Episode 257: Proof of Solvency with Kostas Chalkias

Transcript

foreign [Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online [Music] catch up with Costas halkias co-founder and chief of cryptography at mistin Labs we dive into his background and then explore his work on the concept of proof of reserves or as he calls it proof of solvency we look at old models for this how zkps can be used in these protocols

the way that exchanges currently use them attacks on some of those approaches the security vulnerabilities privacy issues and general bugs that can be found in some of these systems as well as how to better create proof of solvency protocols for some context proof of solvency means does this entity have the liquidity assets reserves that they say they do obviously this is very relevant to our industry today so it was great to get a chance to kind of dive into this topic with Costas now before we kick off I just want to let you know that we are rolling into our last weeks of ZK hack if you haven't checked it out yet it's our annual online multi-week event all focused on bringing you up to date with ZK tools and Tech it also

brings together some the best CK brains to hack on broken ZK protocols we have prizes but more importantly this is a great way to get cred within the community it's been amazing so far with dozens of hackers hacking and hundreds and maybe by the time this airs thousands of Workshop participants be sure to check out the website to see past Workshop videos puzzles and some of the solutions as well as sign up for the next few sessions and hopefully get a chance to try your hand at the current ZK hack puzzle you can find out more at ZK hack.dev now Tanya will share a little bit about this week's sponsor today's episode is sponsored by Elio Elio is a new layer 1 blockchain that achieves the programmability of ethereum

the privacy of zcash and the scalability of a roll-up if you're interested in building private applications then check out Elio's programming language called Leo Leo enables non-cryptographers to harness the power of zkps to deploy decentralized exchanges hidden information games regulated stable coins and more visit Leo Dash lang.org to start building that's Leo Dash landg.org you can also join Elio's incentivize testnet 3 by downloading and running a snark OS node no signup is necessary to participate for questions join their Discord at elio.org Discord so thanks again Elio and now here's our episode [Music]

today I'm here with clusters the co-founder and chief of cryptography at mistin Labs welcome to the show Costas very nice to see you eventually Anna and I'm super happy I have the opportunity now that everything is super hot on the topics I'm working on I know a lot of people actually in the industry know me by my nickname which is okay because you remember right when we started this this podcast it requires a few moments to be able to pronounce my name that's what it is that's what it is there are a few takes that will have been cut by the time people hear this but I did I did say it by the end okay thank you cost us uh welcome to the show

today I mean our plan with today's episode is really to talk about proof of reserves a topic that you've been focused on for quite a while I want to hear though like let's kind of rewind a little bit before mistin Labs what were you working on a few years ago where did you you start to get excited or interested in this concept of proof of reserves okay first I will give a few hints on how I went into the cryptography space in general right imagine I'm an immigrant in the U.S I come from like a Greek University I worked for a couple of European companies in the past all of them on security and cryptography and all of my life that I can think after 2005 or 6 was breaking stuff you like to break things

well I was I think I had an inclination into doing uh like some cool attacks in systems and and all of this you can even I mean back in the days you could very easily like do all of these JavaScript injection attacks you can even go to websites you can learn how things work on the server side but anyway eventually I ended up doing pairings by linear pairings which is like one of the major uh Primitives that is used in zero knowledge proofs since 2008 nine and I was hired at Corda you might not Corda Corda it's from R3 yeah yeah it was one of the first biggest investments in the space at the very beginning there were like permission eventually they got like

semi-permission less and all of this stuff but there was a benefit there the benefit was the guy who hired me was my Khan Mike Khan is one of the first developers of Satoshi and I had the opportunity like since 2016 to literally work on like hardcore blockchain cryptography and obviously back then because the company was backed by some of the most major banks in the world I think all of the popular banks that you are aware of were part of the Consortium who invested in R3 back then and I worked there leading all of their cryptography efforts for uh like two to three years I remember myself starting the the proof of Reserve staff even

before I joined Facebook which means that back then we were doing sgx enclaves and not zero knowledge proofs and I remember myself being on the Zero knowledge proof the first event that happened I was there with 100 cryptographers I was the only person doing sdx everyone was sporting at me and when I said oh my God where am I going it's now kanetti and kravchik and all of the like Daniel benaros and everyone was looking at me okay this guy is doing something different however we want to hear different voices um what event was that was that ZK proofs yes it was the zip April the first one that was organized back then by candid but anyway the the zero knowledge proof topic actually attracted

my attention of course and then I said okay I'm breaking stuff and then I realized I'm dealing call of the day with bankers and people who are doing uh like decentralized Finance let's see is is everyone solvent can we even prove this can we do anything to actually provide some evidence to the world especially for exchanges and some centralized wallets even custodians right sometimes we need solvency for custodians as well not necessarily exchanges and I started like doing this work from 2016 as I said and it's important because I think one or two years before I join R3 my car was literally an auditor he was called by one of the major exchanges back then to do personal

audit so he went back to their database and he actually uh with his eyes checked the results of the database oh these are the assets these are the liabilities I can prove myself I put my signature that this company is solvent wow and then I said oh my God is is this like okay to do it yeah we rely on Experts and I rely on your uh like sayings but this is not verifiable there were a few a few people even uh like after the empty box case where they started building cryptography they realized that personal auditing by real people and that they were considered experts is not enough right this is not transparent this is not auditable you

rely on someone's reputation that this is actually happening the big four like the big Auditors weren't in the space yet like imagine all of these things were just a toy there were not real assets back then now they have like more of a monetary value and they said okay let's use a very basic cryptography let's use Miracle trees and with Miracle trees people can uh someone like a company can just put all of the balances in a medical tree and I will check if I'm included in the miracle tree this was the the very first uh like approach on how we can do like proof of liabilities at least is this is this the work you were doing or is this the work that was being proposed generally so like the first proposals were even

exchange between some email threads even before my time like 2014 2015 the very basic stuff I'm not saying that this is the one that we should use today but if these guys weren't there like people like Greg Maxwell and some other folks we wouldn't be in a state now that we can have more privacy preserving techniques techniques that are actually more secure and all of this stuff so imagine 2014-15 is a very important day because empty gogs the collapse of the empty Corks And the rumors that they were insolvent yeah it sparked the interest of some cryptographers especially those in the Bitcoin space that is okay let's see if we can automate this process and the automation started as I said

with very simple Miracle trees but these Merkel trees were not as like the Merkle trees were using for membership proofs what we do we also have a summation up to the roots so you start you have a medical trees with all of the balances of the users like you have five Bitcoins I have seven Bitcoins we put all of them into leaves in this Merkel tree and then we do the addition so the next level has five plus seven twelve and you go up and up and top eventually you go up to the root and the route should have the total amount of the liabilities of the company right and we said okay what do we do with this what are the reserves maybe not liabilities always I will explain there is a huge um like misconception here when we say proof of reserves if

this is enough to actually prove solvency right here you're talking about like the Merkle trees this was sort of first attempt I remember R3 so this is a 2017 yes exactly exactly I vaguely remember well it started earlier I think think it started even very close to the ethereum I mean when a city was published uh R3 was in the like they were trying to build R3 back then um but but in a different way like more private and they wanted to actually explore I don't know different ways of public blockchains but still a smart contract platform I was there I worked until 2019 and then I met some some blacks here with our city of atmiston

this changed my life not only at Mission Labs it saves my life for me to go at Facebook yeah and I will explain what happened so we had an algorithm this was like a post Quantum signature scheme and then there was a conference in Canada and I said okay of course it's a good publication I'm going there uh it was a night Ripley conference not so famous but it was it was okay for the time being and Sam was also there because what happened back then it was David Marcus building the team of Facebook that they will deal with blockchains and obviously some key members of the team and some is I don't know if you know but some is probably one of the youngest people being promoted at this level that he was before he leaves Facebook oh wow

he's he's very smart but anyway obviously some I didn't know this guy back then um also attended to try and check oh is there any interesting presentation and then he has seen the name of my car as I told you the guy that was at Bitcoin and he said how bad this presentation can be right the conference was not perfect right there were many week presentations and all of this and I was fortunate because Sam joined my session and then he went back to Facebook and said okay I met the guy that we should hire cool so he saw you give a talk and decided you would be a great addition to the team and then he recruited you I guess exactly and it's very funny that Sam didn't actually refer me to Facebook someone has seen his post at Facebook

and someone else got the referral bonuses yeah we're making fun with some these days but anyway this was my first step to say okay I'm now in the UK I used to work in London R3 was like New York and London but most of the engineering team was in London it's a good opportunity for me to go at Facebook obviously they are building something new I know they want cryptographers the team seemed really cool I talked to some then I even talked to some of the leadership imagine getting someone as a transfer from a company where you are leading stuff and you're getting paid well you're actually having your own team it's not easy right even if you say I'm going to Facebook

but I was convinced uh like even David Marcus was a key player and Evan think Evan like the CEO of Mr now was also like the the director of all of the research team at Facebook did you have any trepidation though going to a company like Facebook now meta like at the time this is 2018 2019 I guess yeah um the reputation already of Facebook because like it's a big company but it's not I mean it first of all wasn't really known as a cryptography company at the time no and like yeah did you have any worries about going to such a big org I can give you uh like the full perspective here I didn't and I will explain why obviously this was like

right after the Cambridge analytica situation which happened the year before okay and obviously as a researcher you want to go sometimes in companies that you know you can fix things okay uh I didn't know of course if it was like Facebook to blame or if if it was just because they they missed something like in the flows but anyway it's it's like in drinking two to year right you want to go to a company that is big enough to support even having a team this was one of my first requests back then I didn't have a team directly but eventually I did lead the team as I wanted and the fact that I I was about to work in a startup inside the meta Facebook

back then was also very good for me because I was very experienced with startups and I said okay it's a big company as you say they have their own issues but at the same time they have the the many benefits that they can have access to like the best resources available I can work on very important problems it's a new blockchain I've done it once I've built one blockchain with Mike and all of the R3 team Corda I know how to do it again and to tell you the truth at the same time you know how it is with cryptographers and like senior Engineers you're getting offers from Apple Google Facebook and so on and then I had a few other options Visa as well back then and then I said okay I'm joining Facebook because in all of the other office efforts that I have

they are actually putting me as a security engineer or as a cryptographer where I don't know where what is the project I will work on but Facebook has it had a dedicated role for Costas and this is the reason that I picked Facebook it wasn't necessarily money it wasn't necessarily uh like the fact that you said bad reputation they had a very clear role for me and I joined Facebook super happy three years leading staff starting officially publishing uh proof of reserves proof of solvency protocols on 2019 so the first year at Facebook we already had the presentation back then in Amsterdam it was like one of the first no second or

third zero knowledge proof event I presented our first ideas how we can add privacy to the original schemes of proof of solvency and since then I worked to show so many different things at Facebook so from proof of reserves leading the zero knowledge proof story with bobbins now bobbin is a polygon um leading so many different like compression schemes even on signatures with letter letter is an a16z now we had so many I mean the team was one of the best you can see back then I'm not I'm not kidding right I was in court I was I was dealing with like hyper leather fabric and I like all of the ethereum guys

I believe that Evan think because he was like the head of uh research back then he managed to build a very solid team and I can tell you for sure because I was internal at Facebook right the reason that Libra didn't launch wasn't technical yeah we would already technically even a year ago before the Libra project collapses and we were super happy with what we did and it makes sense right after the Libra collapse you've seen a few startups popping up yeah like it's it's missing Labs it's Aptos it's linera it's uh it's even David Marcus lights part at least for almost all once there is a reason for this the team goes very very strong and because Facebook couldn't keep all of these people eventually I mean nobody

would work for a project that wouldn't fly ever launch yeah yes then I personally when I realized that Libra will will not manage to do it for a while before I leave Facebook I also worked on WhatsApp security I have a few patents there and all of this stuff I'm against patents but you know big companies they have to do this for even defensive reasons reasons I'm putting it is I can I can give you an example I I didn't know about this right there is a reason sometimes you might be the inventor of some idea and there might be a company outside the U.S that they will say no no we did it and now Facebook you cannot use it so sometimes they because of these uh Potential Threat they they go and patent but anyway this happened

and with mistan I think we had the best opportunity possible and there is a big reason for this is some of the research that we were either finished at Facebook or most of the times especially now we extend it after we left Facebook it was so Innovative that compared to the other blockchains that you could see here and there you had an opportunity to actually build the system with high throughput privacy whenever is required some very cool cryptographic Primitives I had all of this experience with proof of reserves and working with the Libra foundation with Corda banks in the past and then I said okay it's better for me not to stay at Facebook it's better to me not to join another company now all of them are friends right I'm personally a person

who likes the community I want other projects to also flare is but I said okay I will join mistan because the team that Evan Chang is now having is was literally one of the best I've ever worked with wow so we have five Founders who all of them were almost like having a one of the best promotion parts that you could see at Facebook these guys couldn't be like fake right it's there is some real substance behind it and and then I left Facebook I joined Mr nazda lead cryptographer and obviously co-founder and now we have again I believe one of the most solid teams we have four Departments of cryptography we have a zero knowledge proof dedicated Department we have a random Bitcoin

dedicated Department we have an optimizations department and we also have an rfcs Department okay so this is where I am at the moment right leading these four verticals inside miss them sounds good let's go into proof of reserves so you've started to tease some of the early work so I think we Now understand the history of like when you started working on this yes proof of reserves obviously we're recording this just a few weeks or a week after the crazy FTX Fiasco collapse and all of that the topic has become super relevant because in that case there were no proof of reserves and we are learning that reserves were not there and that's kind of terrifying so this idea of proof of reserves you do

have it being used in exchanges I want you to kind of go back into explaining what is a proof of Reserve actually you started with the Merkle trees but like let's even go a bit higher than that like what is it for I will explain what's the problem we're solving here right we have companies we have exchanges we might have custodian wallets and like all of these people who own money and they handle money on behalf of the users for which the users do not have the actual key to the blockchain like someone else is controlling your key to make transactions on the blockchain and this is what's happening usually on centralized exchanges like the FTX case back then with empty cogs and even like all of the major exchanges that we're

aware of people are not good at protecting their their passwords eventually sometimes you are lazy and what you do is actually you go there it also gives you all of this flexibility to do the transactions without you remembering very complex passphrase and everything and people felt really good with that until we realized the the problem right the problem is what if the company you're putting all of your money there by credit card you are having some wires you're sending all of this because you don't have a personal account they control the Bitcoins ethereums whatever is the coin for you but you don't know if they are solvent and what solvency means is the money that all of the clients have in the exchange these

are the liabilities of the exchange are matching all of the assets that the exchange has in the outside world which means the assets the real Bitcoins that I have on the network and I control the key for I'm the exchange now all of the other potential like acids that I have Outside The Exchange I might have some cash I might have some bonds I might have some real estate Investments I might have different things but at the same time I want to ensure but that wife one day all of my clients all of my customers come back and say I want to withdraw my money am I able to pay them back and if you consider what are the functions involved here it's like proof of liabilities you need the proof to

actually show how much money you own to your customers and the proof of assets how much assets do I have like in my ownership would you say then is proof of reserves both of those things is the proof of reserve a proof of liability matching a proof of asset yes and sometimes we call it proof of solvency as well so proof of reserves is probably equal to proof of solvency and this is divided into proof of liabilities and proof of assets sometimes people are confusing proof of Reserve with just proof of assets because the word reserves sounds like like that's what I was thinking too yeah exactly so what I use lately I better use the word ink proof of solvency and

then I divide it to proof of liabilities and the proof of assets and you can see different mechanisms even from the cryptography perspective how to prove liabilities and how to prove assets and I think this is causing the confusion even on Twitter people can see like there are some very good Solutions out there and I can mention like start with a little bit Samsung has some great ideas we know all of these Benedict Boons and Dan Boone have some very good ideas so for Selective disclosure yes exactly and there is also chain link resolving with oracles the problem of proof of assets and I will explain why these problems are different but anyway let's stick to the point where you have to prove liabilities and you have to prove assets how do you prove assets let's get this

side first right there is a second parameter actually before I go there which is liquidity we know that the FDX case might not be we don't know if it was truly insolvent actually this this is like the court or uh like the legal system we decide but we know they had the liquidity problem this this is a fact right and sometimes I might say to you right let's assume you're putting your money into my exchange I'm an exchange now and you're having like one million in dollars in my exchange and I go and buy a real estate I go and buy a house and then you say I want to withdraw my money yeah this money might not be liquid I mean I cannot even I need to sell my house first to give you your money fair

and I think in this case especially with the case it just went down like Investments with long lockup periods for example would still exactly like asset on the balance sheet but wouldn't actually be liquid so if you needed to take the money out you wouldn't be able to exactly exactly and this is usually the main problem that even if you do cryptography and all of the fantasy Solutions you need to Define some function on what is liquid and what is not liquid and then you might say I'm running in a fractional Reserve regarding liquidity however in total I am solvent because Liquid Plus non-liquid assets surpass the liabilities and it's a problem right it's not easy to solve and let's go and see what are

the options that we have proof of assets first because proof of assets as we said is like the assets that you have on chain let's assume these are the liquid assets you have Bitcoins you control keys for your Bitcoins and ethereum and there are non-liquid assets which might be as you said Investments bonds even cash on the bank and all of this stuff so there are companies like chain link and some others where they're building a set of like oracles and probably they have some collaboration with Auditors to connect to the real world right like that yes to the real world you need this you need this and there is a question can we do this without auditors probably with some zero knowledge groups but again all of the system like the banking system and everyone who is

owning these assets eventually so your cash is under a bank your real estate is probably under some agency or or something they need to provide these proofs because otherwise how do you know that so what's happening is let's assume the simplest model is you have a set of oracles the set of oracles is talking to some Auditors these Auditors are auditing the actual reserves the actual asset so I'm not going to use the word results again the actual assets and these are giving like every few moments they're giving a signal that these are the assets these are the assets these are the assets we need this heartbeat right because you know these are fluctuating uh and this is one of the other problems that we have now what do you mean the assets at

which time stop yeah because even in one moment I can transfer funds or I can transfer some of my assets or I I might acquire a new company my assets are changing constantly so for process solvency it's very important to Define an actual time stamp in which case you are doing concurrently the asset check and the liabilities check and this is not very easy in the real world how would you do it like how how would you actually say all of the other providers of these assets Banks real estate agencies Bond providers the stock market Investments investment funds how do you say to them give me by this

timestamp all of my assets and I will compare it with these liabilities there is a process here and you need some time to organize it but it is possible if we do it properly it is possible and there is another thing that you mentioned at the very beginning of this meeting right one of the issues is if you know however this timestamp and you have a friend in the other exchange you might ask them okay tomorrow at seven o'clock I will be audited can you actually I said this before we started the interview but yeah this idea of like a short-term loan to move funds into an account at the time when you're actually doing this check and then you'd move them right out and I think there's like a theory that crypto.com may have just recently done that but that's a little can conspiracy

theory possibly I won't get into this into the conspiracy and rumors I will talk as a cryptographer here right what can we do is it anything that we can do surprisingly there is a paper from uh Benedict Boons Jeremy Clark and like all of these popular like famous notable cryptographers wearing their Provisions paper it's called provisions it was the first scheme that I've seen I think is 2015 that they had an algorithm that said okay if proof of assets is happening at the same time for all of the exchanges then there is a zero now let's prove that we can create that all of them are solvent and they use this asset once right you didn't double use

this asset in my audience yeah interesting okay so it is it is possible however this algorithm goes only based on the facts that we can see on the assets that we can see on the blockchain because in the blockchain you know because imagine these are addresses that they are owning some assets and by zero know let's prove you can use the object ID the utxo ID or whatever it is and say this utxo ID in zero knowledge proof is not used here and here it's used only once it is possible is it also possible to take like three snapshots in a certain period of time in case like almost to look for these type of short-term loans although I guess actually if somebody knows the snapshots are coming they could just make the loan

longer yeah it is it is possible and this is like what I call continuous auditing you need some continuous auditing right either the this step is every few moments literally in an analog way it's very difficult how to do it per second right because all of this requires almost some like computations you cannot even do it every second so you have to take this into account because if you are building zero knowledge proof systems for this stuff we also need to account for how I mean the frequency of this it's yeah it's and it's important right it might take time and you know better I mean with all of the guests that you have that some proving systems are not super fast or even if it's not super fast even if we say a minute we

cannot go less than a minute how would you do that okay this is one this is one of the problem right first problem how do you ensure that at the same time in one organization all of the proof of assets are happening at the same timestamp the second problem is how do you ensure that these are not colluding and even if exchanges are not coloring not everyone is audited at the same time even if we could enforce it because it might you be you in an individual who would be a friend of the CEO of the exchange for some reason you had a lot of assets and because we're having a like assets outside the exchanges you own the the private key personally you can just rent it for a while right and then after the audit you will

never be audited because you're an individual who cares yeah they will return back to you the money and we have to figure out how to solve this and the way we can do it is with continuous analytics if we see big transactions happening this is an alert and we have to do this however we also propose something else in one of our papers the audit should happen in a timestamp defined by some set of Auditors in the past okay so imagine I'm coming I'm coming towards you now and I say to you I will loaded you for yesterday not today yeah Ah that's nice okay now it's in the past right you cannot change the past and probably you have to find a way to prove what were your liabilities back then and what were your assets back then

and now you don't have the time to do all of this collusion thing so there are ways to do it we don't know how far in the past it is possible because you might have lost the keys yeah yeah there's things that kind of had you lose yes exactly in a way also you're you're proving proof of liability and assets then and you may have lost it like maybe you've totally gone out of whack since then and you're not proving it for now okay this is true however a few things might be auditable already right if you had like some timestamp on the transaction that happened back then and even I don't know with some auditor supervision or even if you don't want to provide quite so much privacy and you want to reveal to the world these are the assets I own the blockchain

obviously you're losing privacy here these are all of the liabilities I have for everyone you can go and check at that day was this your balance are you happy with this if you do the sum of the liabilities is it the same with the sum of assets or at least lower than the sum of assets then it would be golden but we need also some privacy we cannot reveal people's uh like balances yeah and this is where the problem starts let's assume we finish with proof of assets we understand the problems there let's go to the liabilities now on the liabilities part how do you ensure that the company is adding the balances of its user the liabilities to their customers correctly and I'm going to talk about attacks now

what zero knowledge proofs can do and all of this stuff plain Miracle trees might not surface because if you have a miracle Tree in theory where you're going up to the root you can read your neighboring Leaf right you can read the balance from your neighboring Cliff to do the addition and go up and up and up and up so in the original mechanism where our balances were just leaves of the trees and then you just go up its level you know your neighbor and you are learning some value that someone in the network has and you might be unlucky or lucky to be next to Mark Zuckerberg for example and you can see someone with 10 million dollars in Bitcoin why you should know as an

individual what someone else is owning as liabilities to this particular exchange so we had to hide this information okay simple Miracle trees do not work and here is where zero knowledge proof is coming so it's more for the Privacy here that you're using you're using zkp so that you can create this proof of liability without revealing everyone's account exactly okay well this was one of the first reason that it was proposed post but obviously you can also use that KP for compression but let's assume this is not a problem now compression is not a problem here and then what you need for zero knowledge produce okay I can build the serial knowledge proof scheme that I take the miracle tree and what I do is I blind the balances and then I use homomorphic encryption up to the root so

you know this is encrypted of something and your neighbor has another encrypted of something but if I add them I know I have the encryption of these two values I know one of them but I know the correctness of the operation and then you can go up to the root and you know that the correct operation has happened so here is one application of zero knowledge proofs and obviously because we are talking about blinded values now you apart from the homomorphic encryption you also need zero knowledge groups to ensure that there is no overflow so there is this called arrange proofs you need to ensure that like the balance will not get up to some like very big amount and then it because we have groups in cryptography right this will go back to zero and one two three four

again like starting from the beginning you need zero knowledge proofs to prove that the range of the addition of this homomorphic operations is correct is not overflowing got it uh just a quick question on the fhe that you're talking about here like since it's just simple addition is that something that like current fhc systems can handle already because I know that like more complicated computation like just generally fhc isn't like completely developed space okay you say already today you can use the fhe that exists to do a scheme like this yes and you don't need fhc in in practice like even partial for morphic encryption works because you just need addition F States e is additional multiplication and here

you don't need multiplication you need only addition which means that with very simple l-gamal encryption which is like additive is adding the exponents which are encrypt it works and this is one of the systems that we proposed originally proposed in the provisions paper of danbone Benedict de Boons and Jeremy Clark and all of these guys and then we said okay they're proposing this they didn't have a Mercury structure back then for them it was a flat structure but we said okay we cannot publish billions of information on saying let's do the medicalized option and what we did is very plain patterns and commitments not fully homophoric encryption just homomorphic encryption uh just addition and arrange proofs on top of them and now you can go up to the

root and you know all of the operations were correct so was this both for proof of assets and proof of liability or was this only for proof of liability the miracle tree approach is usually for proofs of liabilities and I will explain why we need medical trees there there is a reason I didn't finish yet with the proof liabilities the fact that you know you have a construction that in a zero knowledge-proof way is adding the balances correctly up to some root is not enough Y is not enough and now we'll explain about some new findings we had in the previous this year actually Financial crypto conference that we revealed that all of the proof of liabilities that at the moment most of the major exchanges those

who support it offer they have vulnerabilities okay so here you're talking about like actual uses of this so this proposal this idea of visualized proof so it's already being used it's in it's been used by these exchanges but you found a vulnerability in that model for vulnerabilities four vulnerabilities in that moment okay and I will explain what I mean here okay let's assume that you had a way to do uh the addition right we explained zero knowledge proves we explained Miracle trees the first one is the original proposal from 2014-15 from from Maxwell had the small issue where instead of commit think to the addition of the two values you can play games

like breaking a bit the addition property and you actually commit to the maximum of the two values so if we had five and five I could say that the sum is five so you can hide vulnerable you can hide balances up to the root and unfortunately well this is public information now for example all of the audits that until 2018 2019 the Lloyd had were using this algorithm which was vulnerable huh was this a bug was this a mistake why were they only taking the top the most the biggest one that's that's the best question I wanted to hear so the vulnerability was actually published even before we find it the problem is people didn't realize what they found

and then and then because I was at Facebook I had all of the research supervision of what's happening in the space I said okay let's see if this vulnerability actually applies today in the exchanges and then I realized that they are doing it even with one of them one of the big four auditors hit an emergency when we reported it oh I'm not kidding they they literally called me that we're going to have a Friday meeting I don't remember the day and let's see because Costas I can assure to you we didn't know there was a bug they didn't know one they didn't know that the algorithm they were using had the bug oh that's bad what was happening is I personally believe

that the Auditors didn't know about this vulnerability they didn't do it on purpose I have a few evidences that the reason for doing this is because first the original algorithm with the Merkle trees was not published as a cryptography paper it was published in some threads and in some forums and people never had the ability actually to do a proper security proof got it then there was a guy there was a team I don't remember the names of the authors that on 2018 they said okay the Merkel Teresa summation is not correct right they can actually play games here and prove different balances by committing to the max instead of the sum but nobody paid attention probably the conference that was published

wasn't uh I don't remember which con yes maybe it wasn't crypto it wasn't your Crypt it wasn't like CCs is there a knowledge Summit no it wasn't okay I think I think the title is called breaking The Binding or something but anyway nobody paid attention you know the Auditors also do not have cryptographers I explained at the very beginning that even big companies like Facebook they didn't have like unlimited cryptographers right even in University departments you could find more cryptographers than at Facebook at the very beginning or in an auditor who is an expert in cryptography would join an auditor for years and have like a big research team it's it's very difficult

even blockchain teams like sometimes struggle to find good cryptographers so I believe they just got what they found in the Forum and they just applied it and that's that's why nobody could figure out this is actually exploited can be exploited this is the correct wording because I think at least in the Deloitte case it wasn't exploited they just didn't know this was one vulnerability but were there others yes this was one the Merkel 3 summation was wrong the others are okay what do you do with the proof of liabilities you have the medical tree right and then you need the people to check their inclusion to this medical tree if nobody checks you are in exchange and you will say my liabilities

are zero and then Anna and Costas never check if their balances ah yeah okay right so you need interaction right proof of liabilities cannot just be proven by just a commitment you need people to actually check that my balance was there otherwise nobody knows if if the balance that you are reporting is is the correct one and yet you want to keep everything private so you can't like have some other person checking these balances you want it to be the actual owner of the of the accounts I guess exactly and what's happening is there are two options like I think Kraken is using one of them so the auditor might have access to the balances okay right let's assume that not everyone in the world has access but

the auditor might have access I'm not saying that this is the best uh application I wouldn't do it just this I would try to hide even from the auditor sometimes from the solvency auditor sometimes the individual balances but let's assume this is tolerable for now the auditor goes there and in the system they check some balances how do they know if this balances are real if you don't ask the person who has the money who whose money is belonging to them you don't know right you need people and what Auditors usually do they do random sampling they literally call people hey is it you with like 3 000 uh dollars in FTX and then I don't know how the sampling is happening what I realized after talking to some

Auditors is they also create their own accounts to the exchanges The Exchange doesn't know that these accounts belong to the auditor so they can definitely do random sampling between them right between their own employees okay um but this is again this is not enough and to tell you the truth I was never audited in the past known my friends was audited I we don't know if random sampling works from Auditors like by phone call what you can do however is you can just publish this Merkel route this commitment on the total balance of liabilities and then users can request the proof of inclusion and then you check if your balance at that day assuming you remember your balance is included in the total liability proof

and then we we identified in the paper that if you have for example 1 million clients for the company to cheat in 100 accounts like to not include 100 people on purpose if five percent of the population checks they will be caught if they try to cheat they will be caught obviously you can sit by your meeting One account if you know this user will never check right this this is this is obvious however we have to talk with asymptotics now let's assume that this is not a real Attack the real Attack is if they they are doing this like uh continuously and they're actually removing many balances from the American tree if they try to remove many balances we did the math and we realized that even with a small portion of people checking the inclusion

proof it would surface right it would be okay it would be okay so this presenters to tell you the truth varies between depending on the population from two to five percent I think if one out of 20 people was checking and he and the exchange and the exchange doesn't know who is seeking because this is a very important information and I will explain why this is important and what is the third attack that we found yeah as I explained before people need to do random sampling somehow they they should check their proof of uh like inclusion how you just see a miracle tree who is giving you the the inclusion proof someone needs to provide to you but what's happening is this website sometimes they have their own website

and they say here is the medical group Anna sees this Mercury root Costa sees this Mercury root but we don't know if it's the real Mercury root because if you refresh I might see a different micro loop and the fire reference I see a different Merkel root so this is like a web 2 website where you're just like checking exactly some and that could be hacked is what you're saying exactly it's a web to vulnerability now yeah yeah okay is that that's the third one then this is the third vulnerability let's assume this is the second for a while and I will explain what the third one so the second one is a web to vulnerability because we're not committing to a public bulletin board on the potential balance people don't know if they're taking against the correct Mercury right and we need to what is the

public bulletin board probably you have to put it on Twitter on Facebook on a blockchain you need the public bulletin board the reality is the world doesn't have an approved public bulletin board today we only say that it's blockchains but people are not familiar with blockchains how can I even check if I don't have a light client if I don't run a full node that this was literally is something published on a public bulletin board so I think we have to improve there create some tools for the community that can be used across the exchanges that people very quickly can check their balances and they know that they take against the correct proof of liabilities right the correct route that's the second as I explained before there is a third one when you join an FTX or any exchange

website you are assigned an identity right some some identifier you have a user ID how do I know that FTX is giving me the same user ID with you or not or they're giving me their assigning Community like if it's independent yeah if it's you don't know it somebody else okay you don't know the weeks means that if there are people in their system that they happen to have the same balance and sometimes you know we have rounded numbers you will have five Bitcoins and not 4.99 it is possible this is a threat attack to actually send the same inclusion proof to two different people both of them will check they will say my five dollars are there but this five dollars is reused between different users now

right so you cannot sit on everything but you can sit on equal balances now so this is duplication of accounts when there's an equal balance yes and the proposal here is you should use something that is either picked by the user like the user ID I pick it or you might use my phone number or my email as user identifier rather than a random user ID why they're using user IDs they try to solve the the Privacy problem no no I cannot Reveal Your like email even to the auditor I use a user ID however now you need to proof that this user ID is unique right um or we need some kyc provider that will give you a token on That's Unique

yes that is unique like it's your it's your email but there is a token over your email so this is the third one and there is another one that surprisingly was I was super uh excited when I found it a few implementations are truncating the hashes so instead of using all of the output of the hash while you're going up to the tree like 256 bits they truncated this to 64 bits okay uh now it's brought forcible oh really so here the Privacy could be leaked is that correct or could you still it's it's like when you say Brute Force what what are you of course there are you I can find two balances different balances that they happen to go to the same house

be okay and why would they truncate it though why why did they do that I think they did it for performance reasons and it was a huge mistake um and yeah I even found a website I think this website is not like live now it was big hex it's um I don't remember where this exchange was from but if you said something on Google for broken proofs of solvency you will find our full uh report we have names like big hex there Deloitte coin floor Kraken bitmex anything from armanino there there's so many different names and one of them was using sword classes completely everywhere I could I could literally create a fake wow a proof of reliability

for everything so yes these are the four attacks that you can find at the moment on proofs liabilities when you talk about these proofs is this a situation where the proofs are being created and then there's an outcome and that's sort of the audit basically I was kind of unclear even going back to the first one the bug like who's running this is it the exchange runs these proofs and then the Auditors would check this to make sure that it's accurate yes so the exchange is publishing their proof of liabilities is Computing the approval abilities and Publishing the root of the proof of liabilities or whatever system they are using and their proof of assets

obviously it can be the auditor as well along with exchange and then the user element comes right afterwards so after I see the commitment on the proofs I request the liability inclusion which means that you have an exchange in clear let's assume that there wasn't an auditor what you could do is you can use oracles to give you some evidence of proof of assets you can produce your own proof of liabilities no Auditors involved and then you publish this to a public bulletin board the users are coming and checking and if we said that if a significant amount of people check the probability that you'd sit it on many balances is very small okay let's assume that we can tolerate this no auditories involved people are actually doing their own checks by their mobile

phones or their website of the company the proof of assets has been proved by systems like the chain link proof of asset proof of reserves they call it I would say that the whole industry should change the name to tell you the truth we should use proof of solvency and proof liabilities and proof of assets proof of reserves is very confusing yeah um and then with this proof of asset system and the prefabilities no auditor is involved computed by The Exchange the users can audit it in a decentralized fashion this is how is this is how it's working and this is the ideal scenarios is what you think should be this is the ideal if we don't want to include Auditors I will give you a very interesting like situation I I came

across so back in 2019 or 20 I think it was coin Telegraph that they realized that Facebook is working on proof of solvency and I can tell you for sure I think David Marcus even tweeted that the other day I don't think there was any other team in the world that they did all of the analysis that we did on peripheral solvency we have at least four reputable papers in the space and we knew exactly where to focus right the literally the team was very experienced on this and something that I also had as a problem is when this article was published by cointelegraph some people because you know what it reminds you the proof of solvency thing it reminds you the infamous Enron Scandal right and in all

of the cryptographic papers usually we use this in some sentence oh there was Enron and it was like Arthur Anderson like the audit company and people said they might have a collusion between the auditor and the and the company and that's why we want ideally to avoid the inclusion of the Auditors but I don't think in real life this is possible I think we need both we need to use the proof of solvency as a like extra system on top of what the Auditors are doing so users have the ability now to audit the system by themselves even if there is no auditor or if the auditor is corrupted to just repeat what you have in mind here so it is like a better proof of

solvency than like because you had found problems with the previous one but obviously with all of those fixed yes you'd want like a better system but are you still using the same kind of thing with like fhe and the merkelized tree is it is it still the same construction but just like without those bugs this is the same construction but we added a few elements there to make it more private and actually to add some extra privacy features there is another problem with Miracle trees if you have a Mercury someone will know your number of clients just by getting information about the height of the Merkel tree ah interesting if I know if I know you're like 2 in the power of 10 like 10 layers I know the maximum usage is 2 in the power of 10

but is this an information that FTX and the other now you're trying to protect the other organization right because sometimes you don't want to reveal your client base numbers and you need to provide all of these evidences but also do not expose your company's success yeah yeah it's it's very tricky right it's very imagine if FTX for FTX you knew that this month they didn't acquire many clients because you can see it from the number of users in the proof of solvency and then you can go and sort the token because they're not performing well business-wise this information shouldn't be no and what we did is we replaced the Mercury one of the like uses that is easy to explain here

with sparsed medical trees oh yeah so you cannot you can add zero nodes in the trees and now you can extend the number of users to whatever you want people that do not know by checking the proofs how many users exist and in reality how many leaves how many uh layers you need right people in the world are eight billion you don't need the three bigger than 80 billion even if every individual had the trick so you you shouldn't imagine that sparse military would would be huge it would be like an extra two or three layers compared to the standard metal tree but it offers this extra privacy uh perspective even the cryptographic solution though that you've the the fixed one this is a like

random question but does it actually output a total at the end like you're talking you're using fhe it's all private but like yeah do you when you actually do that last matching are you seeing a value actually no okay you can hide the value why why you can hide it because obviously it's an outcome of some homomorphic encryption Edition and then you eventually have a Patterson commitment or let's assume an l-gamal encryption of something what you do is you have the proof of assets and by using systems similar I mean regarding the output also a patterns and commitment you can have a zero knowledge proof that my assets are less are sorry are more than the

liabilities but that's it that's the only proof it just says it's solvent not it has this kind of percentage solvency or something it's not you can do you can you can do this as well we have zero knowledge proofs here right we have zero knowledge proofs here and sometimes you want to prove a surplus or you want to prove like some fraction but this fraction is very close to 100 percent honestly when I talk to the big four some of the big four Auditors the tolerance level was five percent okay because they know some people might not check and they there is another issue that I didn't mention what will happen in practice right I managed to have access to all of these big systems because I did the experiments for Libra and and Facebook there was another small issue which is even synchronization

internally if you are an exchange you need to actually get a snapshot of your database but some transactions are in Flight yeah what do you do with these things right you need you need to ensure that even if I don't manage to have 100 percent uh like accuracy I can tolerate up to a point if continuously because we were talking about continuous audits previously right if you receive this at a continuous level it seems that something is wrong with your solvency but in practice you might need to have some tolerance like a very small percentage just to avoid all of the synchronization issues why did Facebook matter uh why did you need this like why was this topic the most relevant one why

yeah because because Libra would be the most audited and regulated blockchain in the world I mean what what is this question right I mean it's very clear why and um I can tell you and this is a very interesting story when when I was about to leave Facebook a bit like a few months before this happens I remember talking to like the economists of Libra Christian catalini and now Alonso without head of economic in Mission Labs today they even asked me why don't you create a startup and I literally had offers to create a startup about professional solvency but obviously I was doing this at Facebook back then because the order from David Marcus and all of the leadership is we need to have the best system

for regulation and audits I'm not kidding here Facebook spent a lot of money to improve on the community tools that we have today for proof of solvency we should credit Facebook for the this right because I don't know I don't know about bad reputation and other things do we mentioned at the very beginning but internally I could say to you like with with confidence that the work that was published at Facebook was like genuine and and very like and improved the community like uh offerings that we have today for all of these things yeah I mean it was preemptive too right because it was this sense like Libra was already going to be scrutinized and it had to be perfect it had to be super super auditable especially it had this like

basket of different currencies reserves were really important exactly okay makes sense exactly and I mean for Facebook it was super important I was thinking that if we ever launched we would have the better system regarding like tools for Auditors and Regulators yeah well this never happened but obviously we're still here I know there is like a community effort not only me right I think it's Ellie from Stark where there are many things like Dahlia on Dalia also supported me a lot I would I would mention this on proof of liabilities this is not a chain link but I think we should have an RFC proposal for standardizing proof of solvency if we don't do this we will come up again into the come back to these problems that I

mentioned the four attacks and all of these things right when you say RFC what is this request for oh request for call I mean we need we need them like the erc's as we say for ethereum we need something as a community standard a community proposal to tell you the truth I started this at zero knowledge proofs and if you see one of my papers is even mentioning proposed standard since then we made many additions I also found the attacks I also talked to the Auditors I talked to some exchanges now I have more information and because now the topic is super relevant I think many other cryptographers should help we should form a small Consortium like a small committee and try to Define some rules it's not a perfect solution as I

explained because of synchronization and some other issues that you might face however without this we have nothing at least let's have a tool that can make the work of potential fraud or something more difficult to be performed and do you see this like once the standards say it happens it needs to be implemented by all exchanges across the board in a way to avoid that issue of like a short-term loan or I wish I don't know if they're going to do it I wish they will do it and I know even even binance's CEO mentioned the other day that we need proof of proofs of reserves I totally believe that we should set something in place now make proposals I don't care if we're going to have options but why

we're very close to a working solution now zero knowledge proof might improve on top of the mercurialization as well because we talk about medical trees but there are other ways to prove membership as well right and I can see with the recursive zero knowledge proofs and many other things we can even make a better proposal that works for both proof of assets both liabilities and actually proving the that the assets surpass the liabilities or at least prove the tolerance right proof how much of a fraction Reserve you have is it 80 is it 90 because sometimes you are talking about solvency but you don't know exactly today how much money SBF needs for for the solventy of FTX right we we believe it's some billions but how many

billions yeah yeah and what's the percentage of billion of these billions compared to the total uh valuation of the company or or the liabilities I think we can do it it just needs extra I don't know motivation probably from Regulators to tell you the truth Mr and chewy the protocol that we're building the crypto Primitives we're supporting is to enable this when it's ever if it's ever required yeah yeah and for example supporting zero knowledge proof verifiers on top of the chain supporting intent signing I should know if you are signing for transaction or for a proof of possession or for a proof of assets or for all of this stuff this brings up a little extra question which is like

you'd have to do this for each currency wouldn't you like each blockchain would need to run something like this because when you talk about accounts and being on chain like it's not that it's joined across like Bitcoin versus ethereum even like when you have to run it twice yeah it's a good question regarding the how do you do the summation right can you can you have one user having just one tree for all of their assets this is a very difficult problem and because there is an exchange rate between them which is defined by like uh different exchanges might have a different exchange rate it's not easy to do this at the moment what we have is individual Mercury spare asset yeah I see how you can do it with the help of auditor or

some oracles probably that can define a particular exchange rate but you should imagine there might be a fluctuation now right one percent or like 0.5 percent I don't think we care a lot about this stuff right this is happening in the real world it's fine if continuously however you see all of these glitches you have to take action but yeah we can make it one most of the solutions I've seen on proofs of liabilities they're using different proofs per different currency okay yeah it's a good it's a good call yeah that would be more like you want some consistency though I guess yes there is another thing okay it's a good pass actually that you're giving me here there is another small problem that I also realized that is happening

uh the small problem is pending transactions and in Flight transactions and time lock transactions and also assets assets that are locked in the l2s or some like payment channels right what do you do with this bridges yeah or Bridges right I think this is the reason what I'm saying this is the reason we're in a very good State now we have some Primitives some tools they seem to work for particular cases but we still need extra Innovation on how we can combine all of these puzzle pieces into one solid solution fascinating um it's not easy you might even have locked in an L2 more than the money that you have in L1 true right which means that you need

support on the L2 as well to prove ownership there and even there there might be situation with payment channels and fraud proofs where you don't know if if there is no expiration of the of the fraud proof period like of the challenging period of the seven days right how how do you do this even if I give you a snapshot you don't know if this is the current very true and this especially in payment sandals the collusion think might be super easy because there I might have given you the money you might have already sent me the transaction to return me the money back like it's a it's literally a loan that is secured it will happen I mean you can you cannot Escape I can already hear like I can already see a few edge cases

as well things like locked assets burned asset like things where you do have them but you can't do anything with them so they're not really assets you could ever have liquid I guess you're vested but then it's it's still an asset but yeah there's a lot of edge cases here that you need to account for that they're even more right you might I know participate in the lottery you know that you won but the assets are held by the smart contract the smart contract didn't show the result yet even okay even if you don't know even if you know that you will win for example you need the salads Inc period to finish until you claim your winnings you cannot provide the proof right it's very difficult

yeah we have a lot of work to do Anna it's not the reality that's the reality and when people say that like this will solve everything it's not right it's good to have it's by far better than having nothing yes but we need to explore all of these particular educates as you mentioned imagine we're talking for one hour and you already found the next case right that's that's the ugly reality but at the same time there is a good like positive outcomes from from the research side and I don't see why we should not standardize something at least this makes sense Costas we are almost at time but I do want to hear a little bit more about what is going on on the zkpe front at mistin today so the the nice like

news the good news is already ensui we have support for bulletproofs and you will see actually there is a PR literally now that is uh getting reviewed we're going to have growth 16 as well we're going to have very fires on top of three there is a benefit on sui compared to all of the other blockchains because for some trans action types you can even avoid full consensus which means that we can have this transaction actually having an accompanying zero knowledge proof that will run in an independent and parallel like fashion and this is how we can enable I don't know using kyc per transaction you can do private transaction confidential transaction

without waiting for a full consensus and getting to a blog or even if a huge size of a transaction will affect the block size the fact that we can parallelize things allows us to have an extra bit of like startups that I believe will join three just because it's easier with us to like bump the network bumperize the network with zero knowledge proof per transaction without creating all of this like block restrictions so does this sort of open up new use cases where you'd need something like that I think it's happening already I think we receive some partnership requests where they can see why they have a small benefit to actually do ensui so what will happen is we have this like

individual team now I have Francois garilo and actually Francois had the presentation uh like the last few days on the Zero knowledge proof conference uh we presented our findings we even managed to have a verifier on group 16 that it combines The Arc Works framework with blst and we managed to have a double the efficiency on the verification imagine we're not focusing as a blockchain on the proving because for us verification is what matters and even if you can get like double the efficiency it means that you can accept double the number of proofs right so we had some improvements on how we're doing like the pairing computations and

parallelization there and using the correct combination of existing implementations that I think on the on the verification side we have a very very fast growth 16 verifier now on three cool and obviously you don't stop there right imagine I'm also one of the co-authors of Winterfell um I know Winterfell is used in in polygon popping is a close friend we work together like in so many different topics and we're even having plans to augment Winterfell right even if we're working on individual like different companies research is different right people in research are friends yes and and for me like this is how I see bobbins here and I know we've discussed

on a lot of like improvements on top of Winterfell I cannot guarantee like when we are going to have Stark uh verification on sui but I can tell you for sure that we already have uh like some work in progress on having optimizations on top of Winterfell interesting um and this will be open sourced everything in mistem is open sourced and generally we believe that we're going to have a very rich API and personally because of my personal interest and I see the interest from many providers and and partners I don't see how a new blockchain Will Survive especially if regulation comes like faster than we expected without having support for these Primitives at the core

layer wow we need it we need it so yes you will see a lot of things being published from our team in the next week you will also see an extra blog post we're going to make how we made BLS aggregation faster okay slightly faster but faster than what exists out there nice I'll be sure to include it in the next CK mesh I don't know if you know about this my monthly news yeah I know right collection yes a lot of stuff be sure to send that to me because I sometimes miss things but yeah send send them my way I will I will uh yeah thank you so much for for everything here and I'm super happy to help and give you some like I don't know progress reports on how the solvency sector is actually getting either

promoted or if there is a coalition of all of the exchanges and the researchers to do something because when binon says we need proof of results I think they need to do a bit more research what which algorithm yes how we're going to use it if you are going to provide privacy these rules are not enlisted properly hmm cool well thank you so much Costas for coming on and sharing with us proof of solvency which we are now not calling proof Reserve anymore proof of solvency I'm going to go with it and uh yeah how kind of the history of this concept and now how we might have a better way to build those into systems yes and I'm super happy to help anyone in the industry even if we're not Partners not only myself I believe

bobbins as well and other people who worked here Cornell University people under Ari Jewels uh GMU Visa they are all eager to help on providing extra input if they want to build proof of solvency for their exchange for free very cool so thanks again thank you Anna and I really appreciate your uh like even your knowledge I'm surprised now that you managed to find the net case in half an hour wow really that was a new one oh cool it's it's something it's it's not that it's necessarily new it's something that I didn't expect people who realized very quickly right but you did right you understand now why we're not using zero knowledge but sorry proof of solvency everywhere because there are red cases

um cool well thanks again for sharing that with us I want to say a big thank you to the zero knowledge podcast team Tanya Rachel and Henrik and to our listeners thanks for listening