#DappCon22 : Day 3 - Major Learnings Building The zkEVM, Jordi Baylina

Transcript

for the next stock when I have Jody bellina and he's going to be talking about major learnings uh building the ZK AVM [Applause] hello good afternoon everybody I am Jordan I'm the technical lead at polygon Hermes

today I'm going to explain a little bit of the all the learnings and a little bit how we are building the zkbm it's my presentation is going to be a little bit technical I'm going to try to go a little bit fast but you know any questions you have at the end you can ask me or any of the team members that are right there so feel free to ask and and see how we are building that okay so let's start so mainly what we are building is a zkbm the IBM that we are building is from the user perspective it's quite easy to explain the days that the user should be able to use any of the tooling of ethereum he could go to metamask and just do a transfer

can do a maybe to remix and have a smartphone track compile and deploy smart contract so a normal user should not notice any difference uh by deploying to ethereum by programming to ethereum to deploy into an layer to layer one this is the goal and this is what we are trying to to achieve the network well the the system is has like many many pieces you have the bridge we have the smart contracts the the node I'm going to focus very much in the proverb because is what distinguish between the kbm and an optimistic roll up and it's probably the most difficult part that we have to that we have to build okay so what the

Proverbs have to have to do well the prover starts from uh it's a well it's a circuit it's a zero knowledge it's a deterministic program you want to you want to see that that it takes the Old State Route it takes some transactions these transactions are normally feeding transactions and I want to highlight that because it's our transactions that are not signed differently or have different format they are rlp normal ethereum transactions generated with any tooling from ethereum and it computes a new estate and this transaction should be processed the same way that ethereum process transactions if you are doing a transfer you're doing a transfer if you are deploying a smart contract you are deploying a smart contract if you are doing a call to a Smart contract it's actually Goods a call and if this smart

contract also another smart contract then this needs to happen so we should it should work exactly the same way that ethereum does so how we build that okay if we want to do it like in a traditional um CK systems we have the we have what we call the our one CS systems here for example we have our 1C assistant it's just uh like this is very much like writing uh like doing a uh an electronic circuit with just with Gates that do a computation but it's a case that they don't feedback they just you you put some inputs with these Gates you compute a deterministic program and at the end you have the solution as you can imagine this is quite hard quite expensive you need thousands well thousands of

millions of millions of gates if you want to do sdkvm and this is not uh not practical on that so well we had to invent an equivalent in equivalent to the to the equivalency to the hardware we need to mend what we call it the clock okay so the clock the day is that we have a smaller circuit and the idea is that which could distribute many times okay this is what uh uh well this is what we call with polynomial either this polynomial entity language because instead of having signals we have like an array of signals an array of signals we can we can represent that with a polynomial okay and the idea is that we have a state transitions so we can from each each part of the polynomial so it's it's from one state to the next state we

have some some some Gates or some constraints and then the idea is that we we have state machines and if we have stained machines then we can build processors and once we have processors we can create an assembly and what we do is we program so we created a processor with this arithmetization with this uh system that's executing execute shooting an assembly code and this assembly code is mainly an inter an interpreter of an ethereum of an ethereum State machine this is the idea of how we are building this okay so we have like these two two big pieces one is the arithmetization which is a quite a small circuit and then we have the the assembly okay so let's see uh how we are multiplying here

give a big highlight on how we are doing this arithmetization so that the people we understand how it works to understand this the idea of a sustained machine I'm going to show what would be the hello world of of pill this language that we created in order to create this Arena meditation or this Hardware if you want to to to to with this equivalence okay so here we have we have um well we want the problem we can set up this problem this is a hello world problem the idea is that well we work in a specific field and then we have a we have a number and then we want to find two numbers that when we apply a Fibonacci serious uh [Music] 20145 times then it gives that number so

that you know these two initial numbers say a01 A1 that applies to this we can do that in circum easily this would be just a loop in the normal circum but we want to use pill so in order to use steel we need to Define State and a transition state in this case the state is the last value and the before last value and then we Define this state transition function so how we are what what are the next value of these resistors okay so in this case we said well that the before last value is going to be the last value and the last value is going to be the addition of the last values so we have this state is this is very important because this is a state machine okay and again if we have a sting machine we can build the

processors we will see it we will see it later okay so we have this set of values that are the values that these registers happens in everyday place this we call it the trace okay and we can represent that with a polynomial a polynomial at the end is as I explained is simply a set of values it's actually our evaluations to to different points and then we have these polynomials and we Define these State transitions so how we write that how we write that in pill okay well um if we were if we write to write that in pill the idea would be this we will Define the before last and the last and then we would Define this state transition in this case would be that before last

minus last uh equals zero okay and then the last is equals to the before last process so the prime means the next one and here we say that the next one is this one the problem here we add this is last at the beginning because uh the problem is that this state transition function is to fulfill in all the places and including the last one with the first one because this is a uh this is a rotation so it has it gives all it gives all the way around so in this case we we add here with we call it a custom polynomial support a fixed polynomial that's exactly the same that's just zero to all the points except the one that's one this is fixed is part of the verifier if you want it's it's a pre-computer polynomial and then we just

add this this constraint okay so we say is if if his last is one this is zero that means that uh what whatever value you put at the end is going to fit with uh with uh with the first one okay and then we also Define a public input in this case would be the output this is what we will be sharing the circuit and then we here we Define that the condition for the for the for the public output yeah so this is how the idea of how it would work uh uh a single state machine this polynomial well of course for if you want to write the full circuit we need to write of course we need to compute the pre-computed polynomials and we need to compute the trace we need to actually execute in this case would be for example have a two inputs and then we

evaluate these polynomials at all the point so we built all the trace so once we have these polynomials that and we have this pill with these identities that needs to fulfill then we are done with this we have the the the the the tooling is we call it uh pill Stark that we actually automatic basically we can create a proving system a stark proving system for generating a proof and a verifier okay so this polynomial identity language is well it's more com you know it's more powerful than that for example can do permutation checks not only check you know State transitions but for example we can say that one polynomial is a

permutation of another polynomial so that the values in one polynomial are the values of the other polynomial we can also do permutation checks in multiple rows and with a selector so that you have like maybe two this two columns this needs to be equal to these two columns no matter the order and but only in some specific lines so we can do that and we can also do block apps okay so blue cap is just an inclusion so that all the numbers in the first uh polynomial must be included in the numbers of the second polynomial and of course we can do that also in a multi-row and with a selector so all the numbers of the selected two columns must be included in the last one okay so this allows us a lot of flexibility we have also an idea of copy constraints

like there is a we can have a polynomial and ideas that we want to be sure that for example the first evaluation the third the fourth and the fifth are the are the same so we Define this with a constant polynomial but just a permutation of the identity polynomial of the X polynomial with rotations with all the values that are that needs to be copied or that needs to be the same okay and of course we can do that in in multi-value so with this we have a actually we have plonk okay so with this this is for example this is the plant paper which here we can Define this is an example of plan people that is familiar with plan they will recognize these polynomials and this is the conditional subplot but this is as you can see this allows us to extend much

more than plant because this allows allows us to Define custom Gates we find different permutations have different uh stain machines that are Computing different parts and connect them and connect them together okay actually we combine that also with with circum with circum we added the concept of custom templates or custom Gates and there is that you can combine uh plonk and you can combine plonk and circum so there are pieces that you want to have stain machines like more for like processor likes and others that are circles for example ketchup is very much a circuit and it works better with uh with silk with language so we can combine both things and call one from

the other on the other of one so we have the best of of Both Worlds here so this is all the tooling that we built uh we used to build the the the we used to build the the KVM okay so we have this tooling this is Spill Stark that actually with once you have these polynomials constraints so we have for this polynomials that needs to fulfill these specific identities we can generate uh Stark and not only that but we also generate this this tool also generates all the recursion so it regenerates the Stark that verifies the Stark and you can aggregate them and all this is quite automatic uh with this tooling by the way this tooling is absolutely open source anybody can use it and it's it's available for for for

the people okay and the other thing that also includes this tooling is that you can also verify this Stark with uh with uh with problem 16 so with a normal circuit that then you can use as an rjs or a rapid snark to to prove the last one so we don't have the this for example the we can verify a stark for a stark with just with the gas cost of a normal glow 16 in the last in the last in the last part okay but let's go up let's go back to the let's go back to the to the proverb okay so let's go let's go back to the how we built the circuit okay so well in order to build the circuit we need to build uh

we need to build uh a processor okay so processor is a state machine we have some registers we have some operations and then the status of the next resistors depends on operations that we are having okay so in this case we have on the operation the operation is a set of polynomials we could pack that with a single number you know we could have a polynomial with the values and each one is instruction but actually we have like many many many polynomials and it's each one is part of the instruction okay as part of the instruction we have for example in a in b and c and d in E set a set D said c said dncd okay so here is how we Define the how we Define the next step we we create that an intermediate value here the intermediate value is if

in a is one is going to be a if in a is B is going to be B and the others are zero so you can you can have a selector you can add them also you can add a and b or okay and then is this the operator and then we assign a prime if well if it's set a it's one then we are assigning this value to to a and if not uh we just keep the last we just keep the last value okay so for example for doing a move between register a and resistor C in a would be one c c will be one other registers will be zero and then this this uh this uh equation would hold okay we have also part as part of the as part of the instruction we have

like a constant value this is very much for immediate instructions when you want to uh well just assign a specific value to a register and then we have also a special special polynomial we call it Fringe and this is for not for the for deterministic and a lot of time is very useful for example you want to do a division division is quite complex so the idea is that you put the result of them so you put the result of the division and then you check the multiplication it says the division by time version of the multiplication so some instructions allows you to put some value of course you need to be very aware that when you're putting some value then you need to check uh after okay as a normal process as a normal processor we have a program counter a program counter is uh you know it's a

register that tells you exactly which line of code you are executing from the from the ROM in this case okay and we have also conditional conditional instructions so it's as if this value is this then you go jump to this to this other place so we have a full assembly uh in that part okay for that we need to check some comparison and then just assign this new uh program counter okay um with this of course here with this we can this is a processor we can put an instruction so we here we are not forcing to execute a specific ROM so we can we could this will execute the the this would be a processor that would actually good but you would be able to

put any execute an instruction so how we force that the instructions are executing are not random and are the specifics that were in the wrong well the way that we are doing is quite easy we have all the instructions which is all the all the polynomials that represents the instruction in this case would be a net okay and here we have the program counter okay and this needs to be included in the ROM the ROM is well it's just a the numeration this is just the the the well the line number of the ROM so the first instruction is a jump and then so and then the line number must match with the program counter so that means that because there is only one line two in the ROM if I'm if I should have to execute the line 2 then

this this must be so this instruction must be that the one that's in the room okay so this is a way that we are forcing to execute a specific problem okay um we have also a memory a memory is a normal read write memory you can read and write the trick here is uh we sort so we sort out the access to the memory all the reads rights but we sort them by addresses so we have like another another state machine where we do all the reads and all the rights order it in the same but so we sort first by address and then by the the program the counter the program so the the line so the the execution Trace number that we're executing that means that all the reads on the on the fork in this case for

example all the reads and writes of the position three are done here and then this are done with a single register so we have a register with it's temporary using the register three and then we connect both uh stain machines with uh with the permutation check so all the instructions that were actually here must be included in there okay of course here we need to do a check to to be that this table must be sorted the right way but this is the way we Implement run okay we have other state machines like arithmetic State machine which those for example some 256 bits operation uh in there so this is a state machine that's specific to doing 256 feet operation and then here we have a lookup or a permutation check we when we

checked that the instructions that we are using that that we are executing in the here in the in the in the main in the main processor are also that we are assuming here that this multiplication is right but we are so verifying here so we we need to guarantee that this this this operation is validated in the other uh steam machine so here are some of the tricks that we learned during the during the implementation during the execution during this year on the on the acceleration of this state of of the ZK of the KVM okay the big picture of the the big picture of the so the of the of the circuit of course we have the processor we talk we have the ram we

already talked we have the ROM which is uh we'll really talk a little bit we have a storage okay so for the storage we we are using a sparse Mercury uh with some with some slightly modifications with the Goldilocks so that works that way it's not uh it's not particularly it's a specific Mercury that's very optimal with a hash function that's very optimal to work in this prime number and it's a specific and the storage itself is even another processor because for the sparse Mercury there is a lot of logic there so it's a kind of a so it's another suprocessor that's Computing the reads and the brights and and then with block up we connect it to the to the processor okay we have also the binary in the binary here we do all the instructions of that 256 instruction for

ads hope less than equal signs and excellence and so on we have also the arithmetic same machine and then we have the ketchak okay for the ketchak actually so now it's like it's a circuit but here the trick here is that we are doing uh with a circuit that's doing like many many kick Checkers at the same time because it's using each one is using a different different bit and we are be a block up we do the the gates the in the RX source and so on here probably the most one of the most difficult thing machines here is the or the padding one because the kitchen we need to pad that and then it's for doing all the padding we need to well we need to deploy that and this is a kind of a ROM and then we check on that but that's

a thing in there okay so this is very much the the the hardware we call it Hardware it's not Hardware here is polynomials but uh actually the static meditation we like to call it Hardware because this is the low level this is the where the things you know the the the the the metal uh on there okay so on top of that of course we have an assembly this is a processor we have an assembly and then in the assembly we need to implement the the ethereum we need to implement uh the the the the so the all the logic that the film happened okay and I want to show you here some of the the op code how it looks like a little bit okay this is uh

well this is for this is the part that we're we're [Music] processing the all the opcos here we have the ad the mole uh subtraction okay division so on but maybe we can go at the end maybe where there are some some more interesting once let's see here at the end um well jump destination here we have see the loops right there well here it's a lot of code right here yes you have returns we have here we should have delegate call here we have a

create two so here we have all the we have we have all the up codes of ethereum so that's why we are so much compatible because we are uh we are programming ethereum exactly the same way that that ethereum that ethereum does okay maybe another another piece is the our people are pre-processing when we get a transaction we need to to uh process so we need to parse an RP and all the fields and do all the logic that actually ethereum has okay so this is some example of the code everything is available isn't open source so you can you can take a look at the repo and and check how how everything is done here so uh yeah let me just

of course then with this with this we have the ROM after the ROM we need to create a proof here we have this recursion the recursion the recursion starts is very useful for many photo things one it allows us to aggregate many proofs in a single proof so this is one thing and the other is also that the proof is you can pack the profit the proof can get every time that you that you recourse one time uh it's getting uh a smaller so both things combined together just to have the last score of 16 uh the last growth system uh proof okay uh as I mentioned uh before with the ROM so we are very much ethereum actually we

are running all the ethereum all the ethereum test Nets we are we're using all the the helium suite for testing uh the compatibility uh this is the roll nut right now um more than 85 percent of the tests are are passing of course getting to Davis to get to be at 100 uh well as you get closer to 100 it's more difficult but yeah that's uh that's right there that we are testing all the edge cases and all the you know just underflows overflows uh you know you can imagine all the all the testing that's in there and this is well for us this is important because this gives us uh uh good compatibility and from the end user

uh should not notice the difference of programming in ethereum programming and programming here okay uh here I want to talk also a little bit about benchmarks here is well there is a little bit modification here from when I explained this number simply it's actually uh the the proof time right now that the the current proof that we are working and this is a work in progress but the the current proof that we have had this point is it takes about 50 minutes in a quite big 64 course uh GPU but the good thing is that it can process uh let's say 1.5 megabytes this is probably short it's probably it's much more than that but we are finishing to do the the finishing to the numbers but so that

means that and this is the important part is that the cost per transaction is going to be a subset uh Sub Center floor uh cost of transaction at this point and we still have a lot of margin to improve actually we are working really hard with uh gpus and fpgas and there are a lot of limitations that are in that to-do list that probably will will get these times these times this time it's done okay broadmob well but at this point we have what we open source that in uh two months ago we are working really hard right now in back fixing and stabilizing the different pieces of the piece um currently the the internal test net

is working quite well and yeah we hope that very soon we can publish the public test net with everything in there and then then we already started to to organize the the audit here having a lot of help for example from the video foundation and from even we are collaborating with other teams here because you know auditing auditing these systems is not is not easy there are a lot of new code and a lot of new things to to check and to double check and this is going to be a little bit challenging but we already uh we are we already start uh this this process and they are the ideas to let's see this is of course

this is not a commitment we are not going to launch anything until until it's safe and in saudiated and it's we have enough warranty so zero percent so 100 warranty is that that that's no boxy we will never have but we don't want to be crazy and we want to launch the things uh as more as safe as as possible so we need a lot of people to review a lot of people to check and to be sure that what we are launching let's see if we can launch that by the end of the year beginning of next year that's uh door hope okay so that's very much it but just before ending just that everything is open source if anyone is interested to take a look to check uh or even to using the all the all the tooling that we built for BBM building

other applications is available there please contact us uh here we are open in polygon we are very open to the community and to open to talk with any people that wants to use this this uh this tooling and that's very much uh thank you very much so thank you very much for the questions unfortunately we don't have time for that but everyone can catch up with him later and also the slides and the video will be available um and again thank you another round of applause please

[Applause]