ZKPodcast: Circom & Hermez with Jordi Baylina

Transcript

[Music] welcome to xero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me anna and me frederick this week we catch up with jordi beilina the co-founder of iden 3 and the creator of circom we chat about his work in the ecosystem building zero knowledge circuits and the new roll-up project hermes but before we start in i want to say thank you to this week's

sponsor parody technologies so parody has been mentioned more than once on this show frederick is currently the cto there and once upon a time i worked there too in fact it was during that time that this the zk podcast was born so for this spot the folks at parity wanted to share that they are currently looking to fill a number of job positions including many on the engineering side as an engineer at parity you would get to write rust all day be at the forefront of creating and shaping the decentralized web and hopefully also dig into some cool zero-knowledge crypto tech the best way to get noticed for this role is to familiarize yourself with substrate the platform built by parity which makes building blockchains much much easier

so go check out the substrate libraries and then head over to parity.io jobs to find out more so thank you again parity for sponsoring this episode now here is our interview with jordy today we're going to be catching up with jordy bylina who's the co-founder of iden 3 the creator of circom snark js welcome to the show jordy thank you very much anna a pleasure to be here so jordy you've already spoken at the zk summit um and actually we'll add the link to that in the show notes where you do go into circom in detail but i'm so happy to have you actually join on the podcast this is it's kind of crazy that this is the first time that we have you on because i feel like

we actually i see you around a lot i've been on the been at the events been in all the conferences and not only in our conferences but obviously around the space for a really long time yes i'm in the space since 2015 oh wow so this is the thing i wanted to actually start in on because i just realized like last week i was reading sort of this description of the dow hack and your name was in it and i i know that griff must have mentioned this when we had him on the show you know two years ago talking about it but i don't know if i knew you then and i didn't put it together until literally this week

so let's find out about kind of your beginnings in the space you were you say 2015 was it ethereum was it bitcoin where did you start well actually in 2013 i read the the bitcoin paper i get very excited about that and i start uh well i was trying to do some smart contracts that's actually the thing and what's a pain on bitcoin on bitcoin yeah i it was a pain that was my beginning i realized that most of the up codes didn't work and it was tough at that time i also had a lot of work in my other my own job so a little bit i put it on the site and in 2015 later on um just after a javascript conference somebody

started talking about decentralized storage i discovered at that point ipfs and well at that point that blow my mind i start like investigating i don't know how i discover ethereum and the moment that you know i just took the smart contract that i was trying to do two years ago and in two minutes i set up a solidity code and upload and it was working and for me that then i was just uh catch it by uh you were hooked i'm absolutely hooked yeah and and at that point it was like uh obsession just getting all the all my free time all my my free time my sleep time all but all my time just reading understanding going deep and so on and there is at some point i

i get in in the into the dao project everybody was was excited about that project so i started reading the smart control on that i was even writing a liquid democracy for the daho at that point wow but just learning you know just learning the code and there there is uh i get involved a lot in at that point in there you discover here all it's not was about technical at this point it even was all the social part of the of the crypto space you discover that's it's not only a technology so it's when your mind starts blowing a lot and and and there is when the the hack happened you know i i knew a lot about the smart contract people just asking me there and i just get involved in the rescue it was my my baptism in the i was

baptized it was in there what's the expression of that it's like that i translate translate i translate from some catalan expressions no but i think there isn't definitely a thing yeah it was i was sounds like that was very much less learning it was a lot of it was a lot of learning you know well i discovered how to how the hacker did it i reproduced that in the testnet i speak with slocking people and just send them the code and they just but they just told me that they were just working that there was a people of white hats that they were already working on saving the phones so i just joined a call in there i was like the last guy

arriving there it was for me was like a movie it was crazy you know it was in a call with a lot of people that i don't i don't even know nobody there and the people were moving 100 million dollars just just killing there and it was just there in the car listening i couldn't believe the level and it was interesting because at the end of the call they rescued 96 million out of the 100 million but they still there was four million servers and i had my chance there they say i can i maybe i can try to use my smart contracts there to try to rescue and i was able to actually recover that that for the last four million dollars and and from there my life just ginger you just you just made this comment about um how it was like a movie and a few

years ago after we had done that interview with griff which by the way i'll add in the show notes for anyone who wants to hear that sort of extended story of of the dow hack we had just done that interview frederick i don't know if you were there that day okay so we all met up with someone a friend of mine who like he was not in crypto at all and we were buzzing about this story you know kind of looking back at it but we were so excited about it and we explained it to him who he's actually a filmmaker and it was so fun to try to explain it to someone from the outside but it really does have the drama of like a movie yeah actually i have a friend that uh i explain

exactly like you explained i explained him the the story and uh he likes to write books and he talks my story of course he changed it you know it's just a fiction story but took my my story as a base for a nobel uh human he wrote a novel has nothing to do with uh ethereum but it's ethereum actually but it's like you know he just mixed and just put more from his side and then mix other stories but but it was like the base for for the uh for his stories no it's just a it's a local writer but uh it's yeah i understand what you mean it was uh it was it was very very crazy and for me it was abs very very impactful i told you my life changed completely

at that point i have a question actually about the dow hack specifically that i i guess i've never cared enough to investigate on my own but i've had this question several times what happened to the funds on etc so like there was this split because things were recovered and then etc it wasn't like what happened on etc side the day of the etc fork we actually thought that the story was over but then is when epc appears so and we just start resynchronizing servers and and so on and we did there all the recovery we did what what we can i think we missed we missed some date time at the

beginning but the other there was a lot of thousands it was a very complex uh situation but we recover like 70 percent or 80 percent of the funds in etc and well recovering that point that was actually the the most i thought the most difficult part because this was not a technical part had to return so we would recover these funds we record we returned them to their their owners but the the story for returning was hard woman we tried that first chance to to convert them back to ethereum that's where we had all the tooling there people knew that so we tried to to move them to ethereum but this was a mistake we didn't realize that but uh this was actually a mistake so

we at the moment that we tried because you know you need to try to compare that but it was difficult because you need to do it in a way that's uh like secret in order to try to maintain the maximum value of the tokens but at the same time public so that you can prove that actually you move reference and this was not so we set up a full strategy to move at the same time and story and i remember this was really bad because we we just hit the bottom to to move the phones and and uh well yeah i think it was poloniex just uh block us the phones and they told us they told us there is some funds something like there was some funds and from suspicious places that has been moved everything is enhancing of the fbi

and at that point okay so we just took all the remaining funds we created all the smart contracts uh we create a smart contract where people could withdraw their phones and then we just flip it back with that uh we are ready to return the phones please uh exchanges that you have blocked us please send the phones to this smart contract so that the people can recover it back yeah in less than 24 hours they just send the money there so and the people just start withdrawing and everything is there did the hacker get away with something yes i think you get like at that point was something like four or five million dollars or something like that i need tc i guess dc yes yeah but then it's this is when the theorem was at 10 or something like that so yeah

everything got crazy at that point but that's that's what i told you it does for me that was uh was my baptism i learned here a lot about changes and there's a lot about people in the in those scenarios yes it was a huge learning for me you know just uh we learned about analyzing the blockchain auditing generating these smart contracts for for returning security issues you know i learned a lot you know for me was a master class and yeah so just done how do you go from that point to zero knowledge proof stuff like what we're talking about was that was in 2016 right when and how did you first get

interested in the zero knowledge proof side of things i i could not say an exact uh date but uh when you are in this space you at some point i decided that i want to be here just full time it's like that this is my life and i want to be here and the first thing that you realize is that this technology do not scale so if you want to use this technology in a real world you need to think about scaling the project i get very obsessed on the scaling i was studying just state channels side chains and different solutions that plasma that was at that point and i was very pessimistic on all these solutions until the point that in some way i connect the zero knowledge on all that stuff i remember that

vitalik wrote uh introduction to zika snarks and i was reading there i had to read like ten times you know those posts because they are not easy and there are some unconnected parts and and you need to go to step but at the moment that you get it at the moment that you understand it is like you see how it's like this thing no it's oh it's not it's not that hard you know it's uh maybe it took you like a month just to understand it but once you get it you see that you appreciate the simplicity you appreciate that but it's not it's it's really it's really cool you know and when you start seeing all the applications that you've had with privacy you know with a lot of uh applications it's when you get interesting and when

you really see that this is the future of this uh space right this is an important piece in the future yeah it's interesting so it's interesting that you came to it more through the scaling side like you must have been aware of like ccash and these other projects out there but you if for you it only really landed in your lap as a solution to scaling when or maybe like who first put those two ideas together uh i remember there was a post from vitalik also talking about zika rolex well it was roll up that this idea of splitting of separating the computation the scaling of the computation side of the validation so the validity part and the scaling of the data availability and splitting the problem in these two problems

this is what really blows your mind this is actually the real piece of these blockchains can can can evolve and and then it's just a matter of doing numbers you know just uh making numbers how many transactions could you do how much would cost to create the proofs uh how you would set up that and and you start thinking and just analyzing the problem and and then you you you are learning and you are discovering and yes that's identity you know when when this is when i start working with identity that was this privacy part but also this scalability part you know an identity system we want to build a system that everybody can all the identities can do as many claims as

they want so it's not a centralized system it's a sovereign decentralized identity so you need to scale if you want to clean that means you need to do this at a station and you need to scale this quantity of photo stations that the system can handle and and here is where cans again the solution of the of the snarks which is cool because it's the same technology that you can use it for privacy but at the same time for uh scaling and actually problem this is i hear from somebody that says that what really make the the big interest of the snarks is more in the in the scaling side than the privacy privacy nobody cares about that which is which is sad but that's that's that's the the truth but in any

case it's uh it's an amazing technology we're sort of maybe related and sort of a side question really is were you involved in the uh ethereum based system that was set up in the the spanish uh political kind of nightmare that was going on for a while where there was an identity system on ethereum for voting for tracking where these like political groups were meeting and all this stuff i'm a catalan have nothing to do with spain okay so were you part of the catalan ethereum project yes in the catalan i'm just just working for catalan to be independent country and and i think that blockchain

is an amazing technology that can help on that especially i my goal the goal in my life is catalonia be a liquid democracy system where catalans decide their future i want to retire when this happens yeah did any of this work act as a precursor to item three or was it completely separate like separate trains of thought i told you this is my like my long term goal if you want my ideology goal but in the middle you need to to create a sovereign identity you need to scale change you need to uh you need to work a lot in the technology so at the end is you this is the long term path but in the short term you need to work in the everyday

project i think every day here is where uh scaling story identity and so on and only is just maybe my my motivation but you know this is a technology that works for any community in the world that can really self-organize and self serve government and all that together so yeah that's that's that's really cool what is ident three then so this is is this a company either three it's a protocol where everybody can create an identity or if you want a set of identities so those identities can create claims uh mainly on other identities and then you can prove those identities to third party so item three at the end is a simple protocol where you can create identities you can create claims and you can prove

those claims and that's it we want to try to keep it as simple as possible this is like the basic for any identity system and the goal of ivan iii is to define a protocol that can be used for in a decentralized manner for doing that so it's a base layer protocol on that i'm curious what the claims can be like can i claim that i'm a swedish citizen or that i have this education yeah yeah you can have this degree in this school you can claim that uh half a debt on something you can claim that you are a nice person and that or that your podcast looks so it's really cool a claim is any um any statement that you do it's not

right it's like if you go to not rights you write something and you put in a tree so you can prove you can prove that later so i'm doing a claim on you and then for a typical example i'm claiming on you i'm the university you are a student i'm claiming to you that you have this degree and then you can take this claim and prove to uh to an employer that you had that degree and all that with privacy so i don't even if i'm the university i don't even have to know that you are proving that to this job so when you want to keep this all this privacy in the in the full layer and at the same time the scalability work here is where the challenge the challenge comes and where the zero knowledge is

this is a key piece so we started doing uh this identity system but then we realized and actually we realized that the zero knowledge are are so important so that's also why we developed all these tooling for uh zero knowledge you know or this circum and or snark gs comes mainly for this need we need to build these this protocol so we need to define that of course you learn a lot on that and you are doing like iterations and maybe you could do this way you generate the proofs that does not exist way how you manage identities it starts it's complex but it's simple so you've explained where the zero knowledge proofs fit in but do you feel

like the circom and snark js has that become like a bigger part of this project is that sort of your main focus nowadays or is it like still within this umbrella by den3 no it's it's bigger than that you do this project and when you see that when you see that many projects start using that uh you need to understand that and you are trying that these tools be not too lonely for you it's a tool for the community here it's not i don't know there is uh interesting projects i know tornado cash is is using that uh we talk uh so that uh this game uh you say what's the name dark that forest game is using that and semaphore is using that so it's like a

lot of projects that are using circum and i think that circum so i circum brings this technology to a lot of new developers that discover the zero knowledge through these tools i think we haven't actually defined what circom actually is so what is it circle means a circuit compiler so it's like super cool though yeah but uh silicon is uh you know it's uh at the end it's a language to write programs that can be run in uh zero knowledge so let me explain so when zero knowledge what you are doing mainly what you are doing is you are proving that you made a

computation but without you to have to repeat that computation you can verify that much faster but how do you program what computation you want to prove in the case of the roll-ups for example this computation is about verifying all the other transactions so you verify that the signature is okay that you have enough enough funds in your account and all these typical validations so all this process of validating that at the end you want to summarize in a single proof that everybody can verify very fast that all this computation that can be long is proved really fast so how you do you write this this this process so how do you write these programs you cannot use

regular uh languages you need to write these programs in a very specific manner so you have a lot of constraints that you need to use there so silicon is a specific language that helps the developer to write those uh those programs yeah those circuits we call it circuits circuits programs okay it's very much the same but we call it circuit because the properties of these programs are very much like an electronic circuit so imagine an electronic circuit without uh hatching without latches just uh ants and ores and and you just just do any computation you want but just answers just you have an input all over the force on all of those would so you at the end you need to convert uh

whatever you want to compute with ants and nodes if you want with a circuit that's why we call it the circuit and that's converting that is that that needs to be a cell language it's a writing circle it's very much like writing electronic hardware you just do very small components maybe an addition multiplication you have a very like transistors you know in electronics you have like a small components with this you do maybe and you do gate components with these gate top components you do others and then you do more complex uh operations and you are building blocks every time more complex works and at the end you build your program out of these blocks this is what holy cow dsl and at the end it's just taking blocks connecting them

all together and generating the circuit that you want to build so circum is a language to to write that it's very simple it's very easy we have good tutorials and it's very easy to just uh step in and try when you first started on this was already available out there like were there no languages that you could use like why did you feel you had to develop a new one mainly uh well at first it was the leap stark was the original but that was the library though right it's a library yet yes but you know you for for writing those languages you need to understand a lot about c plus and and was quite complex to program in that at that point there was uh socrates i i started doing

some work with socrates but uh i was very disappointed especially because you couldn't in socrates at that point i think no that they changed it and they moved forward on that but at that point it was very difficult to use all the tricks that these circuits can do for example for doing a division you you cannot you don't have an operation that's a division you have a multiplication but you have a constraint so actually what you do is you calculate the multiplication and then you add a constraint that the the result multiply it by time it fits that and then there is this this kind of a lot of these tricks that when you're writing circuits are very important that it was not very well solved in the other languages at that point so i just uh i wanted to write circuits and

the ones that were there didn't fit to me and well i just wrote my own wrote my own languages and and it was it's a you know it's very simple it's really it's well it's really cool people like it and and it's uh it's becoming very much a standard for writing circuits how did you approach writing your own language i mean it you could have made an embedded dsl in something else or did you just write a new compiler from scratch and what did you write that compiler in yeah i brought i brought a new compiler from from scratch you know just uh there is a lexical part and then just create a branch i'm not

i'm not a compiler expert but i knew some some of the basic things of compilers and uh like all the projects you know it just starts a little bit like a toy and and it goes uh growing and so on right now this this this language is fully written right now it's uh rust or brighten uh the writing of silicone in rust that's done by people from university uh that knows much more about compilers than myself and it's doing a full writing of this it goes a little a little bit slowly so because this this had to be like three four months ago and still work in progress but they are working hard and and i hope

that at some point they will replace the actual javascript circle that's right now uh what it is but you know it will come whenever whenever you find the while uh the current silicone works worked well and it's it's fine i can imagine a lot of interesting challenges though i mean especially on the optimization side when you have these super complex circuits there must be tons of optimizations that you can do to like typically in a compiler if you have this like you're building on building blocks then you do things like inlining and you kind of fold a bunch of these layers together at some point before you spit out the end results yeah there are there is a lot of things there to do

uh this is the database we are trying to keep it separated so it's like the the compiler just compute these intermediary signals and it creates a constraint system that's maybe not optimal and then you can have other intermediate uh stages where you can do run all these optimizations the problem of these optimizations is that they need to be audited very well because you can mess it up easily so i change the logic yeah exactly so it's better to keep the language keep the compiler as simple as possible and then all these optimizations put them as plugins yeah like post processing yeah at the end or maybe even the different stages uh yeah so that's a little bit the strategy

that we are following for that but yeah it's uh it's working progress all that all that all that stuff does circum work with every sort of zk snark scheme or is there like a particular type of snark that it's built for uh silcom actually it generates r1cs so cause blank one constraint system so it regenerates a constraint system and it also uh generates the code to calculate all these intermediary variables that you need to build you want to create a proof of a specific program you need to run that program so you need to compute all these intermediary values and this is this is important for that so this circum does these two things you know compute the

generates the r1cs system and generates the the code that computes these windows so all the cryptographic uh primitives that can take as an input on one cs system it works for example here is uh bulletproofs can be connected to there with some aurora it has some some sort of many of them a lot of these constraints a lot of these uh systems they have this uh this input plonk for example it's it's not yeah but that's very very easy to adapt it's not it's it's not so it's not really um another one cs because it can have like only two

it's not a linear combination just have a very limited set of signals but when you have a linear combination convert that to many just add them together it's it's not difficult so just uh connecting circum to plonk i don't know i'm sorry this will be done in it's in the in the to-do list maybe somebody's doing it but it's uh send it to the list and it should not be it's not a difficult thing to do do you do you feel like circom is really the the kind of the tool for certain kinds of constructions and then others do do you see any other languages kind of emerging to deal with some of these new schemes that are coming out like marlin or like maybe the vanilla plonk that doesn't use our r1cs

we'll see this is i think that we it's very early i see that in these uh circuits uh indeed in these languages there is like two sets of languages one is more if you want more high-level languages languages that that are more close to what would be a standard like python or like russian or more like that looks more like a traditional language and and there is languages that are more low level you know this dsl language is more like writing um writing it's uh assembly you know just uh you put them the things together so and this other the other side these other circuits probably in the long in the long run maybe it would be less optimal you know they would generate more constraints and it would be

less optimal but it would be maybe enough but yeah in the long run probably this would be would be more the future so like they would would they have to write their own high level in a way like just like or maybe even a library that interacts with circum but that's optimized for this particular thing yes it's exactly it could be that way we'll see how this uh and subs but you know circum is very good when you want to have full control exactly what you want to do in silcom you have full control of the constraints you are writing and in silicon for example so there is no special library you know all the all the all the components in circum are written in circle there is nothing

like uh special things that you need to import and so in circum you can write any language you want yeah in circle itself and this is in an easy way so this is this is this is i think this is one of the coolest thing of circle and yes probably on top of circle maybe there would appear other other languages just for these more high level uh languages but uh if you have i would say if you have the mind of a of an electrical engineer circums is really good because it's just you can do very very very complex uh circuits too because at the end it's just a complex circuit is uh the union of many uh less complex circuits and this uh less complex circuits are the union

more or less yes so at the end you can build the full thing and and the other cool thing of circum is that you can not fully but you can audit for example a specific component a specific sub component there and you can be sure that at least this piece you can trade it as a black box and and you know that will work as it says it's okay to see that like the electrical kind of entry exactly so if you have a for electrical engineers circo means their tool okay is that is that are you are you actually an electrical engineer by i'm i'm uh yeah yeah i'm i'm a developer but i'm yeah my studies are i'm a telecommunications engineer oh perfect makes sense then you seem like the right person to be doing

that and i've been i've been designing i've been i've been designing electronics for for a while cool um i wonder how does snark js fit into this what is snark js then it's separate from circum right yeah so circum just generates this r1cs and snark gis is a javascript library that actually implements the zika snark protocol so it takes as an input this r1cs and this uh this windows and it's it has all the tools all the tooling for all for all the setups of the zika snarks for generating the proof for verifying the proof for generating smart contracts that can be deployed and verified on chain you know the it's it's all these

cryptographic implementation of the zika snap concretely the growth 16 protocol okay that's so the snark js will how do how do i say this it compi it compiles into a groth 16 curve like how do i what's how would you say what's the interaction so so you write the circum language you compile it with uh circums so you have like two files if you want there are one cs constraint okay uh system it's just a file with all the constraints in there and then you have this in general it can be wasm or c plus plus but imagine that's a wasm file that computes uh that actually computes all these intermediary values

okay so this is the output of uh circum so snark js what it does is well first of all you need to run the trusted setup ceremony the so uh snark js first includes all the tooling for this trusted setup includes all the powers of tao which is not specific to any circuit uh and generates all these ports of tao i'm just i i'm sure you you covered it yeah we did an episode on the trusted setup but yeah just let me ask people just please collaborate to the trusted setup ceremony this is really oh the perpetual powers of taowan you mean yes yeah that's that's important on that but that's this is right now it's like a second

it's a second implementation of the of this multi-party ceremony it's the independent implementation which is important even for the same ceremony because at the end you end up just trusting a simple software right now we have two different softwares that are covering that are doing exactly the you know exactly the same thing so it's more difficult to that there is some problem in in the software um wait where is this this is in snark js or this is this isn't snarky yes this is not gs so we have this powers of tao uh ceremony yep then you take the the your specific circuit you compute like the first key but then you need to run this phase two this is

also phase two of this trusted setup yeah okay so that you have also all the tooling for running for for running your trusted setup ceremony on top of this circuit once you have this setup set so you have like a proving key and a verification key so with the proving key you you want to prove something so you need to well you have an input to the circuit you need to run the circuit with the wasm file that we you had back at the beginning so you get all these the windows but you get all these intermediary signals okay and with this intermediary signals on the proof and the proving key you just create the actual proof movies you know it's a very short uh it's like less than 1k uh less less than 1000 bytes it's like 200 bytes

or 300 bytes of that's actually the proof and then you once you have this proof then you need to verify that so you have to verify that the verification the verification you put this proof maybe you have the public inputs or outputs and with the proof and the public input or outputs you can verify that actually you run the circuit in a way that this public input are not puts much and with this proof you can cryptographically uh verify that this was actually done that way and and yeah and then you can also with the snare js you can take this brief verifier and upload it to the three blockchain

and uh yeah and you can you have all the tooling on that and the cool thing also for us in rjs is that it fully works in the browser which is uh very important you can do all these ceremonies and you can generate the proofs you can verify the proof you can do all these all the tools it works in the browser it's the full tool right now and this is the last updates uh it's fully brightening in wasm so it's very optimal code it's run also with workers in parallel so it's uh of course it's not native hosts uh the generation of the proof but we are getting closer to there maybe it's like two times three times uh four times slower but not 100 times as low so it's just it's an and and this is very important you know if you want to have for example

there is a project that's uh doing that for for voting the voting you probably want to do the you want to generate that proof probably in the browser so so so you need to run there so this is this is the importance also for snarky yes this is that you can do that in the in the browser does it work with anything other than gras 16 not currently will it yes we will see actually in my to-do list i want to really get deep in plonk at some point but right now we are we are very busy with the hermes launch but i hope that after the earnest launch we can have some time to get deeper in the plonk and all these new versions you know all these new uh turbo blogs and all these new uh

add-ons uh based on on planck that are very very exciting and very interesting and i think that their uh snark js and silcom can be used for for those new um schemas yeah and maybe someone that already has not been invented yet ah i think that it's a fair trade-off i mean if you talk about people who actually want to build applications with snarks most of them are still extremely skeptical to using anything other than graph16 because basically nothing else has been used in production like for real uh real value attached and it's it's questionable like we've had many conversations with cryptographers on this podcast

who go like yeah if it was invented in the last 10 years you probably shouldn't use it uh and yeah it's like i don't know i think it's a fair tradeoff to say it supports crosstalk 16 and then like once something else is really proven you can start building out support for that but i mean it's also like smart.js is as i understand it now like a complete toolkit for someone who wants to build an application using snarks right so it's it's the whole stack including like deploying a verifier to to a chain and so you you want that reliability there you're not you're targeting someone else than a researcher basically yeah this is when you want to create a real project that for real your project

that will will hold uh i don't know we expect millions of dollars there you need to consider very much these decisions you know that you need to assume some risks i mean you need to understand exactly what risk are you assuming and you need to cut at some point here for example in in nerms we decided to launch with zika snarks this is a known technology with still a lot of things the only i would say that the point that we are risking more and here is where at least this if you want is our point uh that we are moving forward is uh mainly posted on poseidon is a hash function inside inside the snarks this is a less less used it's not used in z in z cash

they are using pedersen hush here we we are betting composition i know that there is other projects that are using these already in production but here is probably the most risky uh primitive that we are incorporating yes that's that's uh we assume that we we know that but you know at some point somebody needs to i would say that every project needs to include something uh in there so i we believe that poseidon is very new but we have a strong confidence that this is going to be a good hash function and maybe we are wrong and you never know it but that's but i think it's uh we can assume that and that's uh it's a it's a bad but

yes what's what's the most critical from the cryptographer at least from the cryptographic perspective what's the most critical part of uh irma's project was poseidon that's uh that's what gets me more scared let's actually introduce this project you've mentioned now hermes hermes roll up what is this project exactly hermes is a roll up very much as standard ck roll up as we understand and the main differences here is that we want to airmess we design it with decentralization in mind also the other thing that we are in including is all this proof of donation we understand that we are running on top of a layer one

so we have uh in some way we need to promote we need to help we need to just put the work you want there but we need to uh grow together with the layer one so this is the proof of donation and the idea of this proof of donation that's like uh 40 of all the transactions fees that will be collected from the hermes will go to the layer one the community to the community funds where are you collecting this from maybe you can walk us through where that collection point happens yeah this is so how it works there is so here is who can be an operator the operator in the rollup is the one that just collects the transactions embed them in a batch and then send a transaction in layer one

including all these uh transactions single player one transaction that's the compression that's leading the interval up so here the idea is how do you select who can be that coordinator okay uh so this coordinator uh well one option could be just to centralize it it's a centralized coordinator and that's it that's the easy part and here we are betting for a more decentralized lesson right system and here the idea is that everybody can be a the idea is that we divide the time in in ten minutes slots and then you beat to buy this slot so you i want to buy this a slot and then it's an auction the one that did i bid to be a coordinator during those ten minutes exactly okay

exactly and the winner the one that's willing to beat this willing to to spend more money this is the the one that really uh gets the chance and during these ten minutes you can forge as many batches as you can so you have a good hardware and if you have a you can create a lot of transactions then looking for you you send transactions and but you will have to pay your cost so you cannot put like high value there because it needs to compensate for you it's an option so from this money that we collect from this auction it's uh uh 40 is burn uh 40 percent goes to the community to this you know this community fund in some way we will start using

well this we don't want to get very much distracted from that so with this we will probably at the beginning we'll use this quadratic funding on bitcoin but at the end it would be we we will not even decide that so probably we'll send it maybe to the ethereum foundation and three information will send it here so it's just we'll go to the layer one so we we this is uh something that's community funds we don't we we should not be able to decide how they get spent how they get you know they need to get for the layer one so that's the the and then what's the last twenty percent where does that go twenty percent goes to the go to goes to the investors it's gonna be uh kind of a token that people that has this token then we'll get this reward what's the point of

burning tokens yeah the the idea of burning is that uh if you send it to somebody else uh then you can cycle uh the money it's like i'm i'm i'm betting for something but i can bet a lot of money because at the end uh the recipient of this morning is myself so it's like and then you can you always win so there is that you need to be a huge amount of this percentage that's born actually this is like 40 is burned directly and 40 more is is in some way we don't control that this just goes to the community so this 80 should be more than enough why not send all 80 to the community well that's that would be another option but we also are we the problem of sending to the

community we are also afraid that there may be some some some feedbacks it could be some corrupt in some way so i think that having 40 that's burned for sure this this this great uh well we know that at least so you are going to a loss a lot and then we have like 40 percent that if every everything works okay it's like an eighty percent of burn if you want okay so that's that's that that's a little bit this is a hand wavy yeah it's a little bit that's but i think that are uh good starting points and well at least we want to maintain that and see how it works that's the the individual or the this this bid this auction at the beginning there's this person the personers entity

who's trying to get to be the coordinator on the batches is that what you called it a coordinator i'm forgetting no yes coordinator yeah sometimes yeah sometimes yeah operator but it's more it's better coordinator is a good name yeah okay coordinator or operator on the batches they're paying but what do they get like why would they do this well they get all the fees they get all the fees of transactions so when you are sending a transaction the transaction there is a fee so they are collecting all the fees of all the transactions they are including you know the batches that they are generating i see and you know that that's going to be enough that it matches their well this is what uh coordinators needs to in some way uh optimize and and that if there is a lot of transactions with high uh transaction fees then they

will maybe will be able to to bet more and or maybe they have a good cause you know they have a good uh systems that they can run it very cheaply and they can generate the proof very fast and they have these competitive advantages with the other coordinators this is actually their margin so this is where they can they can bet on that i i just realized something that maybe i'm not fully clear on with the roll-up concept but is there actually gas on the transactions within the roll-up because that seems it is it's a transactional fee it's a new new legion but it's not related to the actual mainnet transaction fee in any way it's uh it's not related directly but at the end there is a fee to write

to change well yeah at the end the coordinator the coordinator needs to uh create a transaction on the main net and he needs to pay for the fee for the for the gas in the main net so in some way they need to yeah well you need to include this they need to include this this cost in the people's transactions got it but the thing is that the cost of these uh roll up transactions is gonna it's gonna be like much lower maybe i don't know 50 times less yeah yeah but you're still like so it's like the overall main net transaction fee will be smaller because it's batched exactly and that has to be included in the transaction fees in the roll-up but you still get a disk you get a much discounted

transaction exactly but this is important because uh people think that the roll up transactions are free and yeah and aka me just now yeah okay they are not really free so it's like oh i can't promote them okay i can i can make you a gift and it's going to be free for you but actually somebody needs to pay the gas of the proof and here is where zika snorex are unbeatable physical snarks are unbeatable in the verification in the verification cost and in the proof sites and these parameters is very important especially with this uh high gas fees in the ethereum so that's why zika snarks is still the best schema zero knowledge schema if

you're just taking account this parameter you know the cost of the verification on chain it's still it's like twice it's it's like half cheaper that for example a plonk or i don't know many times cheaper than starks or any other uh any other schema on there so zika snarks is still a good maybe it's like it's not like the last trending in the zero knowledge space you know it's like every every hollow and and plonk and it's like appearing a lot of new things which are cool and i tell you it's like i we need to get in there it's not i'm not i'm not gonna say i don't want to say that they have good very good properties you know they don't need this trusted setup

they can you can some of them you can use some more uh normal cryptography inside the circuits so there is a lot of advantages of these they have recursion they have a lot of advantages on these new schemas i don't want to say that they are bad but for the specific parameter of the verification cost in the main chain uh zika snarks are still the best and you mean the zk snark with the trusted setup and so that's the big disadvantage zika is not a good auth16 with a trusted setup yeah with the trusted setup yes that's an inherent nature of the of that structure know the cryptography but also because ethereum doesn't support any of the other

cryptography so i mean if you wanted to deploy something else and there wasn't you know an erp for it first then it would be a thousand times more expensive because it doesn't support the crypto i was yes and no so first there are some other for example plonk it's supported if you are using the bn 128 uh corp so it's supported by ethereum but even just uh forget about ethereum just uh see the the the cost in the math yeah and the size of the proof you just see how many bytes the sites have i don't care just forget about the the the cost of the block processors what's how big is the proof and how much just takes

a regular cpu to verify your proof i have a follow-up question on the fees because well i wonder how are the fees for the on the operator side calculated because as you said that the operator has to pay something which makes me think that they will have to like be able to set some minimum fee at least or maybe decide the fee entirely but then you don't have the same fee structure as on ethereum where like that the user can you know kind of bid with their fee right like if i pay more maybe i get included so how are the fees actually decided yeah the fees are decided very much like any other blockchain so at the end is the operator can select the transactions

they want and they just include them in the batches if they are reliable but because this gas cost and because these uh variable costs it's gonna be for sure a minimum a minimum feeder but here is uh something very specific from the for for the coordinators and the coordinators probably have to distinguish two situations one is when they are running at full capacity uh and the other is when they are running under under the capacity for under the capacity this is going to be this is going to be probably easy it's going to be just a minimum a minimum fee that will be set up by the by the coordinator and in full capacity it's going to be very much what we now know

in ethereum or bitcoin this is like an actual yeah an auction and you just depending on the moment of the day you will have to pay a little bit more or less yes but there's a there's a difficult problem where if the operator says okay i'm going to pay 10 in fee 10 something and um so they said you know i'm predicting that i'm going to get 10 transactions so i'm going to charge each transaction a minimum fee of one but then they only get five transactions do they still submit the block kind of on time quote-unquote on time or do they hold off until they get 10 or yeah that feels like a hard trade-off for the operator there is an optimization problem there that's one of the things that we are

working there and it's uh this is one of the one of the nicest models of uh hermes that we are building but this optimization problem and let me add you on top of that this is with uh we are doing that with millions of transactions we are scaling so the the difficulty there is that's not half 100 transactions there we have uh maybe i don't know one million transactions that we need to select which are the right ones and make this kind of decisions once you once you earn the auction then this is like a sunk cost so at the end as far as you are you need to understand very much what's your variable cost uh of the fees and

and at the end it's just uh that's a decision problem it's like how much transactions what are the best transactions that i can get how much i get on that and it is it profitable for me so generating these transactions transaction or maybe i need to wipe maybe you need to buy or if it's enough then you just send it there and it's yeah it's an optimization and it's it's this is one of the difficulties and one of the nice things that needs to be called in the in the coordinator site writing coordinator it's uh as i told you it's a interesting engineering problem it might also be a little bit like uh just we have to accept it as a variance problem that it's a repeated game we have to play and kind of like mining

you you're mining and most of the time you're not winning and that's just on cost and you're losing but then every once in a while you win and you get enough to recoup the losses yes this is this is something that maybe the technical people is not very used to but if you talk with business people this is actually what they are doing all the time at the end it's managing the the risks and evaluating the risk and decision making and this is something that's uh very studied from the in the operations uh you know if you talk any operation manager of any big company that's mainly what they are facing or all day it's maybe it's an unknown problem for many of the depths that has they don't know this uh subject

but it's a known problem in the industry in in the other industries you know in the production industry and other manufacturing industries we actually are almost at time but i have we're close to the end of our questions too so we're on track i wanted to ask is hermes a concept or is it a full-fledged product like would somebody come along and build with hermes or on top of hermes using hermes as like a structure or is it going to be a dex of itself no no it's a it's a hermits it's going to be a public rollup you know it's a hermes that everybody can use it's everybody can use to make payments on top of that it's not going to be a decks but it can be decks that can be

built on top of that but you guys aren't building that we are not building the the cool thing of one of the interesting properties of of hermes is that they will include atomic transactions and atomic transactions you know for you know for swapping one uh one token to another token and this is very very it's an important piece for any dex that wants to be built on top of that but it's just a primitive that arms will will include how does hermes really stack up against the other rollups that already exist so there's like loop ring has come out and there are these sort of off-chain layer twos like diversify that also you know are using snarks and bringing like some of these transaction data back on chain how does it distinguish itself

well there are different projects and each one has his ways to understand the technology and i would say even many other ways for example if you compare with blueprint that by the way it's an incredible project and it's a project to later on it's a very like an inspirational inspiration yeah so it's a very good project on that so it's uh for example uh lubrin is more a dex itself and it's uh uh more descent the concept of this centralized coordinator which for the kind of project they are building is it's okay but what for example we are trying to build a more decentralized uh coordinator system here we include this proof of donation stuff that i think

this is something that's new needs to be tested and this can be used in other roll-ups for example in maybe some optimistic roll-ups or some ways to select the coordinator so that's a cool idea it's idea that comes from battery white hat and and i think that's uh something that can add a lot of value to the space uh also this uh proof of donation that you are giving back to the community to the layer one i hope that other projects uh in the uh in layer one follow this layer what to just follow this schema to you know just to to maintain or to help maintain to help improve the layer one i think this is important for the space that this happened and also the you know

the the strategy for promoting for launching we are also building uh wallets we are building apis so with dns we're building a project there what you just said there though that idea of like contributing back to layer one i feel like i mean two years ago it's i just don't i i did not think we'd be in the position where there's so much value on layer two that you actually have to think about maintenance of layer one but i guess that's what's happening right i tell you my point i think that at some point everything all the value is gonna be in layer two and layer one wow it's gonna be just uh you know later two trs now these transactions of uh of operate of coordinators

on that if this is like um extreme and it's gonna be a process but uh layer one that do not scale and it's gonna be very expensive so uh uh when we go to main stream we will need these uh layers too and layer one is gonna be just for these uh highly valuable transactions at the end are gonna be the layer two the transactions that come from layer two and you know i i do not have a crystal ball but i think that the the blocks the space goes in in that direction but what about like so once if eth2 comes out though what happens like as i understood it roll-ups will probably still exist on shards when eth2 comes out like it's still going to be relevant but like isn't it supposed to solve some of the

things that layer 2 solves for for me roll up is very much what in ethereum 2 is called an execution environment okay at least the roll up is a kind of execution environment so the way i see it and maybe i'm not the right person i'm not an expert in ethereum too but how i see it is that uh ethereum two will be mainly uh that availability so you want to do a transaction so you will publish this data in some charts somewhere and then you will get this data and will include in some execution environment roll up if you want to call it roll up uh that will be managed in then in some chain so it will be this state will be updated yeah so you will you will update some some state

according to this so this is how i see that uh how the scaling will will work you know you need that availability that's why we need all the sharding stuff and then you need these execution environments if you want more apps that can execute thousands of transactions it's like it says thousands of transactions but with a very small cost for the consensus environment and and there is where also gets importance this enter into roll-up communication or interlayer to communications that's all these things they are happening already start thinking about sometimes they mix it with this inter-sharp communication but it's like for me it's in their inter-execution environment communication and value transfer yeah and that's why this needs to be evolved and

think very much on that but that's how i think that the space will evolve and how we'll scale would you say like is sircom i'm going to kind of go back to what we talked about earlier in the episode with sircom specifically but do you feel like sircom is in the ethereum toolkit or could it be used by many different things it's pretty broad right it's not written in solidity or anything silcom is it's for writing circuits and you can use the circuits wherever you for anything i shouldn't have said writing of writing yeah because i know it's a language but more like it's not it's not deeply connected to ethereum tooling no the only connection point is mainly that i'm a i'm an aesthetic community

member so for me it's like uh for me i'm thinking with a serious mind uh that's but that's a very weak connection and and the other thing is that are you seeing it being used in other places yes yes yes circum is used in many in many projects and a lot of projects maybe they end up using leap snarks or something else but although there is a lot of developers just a circumstance by the fact that's introducing so many developers to the zero knowledge space it's so important for for just for that okay so that's i mean at least for that is there is enough volume silicone just with that and and

of course silcom is much more on that you can really build real and for example hermes one of the goals of hermes is we are using silicon for developing all these roll up all the roll up you know other circuits are going to be writing in silicon and this is also a uh it's an important uh milestone for circle because an entire roll up built on it but like did loop bring not use circum no lubricant i think there is well they know silcom they start building something on them but they are losing as far as i know they are using uh lip snarks okay as far as i know but it's no i at least this part i think is not open source so you should ask them actually that leads me to like who are the people building circum and hermes like what is this a

how many contributors do you consider kind of part of your team let's see let's see circum is uh well we have some cooperators but may circumvent very much myself you know it's a silicon snark js i would say that i'm 90 a lot percent of the code is written by myself the other thing is hermes hermes mainly it's uh it's the full ident three the fruit the foreign yes we we frozen a little bit the identity and we focus so we put we are like about 20 persons uh developers working there and um we are at this at this moment we are full steam uh preparing hermes we already have like a couple of uh two proof of concepts in s nets and so on

we are just you know adapting doing some changes and rewriting the factoring some some models and right now we are full steam all most of the team just working on on that and that's well that's exciting but you know right now it's like we are in in launch mode you know just we are just going uh first team so the last question i have that i didn't get to touch on what is the proof like where is the proof of donation and what is that actually well it's like it's a way instead of saying proof of burden that's what sounds like really bad it's like at the end it's like you are actually in in order to select uh an operator you need to prove that you actually

made a donation i see so it's like proof of stake where you stake money but here's proof of payment exactly it's proof of donation it's like you are proving that you made a donation in this case through an action but yeah you are a coordinator if actually if you prove that you make this a specific condition that's where the name came from so does proof of donation have is is there like any consensus principle to it or is it just a proof as in like a like a hash or something consensus in this layer two it's the consensus protocol everything happens in layer one yeah that's uh that's the thing and proof yes because

there is a transaction that you can proof that with that transaction yes okay so we're at time and uh it's unfortunately time to wrap up and and end this in some way uh it's been fascinating talking about what has been done but um we usually end on this uh this question of looking forward what are you looking forward to and what's exciting to you at the moment well right now as i told you i'm very very focused in launching hermes i hope that in the next 40 minutes so and next 40 minutes or this will be launch but if you go a little bit further and for me there are a lot of interesting things that will happen one of the things that i'm very very uh interested and it's something that's

very excited is the for example all these uh massive migrations that means that moving dna is transferring uh it's massive transfers between one layer two solution to another layer two solution this is something that we start talking having start talking about and start being a debate that is between prolapse communications that's really important site of course there is ethereum 2.0 that's very important especially for the data availability site it's it's going a little slow but i'm very excited because uh i hope that uh theorem to the zero will solve this uh that availability and this will increase a lot of the scalability and so on then there is this all these

uh recursive you know all these recorded snarks where you can start uh you know this uh there is some projects that already have start working on that that you can have privacy inside the roll-up or even smart contracts inside the roll-up that's that's very exciting then there is all the identity that's still there uh we hope that at some point we can have a full compliance uh roll up just uh linking that with all the identity that's we want to continue and it's a project that's it's not so it's we are we are continuing there right now we are focused on on hermes but identity is still there right now my goal is it's earnest but but the identity is a really important

project for the space and we have the commitment to continue uh working on that well yeah you know just all these uh new protocols that are appearing like every week and and new projects you know super exciting projects i don't know last week there was like a couple of projects that were very very interesting i promise i'm promising coda and uh and uh this was again pickles because that was very interesting all these recursive just to to you know just to verify the full chain that i think that's a very very cool project too and there is a lot of new projects in the space that are happening and and at the end is my my goal is that this all this happens

so that's so it's you're on your way then yeah exactly cool well thank you so much for coming on the show jordy thank you to you finally i can't believe it took us so long whenever you wanna i'm open just uh let me know cool thank you very much yeah thank you and to our listeners thanks for listening thanks for listening