Episode 315 - ZK Hack Ecosystem & Winners of ZK Hack IV

Transcript

[Music] welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online this week I'm doing an episode all about Z hack another project that I'm involved in you've definitely heard me mention it on the show before and we wanted to share a little bit more about what it is so ZK hack is a project we kicked off in 2021 it's separate from

this podcast it's got a different company and partially a different team and it started as an online event but has since become an educational hub for the first part of this episode Kobe and I share more details about the history of ZK hack how it evolved and what kinds of things are happening in the ZK hack ecosystem today we just recently wrapped up ZK hack 4 online our 4-week event and so we also share a little bit about how that went in the second half of the episode Nico and I do many interviews with our top three ZK hackers the folks who competed in our puzzle hacking competition and won we've always heard that our ZK Haack puzzles are pretty challenging but according to these winners it seems they were easier than we thought and this was

really surprising to hear we did also learn that all of our winners are experts in ctfs so maybe there's a connection there anyway it was really fun to hear from them about what it was like to hack on our puzzles what their favorite puzzles were and how we can make these even better next time so yeah join us as we dive into the ZK hack world now before we kick off I would love to point you to the ZK jobs board we are getting amazing job postings there from Top teams working in ZK so if you're looking for a new job and want to work with the best in the field be sure to check it out also if you're a company looking to hire you can post your jobs on the ZK jobs sport as well I've added the link in the show notes be sure to

check it out now Tanya will share a little bit about this week's sponsor Alo is a new layer one blockchain that achieves the programmability of ethereum the privacy of zcash and the scalability of a rollup driven by a mission for a truly secure internet Alo has interwoven zero knowledge proofs into every facet of their stack resulting in a vertically integrated layer one blockchain that's unparalleled in its approach Alo is ZK by Design dive into their programming language Leo and see what permissionless development looks like offering boundless opportunities for developers and innovators to build ZK apps this is an invitation to be part of a transformational ZK Journey dive deeper and discover more about Alo at al.org

and now here's our [Music] episode so to start this episode off um I'm here with Kobe girkin hey Kobe how's it going hello I'm good our goal with this episode is really to revisit sort of the Z hack project and focus in on zck 4 an event we just recently wrapped up and we're going to be later on in the episode interviewing the winners of the ZK hack puzzle hacking competition but yeah I think what we wanted to do to start it off was just to give a bit of a framing for this project for Z hack and also the puzzles often people kind of confuse this podcast the

zero knowledge podcast with CK hack but they're two different companies and actually I'd say they're really developing as two different teams two different communities and I want to do a little sort of revisit of what we had come up with originally you and me Kobi we we first developed ZK hack in 2021 and yeah I want to talk a little bit about how that's evolved do you remember when we first kicked this off yeah so I remember we were talking about doing some kind of of hackaton or inperson event that that would be around people using ZK um but back then you know we had Global

challenges true yeah and that that wasn't yeah that wasn't really an option or maybe not a favorable option yeah um yeah and I shared with you that I had this desire to to do online hacking competitions around cryptography and ZK um with the goal of having people learning and I think that's when we started thinking about zik hack seriously and yeah back then I I don't even think it was only the fact that we couldn't travel to do an IRL hackathon I always think of it like even though there were tools I really don't think a hackathon would have been that

productive at that point like I don't know if people could have really built that much yeah the the tooling has evolved very significantly since then I agree yeah so back then we started off with a seven week event kobby had you had this idea of doing these puzzle competitions a bit CTF like and the way we mapped out the event was to have one Workshop every week so like every Tuesday we were meeting for workshop and then in between that we would run this puzzle hacking competition for one puzzle and so overall we did seven weeks of workshops and between six puzzles and it was quite a feat it was pretty intense yeah and I know that like at the

end of that our team was pretty tired we actually recorded an episode so that I'm going to find this dig this up and add it in the show notes but that was after the first ZK hack event um the reason we wanted to do a an event like a a podcast at the time was you know this was the first time we had done it it gave us a chance to Showcase some of the winners and and say thanks to the the team since then I don't think I've really covered ZK hack on the show MH when I think about it um so this is a bit of a revisit to the project uh and because we just wrapped up our fourth online event I thought it would be kind of a good time to do that completely agree so I want to talk a bit about what ZK hack

has evolved into people might know it as a hackathon series or they might know it as an online puzzle hacking competition um but it's actually like a full ecosystem of of things channels we do all sorts of things over at ZK hack I know that in the first kind of intro talk for ZK hack 4 I actually shared a graphic which was like a map of all of the different things and I'll try to dig that up and and obviously add a link to those videos to the show notes um but I also wanted to just cover it here because I think people might have heard about some sort of content with ZK hack in the title and so I just want to kind of map it out for

everyone so the way we think of ZK hack is almost like a website as a hub so if you go to the ZK hack. deev website you can see a lot of the things that we're doing we also have a Discord that's super active so from the website you can find links to the YouTube playlist to our Twitter account to the blog you can see previous puzzles ZK mesh which is a monthly newsletter something that I I think that started like over over two years ago that is now under the ZK hack umbrella so if you're looking for a place to just get updates about the latest research we send this out once a month you can find that over on the zack. website you can find the link to

sign up for ZK mesh ZK hack is also the team that built the ZK whiteboard sessions so this was this like educational multi-part video series and so I don't know if you've heard me mention that on the show I think probably I have over the years mentioned that that I think that series really helped me to understand the actual fundamental building blocks of zkps even though I'd been talking about them for years and interviewing these researchers I never really got a real sense for it until I watched those ZK whiteboard sessions closely and then on the Discord side of ZK hack like over in the Discord we do things like we we have study groups about all sorts of different content pieces so for example there is a

study group running right now looking at the ZK whiteboard sessions so what they do is they watch a video and then every week There's a small group of people who get together and meet and talk about it and figure out you know what did they understand well what did they not understand well and then they'll bring in kind of more expert people to help them navigate that uh Justin Thor has been running a study group over in the ZK hack Discord since the end of 2021 at least um and he's run through three cohorts of this study group and so in that he goes over the book that he had written and it's kind of a living document that he updates and he runs these study groups and then kind of from the feedback of the people doing these

study groups has changed and evolved the content just recently A Team like a group of people wrapped up the moon maath manual study group which was like the longest single one I think it was like over six months um that was very cool yeah and we've done some other ones as well that's actually a place anyone listening if you're like interested in joining a study group definitely head over to the ZK hack Discord but also you might want to run your own study group if you have a piece of content you're really into you think people would like to learn along with you and it's on topic this is something you could bring up in there too so I would like to add a few words on the study groups I think that's one of the coolest things that came out of ZK hack they cover both

fundamental topics and pretty Advanced topics as well the thler book is very extensive and goes into details that you don't usually see in the industry so it's really cool to to learn all of that and maybe to clarify to people that hasn't seen how a study group is run it's run pretty professionally even though it's run by volunteers and people that are around in Discord you have weekly sessions sometimes and you run through through a series of some kind a structured program and people are very welcoming

and collaborative and their exercises it's really worth the effort if you want to get much more into ZK or Advanced cryptography I would definitely recommend and yeah I'm also pretty happy about the zik Whiteboard sessions that you you know you you led because I've seen people refer to it as one of their favorite resources to to catch up on the most interesting and fundamental parts of snark world so uh yeah I would recommend anyone to at least check them out yeah maybe some context on that too the I know I already mentioned the ZK

whiteboard sessions but I forgot to mention that the first three modules so the first three videos are actually they're from Dan Bonet from Stanford and he created this sort of mini course on what a zkp is sort of on the on the computer science level I think what we found in this whole Space is that you have these very high level explanations so you have like the where's Waldo or billiard ball explanations of zero knowledge proofs and then you have the papers which are Super dense and hard to follow and I I feel like slowly and surely the middle is being filled in with new pieces of content courses I know like there's been lots of teams that have tried to get some sort of cohort to like onboard more people and I

think we're getting there but yes CK CK whiteboard sessions is one of those yeah just just to continue on that study group topic though those are also they are run by Volunteers in the community like you mentioned and what we find with those is often there's like kind of a pile on at the beginning like you'll have like a hundred people be like yes I want to be in this study group and then it definitely goes down over time but what's cool is the people who are there at the end often really know each other like they've been meeting weekly they might then get to meet up in person sometime and I think it's a cool way to find like obviously fellow Learners to learn along with you but also maybe future collaborators co-founders something like that yeah and the last

thing I want to cover though on ZK hack sort of the larger ecosystem is the events as part of ZK hack we've done two hackathons those are IRL hackathons so this was ZK hack Lisbon and ZK hack Istanbul anyone who was at those events or around those Events maybe heard about them so those were our you know first foray into the actual IRL hackathon land but before we did the IRL hackathons we had actually been running these online events and as mentioned kind of earlier that was what first started the ZK Haack project this like online event it's a very unique format um and we've actually done four of them now so the one we did back in 2021 end of 2021 1 ZK hack 1 ran

7 weeks ZK hack 2 or ZK hack mini ran I think in March 2022 and that was a really short one I think we only did three weeks and then we found our sweets our sweet spot with Z hack 3 which we ran in November 2022 and for that one we did four weeks with three puzzles and I think that's now kind of our format because it's perfect it's a it's a really good amount of time for people to get to know each other in the community but not so long that there's like an exhaustion um I think our team also really likes that it's you know four weeks and we can keep the energy up I think if it's if it's just four weeks and so what we wanted to talk about even

in more depth today is ZK hack 4 which was our most recent online event so we ran this from January 16th until February 6th we were meeting weekly the way we do this is often we have our kickoff at the very beginning and after that first session we kick off puzzle one one week goes by we have one of our partners do their workshop presentation and this time around our partners were risk zero and polygon so that second week session was with risk zero uh they did their workshop and then at the end of that Workshop we kicked off puzzle two polygon presented the week after after that we kicked off puzzle 3 and then our final session was a panel at which point we kind of

concluded the event and shared all of the the winners and prizes and yeah kind of we could see then how the hackers had performed so yeah now I want to talk a bit about this because Kobe for this time you've actually been behind most of the puzzles for most of ZK hack I would say at least like in terms of the vision for what it's going to be we've had sort of Partners to build them at times this time around though we wanted to do it with geometry research so maybe can you share a little bit about what your thinking was for ZK hack 4 maybe how that compares to the previous puzzles and what it was like to build them yeah for sure happily so for zik Haack 4 what the the theme that we had in mind uh was

what can go wrong when you try to write security proofs by hand waving it and just kind of collect references and say this was done there a bit differently this was done here a bit differently and if you take all of this together yeah and write it very convincingly maybe you have a secure system um but that doesn't always work and that was the the theme that we had is this kind of like I'm trying to imagine how this happened so like you have these different pieces each have been proven have been like there's some security proof everyone feels confident about using them but is it in the gluing them together that you make the mistakes

so it might be in the gluing them together that was one of the puzzles that we had and other cases would be that you don't really look into the properties that you really need from The Primitives that you're using for example elliptic curves and just saying okay I have an elliptic curve here and I have an elliptic curve here so they're interchangeable but that's not always true and that's another puzzle that we had nice if you look at previous hack puzzles um you might notice that they were also touching around these kind of topics so we had this hash to cve puzzle where the random Oracle wasn't good and

so on but in previous puzzles we didn't Focus very heavily on the security proof part where you were just presented with some implementation and a broken protocol and you would have to hack it and create false proofs and so on but here we really try to to make it convincing that these Protocols are secure but they are not so that that was kind of a change in in the theme and I think it it was pretty fun to create those it's pretty fun to to see how to do proof by convincing and how it doesn't really work all the time this

time around you used arcworks as kind of the language of the puzzle but I know there was a time where you used a different language I think right it hasn't always been arcworks true very true we did use the arcworks for a lot of the ZK hack puzzles and also this time in ZK hack 4 and because it's pretty flexible very configurable you can use many different kinds of elliptic curves and you can use it for snark work you can use it for General Advanced cryptography so BLS signatures and stuff like like that um but in ziki hack mini we've used Winterfell which is from the polygon team because there we wanted to

focus on Starks and Fry and we had some broken airs and we had really explanatory puzzle around how to hack fry if you have too few queries so that that's why we used Winterfell that time and but still I believe that almost every puzzle if not all of them used rust so that's something that we didn't change but I wonder would it be possible to do puzzles with like the other ZK dsls or is there certain characteristics that you kind of need in this language to be able to showcase the problems with the snarks basically the bugs that's a

great question yeah so I believe that you could make interesting puzzles even with dsls so you can make you know broken circuits in circom Noir and so on but what you might not be able to do easily is change the internals so what we're trying to do in ziki haak usually is some self-contained piece of advanced cryptography and you know a broken circuit is one kind which is cool but it's also something that people may encounter in their day-to-day but encountering the deeper

parts that usually don't think about in cryptographic Primitives and what's behind the zig dsls that might be hard if you want to do it with an existing DSL that's that's my intuition yeah I almost wonder if you were to use like a ZK DSL to aren't you like creating the bug I almost start to think it it borders on like a bounty for the ZK DSL itself like what if you find a problem in the I gu you could find that anywhere but yeah yeah uh yeah for example one thing that we published a while ago um in in the geometry blog was around growth 16

malleability M and there in order to showcase the kind of problem that you can have where where we focused on public inputs that are not really used in the circuits and how you can change them and so on there we really had to go into snark JS and change its internals in order to show some problem oh wow and that that feels like not the best fit in zik hack because we want something that is self-contained and educational that makes sense so you just kind of mentioned though this work at geometry research I I feel like niik came on the show a few weeks ago and we did the Zeki jargon decoder and he kind

of mentioned geometry research but I know we've been wanting to introduce it it's kind of a new player somewhat like it's sort of like a a new player in the field and Kobe you're an often co-host on this show people know you really well so why don't we do like take a minute just to talk about geometry research who were for this edition of ZK hack 4 the partner yeah let's do it okay so geometry research is a company that works on interesting cryptography projects in general if if I could put it in the way that is uh that is most exciting M maybe a bit of History I ran geometry which was a combination of an

investor and and research group MH what we did uh 3 months ago we spun off the research group into its own thing and that's what geometry research is and so together with niiko Andrea W and intong and we created geometry research we have a few themes that we really like that we think will be important for the industry um either in 2024 or or moving forward and we collaborate with with uh companies and projects that are also aligned with the topics that we like and so couple of topics that we really like

are around identity and and cryptographic primitive acceleration and we engage with with these companies to build meaningful projects around these topics and release them to to the public and create something that that is unique and utilizes what we can do best at geometry research I know when you were developing geometry research you were talking about potentially doing like audits do you guys also do that do you do like Security checks on some of the stuff that exists or are you Mo are you mostly building no yeah completely uh we also have some um good expertise in in looking into in the internals of

protocols so we also do security audits we just finished one a couple of weeks ago by the way cool and yes so we we collaborate with projects in different ways either we do these bigger projects that that the result of them is something and new and unique that you can deploy or that we do research that gets published as papers or technical reports or that we also do security Audits and make sure that things are working well are there any teams you can already mention you work with um not yet

publicly but soon okay uh I promise that uh we will share much more soon but uh yeah if if anyone wants to learn more or and and see what are the things that we're interested in or see how to collaborate I'll be more than happy to talk to to anyone that wants to cool how then do the puzzles fit in like you know we're partnering on this you're one of the co-creators of ZK hack generally but yeah how does like geometry working on puzzles for ZK hack how is that kind of part of this yeah so I think it fits very nicely into both the fact that we're building new protocols and so what happens in Z hack

puzzles is people sometimes building new protocols that are broken so we're trying to or this is a way to show maybe how what is the wrong way to build new protocols and that yeah we don't do it like that in in Geometry research and but also it ties into the fact that we're we thinking about the internals of cryptography a lot of time like that's something that all of the team enjoys that that also ties in into us sharing some of the insights that we had when we're working on projects when we're learning about protocols and we feel like we sometimes

try to change stuff and see and see how it would affect the the project and so on on and we then have some some learnings there as to how things can go horribly wrong when you do that and that's something that we like to share like we we do that even beyond the puzzles we write posts and all that so that's also something that kind of ties in very nicely that's cool I I was just thinking as you're saying this too like in ZK hack we have these two events that we're doing right we do the online events which are about the bugs in the protocols and you're supposed to break ZK and then we have the ZK hack IRL hackathons which are about building with

ZK it's not like the hackathons aren't really about like building protocol level stuff although there's always teams that do where they're like doing it like an implementation they're like actually adding to the libraries that like power ZK could we ever do like a puzzle that is actually about like the application Level of ZK yeah I I think in some sense we already do that but that's true that it's it's rare that the puzzle is really about an endtoend application oh but one of the puzzles did do that yeah I think like in some of the puzzles for example in in puzzle one in zik hack 4 you were already talking about a potential private transfer or private uh

private payment application and we showed how to break something that is more you know it's still in the protocol level but it's something that is tied to very concretely to the application and how it's deployed oh wow but yeah it would be interesting to also see how the environment affects the security of the application so not only the circuit not only the cryptography but also the way that it integrates maybe into the blockchain verifier or even the JavaScript library that communicates with it that could be really really interesting actually NE yeah maybe for the next one yeah I think the current Cadence for the online events seems to be one a year it is quite a lot of work

for our team to produce it because it's this multi-week event we often like to do it in the winter at least in the northern hemosphere because a lot of people are traveling less a lot of people are sitting at their desk and so that they can join us for this online thing but I think yeah look out for next year we'll probably do it again in the it will either be late this year or early next year where do another one I want to just sort of wrap up on Zack 4 we're going to be hearing from some of the winners who actually you know went through the process of trying to break these things that Kobe had set up and solve these problems well it wasn't only me we we had a bunch of people helping so Andrea has been very pivotal in

making the puzzles and also thinking about the potential hacks and the rest of the team also also helped with some advice or ideas and in one of the pals we also got help from Mary Maller which was she she can come up with very devious convincing protocols and uh yeah she did and that helped us design one of the puzzles so that was pretty cool that's awesome yeah when we wrapped up so our last session was February 6th we did the wrapup we kind of announced all the Prize winners what was kind of nice there was a lot out of the top 10 or top 15 there's like familiar faces in there there's people

who've been coming back every single year to do these ZK hacks but there's also some new folks so congrats to everybody who who tried their hand at this and obviously especially congrats to those who ranked um usually those who ranked would have had to have done all three puzzles in a pretty timely fashion I think this time around we had almost 60 participants in the the puzzle hacking yeah and the thing is like this is this is hard this is like very Advanced a lot of those people who are ranking are people who work in ZK companies you know like they're they're not really so much armchair enthusiasts but really kind of like already working in the field um but I know every once in a while we also get folks who are new to

the space trying out these puzzles so it's very cool yeah we met really good people or yeah really smart people through this competition so that's cool yeah so just I want to kind of do a quick Roundup of everyone who made this happen um on our team on the ziki hack side we had Agy who's running events we had Gaylord who's recently joined the Zeki hack team and he was really helpful behind the scenes with the website and tracking all of these winners Kobe your team Hector helped us on marketing for the event and Rachel also helped us with some of the admin behind the scenes so thanks to the whole Z hack team uh it was so great to get a chance to do this

again with everyone so I think this gives everyone a good description of this event and the whole zck ecosystem I do want to shout out two upcoming things that are happening in the Z hack world to look out for there is a new series of Zack meetups so these are you know short one twoh hour meetups in pretty casual small settings we've hosted two so far we've done zekia hack Lisbon and zekia hack London and we're going to be hosting one and Athens around ZK Summit and we have one planned for Berlin later this year as well so we're looking to kind of like move ZK hack all around the world to actually get to meet fellow hackers in different cities and we also have our upcoming IRL hackathon ZK Haack

CCO so we announced this in the event that's going to be happening May 17th through 19th in kco and that's the week before eth Berlin and the Berlin blockchain week and even though kco and Berlin are not that close to each other they're not that far either so if you're planning on coming over for berin you might want to also check out ZK krao the week before yeah I think that's a pretty good summary of the things going on in ZK hack cool thanks Kobe for sharing with us the story of geometry and also all of your thinking around how to develop these puzzles a pleasure always cool all right next up we're going to be hearing from the winners of ZK hack 4 and yeah who are the hackers who were able to figure out these incredibly challenging puzzles so fast

Nico and I are here with our third place winner of ZK hack 4 prian welcome to the show Preen hi Anna thank you for inviting me it's my first podcast I'm kind of nervous but yeah oh don't be nervous I mean you're here because you won something so yeah yeah hey Nico hey Anna hey pran so panch tell us a little bit about yourself who are you what have you been working on yeah so hi everybody I am prian I'm an undergraduate engineering student from India and I'm currently in my final year and I'm just working on my bachelor's thesis right now um and the thesis that I'm working on focus is on applying zero knowledge to like the domain of electronics so

yeah that's what I'm doing right now cool I have a question for you was this the first time you participated in the ZK hack online competition yes really yeah wow that's amazing how did you find out about it yeah so actually like before this I was kind of doing a boot camp so there was like a zero knowledge cryptography boot camp by Lambda class and I think there somebody like told us that you know Z hack is going to start in like two weeks so you guys can go and register so I just found out about Zak from there yeah nice was that your first contact with cryptography and zero knowledge uh yeah not really so actually I've been like interested in

cryptography like since my like freshman year in college and then I'm like have been pursuing like cryptographic Primitives and then just like the previous year I came to know about Z knowledge and I've been just diving into it from then amazing I want to know if you've done ctfs in your past because this done you have okay done a lot of them how did ZK hack puzzles actually compared to the ctfs you did in the past like are they similar I know we say like oh you know they're like CTF like puzzle hacking competition but I yeah I'm just kind of curious if you would put it in the same category if you see it quite different yeah I'd say they're quite similar but like the only difference kind of is in cdfs you have to like you

know get this flag now here there's no flag you just have to like kind of crack the problem hack the U challenge right and another difference I'd say is at least like I thought like these were like you know problems for speedr running right so they were I thought they were kind of easy easy right they're not that complicated and like in cdfs you usually have like really complicated problems you spend like you know 3 to five hours like each of the problems so yeah these were like fun little like speedrunnable problems and they were also like fun doing them was fun right nice it's pretty funny to hear that you found them easy because I've always been told by people trying to do this that it's very very hard maybe do

you think what made it easy was that you'd like been studing ZK specifically like or something similar to what we kind of covered in these puzzles so I guess I found them easy cuz I had all my cryptographic Primitives right already and I'd say I also had like experience playing CDF so you know yeah that's why I kind of found them easy and a lot of the times people just like get lost in these Concepts so for example in the first problem they mentioned zcash and they mentioned like cycles of liic Curves but if you if you actually just like open up the problem and like look at the source code you'd find that you only maybe need to know like how the artworks library is like you know what's

the syntax in artworks how to understand the circuits you don't really need to know like all these things you just need to have some basic like cryptography knowledge like basic elliptic curve knowledge at least to solve the first question so again like I guess some people would even including me I like wasted like first 20 or 15 to 20 minutes just like searching around like cycles of leptic Curves and like zcash I pulled up the zcash specification and then I was like let's wait a second let's just look at the problem and when I looked at it I found that yeah I could just understand what the problem was and I spotted the vulnerability and I was able to exploit it yeah yeah that was very quick I guess the difficulty with that puzzle was you know working with these cycles and confusing people with like

different fields and it's it's impressive to figure that out so quickly yeah even I was like looking down papers and then I just said okay let's first look at the problem then if I need to know something I'll I dive deep into it but yeah I didn't need to you came in second on that first puzzle the first puzzle's name was called Gamay um I I do think like looking at sort of your rankings you came in second on the first puzzle 11th on the second puzzle and seventh on the third puzzle but that first puzzle it's it was like I think the first two so you yourself and the top were so close MH and that the weight we weighted it based on how quickly you

solved it from when the first person solved it right and uh I think that made the big difference so that first puzzle got you over the line yeah right and and like that's the thing cuz like for the next two problems I had to look things up right so you mentioned that the puzzles were fun of the three which one would you say was like the most fun for you uh the most most fun if I talk about fun I'd say the last puzzle could was cuz it was like really quick and like for me it was like the most fun and was one of them the most challenging or were they all easy and like breeze run through them yes so like they were all like easy but from like I'd say for Speed running from

the perspective of speed running I'd say like the second one was kind of the toughest for me cuz like you know uh like it involved a first of full aggregate signatures which I like hadn't read about so if you already knew about it you had like a head start there so I had to like kind of like read a bit about it and then like come up with the solution so yeah what do you think we should do next time that we host a online ZK hack is there anything you think we could do better I mean I think the problems were fun and like from a speed running perspective they were kind of good but I guess maybe we could have like more kind of complex problems cuz these were like just one single vulnerability and you

exploit it you're done so maybe we can have like some problems that are like really close to actually auditing some systems some real systems so yeah that' be cool yeah so chaining different vulnerabilities and yes getting something more complex out of that okay yeah that's a good idea thanks prench I want to hear a little bit about what you have planned career-wise so you're now a winner of ZK hack and this you know in our community means people kind of know who you are yeah what do you what do you thinking of doing next are you going to join a team are you going to work in this space yeah so I definitely want to work on applied cryptography because that's what have been like pursuing from like the last three years but for now like I'm also like open to you know maybe found a startup in the ZK space

I'm like maybe I can apply ZK and yeah do cool stuff with it it's like ZK is pretty cool I think yeah cool do you think you might join us for like the in-person IRL hackathons at some point yes I definitely would at some point like I wanted to do like the crack out one but actually like my semester is ending like on 16th and the even starts from 17th so that's kind of the problem yeah otherwise I I was going to attend yeah what is your advice or what would you want to say to the folks that are going to compete next time so first of all you know look at the problem first right don't like jump into looking like there are many things that like they put

in the prompt to kind of throw you off right well it's not really throwing you off it's like good to read all these things but if you're like seriously thinking of speedr running the problems you should just first you know look at the problems you should follow the top down approach so uh try to figure out what like the code is doing and then if you don't know something then kind of read about it so yeah do top down I'd say yeah and that'd be fast if you if you're thinking of speech running it otherwise it's like good to do bottom up too so you first learn about older systems and yeah that's I guess that's a nice learning experience yeah is there a way for people to prepare okay to prepare I guess like most of what you need is the The Primitives right all The

Primitives that you kind of use in Zan like most of them basically are your like elliptic curves I guess and like other cryptographic Primitives and if you kind of know them you are I guess good to go but maybe you also need to have some experience with like the system that they have like you know written the coding so for example this year they focused on artworks right so if you already had like experience like writing circuits or like comprehending circuits which are written in artwor that' be a good Head Start yeah nice um I know that in our just previously with Kobe we were talking about potentially trying it out with different languages in the future but I do know that we always announce early which language or

which libraries we're kind of like using so that's a good piece of advice though for people to maybe read up on that before it all starts awesome thanks prian thanks for coming on thank you so much thanks for having me and congrats again for ranking yeah congratulations thank [Music] you so now we're here with our second place winner for ZK hack 4 STI welcome STI hello and congratulations on coming in second thank you thank you I know that you participated actually as a team I think you're the only team in the top three tell us a little bit about yourself maybe a little bit about your team okay uh hi so uh I'm Somey again I'm a I like to call myself a security

researcher um interested in like a wide variety of things so I like lowlevel things like op uh the security of operating systems and mobile apps things like that and then over the last 2 years I've been getting into zero knowledge cryptography as of course I started getting into it like just focusing on learning about ZK and then I realized as well there's a good space for getting into security here like uh security is a really important thing here I mean so over the last two years I've been getting into zero knowledge cryptography and I realized like security is really important here because we have all this complicated math protecting maybe like I don't know billions of dollars um so it was really fun to try to apply to my skills here um and yeah as my team at zelic so zelic is a smart contract

security auditing company and over the last year we've been also getting into to um like Z knowledge security earlier they mostly focused on like blockchain so like solidity salana things like that so yeah as part of zelic we do uh uh circuit audits so things like the scroll Z KVM for example um I was part of the audits for the circuits for the ZK evm and also axum's uh ZK co-processor so those were some really interesting Audits and we found a lot of cool bugs there and yeah that's my background nice sounds like a very good good position to be coming into ZK hack with because the ZK hack online CU you're you know in these competitions you're looking for

the bug and I guess that's what you do kind of every day yeah is this the first time you participated in ZK hack um I think last year uh I looked at the challenges uh but I wasn't uh I didn't have time to do it at that time so I think this is the first time I'm properly like you know coming in at 11:00 a.m. PSD when the challenges are released uh like everything blocked out and trying to get it solved as quickly as possible so yeah I guess this is the first time I'm actually trying to win did you find it to be very time consuming um I think uh we solved most of the challenges under like 1 and a half hour I think all three of the challenges we solved under 1 and a half hours so I guess it wasn't too time

consuming in that way uh at least compared to for example I do these Capture the Flag competitions uh in general and um sometimes the cryptography challenges there uh might take take like uh the entire day like 24 hours uh because there's like uh I don't know you have to read like three four papers and try to understand attacks and Implement them so compared to that I think these challenges were much more self-contained so it wasn't it wasn't too bad you're the second person to mention that having done a lot of ctfs that these were kind of faster you are also the winners though so we know that there's a lot of people that did take a few days to actually solve these puzzles but yeah that's cool

to hear how would you compare these zik hack puzzles to like ctfs I I think the Z hack puzzles I feel like the bug was sometimes more in the code uh if that makes sense a lot of the cryptographic CTF puzzles that we look at for example they might be like some custom scheme uh and you kind of have to figure out like a issue with like it's it's more in the math uh is is kind of what I'm trying to say um and I I think those might be a little bit more math heavy sometimes and require a knowledge of like a lot of the existing attacks that you've done uh that have have been performed on like those crypto systems before so as an example a a very common type of

challenge in ctfs is you have to break some insecure like RSA scheme right like uh let's say the the key is generated in an insecure way and a lot of the background knowledge you need to know about of like lll attacks uh so these are like lce reduction algorithms uh that are used to solve these kind of challenges so I think there's a lot of background knowledge of the what has happened in the past that you need to know to solve those challenges on the other hand for ZK hack challenges I felt like if you had a basic understanding of elliptic curve cryptography and pairings uh you could kind of just look at it self-contain and try to solve that I think which was somewhat nicer in a way like it's better for someone who is

maybe beginner to approach approach these challenges nice I checked out your rankings over the three puzzles so zelic as a team came in first on puzzle one sixth on puzzle two and then second on puzzle three yeah just looking back over those what was the puzzle that stands out to you I think the second puzzle was definitely my favorite um okay two reasons for that one was it was like you had to kind of understand this these two kind of schemes so obviously the BLS signatures and like the security properties and then also like the proof of knowledge uh paper so I had to actually go and read and understand the security properties of proof of

knowledge scheme and try to figure out like okay what is this scheme doing that maybe like a good proof of knowledge scheme should should not be doing and something like that so I think that was definitely a stand out and also the solution was kind of like you had the proof of knowledge of all the other participants and you are supposed to combine them in a way to get a new proof of knowledge uh proof for your invalid key right and it was kind of like staring at our eyes but like we didn't realize it for a while like we're just looking like how do we get this new information that we don't have and it's like oh we already have all of these other proofs we just need to combine them in a particular way so I think that was definitely one of my favorites it

was also like uh kind of fun because uh we were challenging to like use artworks in that uh like all of us in our team like a lot of the time was spent trying like struggle with rust and artworks like I remember I spent like 10 minutes trying to figure out how to like do the inverse mod in one challenge um and it was like oh I just didn't do a user trait uh like I was calling the inverse mod function but it says the compiler said it didn't work and it turned out like oh I just had to use a trait so that was kind of a a challenging part of doing ZK hack I think for me did you do everything in rust or so I know with some of the earlier puzzles people used to print out stuff stuff from rust do

some calculations in sage and bring it back to rust and use that as their attack so I would I would actually verify my attack in Sage first uh to make sure it works and once it did work I was like well I have to implement this and rust now because I have to like send the code to you yeah so I guess troubleshooting right make sure your solution works and then it's just about rust yeah Fair um I would say well one of our team members is like a rust expert so I think we just ask him like oh what's going wrong here out how to do this um and he would be pretty helpful so I think that's one good thing about being in a team I would definitely if I was solo I would spend I would have spend more time like just struggling on

those things yeah actually wanted to ask you a bit about the team like setup were you all trying to hack on the puzzle at the same time or was it sort of you were taking the lead and then relying on the others to just kind of help you out so the team was four of us so it was me Samy and then Ai malte and uh moit uh so we have four of us I think we would start on the puzzle just like we would spend maybe like 10 15 minutes trying to read it on our own and then we would like start bouncing off ideas of each other May uh for a while and then at some point one of us uh would like realize the solution uh for some of these it wasn't as obvious like the second challenge it's like you have two

stages right first you try to break the BLS signature and then second you try to break the proof of knowledge scheme so yeah we would like slowly get to the attack and then once it's the implementation stage I guess all of us would just try to be the fastest to submit because of the time constraint I think it doesn't make sense to try to like share code it's like well good luck whoever finishes first just submit on your GitHub account nice what do you think we should do different for the future ZK hack online puzzles I think the number one thing all of us wanted was more puzzles like more puzzles okay the other thing was we would have liked the puzzles to be uh little bit more time-taking and more challenging I

think I think they were challenging but because you I I I'm guessing you tried to keep the puzzle self-contained it was like you couldn't make them as hard as you wanted to going back to one of the things I brought up in the CTF point is like we would look at like attacks from the past uh like some common attacks like maybe attacks on tical pairings uh those kind of things so I'm I'm sure that is like increases the difficulty a lot but I think it also increases like how much you learn from doing these challenges to try to understand like the academics Behind These so I think that is something we would definitely uh appreciate more if that happened in the future I haven't done the previous challenges so I don't know if how how much this existed in the uh in the past

but this was just going off the challenges from this year I was about to ask you that because we have this page full of the previous puzzles and Kobe's not on here Kobe was designing basically all of those um but I'll add this in the show notes for anyone who wants to take a peek and also use MPT if you want to have a look at uh the previous ones but this is great feedback for us you know we're always trying to kind of make ZK hack better so this is great it's funny CU ZK hack also has this so it is kind of Kobe's brainchild in some way like these puzzles the spirit behind like the early Z hack puzzles at least were to be very practical so a bit further away from papers and like oh yes these

classic crypto attacks and more into like hey here's a subtle mistake that's kind of hard to to find but also you'll learn from if you find it I'm sure we can find a way to marry both of these nice yeah I was thinking of something like oh I implemented a new scheme similar to plon but oh we made a mistake in like the FIA Shamir process and try to break it so it's it's kind of Novel but also like somewhat similar to like existing attacks so it's not like you can just pull a attack from like I don't know the Frozen Heart blog and just use it but you still have to like make it up on your own H I sort of wish Kobe was here too because he might have had that thought or we may have already done that but I don't know so I know definitely Kobe has

some stuff about for example um trusted setups what happens if someone keeps the toxic waste and he has I think a whole article about how to make fake proofs in that case yeah um I know that we discussed like fet Shamir because there are so many bugs that arise from fimir but we almost felt like is this too obvious are people going to find it too quickly and that's why we didn't go for something like that but yeah maybe another time you can have Kobe and Andrea go through their their process and explain how they came up with the puzzles yeah what's next for zelic the company you're doing Audits and you're moving into the ZK space where it sounds like you've moved into the ZK space are there any tools or anything that you'd be building on your side like I know

there's other auditing firms that are like exploring formal verification and stuff like that so we have a couple of people who already work on formal verification on the solidity side uh for example for smart contracts uh inv variant testing uh but also for ZK we have an internal project where we are trying to understand how we can formally verify circuits which are made in Halo 2 for example which might not be as straightforward because they're you know laid laid out in a table instead of like a formal language like in circom so yeah those are some of the things we're looking at uh we're also looking into moving into new cryptographic algorithms so a lot of companies are using MPC to build MPC wallet or other forms of uh Technologies like machine learning using

NPC so and often these are like custom or novel cryptographic schemes which might need like closer inspection obviously CU it's never good to roll your own crypto so yeah those are some of the other things we're also trying looking to move into nice we asked this also to the previous participant but what would your advice be to folks who want to compet in the next DK hack puzzles I think I would say to go look at C ctfs that's how I got started that's how a lot of my friends got started um in fact there's this amazing website called crypto Haack uh which has a lot of like cryptographic Puzzles starting from a very beginner level like you start breaking Caesar ciphers and exr ciphers and going all the way to you

break like ring lwv and like ltis spage schemes so I think that's actually all if you try to like solve the challenges from 0 to 100 it's like a formal education in cryptography almost wow uh with all the papers you have to read and all the attacks you want to understand and once you finish that I feel like it's pretty easy to get into zero knowledge cryptography read the papers try to understand the attacks on the other hand if you're not too interested in the math side of it of course there's a lot of like circom circuits where you can just think of it as like a programming language right it's just reading code you don't really need to understand too much math Beyond uh modular arithmetic and I think that's another way to get into Z knowledge cryptography uh so there's like two

venues either you go the math side or you go the programming side but what about for the next ZK hack participants the puzzle hackers oh the puzzle hackers yeah I would say crypto hack and uh uh because I I think those CDF challenges are pretty similar um and yeah like I guess try the Z hack puzzles from the past which I need to do because I haven't tried all of them yet sounds good cool all right thank you so much srii for coming on and congratulations on being second at CK hack 4 yeah congrats thank you so [Music] much we are now here with our first place winner for ZK hack 4 Nicola Yos he's also known as NEOS Ledger on our

leaderboard welcome to the show Nicola thank you welcome from one Nico to another yes exactly there's two Nikos on this on this one so uh we'll have to clarify yeah Nicola this is your second time coming in first place on a ZK hack competition and I know you did at least one other ZK hack um because I saw you came in second I think on the first one we ever did did you also do the ZK hack mini or was that the one you skipped yes I also participated uh but only with the first challenge uh because actually with the second one uh I had to travel to the other side of the world uh so I wasn't

able to to compete all right to give people a chance I understand [Laughter] that's crazy but so you've done all four ZK hacks yeah actually we the first one it's thanks to the first one that I discovered the world of their knowledge at the time it was a colleague from my work who said hey there is this new CTF event with it's it sounds amazing uh so it was actually the first Z ZK hack event wow and so I was like oh it sounds very interesting it's a new stuffff and let's learn about this damn you came in second on the overall picture but I'm guessing like the first puzzle you would

have had to like do a lot of background reading to be able to get into it well uh I'm already quite knowledgeable about applied the cryptography so I already knew lot of things and I already wrote some Rust a lot so I had a bit of background but not in knowledge but it's it was like quite easy in a way to to come P well is maybe easy is not the right word but it's um I don't come from uh nowhere actually Nikolai I'm curious about um your background now that you mention it and since we're both French and I know Anna speaks some French I do how about we cond some of this in French

yeah amazinga do back okay [Music]

okay proof okay zled

no I just wanted to say that Sor yeah I just wanted to say French okay to our listeners who don't speak French we're going to switch back for you now but um to anyone who speaks English and French you've just gotten some insight into nikolas's background uh working at Ledger and so I guess this is The Ledger Ledger like The Ledger we all know and love right yes is ledger going to use ZK on some level uh actually I don't know um there have been some projects but it's some proof of concept so so PR familiar with the concept uh we're working with

blockchains which are using zero knowledge yes obviously I don't have any idea if there are products who we use a got it so let's bring it back to um the ZK hack 4 and the actual event that we just wrapped up so you know as mentioned you would come in first for ZK hack 3 and I think you got all the prizes for that come ZK hack 4 puzzle one you actually came in third place for puzzle one for puzzle two you came in second place and then for puzzle three you came in first place so it's just kind of like a steady step word up ramping up for you yes in fact the the

difficult part is that now I have a boy who was two months old so oh I also needed to take care of him and that's why it's uh I needed more time in some challenges yeah clearly didn't stop you clearly wasn't enough so one hand you were holding a baby the other hand you were breaking puzzles for ZK hack I'm guessing that's why in the third one I think it took 15 minutes or something wow to read because it's like a bre when my son was sleeping was just perfectly timed nice

so that's what happened over the course of three weeks you changed your son's sleep schedule to be exactly at the time of the release and let's go nice all right um we've actually just interviewed the other two winners for the third and second place and one of the things we wanted to understand from them was like how did you find each of the puzzles were any of them extra easy were any of them extra challenging yeah how did you find these three from my perspective I were easier than the previous ones but at the same time it's because I already have a background for example I already know what the BLS 12 381 12r uh I already used arws a lot uh so I heard

that some participant were string with a type system of artworks library and well I already used it in the previous editions so uh it was easier for me I guess yeah nice that's actually really good feedback though to hear that you found the previous ZK hack puzzles harder and you think part part of it might be because you are familiar with the material now what could we actually do for future zik hacks that you think could actually challenge you like someone at your level that's a good question um uh in mini I guess there there was a really hard challenge which I didn't manage to solve about the winter fail uh implementation where um

the aim was to Reit uh the verifier because of the proving system was using very weak parameters and it was actually quite difficult to check in the right way the verifier so this is the kind of things which is harder I would say do you think using a different language would make this more challenging for you actually like we using artworks we've used artworks for ZK hack 1 and ZK hack 3 and ZK hack 4 and the one you said was really challenging was the one where we used Winterfell I think well actually I don't know uh because at work I'm really used to switch to different context uh to to really discover new contest in in

a fast way so I don't know whether it will add some additional challenge or it will only make it harder for over participants I don't know true all right maybe let's throw the question back to you then so what would what should we do if not language what would be another way maybe uh something focused on implementation uh for example um right now I'm participating in another CTF which is focus on postum cryptography and one of challenge is to implement TLS exension to support post cryptography in TLS uh in a way which is uh easy in which is doable not easy but doable as a

CF Challenge and uh I found it quite different from the usual challenges which require breaking things so maybe a challenge which focus on implementing uh or adding some Z thing to an existing protocol or solution or software and evaluating that the integration of the protocol was done right or maybe a second thing is to instead of trying to break something uh taking something which is broken and TR to fix it fix it fix it ways to to fix broken implementations that's cool that's a neat idea so you mentioned um

you're participating in another CTF right now do you do a lot of those not much now that I have a boy uh but uh well in the past I did s uh ctfs um for in several domains I would say for example several years ago I participated in a CTF related to satellites which was or organized by the US Air Force called hack aat uh and so it was a a really nice ETF also to to discover all the Technologies around satellites Communications and the objective of this CTF was to uh make people from both the physics uh of making satellites actually

work and people from Cy cyber security uh work together and I think it's the same thing with Z hat to to make people from the Z know world and people from the cyber security or whatever we call it meet to to have systems which are more robust more secure in the end for sure have you ever designed a CTF like we heard from a previous interview that there's like a really awesome Ledger CTF kind of yes going on I participated it in the two last editions okay because there were several

editions uh so yes uh for example in one of them there was um a challenge focused on the EOS blockchain uh EOS oh yeah unrelated to your name oh yeah me it's a network blockchain on the there there was a something interesting related to the way the smartphone clats on this blockchain work so I did a CF challeng out of it so but you didn't design the CTF for Ledger did you I participated it it was a a team effort okay but wait did you make it or did you did you hack it that's what I'm trying to figure out you made it okay yes okay okay this is what I was thinking is making challenges

for nice that's cool well also in in France uh there is a famous SEC Conference called the stick uh SS um which is a cyber security conference which is well known for hard challenge uh which is released ahead of uh the conference okay uh I also participated in creating this change three times oh well so you you're a hack Builder almost um I want wonder if we should at some point pick your mind for for new competitor or maybe you want to maybe join the the building team You' You've Won twice I'm kind of like do we try to do we try to create something

that like Nicolas finds hard or does Nicolas join us to make a harder puzzle yeah that's also a way of solving this issue maybe actually for the stick competition it's traditional that the winner makes CH for you after amazing hey this is so cool this is a great thing to I'm going to I think we should bring all of this feedback back to Kobe and see what he thinks Nicholas what's next for you just in general uh I know you're you're working at Ledger but are you also I mean I guess you're going to be doing more ctfs but is there anything else that you're into would you eventually maybe work in ZK you think is

it interesting enough maybe um uh I we don't know because right now I'm enjoying my work at leder uh I can work on many different topics uh and including ZK but it's like right now ZK is like a research fi where not much in leer about ZK but we are trying to to see what we can build with it and besides that uh I don't really know what the future will be well thank you so much for coming on and uh congratulations once again for coming in first place once again and I

really like your idea of potentially bringing you over to our side for the upcoming ones yeah you might have some really good ideas here that we could Implement so before we we wrap up this episode I just want to say a massive thank you again to the ZK hack team who put this event together it was Kobe and Gaylord Agy Rachel and Hector who worked on this edition of ZK hack 4 I also want to say a quick shout out to the runners up who didn't get a chance to come on the show to talk about their experience but we had Rada BK moves Ali baby step forward giant step backwards

and Nick TR uh Nick TR I think had come in second last time so anyway thanks to all the participants uh all the hackers and all of the folks who also came out to our Workshops the partners that we had risk zero and polygon uh geometry as the as the puzzle Builders and zkv who sponsored the prizes for this one yeah oh I have one last thing I wanted to say before I sign off I think I mentioned this earlier in the show but there's an upcoming IRL ZK hack hackathon happening in kraco on May 17th through 19th anyone who participated obviously in the online please come check out our hackathon it's

very different it's more much more about building and less about breaking stuff um but yeah I hope I hope we get to see you again Nicolas at future events and congrats again thank you thanks niiko pleasure and I want to say thank you to the podcast team Rachel Henrik and Tanya and to our listeners thanks for listening