DeFi Security 101 2025 - How Can I audit ZK circuits?

Transcript

staying. Uh, last but least but not last, we have you you you can hear me? No. You good? Uh, we have Jeffrey from Rare Skills. Actually, Jeffrey is a uh has interesting uh career and also interesting ideas of this space. We had earlier I think people mentioned that the material by ROS skill is one of the best in this space about smart contact about zero knowledge about Solana about many things and and you had questions about zero knowledge so now it's your stuff you're going to get one hour condense about zero knowledge take it >> thank you so much

[applause] >> okay thank you for having me here and giving me an opportunity to talk about a subject I'm very interested in. Okay, so let me just get like a background pulse over here. Um, who here has maybe wr written some code that directly implements ZK like with circum or written a prover or something? Yes. Okay. [laughter] Um, all right. Um, and who maybe if who's participated in like an audit contest that use this stuff? Okay, a few of you. Okay. So, um, for some of you this may be new, for others of you maybe not, but what, uh, the title is how to get into ZK auditing, but it's more just

about how to n first of all, how does it work if for those of you who are new to it and second of all, what sub fields are there and how do they relate to each other. Okay, so what is ZK? Uh, I'm going to go off the beaten path a little bit and give this definition. What I would it say people say it's an algorithm for proving that you know something. saying, "Well, that's not I don't think that's a helpful definition because I know of a certain color that I'm thinking about." But there's no way that I can turn that thought process into code. We need to have something concrete that we're proving knowledge of. And what actually happens in practice is ZK is about trying to prove that you have a system, a solution to a system of equations, something like this. I want to convince you that I know

the XYZ and U that are going to uh make this equation uh pass. Okay, that's really all it is. Nothing more, nothing less. Uh, of course, one way to prove that you know a solution to a system of equations is just to plug the answers in, right? I'm going to give you xyz and u. Now you know the answer. You can run the computation and yeah, clearly I know the answer to the system of equations, but that's not very interesting because if the equation is massive, which it usually will be, think like millions of lines, uh, it's going to take you a long time to do that. So if you are somehow able to prove that you know the answer to a system of equations using a lot less amount of data than the amount of variables there are then we would say

that's succinct. Um if the information I give you uh doesn't tell you anything about what the correct answer is right then we would say it's zero knowledge. Now maybe if if I'm giving you something that's succinct then clearly I'm not there some information would seemingly have to have been removed. So you might say, well, if I give you a lot less than the amount of variables, doesn't that already hide information? Well, maybe, maybe not. Maybe the the proof that I'm giving you is giving you some statistical information. Well, I can kind of guess that U is zero based off of what you told me, or at least there's an 80% chance that U is zero. In that case, it's not considered zero knowledge.

So, in terms of security and ZK and all of that, all that matters is, can I convince you that I know the answer to this? Can I do it with a lot fewer than four variables or whatever the amount of variables are? And can I do it securely? securely me. I'll actually talk about the attack vectors later, but um we can think about like we don't want to leak the answer or things like that. Okay. Now, when we look at an equation like this, that's like all right, that's cool, but that looks like something I would do in my algebra homework. How do we do anything useful with this? The whole point is that we want to encode these systems of equations in a way that express something semantically interesting. So for example I could say hey this is a polomial with roots at uh

who wants to tell me what are the roots one and zero. Very good. So this is a polinomial with roots at one and zero written in programmer equality form. All right so that's one way of saying it. This is a polomial with roots one and zero. But you could also think of it as well this is a statement that x has the value zero or one. Okay. So all right that's moderately interesting right? That's the foundation of all modern computers. uh this one is saying well x is either 1 2 or three right because those are the only numbers that you can plug into this formula such that the constraint is true so that's one way of saying it I could also say hey um x is an element in a set which has contains 1 2 3 that's another

way of saying it all right this is saying that uh x is 1 2 or 3 or and y is 1 2 or Right? So it could be the case that X is two and Y is three, but it's not it couldn't be the case that X is two and Y is five. Right? So we're saying that these are the range of values. Now we could stretch this out. This wouldn't be the best way to do it, but we could stretch this out from 1 to 21 and say, hey, my age is in, you know, below the drinking age or something like that, right? Okay. Um let's build this up a little bit.

Here we're saying X has the value 1, two or three and Y has the value one, two or three and X and Y have the same value. So what's what's another way of saying this? Anyone want to take a stab at it? There's a lot of correct answers. >> Uh yeah, that would be true. Well, what you could say is um well, X and Y have the same value. So, there's three possibilities. X and Y are one, X and Y are two, or X and Y are three. We don't know which of them is true necessarily, but we know at least one of those three statements is true.

Okay. Um what would be an equation that says I have X, Y, and Z? One of them is zero. I don't necessarily know what the other values are. I just know that one of them is zero. At least one. Anyone know how we would express that? X by X * 1. >> Okay, you're get you're on the right track. How would we include Y in that? >> X. >> Yes, that's right. Very good. What's your name? >> Thank you. Uh, okay. So, x * y * z is equal to zero. This says that one of these is zero valued. Now, y could be five and z could be 1337, right? We don't. It could be one of those things, but we know at least one of them is zero. Or at least it could be x, y, and

z are both z or all three zero or whatever. All right. Anyone want a challenge? How would you express this? X is equal U is equal to X or U is equal to Y or U is equal to Z. >> Very good. You guys see how that works? So if x if u is equal to any of these values then you have a term which becomes zero and the whole thing multiplies to zero. Now now now we can say something even more interesting in English which is u is in the list xyz.

You can see how I can what makes zk a little bit weird at first is I can have these formulas but with the right framing I can say something that's useful in English which is still mathematically enforced. So now now we have a statement about membership in a vector. All right, let's build off of that. I'm going to say U is an element of the vector that contains X, Y, and Z and V is an element of the vector that can that is uh X, Y, and Z. How would I express this?

>> Uh it's even simpler than that. That won't quite work because if the two left sides are not zero, you could you could find values that make them you could have like 5= 5 then that wouldn't force it to be the case. Okay, so I'll just give you guys the answer. The reason why I said it's simple, you don't even need to add anything. If both constraints are true, then that gives you an implicit and, right?

Okay, there's there's more um composable ways to express the boolean and but this this is not a uh a class. This is a a talk. All right. Um you can read the ZK book. Anyway, let's uh [sighs] let's do this one. Right? This is not we haven't taken too many far steps from what we've already covered. Don't worry. So what we're saying TUV is a permutation of XYZ. Right? So if the first list is 5 10 15 then 15 10 five is that that's an accepted thing but there can't be any if if if an element's in one list it needs to be in the other.

Okay. Would this adequately express it? I know the question at the bottom kind of suggests it's not secure but let's see if anyone can figure out why. >> Okay. Can you elaborate on that? Uhhuh. >> Very good. >> Nailed it. So if uh the first list um contains the same value over and over again, then you could just satisfy one of the terms.

So what you really need to do to prove a permutation is you need to have it needs to go both ways. Now this is not how we pro prove permutations in practice because uh the number of constraints grows quadratically with the number of elements in the list which is o of n squ is usually a bad thing right so there's there's actually very clever ways to do this in a more efficient way but again I would it would take me too long to get to that point to tell you I'm just letting you know but for our purposes we can prove permutations using this system of equations make sense because I'm not done yet this is where I'm about to do something more complicated all All right.

Now that we know how to do permutations, we can prove we know the solution to a Sudoku puzzle. Right? Because um if you have I'm not going to show a 9 by9 because it's massive. But here we're going to do a 4x4. Each uh row and column is a permutation of 1 2 3 4, right? And each of the subboxes is a permutation of 1 2 3 4. So if you create the permutation constraints for each row, column and subbox against the vector 1 2 3 4 then you can prove you have the solution to a sudoku puzzle.

This is this is not like because the permutation that we're showing here is this the best way to prove that you know the solution to a sudoku puzzle. Um no actually since we're dealing with a very small subset of numbers another thing you could do is say hey I'm going to map each of the numbers 1 2 nine to a prime number and then multiply them all together. And because of how prime numbers work, I'm there's only one product that can happen if they're unique. So that's a cool solution, but that only works if you're dealing with a small number of numbers because you have to remap each one. So there's uh several ways that you can go about this. That's one you you guys have probably seen on Twitter. There's a lot of fast progress with ZKVMs, right? A lot of it comes down to like, hey, this is what I'm

trying to express and here's the math I use to express it. But wait a minute, if I rethink my math a little bit, I can actually use a lot less constraints to express the same thing. That's where a lot of the advancements are happening. Okay. Um, this one I won't answer. But I've uh there's a constraint here that says each variable is from the members of 1 124. Uh the cell or row is a permutation of Z of Z. Oh, sorry. This this constraint over here says that the cell is one is 1 2 3 or four. Then we have row constraints, column constraints, uh row permutations, column permutations, and box permutations. So the question then

becomes is are any of these constraints redundant with each other? Actually, you can take a picture of it and think about it on your own. I'm not going to get into that, but uh figuring out if a constraint is redundant or not is a source of uh optimization or bugs because if you remove a constraint, then you can prove the wrong constraint, you can prove you know the solution to a Sudoku puzzle when in fact you don't. Okay. Oh, sorry. Sorry, I'll let you guys take the picture of that. Cool. So, what we just did was a bit mathematical, a bit philosophical, right? Which is kind of what makes ZK fun. And this is where all of the security questions come in. So, me doing all of these permutation constraints was kind of my way of presenting Sudoku. Did that actually

capture if Sudoku is relatively simple, but for a more complex problem, does that actually capture what I'm trying to do or is it just incidental? Um, right here we're just showing, hey, these are the math equations that I need to write, but this sits inside of a larger piece of infrastructure where you're transmitting data from one place to another. Um, is the size of your data transmission leaking something, right? Or the usable side channel things going on. Uh, right. We haven't shown how we go from a system of equations and a solution to something that is a compressed version of the system of equations and a solution. Is that transformation process secure? I'll I'll talk about that a little bit, but that's another area where things can break.

All right. Now, for those of you who are curious, thinking about getting into auditing, I'll just share my perspective having trained some people who actually completed the journey. That's going to inform a lot of the rest of this talk. Uh if if you watched this last part and thought that was fun and thought maybe I want to get into this, I'll just kind of speak to that. Uh everyone who I've seen by by uh who by saying become a ZK auditor, I mean they got hired by a firm. Some so that's that's kind of a I think a validation that they got to a certain point, right? But obviously some of them went on to be successful contest people.

I'm not counting that. I'm just talking about the people who went on to firms here. uh everyone who got hired by a firm as a ZK person had one of these two things. They already had a good math background and I'll talk more about what I mean by good math background because there's a lot of misconception around that um or they already were good at auditing solidity or the you know some web two thing or some more traditional area of security because the attackers mindset I I've seen I've seen people can if they have a very very good attackers mindset once they know the bare minimum of uh how ZK works they can start actually doing productive things in security right away. I've uh seen that happen as fast as a week if they were uh trained very effectively.

So uh but you need one of these two things. You know, if if it doesn't apply to you, then you know, sorry to be the bearer of bad news. You have a longer journey ahead. Okay. So to really get ZK, you you can study ZK directly, but it does require some background knowledge as I was just hinting at. Let's talk about exactly what that is. Um, and the other thing I want to say, I'm gonna It might look like I'm just dumping a lot of material on you and I'm giving you a road map or something like that. If you want to be and if you want to be successful in any field, you know, you you you don't really want to think about it as, hey, I take these steps, I get a certain goal, and then yay, life is happy after that. It doesn't work

that way, right? You have to constantly be staying ahead of the curve and constantly improving yourself even after you've accomplished some goal, which may be like, oh, I want certain contest earnings or work at a firm or something like that. So what I'm presenting here is more about hey these are the things I think you should block off 30 minutes a day to studying. Now the order and in which you do it may vary but these are the areas that are worth the investment that you'll actually see ROI in. Okay. So the things that are not related to ZK I'll talk about ZK in the sec in the in the part after this. Um but these are all the most common things that I see in ZK that are not directly ZK itself. math background obviously again I will

explain what I mean by strong strong math background because that does not mean you need to go off and get a math major uh proficient in Rust everybody in ZK seems to be rustpilled uh so you should you should know it uh not that hard cryptography algorithms like hash functions and public signatures in privacy applications it's very common to do um ZK for that like I want to prove to you that I know the private key for a certain wallet without writing a signature because then that's going to connect me to the wallet U so that's you want to know how those work. Uh and I'll talk about the degree to which you it's helpful to know it because obviously you don't need to be an expert in cryptography but you do need to know some things. Uh Mips and Risk 5 are the most common architectures

I see. So and these are pretty darn simple or even simpler than the EVM. So I I'll talk about how you can learn them but I'm just giving you an overview. All right let's talk about math where I'm going to spend the bulk of my time. Um, algebra is the number one thing. You have like we were just doing algebra, right? So, you do not you need to be very fast when it comes to recognizing, oh, this this is a solution to a system of equations. If you're slowed down there, it's kind of like running with metal shoes, right? So, you you definitely want to make sure that you're okay with algebra. Now, after that, there isn't any like one field that gets heavily used. I mean, abstract algebra does is a very common language for

expressing concepts inside of ZK, but I've seen a lot of people do just fine without they probably know less abstract algebra than a typical undergraduate math major would, right? Um, the thing though, you do want to understand abstract algebra and to get there, jumping straight from algebra to abstract algebra is a little rough. So, it is helpful to have at least some familiarity with these intermediate subjects where I've put a star next to Okay, now completing this math now I think in a perfect world you actually study all of these subjects properly and you study abstract algebra properly and this would not take that long like algebra can be learned in half a year and same thing for proof writing discrete math and linear algebra. So um even if you're moving quite slowly that would probably be like two and a half

years to complete all of this assuming like you're you're moving at a slow pace. Uh but my point is you you don't need to wait two and a half years to start doing zk stuff. Uh, but I think this is all stuff that you want to learn eventually and want to be making progress towards. Especially if you want to get to the frontier of the field and you want to read papers, you do need to be fluent in abstract algebra because that's the language that they use. These are nice things and absolutely not necessary. There's some stuff on here that I'm very weak at, but when I've read papers and reasoned through things, they're like, "Oh, I wish I I wish I knew that a little better." [sighs] But like I said, think in terms of lifestyle, not roadmap. If you look at all these math things like uh oh man

look at this this is almost like half of an undergraduate major. If you think on the scale of like 5 10 years this is nothing right so just make a little bit of progress these are the helpful fields and don't be in a hurry. Um so there's a lot and but I but I but on the other hand I don't want to push it in the other direction like you know you don't have to be that good at math. Sorry you do have to be kind of good at math. Uh some some people try to be nice like oh I don't want to be elitist like oh you have to learn math just like me. you have to be like me, smart and disciplined like okay I don't want to come off like that right uh but you will just end up spinning your wheels unless

you're you're fluent especially at algebra and if you want to engage with the modern literature you need to be familiar with some abstract algebra okay um but I'm not also at the same time there are some people who make zk seem way more mathematical than it actually is and it's kind of a problem with academia writers where they like to make the more complex I make it look, the smarter I look. So, I'm going to complexity max this paper. And I I like any normal person, I find that to be quite frustrating. So, um so I'm not I'm not saying that's a good thing. Uh there's a middle ground, but it tends toward having math fluency.

And this is what I mean by good at math. When people hear good at math, they think like, oh, it's a person who knows all the stuff on the left column. Um no, you don't need to know that stuff on the left column. And very few people know all of them. But the stuff on the right is I' I'd say this is the core stuff and anything on top of that is helpful. But at that point you're probably getting diminishing returns. Um let me just emphasize with the linear algebra thing. This is more as a stepping stone towards abstract algebra at least being comfortable with using matrix arithmetic because you do need to be comfortable with matrix arithmetic. A lot of things are expressed that way.

But do you need to know how to do spectral com uh decomposition and en vectors? Uh I don't really think so. But you do need to have the elementary parts down. All right. Um so how how do we go about it? I because like I said I don't there's two camp one wrong camp is you know you don't need to learn math. I'm just going to give you an intuitive explanation with nice animations that tells you what's going on. I think at the end of the day that's a waste of time because you're not going to be able to do anything productive with that kind of knowledge. On the other hand, I certainly don't think that you need to spend two and a half years talking mastering these five subjects I talked before you can start doing anything. Uh the way the ZK book works and honestly

pretty much every teaching we do is in order to understand this subject, what's the bare minimum number of prerequisites to get from high school algebra which is where we assume everyone starts up until hit understanding that point. Now in a perfect world you have a very broad understanding leading up to that point. So this becomes easy to learn but it's not a perfect world. So we spend a lot of our time thinking about well in order to understand a pairing right well there's a lot that could go into understanding a pairing in elliptic curves but all we really need to think about is the group properties because that's all that you're actually going to use in practice. If you want to peek under the hood well you can get it you know study the relevant math for that.

Uh but we still have to give people a lens to look at it through a group perspective. Otherwise, they won't be able to make sense out of it. Okay. Um but that's talking to rare skills. Again, if you want to engage with the papers and whatnot, they're not going to they're they're not going to spend all of their time trying to figure out what's the most uh prerequisite light way that I can think about this without um ex oversimplifying. That's they just don't have time to do that. It takes us a lot of time to write like that. Okay, so that's the math thing. Like I said, you don't have to learn all of the math first, but you do need to be making steady progress towards it. Rust is not hard. Um, it's a cool language. I'm going to shill my platform over here,

which gives you 700 uh problems to practice on. If you finish that, you have, you know, more than enough Rust. Uh, I think 30 days of regular study with Rust, you know, most of what you need to know because the hard parts about Rust, like the asynchronous and multi-threading stuff, doesn't pop up too frequently. people just more like Rust for the safety features and the really cool type system. And that part's not difficult to learn. So, um, but just when you're learning Rust, you know, don't if don't just like read books and watch video or something like that. You actually need to write Rust if you want to learn Rust. Um, and you're you're if you're if you're here, you're probably quite smart, which means that your brain

is good at tricking you into thinking you're learning when you're not. So, okay, I need to actually write Rust. they need to do the actual practice. So, your brain thinks like, "Oh, this is going to expend a lot of valuable energy. How can we get this guy to conserve energy because the survival instinct kicks in. Let's let's just have him watch some YouTube videos or read some uh tutorials or something like that." Yeah, you should do that. Now, I'm going to give you some dopamine so you feel good about yourself so that you keep uh not actually doing the hard thing. No, you need to be aware that that's a thing. Your brain is very good at tricking you into doing pseudo productive things. You can learn it in 30 days. This this is not like math where you it's a long journey. You can learn Rust in 30 days

or 90 days if you're very inconsistent. At least Rust to the degree that you need to know it because like I said almost every major framework in in the space uses it. Now cryptography uh how much cryptography do you need to learn? I think if you take the equivalent of cryptography one uh which is what most universities would call it that's plenty. It's worth having implemented the algorithms yourself uh one time so that you really know what's going on. Um, and then past that, I I mean, unless you really want to get into something like FHE or MPC or one of these other buzz buzzword things, just knowing the basics, like how does a public signature work? How does a hash function work? Uh, that's more than enough because in ZK like how do how do

private blockchains stay private? They actually use encryption, right? How does it work? You say, I I transmitted money to somebody else, but I encrypt that because I don't want people to know that. and I do a zk proof that says I encrypted money that I actually have. So you'll need to know how the cryptography algorithm works. But these are pretty rudimentary cryptography algorithms. So how long does it take to study the amount of cryptography needed? I mean a quarter in a university is about 10 weeks. So I would say with the equivalent amount of work you can know everything that you need to know unless you're going into some specialized field that requires some additional cryptography.

Um, the more math you already know, the easier cryptography will be to learn. But obviously, the later that you learn cryptography, the later that you will be able to more deeply engage with some cool stuff. So, it's a bit of a trade-off there. So, I would say with Rust, it kind it's it can be learned fast. So, just most of you guys probably already know it anyway, so just knock that out. But with cryptography, you have to be a little slow and you have to pace it with where you are in your math journey. Um, also again my usual bold text at the bottom. Uh, you know, just watching a video about cryptography will only get you so far. You actually want to implement the algorithm and they're not as complicated as they look. Uh, they're very hard to debug because if you mess something up, it's very hard to tell

where you went wrong. But that's a good skill to have. You learn how to build things very incrementally. Uh, okay. Virtual machines also something that's simple because MIMYPS and risk 5 are very simple. I've seen researchers on my team when we had to write about like register based architectures. They learned this in like a week. Now it was a week of full-time doing it, but like they actually coded a risk 5 virtual machine from scratch. It's simpler than the EVM. This is not difficult. You just want to know how it works. And if you're going to do the audits, obviously you need some awareness of the specs and how the specs might deviate a little bit.

So don't overthink this one. There's a good chance some of you already know it, but if not, don't worry. It does not take a long time to learn it. Okay, so the Rust and VM stuff simple. They're used widely in ZK, but they're easy to learn. I'm I'm assuming you guys are relatively mature programmers. So this is these are these are a time scale that I feel comfortable estimate estimating. Um math and and cryptography that requires a little bit more pacing. Uh but once you learn it, it's it's really going to help you for the rest of your life. And um that's ZK is a field of math technically. So you do need to know it. But don't don't fall into the extremes where hey I just want to jump into ZK without learning math at all

versus oh I need to master math completely before I get into ZK. I think both of those extremes are probably not going to work for most people. Okay. So having that out of the way you do this you knock out Rust. You knock out VMs. Uh you have a schedule for working your way through math as time goes by. Now let's talk about what you would actually be learning directly related to ZK because obviously if you know these four subjects now this doesn't mean you know anything about ZK. Okay. Now ZK is a big field and there's no one person who knows everything about it. So um what I'm going to be presenting here areas that you could focus on and I don't think any one person has it all down. So um obviously start here. My biased suggestion is to

read the free book that I published on this link. Um also Joel is one of the authors too back there so you can thank him. All right these are the major topics within ZK that pop up. I'll just explain what they are one by one. So arithmetization scheme we looked arithmetization is just a fancy way of saying writing a system of equations like what we were doing earlier. Oh I wanted to say that u is in the list xyz. So I'll just write it out like this. Now, of course, you don't actually literally write the math. It has to turn into code in some way, right? And not only that, you can't just write equations in an unstructured way.

Um, they need to you need to write there's some constraints depending on how you express this stuff. Like it might say, well, each uh equation in your system of equations can't have more than one multiplication or it can't have more than one addition or it needs to have exactly this many variables per uh equation. If that's the case, then that means you need to do a little bit bit of algebra to finagle your Sudoku system of equations into one that's accepted. So the standard formats for how you can encode your system of equation is called usually one of these three three things rank one constraint system plon and alge and air. Uh so what are these things? These are just

algebraic formats. That's it. Okay. Like for example if you have a system of equations you can oftentimes present it as a matrix multiplied by a vector. Right? That's one way of expressing it. That's that's exactly what R1CS is by the way. um whereas uh plunk and error are not exactly like that. They um have they're a little bit more restrictive than that. But these are not difficult to learn. And honestly, an AI could teach it to you because this is just doing algebra to turn one algebraic form into another. Um and you you should learn this stuff because it's going to be kind of the basis of everything.

Now, how can I let me try to explain lookups properly here? So if you um let's say that you're simulating a bitwise operation on a 32-bit word by default that's going to create 32 constraints right because you at least need 32 constraints to say this is one bit another bit another bit another bit and what I say is a bit is really a bit so whenever there's a lot of very repetitive constraints that can cause your number of constraints to go up a lot so lookups are an optimization to handle that and um But honestly, lookups are just algebra. Again, they're just say, "Hey, we're going to state

these constraints in another way. Rather than saying um these two binary number, these two words have an exor relationship with each other, we're just going to create the truth table for exor and say these variables are in this table somewhere." So, I'm not actually going to explicitly create the constraints. Okay. Uh these are used very very frequently in in uh ZKVMs and almost and very rarely in privacy applications. So depending on your interests that would affect whether or not you are interested in learning about this. Now a backend is how you go from algebra to the succinct zero knowledge proof. Right? I have my system of equations and I have an answer. Now I want to convince you that

I know the answer to this system of equations. Well, the algorithm for going from system of equations plus actual variable solutions to something much smaller is what we would call the back end or it's where you would typically hear of things like groth 16, bulletproofs zkx gkr uh plunk, which confusingly is also an arithmetization system. Um that's that's where those come from. Now this is where like the moon math is because it's not trivial to go from a big system of equations and then crunch it down to something small. Obviously, you have to be doing some non-trivial math along the way. Um, this is what we teach in our ZK boot camp, but you can be an effective auditor without really knowing this

because most of the time this is going to be a library and what what you're going to be auditing is where the con are the constraints actually expressing what they are supposed to express. Um, but if you're going to work in the field long term, if this stuff is a black box, then some knowledge is not going to stick to itself. you're going to feel like you're I'm just memorizing how this works because it just is that way. It's it's definitely easier to engage with a field if you know what's fundamentally going on and okay now that that's why these different arithmetizations uh look the way that they do because they're actually constrained by what the back end is doing.

Uh so but these take a while to learn. So in our ZK boot camp we it takes about 15 weeks for people to code grath 16 from scratch. But these are busy professionals who can only dedicate like three hours a week to study. So if you want to learn it a lot faster you can. But realistically people are busy. So 15 so 45 hours right in order to learn just one of these backends. But again if learning is a lifestyle for you know this is something that you am you break up over time. You don't have to worry about learning it all at once. Okay. Okay, frameworks. Uh, like I said, these algorithms here are oftentimes implemented inside of libraries. And the libraries give you a DSL for writing out the math equations, right? Because you

you wouldn't want to actually write out the math equations. We just did it in raw rust, right? That would be kind of painful like I have to represent a variable which doesn't have a concrete value yet. So that's all handled for you. These are the most common ones. I absolutely recommend learning CIRCOM first because bless their hearts, Halo 2 and Plunky 3 are don't have the best UX. Uh they've made great contributions to the ecosystem, but they can feel a little bit verbose. So it's kind of hard to get to the core of what you're trying to do. So circum can be learned in a week if you really grind it out because it's it's only one step removed from a math equation. Uh but and it's still used. Some people will talk about oh circum's an old language like no everybody on Salon is using circum at

least all the Salana people I've talked to. So you you definitely want to you definitely want to know it. And it's also much easier to learn circom first before you learn one of these other rust DSLs which are more commonly used. Uh plonky 3 seems to be the one that's most frequently used in um uh zkms. Uh succinct use it and then a lot of people uh took inspiration from succinct and use planky 3 also. But to learn planky 3, you do need to understand how the air arithmetization works. Okay, that's because it's based off of that. And it would help if you know a lookup argument because those are used by ZKVMs.

Okay, lookup arguments by the way fall more under like the arithmetization side of things. It doesn't have much to do with the back end. All right, so that's frameworks. Privacy applications. Now, privacy applications are all basically forks of tornado cache if I'm going to be a little cynical and mean. Uh, it's not true. There are some cool innovations, but there it's generally you update a Merkel tree and then prove later on that you you you put something into the Merkel tree and that you're not reusing something. That's fundamentally what's going on. So, a lot of people have uh built tornado cache from scratch because it's not hard. Uh, the guide you can just read on RZKbook and you'll have a guide for that.

Um, now if we're talking about private virtual machines, those are a monster, let me tell you. So that that's different. But if you were just talking about we're trying to create a mixer, then actually these are a good place to start because they're not that complex. Um, and actually quite a lot of I see I see a lot of this on Salana too. I'm not shilling Salana or anything. I'm just saying that I see a lot of them using creating circum privacy applications. So check it out. Maybe you'll find audits there or something. Okay. So building an actual VM is not difficult. Like I said, you can write a these this risk five or myips thing in one week if you're motivated.

Um because an actual VM is really not that hard, right? You loop through op codes. You put the op codes into a big switch statement and then determine what kind of state update you're going to do based off of that. Very simple. Um now the problem is a virtual machine has memory, right? Any computer has memory, right? So you're saying my RAM at this particular clock cycle had this state and on the next clock cycle or after I executed the next op code at most one of those cells got updated, right? It's it's it's unusual to update a whole bunch of RAM at once. Usually you do like in EVM terms it would be like I'm going to mtor load which is only one word at a time or you could also do M store 8 but you know you get my point right.

So most of the time the constraints in a memory would just be the memory doesn't changed. The memory doesn't change. The memory doesn't change except at one or two locations. But just saying the memory doesn't change one gigabyte of time is already creating a lot of constraint. If you have a gigabyte of memory then you need a billion constraints to um or eight 8 billion because you multiply by bits. But you get my point. It's it's a lot of redundant constraints which just make your system of equations unnecessarily huge. So most of the optimization that goes into VMs is how can I not have that many constraints particularly because the allowed state transitions are very small only one cell

can update and only one cell is read. So um if you want to get a sense for how those are solved these are kind of beginner friendly starting points. uh zk sync is based off of the paper two shuffles make a ram but this is kind of a development that's everybody uses some variation of that which is what well the idea is you you keep a bunch of tupils which is when was a certain memory cell accessed and read and then when you if you sort it by time stamp or clock cycle well the just looking at that sequence of tupils you should say well the value should always be the same up until a right hit and then anytime it was read it should always have read that value so Now you actually only care about cells in RAM

that were actually engaged with. You can you don't even need constraints for all the other stuff. So that's um kind of ties back to the permutation argument, right? Because we need to sort by time stamp and say, hey, did the state updates over time actually make sense? Uh so VMs are very easy to understand, but the memory consistency model is the hard part. actually. So, in our week-long um ZK boot camp, we actually ended with uh creating a ZKVM, but we would so that tells you how rather simple you can learn in one week how to write a VM in circum if you really go for it. But the memory consistency model is something that would probably take another week just just to give you the scale of the difficulty. You can build most of the VM very soon, but knowing

how this works, it takes a bit of effort. All right. So if I my my general guideline if you want to engage with the ZK space uh you make math math learning a lifestyle it's fundamentally a mathematical field. Uh knock rust out. Everyone wants to learn rust. Rust is fun. Rust is useful. Uh don't overthink it. Same for cryptography. It's it it takes a little bit longer to learn but it's a subject all CS under not all CS a lot of CS undergrads take. So there's nothing fundamentally weird about it. uh VMs. Uh if you take an undergraduate course in a VM, you already know way more than you need to. Uh you just need to know how they work. Like I said, it's a it's a switch statement with a loop.

The hard part is the memory consistency model. Uh you can get a big overview of things by reading through the ZK book, but I'm not going to pretend like the ZK book will tell you everything. It's going to get you started, but you actually need to code this stuff up and engage with it if you want to uh learn it. Um, this would kind if if I was to create like a knowledge graph of everything that I talked about, this is what it would look like. So, what do you need to learn before you learn the other thing, but again, I'm not advocating that you need to have 100% mastery of one node before you move on to the next node. Uh, but you do need to know some things about one node before you move on to the next node. And then I would advocate

that you go back and master the node that you skipped over, especially the math part. Um, anything that I should explain here? I think this should be mostly self-explanatory. Arithmetization schemes are very simple algebra, but they're oftentimes expressed in abstract algebra terms. Can you guys see my mouse? Yeah. Okay. Uh, most frameworks except circum are written in Rust. So, it's helpful to know Rust before that. Uh, if you're going to make a ZKVM, obviously you want to know how the VM works. And, uh, lookups are something you should learn after arithmetization schemes. That should be uh mostly self-explanatory.

Um and backends as you can see you can do a lot of ZK without knowing how the proofs actually happened. But but knowing how the back end works will give you a framework for understanding everything. So I wouldn't advocate you know like oh I need to master groth 16 and and plon and and bulletproofs and stuff like that before I learn all of this other stuff. No, backups are backends are a challenging subject and they're best learned slowly, which is how we teach them. Three hours a week for 15 weeks. Don't be in a hurry. Um, okay. And then when you get into the ZK world, inevitably you start hearing about all of this. You know, if if I don't know how garbled circuits work. I

barely know anything about it. You know, you don't don't uh expect yourself to be even intermediate at a lot of things, especially not in a short time period. But if it's your lifestyle to be learning something new every day, especially the foundational things which make it easier to learn the more advanced ones, then it comes with time. A lot of people put pressure on themselves like, man, in six months I need to be here. A lot of things are basically impossible in six months. But if you look at it on a six-year time frame, well then pretty much everything seems easy. So try to think in those terms. Not seems easy. It is easy. Okay. Um, and the other thing about ZK, this is something an anti-attern that I want to warn you about is it's easy to read something and like, oh yeah, I

understood that. Great. I feel good about myself. I can talk about this at parties um or not at parties, at like conferences. And you can read some articles and then like actually sound like you know what you're talking about. Um, which is fine, you know, if you just want to shoot the breeze with people and talk about interesting subjects. But if you want to do something economically valuable, you need to be able to do more than just talk about it. So what with the ZK book, what I really really recommend is when you see the math, we've made the math intentionally easy to translate into code. So one way to really engage your brain with that is you should actually code it. The bulletproof section of the math book actually has a um uh exercises for you to code the bulletproof from scratch incrementally. Um and that's free on

GitHub. So you should actually do those things. I know it's painful, but I already gave you my speech earlier about your brain tricking you out of doing painful things. So, don't fall for that trap. Uh, if you need anything, that's my email. So, that will wrap up the talk. [applause] Oh, and uh come come to our live smart contract hacking event tomorrow if you if you aren't already signed up. Yeah. Thank you. So like there is there is like a kind of you want to achieve something so you learn this to achieve

this. So like about like two years ago there is a group of there was a team called chain light and there was a zk contest. >> Yep. >> So these are experts and that was some young guy. I don't know if he's a guy or a girl. >> So they say they learned rust and zikk like three days. >> Mhm. and they like flushed out the most balls and they won the contest. >> So like you are saying like you need like and Zeke I think ZK slet called him to like give them a reit on their code base. So like you are saying it might take you time to learn all this or also we've seen it's possible to also like for editing I heard talking about like if

you know how the constraint works maybe has to prove that is one then maybe the person brings minus one and he passes the I I don't understand this I kind of know that kind of thing so like the whole gap is like so long especially when you want to enter bounties you want to enter p So like how do you like balance all these? >> Okay, so if you're talking about chain light, um one thing I can guarantee is that they have all of this other stuff absolutely mastered to a very very high degree. So if you have the prerequisite knowledge just really really down, then learning something right in front of it is very easy. So I've seen people learn ZK part-time in about five weeks. So,

Filigy actually took our uh >> the guy >> the guy who beat them >> learned all this with no knowledge. I just think he wants some malupad in mathematics. >> Oh, you're okay. I think I know who you're talking about. But the person you're the person you're talking about is of extremely strong math background. So, um if you if you're coming I'm I'm I'm talk coming into this assuming that you guys aren't math majors or competed in math competitions. If you if if you're coming from that background, they have a very different story to tell. So, um if how do I say this nicely?

If you come from a competitive math research background, a lot of what we do is child's play. So, I that's that's just that's just a fact. So, that's how they're able to do that. Yeah. Hello. Yeah. So about the auditing of CK circuits and more specifically in using CKVMs, >> what is the level of trust that I have on the compiler to actually uh translate all the constraints that I set up in the

ROS code into the memory consistency? >> That's a great question. >> Um there have been known bugs found in Aztec at least for that and I think Z what's it anyway those happen these are not mature compilers right so even if these very smart well-resourced people do it they're working on something new and it's just part of the nature of the beast that there's going to be problems with a compiler so um could it be a if if the question behind the question is is it a fruitful area of research to really get into zk compilers and find bugs there I suspect so if you have the background knowledge to handle it um it's a very niche field and there's pros and cons to getting into

something that niche. So, but but if it engages you, then I think that there's there could be opportunity there, but I don't have um deep familiarity with the like the the the compilation part of that stuff. But it's complicated. Very few people know how to do it and bugs have happened. Uh yeah, one of the challenges I have um or I had when I when I started with ZK is if if you learn something like a c certain topic, it takes so long because I have a full-time job. So learning everything even if it's a lifestyle if I

come to a point where I learn arithmetization and then I learn R1CS um it's very hard to find applications that need auditing for that stuff like you have to actually find the clients in my case as a security researchers um we don't we don't I'm not the market is not flooded with um RCS implementation that you have to that you have to audit. after a couple of months if you ask me now and I'm I I think what I'm I'm I'm one of your first students and I and for everyone here like if you're interested in the course I it's definitely worth the money. I was skeptical at the beginning but it's he's really a great teacher. I'm not trying to show the project. I've I don't get I'm not paid by by him to say it but I just want to say like it's it's it's really worth the

money but um I it's been a year ago and if if you tell me now, hey, can you audit my R1CS project? I was I have to take like two months again to to go back to the the content and learn it again. I'll probably learn it f faster than the first time. But um if I have to learn something else like fagg or something, I I'd have to learn again for two or three months again to to to be able to to audit something because auditing something is not like >> building something. building maybe you don't have to understand everything like very specifically because you're just building it and if it works it works and then the auditors take care of it but the auditors have to understand everything uh 100% and this is the challenge I face the most with with ZK

>> it yeah I think that that's why I talk about the lifestyle thing because it's it's a big field and if you don't have the luxury of studying it full-time it's it it creates a challenge and there I think there's there's no fundamental way to solve that kind of a problem um the well at least I I remember that when I was teaching you. So we didn't focus on like the constraint part of the stuff in the course that was focused on the back end. So I think if you're concentrated on the arithmetization part, that's probably something where you're more likely to get audits. Um but if you're if you're as an auditor, you're really trying to get to the place of, you know, I know this better than the devs do, right? And and fundamentally that it takes a lot of work to get to that

point, right? So I would say ZK sometimes feels like learning how to code all over again because we're using a totally different environment. We're using a totally different language and we're using a totally different programming language. Uh even not just programming language like expressing things as polomials, right? Um is is a weird way to express computation and a lot of people have a hard time even just using normal variables and for loops. So you're you're kind of going through that again. Um the what I would say if you want to get into auditing as fast as possible um where where most of the audits happen um

the most fruitful thing to focus on would be this over here which is just talking about how do we use math to design um our application. Right. So circum is very is one step removed from math. So that's what the people at rare week were studying and they were able to participate in the succinct and uh brevis co-processor contest afterwards. uh now were there a lot of knowledge gaps right you have to learn a new framework because those are written in plony 3 but the the actual focus of hey are there missing constraints that's probably the easiest thing to jump into because you can reuse the attacker's mindset but at the same

time in the long term I suspect it's also going to be the one that gets most commoditized because it's also easy to get into relatively and um people are going to build better and better tooling around detecting missing constraints and that's something that a computer will tend to be good at. That's not true right now, but it will be true later. The good news is you did the hard part already. This part's a lot easier. People, if you're really focused, you can get through this in a couple weeks, especially with the background knowledge that you have.

Um more than a question is like a comment with the question before is that you don't become an auditor and that's all like uh you start to learn as long as you start you keep auditing for example when you when it arrives a new concept or something like that and you do an audit on that you you keep going for example a technique that I that that I use is that I keep a list of things that I previously found to use in another audit and that audit will give me more items to check. So what I am trying to

say is that auditing something you don't you don't you just don't say like I am an auditor and I learned everything 100%. That doesn't happen I think. >> Yep. And also in terms of time scale, something I would say like the people that I've seen go from not knowing anything about ZK to working at a firm was six months of part-time but bordering on full-time study. So that just in terms of the optimistic time to get to that point is the that's the amount of um effort that I've seen from them. And these these people didn't either didn't have a full-time job or didn't have a very demanding one. So that's if you just want some sense of scale about what you're trying to do.

That's that that's what I've seen in the faster case. But again, everyone's case is different, right? You might already know someone at the firm. You might have happened to study something that's particularly relevant. So, you know, take that as a with wide error bars. All right, I think that's it. >> Thank you very much. [applause] Thank you. Thank you very much for coming here and thanks everybody for attending. Thanks the volunteers. Uh thanks the recorder. We are actually

continuing tomorrow and the day after in the main event. If you have problem uh getting tickets, let us know. We have a full content there. There's workshop, there are two tracks. So, please enjoy. And there are many other events. So, please enjoy. And thank you.