasn't possible previously to do it efficient but now with custom Gates and gadgets you can do operations like that more efficiently um without having to like add a thousand constraints so yeah thanks um do you have the concept of like gas or anything like that like can anyone just prove these things using my app and how do I keep my keys and secure like is that the same concept or is that a different analogy so um we don't have gas because computation happens off chain you are essentially paying for your own computation by running the the approver the software in your browser

right so there's like you're not paying any node on chain to do the computation for you there is a transaction fee that you have to pay with every transaction that you're sending um to the network but it doesn't it doesn't depend on the amount of computation that you can do that's also by I said earlier that you can tap into unlimited amount of offchain computation because you are doing the computation and not any onchain node um you know like on ethereum like you essentially have to pay the entire network through the computation over and over and over again with Mina you do it yourself you have a tiny proof which is like you know very very quickly very efficiently to verify you send it to the chain they verify it they say yes it's correct or no it's not correct and yeah so there's no notion of

gas but would that mean that my app needs some sort of wallet integration um yeah so if you want to interact with the Mina blockchain you can do it directly in OJs so there's like um things that are provided to you like transaction apis and you can also use wallet extension extensions uh yeah one quick question um do you have any restrictions on the complexity of the circuit let's say for example if I have a circuit weigh more than four 5,000 uh if I was CLA will that be okay or it going to be too slow or anything yeah so um at the moment we can prove

two to the power of 16 constraints um I mentioned earlier that we are working on chunking which has been implemented we just need to expose it in ongs which will allow you to prove two to the power of 32 constraints so that is a lot earlier you mentioned the accessing onchain data in the smart contracts but I thought that only the proofs are stored basically on chain so where where is that data coming from and uh and um how like when you access the data how how isn't going to be out of date when you actually want to commit your y proof

or yeah submit your transaction yes so every account on the Mina blockchain including smart contract accounts um they have some onchain state it is eight field elements there are some other onchain state like permissions are stored the verification key of your application installed in order to verify um your proof but yeah so there's there's something called actions and reducers which I mentioned about earlier um instead of directly changing the onchain state what you can do is dispatch an action which says increment a then another user is also doing the same increment B increment a by five whatever they are sort of like dispatching instructions and then later

on you can come in invoke a different um method and say reduce all these transactions like go through them apply them one by one and that's how you can prevent sort of like race conditions and concurrency so what happens if if uh my application needed you to have certain amount of whatever other token but and when I submit the transaction you still have it and then but in the meantime someone for some reason your balance changed and it's just going to revert or so um tokens are a interesting example because you don't Implement tokens like you do with solidity it's not a map

structure in a smart contract tokens are actually something that are natively implemented on the layer one right so rather than having a smart contract that keeps track of all the um balances in a map data structure they're actually like baked into the blockchain right so there's not the same uh I guess like constraints with like smart contract State because it's differently handled that makes sense thanks okay thank you very much floran that's was a great speech