Episode 236 - Aztec Connect and Private DeFi with Charlie and Joe

Transcript

[Music] welcome to xero knowledge i'm your host anna rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online in this week's episode i check in with the folks at aztec aztek is a zk based privacy l2 project the team has a track record of delivering some of the most important ziki research and implementations one big highlight here would be the original plonk paper in this interview i

chat with joe and charlie from the team we talk about aztec connect and how this relates to zk money we talk about how the team has evolved what future projects they are working on such as the dsl noir and aztec 3 we also talk about what stopped their recently planned launch at the very last minute we do kind of a quick postmortem on that and what's next for the project but before we kick off i just want to remind you to check out the zk jobs board if you're looking to work in zk professionally this is a great place for you to find your next gig you can find job postings from some of the top teams working in zk also if you are a team looking to recruit this would be a great place for you to let technical people know that you're looking to hire

i've added the link in the show notes now tanya from the zk podcast team will be sharing a little bit about this week's sponsor today's episode is sponsored by elio elio is a new layer 1 blockchain that achieves a programmability of ethereum privacy of zcash and the scalability of a rollup if you're interested in building private applications then check out elio's programming language called leo which enables non-cryptographers to harness the power of zkp's to deploy decentralized exchanges hidden information games regulated stable coins and more visit leo lang.org to start building that's leo.lang.org you can also participate in elio's incentivized testnet 3 by downloading and running a snark os node no signup is necessary to participate for questions

join their discord at aelio.org discord so thanks again elio now here's anna's interview with aztec [Music] today i'm here in person with joe and charlie from aztec we're going to be talking about aztec the trusted setup they did zk money and aztec connect welcome to the show both of you thanks for having us great to be here i am very excited to hear about the latest on the project quick disclosure the zika validator is a small investor in the project as well joe you've been on this is your second time on and i think last time we were talking primarily about zk money uh

we'll i'll add a link to that in the show notes but maybe do you want to just let people know a little bit about yourself yeah so normally my role is kind of focused on product um helping take uh everything that zach and the crypto team build and charlie and the engineering team build um making it into something that people can click on and play with um but more recently it's kind of more encompassing fundraising regulation um a lot more boring things but um they're also very important so yeah do do a lot of uh different hats here at aztec would you say you work on product yeah technically that's my my full title but um yeah the moment it's been a few other things have crept into that remix

as it is in a in a fast-growing company cool and charlie this is the first time we meet tell me a little bit about what you do at aztec yeah well i'm the lead engineer here at aztec and i've been here about three years so far and i've been involved in almost everything since the trusted setup but um i define a lot of like the uh tech stack that we use and the process and i've just been very heavily involved in engineering uh aztec two and uh a new product that will be launching cns at connect very cool so you just mentioned the trusted setup years ago i did i think now we're talking two years ago i did a series on

trusted setups and i think we had tom who was at aztec at the time on the show talking about ignition that was the name right yeah we call it aztec ignition aztec ignition and so that that episode we'll link in the show notes that was you know a multi-interview episode i interviewed a number of people doing trusted setups i remember being really impressed with the aztec ignition ceremony and actually later doing i i helped kobe do the plumo ceremony and like that was one of the ones we were like really looking at as like a guide tell me a little bit about what it was like to build it um it was fun to build it uh it was the first thing that i was that i was actually doing when i joined aztec uh i

think our trusted setup was they're all quite different like people have these different algorithms and ours just was this process of um like doing a huge numbers of elliptic point scalar multiplications like 100 million of them i think and um it was done sequentially by i think over 173 people around the world um so the actual like efforts of like uh process of doing this elliptical scale multiplication was fairly simple so what i that was kind of already done i just needed to make it extremely performant like parallelize it over many cores it was about six gigabytes of data that needed to be shifted from participant to participant

so i built a coordination server just a centralized thing that basically and and these docker images which meant that there was a very low uh like barrier to entry to run it it's like if you had docker you could just run this thing and it would connect to this server it would put you in the queue and like when your turn came around it would just stream the data down perform these uh elliptic curve scale modifications and sort of stream the data back up again ready for the next candidate to pick it up and we visualized this all on like a pretty globe that i think is still still visible right yeah yeah i remember that uh was it a headache like was it i mean this was your first project maybe actually joe as a like more on the coordination side was it like

was it a fun activity was it something that brought your team together or would you say it was also kind of like a burden like trusted setups kind of get i think it kind of you know a bad result yeah i think it was it was there's a lot of coordination between kind of um people we wanted to run it who were not members of the public but had specific requirements um so like the they wanted to run it at certain times or something because they were an institution and so that was definitely a headache i remember tom spent a lot of time kind of coordinating that but i think the one thing that saved us compared to some of the more recent trusted setups is you could run this very quickly i remember charlie um rented out an aws machine and i think

had the record of what five minutes or something for running the whole ceremony yeah so yeah the coordination wasn't that bad because we could kind of chunk the day into like our slots and get quite a lot of people um doing this so it was there was a lot of kind of updates for people to see the graph evolving see who was doing it whereas some of the more recent trusted setups have been like eight hour affairs and it's longer very painful because you're just like oh wait someone's still running the same thing two days later and like um i think that did help us a little bit because a failed participant wasn't that much of an issue because we had this coordination server someone else could just jump back in and we we got a lot of participants i think at the

time it was um after z cash it was the largest trusted setup that had been done um and most of the i think planck improvement implementations still use the crs was output from that it's now kind of a public good that anyone can use which is i think a pretty cool legacy cool and that's crs common reference string this is the thing that sort of unlocks a snark this is the thing that you need to start a system uh is that the wrong way to say it i'll take a stab and then charlie can correct me but uh i i view it as kind of maybe unlock sounds more like you're revealing that yeah i think you feed it in uh in order to kind of uh obscure all the gates in your program so for each

gate in your program you need a point from the common reference string um and that's kind of how we use it and blank and the assumption there is that if that point was generated in a trusted setup then there's no other way for you to kind of back out what happened uh or how how that point was generated so it can be used in the program to gain privacy and that was the that was the piece that used to be called the toxic waste right there's this secret number which is basically the combination of all the randomness of all 173 participants and that is called the toxic waste and i think nobody knows

what that is because if you assume that one participant was honest and threw away their part of the randomness then it's impossible to know what it is and that randomness is then used to uh as the multiplier for these elliptic curve points um so there's they all have this sort of same relationship to one another in terms of how they've been exponentiated but you don't know by how far and then you can use those elliptic curve points um within the uh the mathematics of the of the proving system to to do the to make a snark basically work i did do that episode a year ago but i can tell like i am actually rusty because i have a question that i feel i probably already asked before at some point but the common reference string is

that is that actually secret or is that viewable no it it that is public information and it is um a set of 100 about 100 million elliptic curve points um on a particular elliptic curve but why like how could that be public and yet somehow it's still securing the snarks privacy like it's keeping the start look like if you know that why are you not able then to discover how the snark works or like undermine it there's this elliptic curve uh multiplication that we do you can take an elliptic curve point and there's a sequence of operations if you want to sort of uh exponentiate it by 10 say you

go through the sequence and you end up with a resulting elliptic curve point but you can't back out the fact that it was exponentiated by 10. 10 in this case is the toxic waste that i'm talking about so we have all of these elliptic curve points that sort of have these relationships to one another in the way that 2 4 6 8 16 have a relationship to one another but you just don't know by like the the scalar value by which they've been exponentiated ah okay because every one of the 173 participants did it by their own random number and then took i took your results exponentially so that passed it on to joe he took it exponentiated by a random number so good luck trying

to figure out what the combination of all those random numbers is interesting but the that sort of relationship 2 4 6 8 16 continues to exist cool i feel like every time i talk about trusted setups i get a little bit closer to understanding what's actually happening under the hood nice um okay so i want to keep going on kind of learning a bit about your role at aztec and so you worked on the trusted setup but like nowadays you know yeah what kind of role do you take in the org yeah so after the ignition ceremony i was then i've sort of started working on the actual circuits themselves for uh for what is currently our production

aztec two is sometimes referred to system um and yeah i mean i sort of uh just laid the sort of the the foundation the architectural foundation of that system and wrote some of the initial circuits and then as the rest of the team became free uh after moving on from our original aztec one everybody else sort of started contributing and we've taken that on to the current live system and ck.money yeah i mean i think charlie's probably underselling himself a bit there um charlie's really responsible for everything from uh past the cryptography well as soon as that's been put into kind of a workable um cryptography uh production piece of

software um charlie and the rest of the engineering team um takes that and kind of builds it into kind of a usable kind of engineering piece of software um that's everything from our client sdk um which kind of acts a bit like a full node in the browser to our roll-up software um which actually aggregates thousands of transactions together and posts into uh ethereum um and yeah as a result um post launch we're actually moving charlie up to cto he's been with us for three years now and i think his previous work has secured all of the um circuits that people are using so we think it's a worthy title um to give him and to help

bring aztec to the next level as we scale towards kind of decentralization very cool i want to talk a little bit more about the structure of aztec so you sort of mentioned this like research side and engineering side how do they work together i mean we have a we have a cryptography library called uh burasenburg which i think is kind of the the main interface between the two and i think that's where engineering and crypto meet and it's probably one of the most interesting roles we're actually hiring for at aztec is people in that library because you kind of have to have a maths knowledge but also um i hope the cryptography team won't mind me saying this but sometimes cryptographers don't write the nicest code um so kind of being able to kind of take

crypto cryptography put it into code and then make it production ready um is i think the interface and uh charlie can talk a bit more about how how the team's structured around that um yeah so i think joe's described it quite well as there's this this interface between the cryptographers and and the sort of the larger engineering team which you sort of operate at a higher level like i myself for example are not a cryptographer i'm sort of like trying to learn as much as possible as i go along and uh you know it's a slow process because it's quite complicated but um yeah i mean our cryptographers um they're largely working on you know proving system related things and then i guess where we sort of meet in

the middle is the circuits themselves because writing the snark circuits we currently write that all in c plus uh using like sort of a custom standard library you know our representation of a bool our representation of an integer and normal engineers can understand those concepts and the cryptographers kind of build these little components these little bulls and components that work in the proving system so that normal engineers can then start building circuits there's still some sort of nuance to uh writing circuits um you need to get your head into a certain sort of way of thinking like certain things don't exist at the moment like easy branching logic if statements things like that need to be done in sort of clever ways but there's definitely things that

engineers can pick up i mean i picked it up and i sort of wrote the initial circuits so it's it's that's kind of like the meeting point and then of course taking that and actually turning that into a real viable functioning product that works in the real world is just a whole nother sort of leap um like the theoretics and sort of like getting something theoretically sort of working and like a little green tick and a test is like one thing but being able to make that operate at scale uh reliably and stably is a whole nother thing wow this actually makes me a bit more curious charlie to your background before that like what were you doing that sort of led you to this role um well i've just always been a huge computer geek like i started programming

when i was about 10 years old and i just sort of fell in love with it immediately um and yeah you know i sort of i originally wanted to be a a games developer you know it was that sort of formative gaming time back in the 90s where games like doom and things were coming out that industry exploded into like you know hundreds of thousands of people like size teams night that kind of put me off a little bit i didn't really i liked the idea of the small team creating something big and i went through various sort of big companies you know i worked at toshiba betfair bloomberg and then i i didn't like the big companies so i moved to the startup space i worked for a couple small startups and in 2016 i got into into crypto like

so many did like uh and sort of thought wow you know the flavor of this is much like those sort of formative gaming years back where you've got constrained environments and you're sort of changing the world uh at the same time by sort of building in them and small teams of people can really make a difference and um that's when i sort of knew i wanted to get into crypto i sort of started working on personal crypto projects client libraries and the like and eventually i discovered aztec and i'm very glad i did so cool i think we found well you found us in the dark depths of reddit i think i think i discovered i discovered how second read it i think i originally sent an email got no response i think it just got lost in the ether yeah but i was not

put off and i i tried again a few months later and yeah it all worked out but i mean working with aztec it's not just kind of blockchain it's your knowledge what was the connection there like do you feel like it's not really just yeah it's not straight up crypto what's how what's how does zk add to that well i think the privacy aspect of what we're doing sort of sits like deep like with me ideologically personally you know i i'm big on protecting user data and privacy and things like that i think we're in a bit of a dark time of of users um having their data mined and and being controlled by their data and uh i think it's really important that we you know

we protect what we have by having uh effectively private forms of cash and and things like this and also i think there's just huge business gains to be had for this for parts of the world that are economically developing etc i was just going to say i think uh on privacy like mine and charlie's kind of not differences but how we view what can be built with azteca most emphasized by kind of zk money and charlie's interpretation which is a command line interface which he built around our sdk so very kind of uh very kind of like hackerish and um maybe taking you back to those those doom days um but yeah it's i think it just shows that there's a lot of different flavors

to kind of privacy and what could be built on the network and um a scale of privacy as well um which people will find that kind of their level on you just mentioned ck money and actually i mean i think i am very curious about like what that connection is between like zk money and aztec connect so yeah tell me well actually maybe let's start with introducing ck money yeah so zk money is our kind of example application of what can be built on top of aztec um we first shipped the first version of it actually for aztec one um it was very clunky um enabled confidential payments and it its goal was to show what's possible with the aztec sdk it got a

massive kind of upgrade and revamp in in march 2021 which is i think what i spoke about on the last episode enabling these uh fully private payments um for cheaper than a normal ethereum transaction really showing kind of that privacy was no longer a ux burden and what we've done uh kind of with the new version of zk money which is kind of coming out with the aztec connect launch is we've upgraded it to have all the new functionality of the aztec sdk that's been added by aztec connect so you can think of zk money as kind of a showcase of what's possible to build with our sdk

now that the aztec connect functionality has been added to it um and as a reminder of aztec connect it's a kind of set of tools to really enable people to interact with layer one d5 contracts completely privately from inside aztec and with 10 to 30 times gas savings um for a process called d5 patching so the roll up i mean this zk money is still going to be zk money yeah aztec con so yeah that didn't i thought aztec connect was kind of taking it over as to connect is the suite of tools which actually allows you to do stuff on the kind of main chain across to the l2 correct yes so we have kind of a solidity contract interface which is the aztec connect bridge interface which

enables the roll-up contract to talk to any default protocol it effectively models um the d5 protocol as asynchronous token swap so you take two tokens put them in and sometime later you get two tokens back and you can model most of d5 like that which is kind of cool um and then we have the aztec sdk which enables you to construct zero knowledge proofs to interact with these uh kind of contracts so the way you do that is you have shielded funds on aztec and instead of sending them to another user like you could do kind of with the original sdk you can now send them to what's called a bridge id and a bridge id is kind of

this encoded set of instructions which tells the roll-up contract which layer one smart contract to call and with kind of what funds and if that proof is valid it could have come from anyone inside aztec and it's kind of how we get privacy and then i guess the really cool part is you can actually batch these together so we all do the same transaction we can be bundled together in a giant kind of aggregated roll-up proof and we all share the gas costs so we can kind of do the same uni swap um transaction for a tenth of the price or 100 for the price depending on how many people in the batch does the batching in this case contribute at all to privacy no it's actually um

just gas savings the batching that the privacy set is kind of quite hard to define but our best effort at the moment is um the set of depositors that a given public kind of uh bridge interaction could have come from plus the set of bridge interactions which also brought that asset in so if you think about kind of um i'll try again but if you think if you think about it you're making a bit of a confused face here yeah if you think about eth as a privacy set um there's kind of deposits into the system from l1 and let's say we have 100 of those um so in a simple system the privacy set would be 100 users kind of for a given asset but with aztec connect

um eth can come into the system through two ways one for a deposit and secondly through a bridge default bridge interaction through aztec connect so you could swap on uni-swap you could kind of oh yeah always i see what you're saying okay because there is just the deposits as well there's like people just using it in sort of it's vanilla so this this privacy sector actually can grow like pretty uh exponentially because there's multiple ways now for um kind of eath to get into the system and we're excited about that growing can you though go in through the defy way and then out in the vanilla way not really right doesn't the contract sort of cause both actions um you can deposit uh do d5 interactions uh and then exit

with those funds so it's kind of fully composable but you can't you have to start with funds in aztecs so either either via kind of a deposit um or we're working on uh various on and off ramps uh to kind of have other ways to get funds into aztec from centralized exchanges cool oh wow like potentially directly there yeah the reason i was asking if the batching had anything to do with privacy was that i know you know i think also last year we had a we did a something called zk sessions focused on privacy and defy and zach had talked about like a way to make a private decks using batching and that was when you said that term i thought oh maybe it was related but

in the like if you're like what you just kind of suggested is like you're actually going to do the d5 in the roll up in private so actually the the the d5 stays public in aztec oh it does oh really so if you think okay we've got all these building blocks on on layer one so we've got uni swap we've got rv we've got all of these kind of um i guess battle tested um more like institutions now in d5 that have survived a few kind of market um crashes like like yesterday and the day before um [Laughter] and what aztec connect enables is kind of instead of having to move those to a new

execution environment uh like aztec we actually just keep them where they are and we move the users to aztec make the users private and let them then interact with these public protocols um i think what zac was maybe talking about previous is it's actually quite hard to make a private uni swap because by definition it's the ratio of two public uh pools so it's actually it's actually quite difficult so with aztec connect we we took the approach that um giving users privacy around kind of which user was interacting with a given um d5 protocol and also what a user's holdings were with sufficient privacy rather than kind of reinventing the wheel

having to move liquidity to the l2 and kind of rebuild everything from scratch on the l2 and that's definitely been one of the main selling points of aztec connect um there's a lot of protocols that i call them second order protocols but they they're not just dependent on their own smart contracts so something like an element even something like a lido it can't really move to a traditional l2 as a different execution environment because it relies on something else being on on l1 so with lido you need the deposit contract for the beacon chain uh to be able to actually use lido and that's not going to move to an l2 um or with element you need kind of

balancer and curve and loads of other protocols to actually exist for their protocol to function so there's this unsolved question with traditional l2s around um kind of breaking composability and liquidity fragmentation that we didn't really want to have to try and solve so we we just made the users private and gave them a way to cheaply and privately access what they already loved or no one i this makes me curious can you use assets on ckmoney as collateral in other things do you have that use case or is that like is there yeah definitely so all an asset is on aztec and and all zq money is just a like a viewport to

show you what assets you have on on aztec and let's take a really simple case of of eath all zk ethers which is kind of our our name for assets inside aztec um it's east that's owned by the aztec roll-up contract so you send your reef to the aztec rollup contract on layer one and in return you get a claim on that each in the form of a utxo note because aztec works on mutexos under the hood and you can do that for any asset and then to go back to the question on can you use that for collateral um if there's something on l1 that kind of accepts the assets you have as collateral

you can construct a zero-knowledge proof that instructs the roll-up contract to send it to that l1 smart contract via aztec connect as a bridge wow so any bridge any kind of like collateral was possible um to kind of deposit um and that's exactly where we're starting with that step connect actually as well so kind of staking all these kind of low immediacy use cases like lending staking kind of yield use cases um we'll start with just ethan dye we'll be very quickly adding in most drc 20 tokens and expanding kind of the the places you can deposit assets as collateral and earn a yield wow that's exciting this is i mean do you feel like aztec connect is the piece

that makes i mean it sounds like it's it's the thing that really opens up ck money to be much more usable than what it is right now which is like it i mean actually yeah this is a question how do people use zk money without it yes it's a great question actually so two ways um so you can either use it for just paying uh friends uh dow contributors just paying people privately on chain um most people do that with a die and because it's dollar stable um or you can use it a bit like a mixer at the moment and uh withdraw your funds uh back to l1 um and then you have a form of privacy on

l1 to go and interact with the divide protocol but you don't get gas savings and what aztec connect enables is kind of all of the things that people use to leave to go and do they can now stay in aztec and access them through zk money so it's just a much better kind of user experience you don't have to keep track of multiple wallets on chain to work out hey did i withdraw to this address previously you just do everything from inside aztec and you have this privacy by default do you i mean i i wonder how much can you see as the engineers building this of the activity inside since it's private i'm almost like curious what behavior like i guess you have i guess you

haven't seen aztec connect behavior yet because it's not launched as we're recording it but even in just kind of generally like it may be in test nets or whatever like how much can you see into what is actually happening inside yeah i can take a stab on at the on chain and maybe charlie can talk a bit more about sdks and kind of what's technically possible for people to decipher um so on chain because d5 protocols that we're interacting with are public we can see which d5 protocol uh a given set of transactions is trying to interact with um because you're going to see it on etherscan and you can also see

the total amount that a group of users want to send to that protocol but what you can't see is what users on aztec that came from what their total balance is on aztec but you can see kind of the public kind of transaction that results from the correct verification of our zk roll up um on ethereum so another way of thinking about it is kind of the aztec roll up contracts like this puppet and uh if people like pull the strings in a certain way with a zero-knowledge proof then it will make a transaction with a d5 protocol so if you look to ether scan you just see this roll-up contract

interacting with various protocols instead of users interacting um so you can still see some stuff but you can't see who which is the i guess the big breakthrough and what can people see under the like in zk money or what can you see actually as engineers or like somebody who's observing what's going on well the sdk what we call the sdk runs on the front end like on the on the back end we receive uh these join split proofs from every user which is generated inside that sdk which runs in the client's browser um and we don't see i mean that this is the same as zk money right now we don't see uh we don't see anything like the values that come through are encrypted we can see an ip

address sent this proof but we don't know um the values uh or or who sent that proof like we can't identify them within the system the sdk which runs in the client well that only has a view of specifically uh your account you know notes it downloads actually all of the data that's that's taken place it downloads uh there are these things that we currently call viewing keys there are these encrypted pieces of information for every single note in the system but they're encrypted and we actually at the moment have to do a brute force decryption over all of those to find out which ones uh yours are belong to you um so you can only see what obviously you're allowed to see

um yeah can you see volume or would you calculate volume more from the bridge part like do you know how much activity is happening yes uh well we can see sort of transaction throughput so you know we can see how many proofs were being sent we can see we have graphs these pretty little grass where we can see oh gosh it was a really busy few hours or a really busy day or it's a bit quieter now but um it is quite mysterious to have a system running in which you know you've got a bunch of people using it and you don't really have any insight as to actually what they're doing it's quite different to anything that obviously i've worked on before as a user do you do you have the ability to create like a

viewing key is that what they call it like the the way if they wanted to show that something has happened can they do that you you can if you wanted to reveal your uh you know you can obviously share your keys with people i'm not sure if you'd want to do that but if you want to share your privacy key with someone that can obviously uh reveal your balances and your notes that does not give people the ability to then spend them that's handled separately by something called spending keys okay so you can control um you can control yeah you can you can view and who can spend this to two separate things but you call it like privacy key not private key it's not you're not sharing your private key so so there's all sorts of terrible

terminologies that get conflated when we say privacy key here it's so it's also you can be thought of as like your privacy key has two aspects to it has both a public and private key aspect yeah yeah it's just not used so they're both private keys but the the use of the private key is uh it has a different outcome so the privacy key is purely used for encryption um and decryption of notes it can never spend notes um and the spending keys can spend notes so we separated it for regulatory reasons also just because if you have multiple devices sharing spending keys across devices is really difficult with like hardware wallets but

something like a privacy key could have like slightly different security assumptions and could be shared across multiple um kind of devices it's a different set of trust assumptions basically you can also do kind of more interesting things um like proof of uh transaction logs so if you give someone your kind of privacy key uh and a set of transactions it effectively uh acts as a compliance log you can say okay in aztec i only transacted with these four individuals and i then did these ten defy interactions with myself so all the funds i have in aztec which total one eth came from these events which is really useful for kind of

off-ramping to centralized exchanges or just doing tax returns and things like that so you were saying though that you're like now opening it up to have like you know centralized exchanges potentially connect directly to the l2 without i guess going through kind of ethereum do you have the vision as well to have other l2s connect directly into aztec yeah it's definitely something that's on the road map but it's it it's a little bit further away because um what you need is kind of a version of aztec on the l2 and then you need evm pure like full evm compatibility on the l2 then yeah and you need to be able to pass messages

between them so if you had kind of aztec running as an l2 on ethereum and then aztec running on another evm compatible chain l2 or kind of other layer one if you had a very good way of passing messages between them you could kind of effectively represent all transfers between these two aztec instances as like a state hash of a merkle tree and then on the new environment you could kind of unwind that and say okay well i've destroyed funds uh on the kind of canonical aztec l2 instance yeah um so i'm going to be able to create funds on the new kind of aztec

polygon or aztec optimism um but it's it's a it's a bit of work um it also sounds like that bridge needs to like would you almost be sending a snark promising that like something's happened on one side to the other or like you're just sending a hash and then you kind of would kind of unpack the hash on the other side so there'll be kind of like two two roll ups but it's i'm definitely oversimplifying and the kind of security of that messaging bridge is um there's a lot of posts by kind of vitalik on the security of bridges and it's just not something where we're thinking about um in the immediate term because uh with the current design we can actually achieve a lot of the scaling kind of benefits of other l2s directly inside

aztec so there hasn't been a need yet but if if one of these environments actually takes off i think we would strongly start to consider it there's no like no one can deploy a smart contract within as in within zk money though right not yet was it's a misconception actually so we have programmable circuits and we've had them since we launched aztec 2. um charlie just had to write them so we have an account circuit and well charlie and the whole team had to write them uh we have an account circuit and a payment circuit in the current the live system and with aztec connect we spent over a year adding two circuits um a d5 deposit circuit and a d5 claim

circuit so these are kind of programs that the aztec team has written we've had to kind of use the whole cryptography team to audit these it's a lot of work to kind of write these programs but we do have programmability we are working though on a way to kind of have general purpose programmability where you don't have to be kind of working for aztec to right circuits in aztec and that's where kind of noir fits into the puzzle so yeah we have this um open source project noir which is led by kev um and it's it's a dsl for for snarks um specifically plonk-based snarks and it enables you to kind of very easily write

snark programs without having to be a cryptographer and that's kind of what noir does internally we also have a project called aztec 3 which kind of enables the roll-up to consume noir circuits so we kind of it's like the missing piece to have like a fully programmable private smart contract platform running on on ethereum as an lt cool when you say like i sort of want to tease that out of like what you can actually build it almost sounds like you're like hard coding or like it's not a platform to just deploy contracts so when you talk about a smart contract i'm assuming you're like you're actually touching the the actual construction of this roll-up

yeah i mean i think at a high level the current state of things is all the programs that we write or circuit so we write act on shared state so that's the main complication is there's one merkle tree which has all the data in it and any program that we deploy into our roll-up can modify that state okay so we have to be very very careful about kind of uh what those programs do because they they could inadvertently if there's a bug you could think you're spending funds but you could delete someone's account or like you could do some pretty serious stuff so we can't open that up to the public at the moment so what noir basically enables is uh it wraps those programs in a virtual

machine um which kind of enforces some smart contract like semantics so state variables have owners um you can't destroy state unless you own it or you have permission to destroy it and you can call other contracts within the system much like you can on ethereum so that's kind of what aztec 3 and noir kind of enables which is missing from the current system i see what would it mean for someone to use this like when you talk about uh i'm trying to sort of picture an engineer coming base maybe you can just tell me like what could they design what would they design and how would they actually interact i think the the place to start is if if you imagine aztec connect as these

programs we've written um we've tried to make a generic interface for all of d5 and we think it probably captures 80 to 90 percent of protocols but there's probably some protocols where it doesn't uh sufficiently kind of capture the needs um so the the first sort of use case would be just modifying aztec connect but doing it in a kind of maybe adding three um asset types in instead of two or adding kind of nfts or some some kind of different mechanic by modifying kind of our existing programs and then from there you kind of start to think about kind of more interesting use cases like coding up a dao where um the voting mechanics are private or the

rules that govern the dao are actually written in an aztec contract and a hidden um or kind of moving all the way up to kind of zk games which is uh a bit further in the future but something that we're super excited to kind of work on once it's ready how do you interface with noir is it part of aztec's company that's doing it yeah we have we have a small crack team of compiler experts that are currently working specifically on noir still it's still sort of in development the syntax is still being figured out it's very uh rust like in in in it's sort of it's syntax that there's a specific team working on that and then you know obviously the aztec three team which has to write all the supporting smart contracts to enable

uh that full programmability that they're a slightly separate team and yeah that's currently how they're interfacing but they're still sort of in their research and early prototyping phases cool how does noir compare to things like leo or snarky js like these there's other basically zk languages we've done a few sessions actually at zk hack and the zk sessions where we talked we had alex ozdemir do a survey of these different languages where does noir fit in i guess the reason we we set out to build kind of a new one uh when there was already so many is um at the time there wasn't a planck specific um kind of dsl

and that's really what noise kind of designed to to enable um some of the kind of circleman artworks now support plonk-based um kind of approving systems but they kind of were originally written for kind of multiple different proving systems and um noir can support multiple ones but it's specifically designed for kind of the optimizations around um planck-based proving systems so that's kind of why it exists and we kind of wanted to make it a much uh higher level language than some of the existing um snark based languages something like a circum uh doesn't really have like a standard library you

have to kind of implement everything from scratch and really be a cryptographer so if you want to be doing like a merkle proof or a range constraint you'd probably have to write that or maybe use use one that someone else has written but it's not supported in the language itself um something like noir exposes kind of all of aztec's standard library um through its programs so you get kind of the benefit of the aztec cryptography team if you're just a small kind of two-person startup building something in noir you can rely on kind of our cryptography and really not have to worry about being a cryptographer just work on program features and what you want to build how

do you think the different languages play out down the line will there be com will there be ways for these languages to sort of interact with each other and maybe this is not that's not like the problem you need to solve but like could that happen i think technically i mean i'm a little bit out of my depth here i mean i know that one thing that we're working on uh with noir is um enabling kind of you to take a noir program and compile it to different uh kind of backends as we call it um and we have like an intermediate representation uh in between kind of the front end of the language like what you see when you're a developer writing the program uh and actually the proving system so i

think kind of if you can compile down to the same intermediate representation uh there'll be a way for you to kind of potentially use different languages in different settings but these are all quite experimental at the moment so it would require a lot of standardization from various teams to agree on like yeah what what you agree to and what you settle on but i do want to talk a little bit about thonk i mean plonk was a creation of the aztec folks it was it was zach and arielle was there any other authors on the original yes uh we had uh wanna as well who uh worked on some of the security proofs i believe cool

i mean plonk's been an incredibly powerful concept i feel like in the zk space tell me a little bit about like yeah how much more development has happened internally like what is the road map for plonk i know there's other teams who've also been running with it like how do you kind of interact with that whole thing and i know neither of you are necessarily the folks that do this directly but yeah if you can just speak on behalf of yeah i think what both minor and charlie's take here is is around what what a different proving system enables um so our current system um is still being uh written in turboplonk um which is probably two and a half years old now i think the the paper

and we think about it in terms of uh how many gates does it kind of take to prove or write a program that that does kind of a zk money or has to connect transaction and how long does it take to prove that because that's what the end user sees and that's kind of that's where we work in it's kind of like am i waiting 30 seconds or 10 seconds to do a transaction when i generate this actual proof um so at the moment we're still using turbo planck transactions on the client take around 10 seconds and our kind of largest roll-ups take about seven minutes um we are upgrading to ultra planck um in in summer i love these names correct me if i'm right uh if i'm wrong

but like turbo plonk made range constraints particularly cheap yes so if you if you consider proving time is directly proportional to the number of gates in your circuit like in planck to do a range constraint requires ie is this number for example between these two values um required a huge number of gates uh turbo planck reduced that down to just like a handful of gates for a range constraint and thus it reduced to proving time and ultra plonk uh makes sort of a similar leap for for for certain things like complicated bit wise operations we can do use many many less gates to do like right shifts and and some things like that like bitwise ands which makes certain algorithms that exist in the real world

such as shah 256 cheaper it will enable things like um [Music] signatures to be done like on curves that are not sort of native smart curves and it sort of opens up a world of opportunities there because you can do them so much faster you called it ultra plunk but you i think i had heard octopunk but that isn't what you said was it octoplank i think was shelved in favor of a slightly better name um i like octo so so to go through the full list i think we have standard planck turbo planck and ultra planck the ones which are kind of immediately being deployed and then the cryptography team to support uh aztec three is working on um

something which has been called mega planck octoplank but i think it's now called honk um no so um that is the kind of the the latest of the cutting edge but um we haven't published um that yet but it's kind of a work in progress that supports kind of a further increase in uh or reduction improving time needed for aztec three uh because you have kind of these uh much more complicated programs you need to run uh with aztec three and no i should add that honk has an exclamation mark at the end yes oh my god that's amazing but you're so just a question i had mary meller on the show just recently talking about like a lot of the work that she's been doing

and one of them was on look up tables which does does one of those incorporate look up tables does turbo plunk do it uh ultra plank has i think lookup tables yes okay cool uh that is what enables these efficient bitwise operations got it if anyone's curious i can link to the mary episode where we explain a little bit deeper what a lookup table is um there's also a part of your stack that we found called falafel what is falafel um yeah we have a lot of food related names uh flour i think i i i don't know who started it it definitely wasn't me although i did start them at the middle eastern trend and some of our services and uh

like falafel is the is the name of what many teams probably call their sequencer or their coordinator it is it's just the server that we run that the browser like sends proofs to and it sends you data effectively it's just like a sort of an internal code name but yeah actually let's talk a little bit about the roll-up build you mentioned a sequencer is there is there a plan to have sort of a decentralized sequencer community at some point this is sort of i'm gonna just for the listener the roll-ups have sometimes different names there's committees sequencers there's agents there's and like almost every system that bridges between two networks will have names for the thing that does

it in your case it's sequencer falafel falafel in your case it's falafel uh is is this is this the agent that also is making a snark um it's coordinating the creation of the start we actually have uh another service that runs behind falafel called halloumi and that introduces that actually produces the the snark itself that is a service that specifically runs this uh highly optimized c-plus plus code because and it runs on huge great big machines in aws at the moment and that generates the snark itself and falafel just asks hello me to produce that proof and it kind of collects these things

together and then it publishes them to mainnet so you can actually have many many halloumi's but you can only have one falafel oh okay so what many snarks at the moment i mean you specifically asked about decentralization of course we want to uh as time goes on we want to decentralize so there would be many for muscles as well very cool how how like who going the halloumi the the ones that are making the snarks who are they like what are they team members right now like who's the snark creators well that's just a piece of software that is running uh like in aws and it takes takes quite a huge amount of compute power to produce these things so it's um it's a

large parallelized uh system uh that basically they they just do jobs like there's a whole bunch of jobs that need doing and they pick them up and those jobs are producing proofs okay cool but like anyone could do it like um they they are part of a system as a whole and in theory down the line anyone can run the system as a whole so it wouldn't be like an individual will run a halloumi you would run falafel and halloumi together but really like as time goes on we want to actually move out of the data center as well like uh much much longer term we want we don't want you to have to be running an expensive machine in a data center that's not very decentralized

either so ultimately like some of these services will probably condense down into single little things that people can hopefully run on commodity hardware but we are we are looking like many years down the line for that i think what do you think needs to happen kind of in the snark world for that is is it the snark that is the constraint here for it being able to run in a small on a device it's it will require um next generation proving systems which has been alluded to we're working on and just a very large engineering effort i think okay yeah i think it's technically possible today um it's just a lot of engineering and um you would have a throughput reduction as as a result so are kind of

it's the same kind of snarks that we run in the browser so they already run on commodity hardware um but the gates in the browser uh to kind of prove like the inner tiny snark it's about 65 000 gates i think uh the largest roll-up what is it close to 32 million gates yes 32 million yeah so it's it's kind of it's a lot more complicated when you're aggregating lots of transactions together um you could do a smaller roll up and maybe get it to run on on a macbook pro right now like a 2x2 roll up but it's kind of you would have a throughput sacrifice so um i think over the next uh year or two with some kind of optimizations on the

cryptography and a large engineering effort it's all feasible it's just kind of us charting our path towards progressive decentralization and for now it makes more sense for us to kind of be a bit more centralized so we can update things more quickly cool but going back to that cover that question about decentralizing falafel halloumi creating this this landscape how do you do it what's the and maybe what's the timeline yeah i think the current plan is um something we call a federated prover and it's a model i think that mina have pioneered actually um so you have kind of uh two roles like we have already a coordinator um which we call falafel

which basically picks which transactions go in a block um and then you have a set of workers currently those are all controlled by us on aws um and we call them halloumi um but those could be decentralized and you can decentralize both parts so our timeline to kind of um working towards that end goal um actually looks a bit different though we would take the current system which is um one entity running falafel and halloumi and get a few other people to actually run the system as is so we'd have some kind of uh trusted investors kind of more large institutions to kind of run clones of the current system to give

redundancy and then that gives like a level of decentralization and in the background then would work on um kind of improving uh the engineering tech stack uh to have a transaction pool which is missing from the current system at the moment you have to send you have to pick your falafel effectively you you don't kind of uh have a network uh like ethereum does and have like a transaction pool so once we've built a transaction pool um it will enable kind of coordination of these um roll-up providers a bit more easily um and that's where kind of token economics can come in um and for decentralization can occur and i think we're we're actively starting to work on that over

the next year um we don't have a date yet because um pudding dates is bad as we we've seen recently with our our launch but uh it's definitely something that the the team is uh starting to work on post has tech connect um and it's a priority uh for the company because we just believe that a fully decentralized privacy network is is very important it needs to be censorship resistant got it you just mentioned the launch i know we want to talk about that so we're recording this mid-june there was a launch plan for last week and it kind of it sounds almost like at sort of the very last minute there was like a decision not to go ahead tell us what

happened yeah so um i won't go into we have a public twitter thread on um i guess the full post mortem and i think the things that went wrong um we kind of ran out of um road for testing very large roll-ups um on mainnet um we've done a lot of testing on kind of forked blockchains and the the ethereum test nets and we'd expected those to behave like mainnet because they're a test net and in some cases they're they're a copy um they actually didn't end up um behaving as anticipated so what happened on on launch day um

everything had been deployed we were sending roll-ups um falafel and halloumi were working kind of as intended and we had a final kind of load test that we were kind of planning on just running to sanity check that we could construct the largest roll-up that we could currently create which is 896 transactions in a batch and when we constructed that roll-up and tried to send it out to the ethereum mainnet it wasn't mined by any of the nodes for any of the guest nodes would not propagate it because there's this upper limit on the size of the transaction that you can actually send to the network which is a i think it's

128 kilobytes so this is a it's a valid ethereum transaction um the the largest kind of ethereum transaction by gas limit is close to a megabyte but certain um client uh ethereum client software um imposes limits on the transaction pool um to help transaction propagation and uh we anticipated that not being an issue but it ended up being an issue um so we decided to delay the launch whilst we worked on a few different solutions um the easiest one is just constraining um the kind of uh batch size i guess the batch size um it only is really an issue for deposits into aztec

would have to constrain it from around 896 to around 400 transactions which it does increase costs for users but it's actually not too much because your only amortizing the verification cost of the snark and you've already amortized it by several orders of magnitude at 400 transactions compared to the current system so it's not too big a deal and the other kind of option we've been uh trying is flashbots you can actually send large transactions directly to flashbots bypass the ethereum transaction pool um and kind of get these large transactions um

mined by going directly to the minor and you get the added perk that you kind of get mev protection by doing that so it's something we're we're considering as well oh interesting tell me a little bit about about the moment though when you decided not to do it like were you guys together here yeah we were here right like because when you launch updates and upgrades it's kind of like a it's a group effort yeah i think basically we had we we were obviously fully intending on um testing this on mainnet but like before launch but it just so happens that that testing on mainnet came down to like several hours before launch just because we had got delayed for various other reasons during this during this launch period um so we were just yeah we we obviously got everything out on mainnet

and we we had we were together trying to well together we were slightly remote but we were all communicating very closely generating these deposit proofs that we anticipated could be a problem like we did we did anticipate there could be an issue here we needed to see that this roll-up would propagate throughout the network and it just came down to the line and when when it was published and it didn't go out as anticipated rather than just continuing to try and like force things through we just said we need to take a step back and we need to like get this working stable before we uh set another launch date in a way it sounds kind of lucky like i'm glad that you were able to sort of stop it before exactly because going out

actually because you don't want that to that to happen after launch for sure so our testing did work it's just unfortunate that it was just so close to the line but yeah there but i'm like when i saw that it wasn't happening i also was kind of like i think it's timing-wise like much much better to to have caught it and to be able to like explore it and not be struggling i think there's been other examples of networks launching maybe a little bit ahead of when they should have not so much roll ups but other things and it's a lot harder i think to walk it back once it's out so i think it's really good that you caught it what's the next stage then like what comes next after that i mean i'm sure the launch i'm sure is still planned but i guess there's

going to be you're evaluating these different options but in the meantime are you also then running extra tests uh like yeah we have the various teams the cryptography team engineering team front-end team and we've effectively reset this uh process whereby we will want to green light before we set like another launch date so whereas previously we had sort of green lighted various things on the assumption that certain things are going to go well we've we're being more strict this time around so once we have those green lights from the various teams then you'll hear more about another launch date i also wonder i don't know if this even factors into your decision but like right now markets are looking really rough people are kind of like sad and things are kind of unwinding

like is it a strange time to launch would it be a strange time to launch right now like would it be better would it actually affect it at all i don't think it would affect um the launch one thing we have considered as part of kind of the the post-mortem though is um kind of with defy um there's kind of a new type of like denial of service that can happen in adverse market conditions so yeah if this words happen and we kind of had launched and we couldn't suddenly produce roll-up blocks with the launch kind of d5 bridges it wouldn't really be an issue because they're not borrowing based bridges but

a lot of the market um kind of drama at the moment is around kind of underclaterized or heavily leveraged kind of debt positions um an aztec connect does eventually support debt positions um so i think one thing we're just we're sanity checking is kind of are those kind of good launch bridges and like when should we put those in place um to ensure that users can always exit from the system and they don't get kind of timed out in kind of highly volatile market periods so are there other kind of i don't know updates or research anything that folks should look out for kind of in the aztec world

yeah we have an update planned um at some point in q3 q4 um where there's a few things we we're looking to achieve um the main one is upgrading to ultra planck which enables ethereum signatures and so currently you have to sign using a grompkin private key which is something the name of the elliptic curve we use grumpkin yeah is it where does that come from is that a name uh it's like grumpkin and the uh hunting of the snark isn't it i think was it was it uh not lord of the rings was it what's that alice in wonderland no game of thrones was it there were there were grumpkins and there were snarks and

it was grumpkins without a p but they were called grumpkin because uh i think zach named it grumpkin and he didn't realize the p shouldn't be there but it's stuck so now we have grumpkins okay yeah so we're upgrading to enable you to have better security basically in aztecs so you can sign with your traditional ethereum wallet um and around the same time we're we're planning on seeing if we can move some data uh off chain and it's linked to kind of large transactions actually um and what went wrong with launch um aztec roll-ups are quite large um and there's a few kind of parts to that there's uh the actual proof which is tiny um and

then there's uh one chain data which is the leaves of the merkle tree um and we believe that should kind of always stay on chain so the foreseeable future unless something like eip4844 blob transactions comes along um but then it is kind of what we term off chain data uh which is viewing keys and stuff where the security assumptions are slightly different um it's not a system liveness issue uh if you don't have this data it's more a user can't access their specific funds um so it's still quite serious but the system can keep functioning so

we are looking at ways of moving that data to kind of other data availability layers around the time of ultra plonk but so stay tuned for more on that because it has some pretty significant gas cost savings for users well thanks so much for coming on the show and sharing with us an update about aztec ck ckmoney aztec connect giving us a little recap on a almost launch and what we can expect soon um but yeah thanks so much thanks for having me yeah thanks a lot for having us i want to say a big thank you to the podcast producer tanya podcast editor henrik chris on research and to our listeners thanks for listening

you