ZK Rollups: Tales From the Field / Danny Holland

Transcript

foreign [Music] hi everybody this is Zeke rollips tail Tales from the field my name is Danny I'm an obligate datavor I can't not uh it's just a thing I've been a solidity developer for uh actually going on five years now um I did this like a few months ago um uh crypto winner was fun in case any of you were there for that I am the head of blockchain Integrations for Vega Vega is a fully decentralized

derivatives platform running on tindermint um our current main project our product is Cash settled Futures which is why we care about ethereum so much um so we're all here at ethrog because we love ethereum everyone here I mean hopefully loves ethereum if there's any haters out here you're probably in the wrong place but ethereum has a problem like clearly it's it's slow it's expensive it doesn't scale very well so it needs our help to scale so uh why do we use it at Vega well that's where the assets are the cash in cash settled Futures is die F you know these guys you can see those so at the

moment what we do is our Bridge uses a multi-sig process that bundles up signatures from all of the validators and submit systems submits that to a Smart contract as you normally would and it Cycles through the um the signature bundle and uh verifies that each each signature is correct now as you can imagine that gets more and more expensive the more signers we have the more validators we have the more expensive this gets and at some point there's like a hard cap where we can't go past that it's it's a ways off we figured out a way to push it further off but it still eventually a problem so but there's hope L2 scaling does exist there's a bunch of different ways to do

it but we've decided to go with ZK Roll-Ups okay so what's an L2 just quick overview and L2 is is a a way to scale ethereum while using the uh the underlying security of ethereum but also offloading all of the compute somewhere else or most of the compute somewhere else so we do this with optimistic roll up ZK Roll-Ups plasma and side chains Asterix is there because people like to argue whether or not side chains count as l2s so I did this thing months ago before the market downturn and at the time six billion dollars was locked in l2s I looked it up today on the same website and it's 4.8 so considering the massive downturn we've had recently this is not

bad the l2s still have a lot of strength okay so a quick overview of some of the different L2 options we've got optimistic rollups the idea is the transaction is assumed correct uh until someone submits a fraud proof and you know disagrees with it what that necessity States is wait times a lot of the systems have up to like a week-long wait time which I don't know if I want to withdraw my funds from something I'm not waiting a week I don't like that at that kind of frustrates me personally what's cool though is it uses math to disprove everything so you know you don't have to like go through some weird arbitration process it's it's math but it does require a network it does

require a whole separate Network outside of ethereum so I mean Vega's already a network I don't want to have to use another Network so that one was out um side chains are fast and secure but they change the security assumptions of of I mean they have different base assumptions than ethereum has and as we've seen with the Ronin hack and the black hole hack bridges are hard and it they can be a hack like that will absolutely kill projects so we don't want that and then there's the debate on whether or not it's an L2 okay so ZK Roll-Ups that's that's why I'm here that's the thing I'm I'm promoting and uh I see it as a per problem uh L2 so like these are individual circuits individual Roll-Ups

for specific tasks so much like an individual smart contract not general purpose not not making a whole VM just individual this is the task so I'm going to start oh yeah so ZK Roll-Ups are uh the benefits are they're fast and secure they are entirely built on math all of it's in the background is math and uh the proof is verified it can be verified on chain and it's in a single transaction there's none of this wait times there's no crazy wait times and the best part is it has fixed proof size so no matter how big you've scaled the thing it's the the input data is fully decoupled from the proof so the proof is just for un256s and then whatever output

parameters you want to do business Logic on so that makes it really cool and this is how we get the scaling okay so General overview on how they work um that's a quote from a french guy you guys can read it but uh you take a very large input file or any input file you want of whatever data you need to actually do the processing on you put it through a ZK circuit out pops the little bitty proof that then you can verify on a generated solidity smart contract so uh the the smart contract obviously can be inherited from and that's where you add all your business logic in real simple real straightforward um in theory it's you know application

gets a bit harder so little quick toy example say you wanted to play Rock Paper Scissors between two people and you wanted to do 10 000 rounds of rock paper scissors you can't do 10 000 anything on ethereum period it's just it ain't happening so in this case you would take player one's choices their ten thousand choices zero one or two for rock paper scissors take player twos throw them into a Json file that's just arrays of their moves you put their arrays through the circuit that's what they're called the Roll-Ups are called circuits long story will I don't even think I'll cover it here but uh what will come out is a proof and in this case the proof is the four unit 256s that is the proof itself

the number of wins player one had and the number ones player two had that's enough information to verify that the wins are correct and to do business Logic on the wins say give someone a an nft or give someone tokens or Eve this is in a language called circum this is the language that uh the ZK Roll-Ups and ZK snarks use I think there's other languages out there there's like Cairo and stuff there's some differences there but this is the one I'm doing um so as you can see here we've got let's see we've got the player one choices the player two choices as inputs we've got player one wins player two wins as outputs so all it does is Loop through all of the choices choice Pairs

and this is where it gets a little weird because it's all based on based on really strange math that I really don't have my head fully around sadly uh you can't do branching it has to be compiled down to like just just numbers it has single equations so that line right there is if this line equates to zero then player one one if this line equates to zero player two one um you got an accumulator for player one accumulator for player two you can constrain them to the outputs and that's your circuit so now one thing to point out is down here we've got the uh the ten thousand

at compile time before you create the the verifier you have to know uh whatever input things you have you have to know the size because that's part of building out the math to it so this could be a million this could be 10 million this could this could be however big your compute can handle but you have to do it at compile time so if you want to upgrade later if you haven't set a high enough cap and you want to upgrade later you have to do a full recompile a full redeploy of the contracts and all that stuff so uh think ahead okay so the idea the thing we want to do at Vega that we're researching right now is to replace our multi-sig control with a

circuit I've already written the circuit it's it's we're testing it and playing around with it and seeing the feasibility of incorporating all of this but the basic flow is that a user requests to withdrawal from the system from the network it gets gossiped around all of the validators sign yeah yeah this is okay and they sign it all up then it's bundled up for the user we've got the um the validator public Keys the validator weights the validator signatures and the the message hash that goes to the actual Transit the withdrawal transaction on chain so what this will do is the signatures all contain the hash of the weights and the hash of the public keys so everyone's

signing them everyone agrees that this is the the set and then what happens is it goes through the circuit like everything else out comes the four unit 256s that is the proof the the signer hash the original message hash and then the total amount of Weights that people that signed yeah that gets put into the business logic and then you you check the signer hash against the known signer hash the one that's on that we store on chain and we go oh cool it's good we allow the withdrawal to go through another thing we can do and I've been looking into is bulk transaction uh check-ins so the Vega network will bundle a massive amount of transactions

hash each one of those make an array out of those hashes and then hash that array and just store that on chain through through the standard process we did in the the last thing so that's that's all this shows and then when a user goes to uh claim a transaction that was on that that belongs to them they submit the original array of hashes and then which hash is theirs all the circuit does in this case is cycle through them and say hey is is the hash provided in this array and then it hashes that array and the output as you can see right yeah right there you've got the hash they want and then the transit the whole array hash and if this whole array hash

was checked in in the last step well then we know it matches so all we got to do then in the smart contract is check does that match and uh has that one been claimed yet and that's it if they haven't you all the rest of the parameters you hand to that that function allows you to run the one that run the transaction so fairly straightforward there's no limit on how many transactions you could you could put into this other than the amount of compute right here but um you can replace that with a Merkle tree proof and you know make it scale and stuff so that is a useful way to scale bulk transactions obviously the user is still paying gas every time they want to you know claim their transaction but you

can't really get past that okay so why are we doing this okay so a roll up with 500 signers or 5 000 signers or five million signers doesn't matter is 66 percent less gas than our current multi-sig with 13 signers once we scale up to 50 signers it's way more than 90 percent and effectively it just gets better and better the further we go along so that's that's the reason we would want to do this there's a lot of complexities involved there's a lot of asterisks and a lot of uh weird caveats and these things need to be overcome but the basically the benefits are they're it's provably secure uh the there's the fixed gas costs the more complex calculations

um and and the uh combined with the larger data sets so you get you get to do complex calculations on big data sets which is something you absolutely can't do on on ethereum right now which is really nice we don't have to rely on third-party networks because there's actually a snark.js in the browser you can download snark.js yourself any client can run the compute so you don't need a full node you know network of nodes we don't have to do that so that's nice there's no wait times like there is with optimism and my favorite part is it's cool and futuristic like that's why I'm here I think that's why a lot of people are probably here yeah exactly um okay so risks the uh so Shaw 256 catch hack whatever you want to call it

is um uh it's too loopy like I said there but basically it's too complex to work into a circuit and then have like 10 000 of them in that circuit the the complexity just goes up and up and up and the compute goes up and up and up however there are a number of newer hashes that are ZK friendly there's MIM C7 there's Poseidon there's a few others and they um they there's been no like bugs or breaks or things and they should be secure but they haven't been out in the field as long as something like shot 256 like we know through through trial and error and you know 10 billion hackers trying to hack it that that not only does the math line up but also the it appears to be

secure in the face of real real threats we don't know that about mimc7 and Poseidon and all these others yet so so that's the problem I've seen another one is there's no community I mean how many of you use uh stack Overflow right everybody always constantly well we don't really have that for for certcom I mean there's some it's getting better but it's not there yet um also crypto is hard every time we end up with a new uh a new feature we want to do or a new weirdness we've got to implement it the libraries don't exist the tooling doesn't exist it's just not there yet and it's deeply complex the language is fairly hard to handle the whole being able to compile

everything into into chains of math is kind of hard there's no auditor there's a couple Auditors but exceptionally hard to find very uh not a lot of availability don't really know how good they are that sort of thing and then of course there's unknowns there's the the things we don't know we don't know right okay so my my to do my call to action is if you are a solidity developer try building a circuit come in play around um in a hackathon you want to win a hackathon try try to do a ZK roll up try to do something that is impossible on chain in a roll-up and you'd probably win the hackathon it'd probably be

pretty cool uh join forums play in the forums um tooling if you're one of those nerds that really like to build tools and stuff please we need you right now it's like um uh I started solid or started solidity in summer of 2017 and web3 sucked in in summer of 2017. it was awful all the tools everything was buggy the compilers sucked everything was that's where we're at with cercom that's where we're at with ZK Roll-Ups right now so please come join um be part of a community and uh play around implement the rock paper scissors you know like like try weird things make make toys that's that's how you learn things that's how you have fun that's

how you get other people to engage so if you're where's the lady developer if you have any interest in ZK Roll-Ups it's not even about the Privacy necessarily but the ability to massively scale ethereum uh I'd say join that try so questions all right all right uh thank you there's uh Vega vega.xyz and um I uh all my music is on all the streaming as sacrificial pancakes so hit me up that's it thanks everyone questions oh yeah I thought there might be no

it's probably it's probably a naive question but um so after the merge do you think that there's any um like competition with ZK Roll-Ups or is it going to make them obsolete or does that in any way does it in any way like the merge doesn't cut down gas prices and it doesn't really open up block space so no it's um this actually helps scale after the merge um it's also a uh it's going to work in parallel with sharding when sharding finally happens so at least that's my my understanding of it as it sits now gotcha thank you yeah okay any more questions from the audience here we are so you mentioned that ZK roll ups in

your opinion should be application specific not General um but there are a couple of layers being built that are generalistic more or less right there are um uh starkware things like that um they tend to be um uh in my opinion slightly on the slow side slightly cumbersome they they need a lot of work at the moment so I mean these do as well but I'd rather have something that is you know bespoke and crafted to the problem than have some generic bulk that I then I'm not in control of but that's just a control issue but isn't the problem with uh like let's say application specific Roll-Ups or even blockchains that they lose a lot of composability among each other like they

need they need Bridges or some other way how to communicate to kind of take advantage of composability uh versus generalistic chains or layers um yes uh however the the ZK is just doing a bit of verification you still have the act the access to the rest of the smart contract and all the business logic so you get the composability in that format with all the other um with all the other uh smart contracts out there you are correct I see your point for sure but uh you you don't fully lose composability because you have it on the business logic side because there is no there is currently no way to verify proofs within a proof so that that does definitely become a problem in the long run so good question

and what else yeah one more down here you're good to take a few questions yeah nice I think we have time so um any thoughts on how to work on expanding the expertise within the development developer circles with zkp like given all the Deep maths that's so hard to grasp even by people from zkp I think it's very scary to try to enter um uh no this this talk is my my idea for how to how to expand this out yeah because I want people to join to to play with it because it is so new it's so strange like yeah yeah no that's that's a good question um and it is hard but

that's why I said the toys like play make make make things that are fun make things that are trivial don't put millions of dollars on them immediately like like that's a that's a you know down the road get it audited and stuff yeah um anyone else everywhere now how does uh how do ZK Roll-Ups uh affect the end user and the way that they interface with uh what we build well um as I said before there is a snark JS library that is brought on in the browser so uh ideally you can obscure it all away just like we do all the connections of actually building up the transactions that go to like ether ethers or web3 so that's uh it really

depends on on how it's developed but if you do it right you can obscure a lot of that stuff away and I really suggest we do that because yeah having having a user actually download a file and then re-upload the file somewhere else and then actually wait you know a minute for the thing to kick out and all that don't do that yeah like at least if you can avoid it okay we have one more question here uh yeah uh now most of ZK Roll-Ups are application specific ones do you see it's like the way for ZK roll ups to be or we will see more of General computation ZK Roll-Ups personally I like the per application um there are there is a general purpose computer out there uh what's it called

what was it yeah the the snark aware guys there the there's a few of them out there those are general purpose but those are really bulky machines a lot to compute it gets really heavy um they'll get better as we go along I'm sure but at the moment application specific any more questions from the floor yep in the middle hey do you see this is the sort of Holy Grail for what you're trying to do or are there it is yeah oh yeah yeah for scaling ethereum absolutely this is this is the best way to scale scale ethereum and that I'm aware of at the moment because uh no matter what we do if we're storing all the data on chain the the

chain the block data gets too big like it we're having that problem like trying to sync a whole node with ethereum right now is a nightmare and it's only going to get worse no black holes like it's it's not like oh it's great but for the all these compromises oh there's always going to be compromises but it's still better than it's still the only way I can see to really scale it big I'd love to be wrong like that'd be cool but and in your whole kind of Learning Journey um what's been the gnarliest part of it for you to get over uh no branching I can't use if statements like like that seriously as a coder like that just immediately kicks you and you're like oh God what am I gonna do so yeah

good good questions thanks another question from over here wow I'm getting a lot this time this is awesome like it's turning into like Mass mentoring sessions yeah oh by the way but before you before you uh ask your question um reach out to me if anybody does start one of these things reach out to me like I'd love to answer your questions after the last time I gave this talk I had two people get a hold of me and I walked them through and they made circuits and one of them made a tutorial and stuff it was pretty cool so yeah yes of course uh so one other questions so the great part is that you're able to remove the computation from inside the smart Contours itself and you're able to do it on the outside but that's also kind of

uh presets the fact that you kind of need a storage solution to keep that information for a long time because otherwise like if you come back to a zkp like you want to verify something like a year afterwards you have to have that information available so is there some kind of way that um it's not intrinsic um we can use things like ipfs or you just build it in such a way that uh the verification is all built in so like you don't care about the data that went into it all you care about is the output so like like with an individual withdrawal from from our Bridge right like once everything's done we we know it's accurate we've we've accounted for it on our side the data doesn't you know that that whole bundle and everything doesn't

need to continue to exist I mean it will in our particular case but it doesn't need to yeah any more questions yeah want to hear maybe this is the last one or maybe one more yeah probably stage manager isn't shouting at me so we're fine cool hi again uh the operation in some layered tools is I think very Central now and they say they will fix it in the future but what do you think about that the like a secure answers infrastructure oh um I think I think a lot of the stuff will end up being wrapped into to

ethereum eventually like there's going to be a lot of like compatible things built directly into the into it yeah um yeah I don't know if there's yeah I that's what I got sorry okay um if there's nothing else I have a question oh yes um you you you clearly seem to have found the place and the role in life at which you shine right you've found this thing that you absolutely love and you just you're able to from that put all your energy into it oh I'm like this with everything sharing with uh

sorry keep going I I just want to know like like where do you get all your energy from I I I go manic when I find something that I like when I when I find something I like I just I dive in and I embed myself and that's what I do and that's the thing specifically the subject is the development of zero knowledge Roll-Ups honestly it's specifically fine you'll it's not no it's not just a ZK roller yeah right it's um smart contracts and blockchain and decentralized you know ledgers and all like it's I like blockchain games and all the other stuff like yeah it's it's crypto in general that I love that I find myself attracted to like this I mean I've been a Dev for five years just

in solidity so yeah wow yeah good question thank you it's it's inspiring to see I don't know how other people feel but like I'm just like wowed um thanks so maybe let's shall we let him rest okay good um it's been a it's been a pleasure thank you very much Daniel very much [Applause] [Music]