OP Succinct and OP Succinct Lite - Turning an OpStack Optimistic Rollup into a zkRollup

Transcript

Hello and welcome everyone. My name is Peter Robinson and this is the Ethereum Engineering Group meetup. Today we've got Tahoon Kim who is from Succinct. Um and to um Tahun, why don't you introduce yourself as a starting point? Yeah, thanks for having me Peter. Um welcome guys. Um I'm Tahhun. I work at Succent. I'm an engineer. Um and I came to crypto space early 2022. I was very most interested in Dowo related stuffs. So I've been building like a lot of like stuffs like uh blockchain engine for like Dows and like

few years past I was more into like sort of like the rollups and ZK's and stuff. So before succent I worked at a company called Chroma. Um uh yeah and now I'm at succ um building stuffs with CK especially something uh what's called op succ I look forward to your talk. So, should we ask questions just at the end or in the section breaks or um how would you like people to ask questions? Um I'll prefer having it at the end. Okay.

All right. We'll do that. All right. Well, please um lead away with your slides. Yep. Can you see my screen? Yes, we can. Yeah. So, I'll begin. Um yeah. Hey, everyone. Um nice to meet you. Um yeah, the title of this talk is a very bold claim which is every rollup will be a ZK rollup. And over the next few slides, uh I want to show you why this isn't just a possibility but an approaching reality which is very promising and how uh we at Suint is paving the way for this

beautiful transformation. Um yeah, so we as succin believe that ZQ roll-ups are the undisputed endgame for scaling Ethereum. Um but to understand why I'll first uh talk about the current landscape of roll-ups. So I hope many of you are familiar with optimistic roll-ups which emerge first. Um yeah and they've definitely been a crucial stepping stone uh to get a progress like this much. Uh but it's more of like an an analogy of like the first gas combustion engines

where um these made sense at like first point when it was like invented um got us moving forward but as you know like technology evolves we now realize that there are better um more efficient options like electric engines on the horizon. So optimistic roll-ups come with some significant hidden costs rather than having a very um working version of roll-ups which makes sense. Um so if we see a point of view from security um they have this often like 7-day finality times which is very long considering the fact that there's like

billions of uh TVL on chain which is basically like locked up if you're trying to like withdraw natively and it also like creates like a frustrating user experience when you try to like deposit into L2 and then like withdraw Well, um and also uh these days people talk about the rollup's inter interoperability, but these this like 7day finality time is just hindering those like smooth interop stuffs and yeah and like two um for optimistic roll-ups to reach like c

certain security level they require some cryptoeconomic names to prove to prove like fraud of the entities that are posting the state state road. Um yeah, this is like this comes from like uh also like from the data availability cost that you have to pay for uh EDA, but also um there's some like bonds that you have to like make like bond to like this cryptoeconomic game which could be like hundreds of ETH uh which causes like the system to more to move more forward to being centralized since like not everyone has like 100 bill like hundreds of like ETH

to like participate in the game. Um yeah, so the alternative is definitely ZK rollups or zero knowledge roll-ups. And the exciting news I want to tell you today is that ZK roll-ups are ready for the prime time. Um like it's largely like thanks to all the work that we do at like succent or other like ZKVM like vendors who provide like very easy way to write ZK applications these days. So historically like even like few years ago um launching if you wanted to like launch a ZK rollup it required like monumental tasks. So um usually like the

devs on the team would need to have like a cryptography PhD and like se specialized skills and optimization skills to write what's called a ZK circuit which is a cir which is a code that verifies some logic of the application and um companies were facing like hefty investments and buying like expensive hardwares and paying for expensive hardwares. to generate proofs efficiently. And uh let's say you first start kicked off with an optimistic rollup and if you were on the team, you would often get like stuck since you have no clear or easy path to like switch to like ZK

without like having like major disruptions of the system. But now the games have changed. Um with SP1 for devs um with our like performance ZKVM like we allowed to write powerful um ZK applications um in like familiar languages like Rust which can be compiled down to uh Risk 5. And for some companies who want to roll like run some um ZK applications they don't need to like buy like uh pay for like hardwares and like GPUs and like write kernels for that and like run themselves but instead they could just use the succin prover

network which handles all the like proof generation with like low latency cost efficiency um through just a simple API through our SDK and for like existing OP stack teams um we have a product called ops succinct which I'm going to like explain from like few slides later allow like all the opt rollups to upgrade their rollups with very minimal friction and engineering. So I just want to talk about like SP1 like what SP1 has been like doing to like get to like this state which is like very fast is uh so like we're going through this

um Moore's law of moment of improving. So we've like doubled up basically like every um feature we provided. So we first had this called like pre-ompilecentric architecture then recursive proving then writing GPU kernels and then we made more of like hardcore um GPU engineering kind of stuffs for like performance improvements and most recent uhly like this has culminated um SP1 turbo which is like our fourth version of SP1 uh to reach like 4.8 8 MHz in the late January of

2025. And um I'm not sure if you guys have seen this real times.xyz which shows that uh with our latest release of SP1 hyper cube which is uh announced like last week and released last week um the real-time proving of Ethereum is closer than ever. So now like it's our fifth version which is like being way faster. Um SP1 hyper cube enables uh zero knowledge proofs for Ethereum in less than average of like 12 seconds. Um which is a huge unlock for scaling

Ethereum. And then uh with like all these like novel implementations of SP1, we also have this succinct prover on the side which is basically like the fastest proving cluster in the world. So um all the like this network would handle like all ecosystems proof requests of all kinds of ZK applications. Uh they could be like rollups, co-processors, oracles or even like proving Ethereum. Um and yeah it consists of like decentralized provers with custom hardares, custom implementation of like the clusters um which achieves economies of scale um with fast finality and censorship

resistance and a solver um coordination layer which is like very important for like these prover. Um so these two combined what this leads is we consider as a paradigm shift. So we consider um this is the foundation of what's called a ZK 2.0 and if ZK 1.0 know was more of a monolithic stack architecture. Um so like let's say we have a ZKL2 which is tied to a specific ZKVM a specific uh proving system um which like the proof

generation is run on like cloud providers like AWS Google cloud platform um but now ZK 2.0 know is all about modularity. You just need to write your ZK application in Rust. Um and since SP1 is very versatile and with stuct prover network integrated uh yeah it's just a much flexible and powerful backend for developers who going to like write diverse range of ZK applications. Now I want to um talk about op succinct which is um uh the stack I mentioned for opt rollups to uh integrate zk um and

this modularity and power coming from the zk 2.0 era uh we can bring basically like bring zk to like every rollup. So we have two solutions for opt roll-ups which is opentyn light and ops succinct. So ops succinct light is much newer release which is designed for teams who want to try to um integrate zk fraud proofs into their protocol um which offers now from like seven days to a one day faster finality and uh we only need proof generation when there's a challenge. So which is much faster and capital efficient for all these dispute

resolutions that was very inefficient in the uh stock optack protocol and for opent uh is for the roll-ups who are ready to turn their optim optimistic rollup into a zk rollup which is they can have a one hour fast finality um proving every blocks uh with validity proofs which would have like much secure rollup like with faster finality which would lead to like better UX better interop like resolving basically like all the problems we had in the beginning.

So these two stacks are both very modular, lightweight. You just need to deploy like few contracts and run the proposer binary for ops succinct. Um yeah, this is very tailored for ops rollups. Very easy to integrate. Um yeah and to delve a deep little deeper into opent light um as I mentioned like the traditional like fraud proofs it's kind of an old tech because they have this very complex multi-round economic games um like dragging for days um bond sizes scaling like with regards to total value locked

um scaling to like hundreds of these. Um, and yeah, these limitations force teams to like stick to their protocol to have 7-day finality window, which is really bad. And for ZK fraud proofs instead uh implemented in OP6 light, these disputes of games can be resolved in a single step with a ZK proof, which would take one day or less to generate a proof. But to be secure, you can just set it to one day so that even if it fails, you can retry and no honest party loses. Um, with this feature, the bond size now shrinks dynamically just to

like five to like 15 E. um because we can compute ZK proofs offchain and then settle to L1 afterward instead of having all this crazy multi-round interactions on chain uh to keep track of the state of the game and like who are more I would call like bold and for those of who are like ready to like fully embrace ZK and go to uh a ZK rollup instead of optimistic rollup. Um OP succinct helps them transform in a snap. So the core benefits are now we're talking about one

hour finality which is uh like considering the 7-day window it's 100 times faster over 100 times faster. Um and this also means that the stage one requirement uh defined by L2B which could be qualified and which is like which means that the rollup is now in a much mature state where users can be more confident that the rollup secure and now like now the proving cost is like uh little as like hundreds of cent.

per transaction with the SPON Turbo. And since now um the SP on hyper cubes like 3x faster um yeah these like price of like proving will just keep decreasing as we make more performance improvements and teams definitely can optimize pre-ompiles for their chain which would drop costs and um yeah they could just modify like some sort of code that you put into SP1 um to suit their unique needs. Uh yeah, so coming back to our analogy of like gas combustion engines,

uh yeah, if optimistic roll-ups were that ZK roll-ups are like more like electrical engines because they're much simpler, more efficient and they're just fundamentally built for the future. It's more sustainable. Um yeah and the key takeaway is that uh opt rollups now have this like clear path to zk future due to like all these like uh modular architecture and stuff. They just have like very nice two options. OP succensive with like thin margins of their fees. Um or maybe app chains with

like very high throughput. Um and OP succinct is more like tailored to large L2s like they have more uh stringent security and interoperability requirements and maybe for like DeFi chains that require some institutional grade finality for maybe more of like collab with traditional like bankings and stuff or stable coins. Yeah. So it's not just us claiming that like uh like ZK is the future or something but like leaders of Ethereum are like uh seeing this vision together. So yeah, Saiger like predicts like most rollups will be ZK based in

like next year. um ZK is the future and even Vitalik himself like back in 2021 stated that like in the medium to like long long-term like ZK rollups win will like will win all like use cases of like ZK tech um and yeah the costs were definitely like a factor that back in the days where you would have to like spend like a million dollar for like the cloud providers to like compute ZK Okay. Um, yeah, but now like improvements have been like coming like really fast with like all these competitions and yeah, we're finally here now like where it's

actually like feasible to run a ZQ rollup very easily and yeah like we found to like very happily like have a lot of like partners who like to try ZK integrate ZK with very minimum effort of engineering. Um yeah and we're very proud to like push like the limits of this like rollup ecosystem to have this ZK integrated which makes more mature um and definitely it will like benefit benefit to users having better UX better security um which could possibly maybe lead to crypto mass mass adoption um yeah so since we're like this

engineering group um talk So you guys might be more interested in deeper technical stuffs. So I have some like appendex slides which could explain a bit more about the architecture of op succinct and opent light. Um you can always find more details in the op succinct book. You could go up on Google and look for it. Um and feel free to ask questions after the talk or maybe afterwards reach me out like if you have like any questions with all these um specs of op succinct um is basically uh generating proofs of

L2s over a ranges of blocks which could be generated in parallel and to maximize throughput. We then act like generate the range proofs in parallel then aggregate and post it on chain. Um and this um coordination of like uh generating like like requesting proofs to the prover network and then um relaying the aggregation proof on chain is handled by a proposer uh which uh is used instead of like the stock optack proposer if you're trying to integrate ops succent.

Uh and it's very um easy to upgrade your OP stack rollup into a ZQ rollup because you just need to deploy like two contracts which is the ZK version of the L2 output oracle for OP succinct and then an SP SP1 verifier which is um called inside this L2 output oracle which verifies the aggregation proof of the validity of the state transition function of the L2. to to be verified on chain. So yeah, you just need to deploy like two smart contracts, run this proposer binary to prove the validity of your rollup and be a Z

rollup. And for op succinent light the architecture clearly defines the happy path and unhappy path and where the happy path is where the new outputs of the state of the L2 are proposed correctly and um yeah so basically what we call uh is a dispute game factory is being called which creates what's called games which represents some state of the L2 and all these games claim to be claim a valid um output at certain point of block then we just um

have it have the state of the L2 finalized after the window of the game expiration. So uh in the happy path everyone proposes a honest valid game uh dispute window passes then the game is finalized and the state of the L2 is finalized. But in the unhappy path for the rollup optimistic roll-ups to be secure, we need a challenge mechanism where if a challenger spots some dishonest behavior um from a malicious proposer, then they would dispute the game, dispute the game. Um and then the prover who um in

case of someone malicious challenger is challenging honest games to um stall the finalization of like an L2. they can defend the honest games within the proving window by generating proofs that oh this game and is and is valid um which also is like verified inside the SPM verifier um on Ethereum and if a valid proposal I mean valid proof is submitted in time the proposer the honest proposer will win and defend. Um but in the other case um where the challenger is honest and there

was a dishonest game being provided uh the prover won't be able to generate a valid proof that will defend to um get a malicious state route to be finalized. So in ca in that case um the challenger wins. So this is a very um high level overview of like OPC claim light. Um yeah and uh to wrap up I think I personally like truly think the transition to ZK rollups is a fundamental upgrade in how we scale blockchains considering the fact that

like two three years we were never feasible to run a ZQ rollup. if you aren't like a mega chain like funded very well. But now uh like due to all this like ZK tech evolving being more performant and cheap uh we can now offer better security users uh faster finality for UX. Um yeah and we have more f flexibility now basically. Um, yeah. Uh, so I really believe that every rollup will be a ZQ rollup and thank you guys for listening. Um, I'd be happy to take any questions. Always feel free to reach me out. Every like my ID and handles are

like fake dev999. Um, feel free to reach me out for any questions. Yeah. Well, thank you. And I know I've got a few questions, but um before I fire off, does anyone have a question? All right. Um so my first question is um so for OP succinct light um there was a one day or less um time and you know so assuming that like the proof takes 1 hour and

then you know so you post the proof and then maybe someone takes an hour I mean so why couldn't someone like you post the tentative state route and then someone has an hour to post, you know, a challenge and then you have an hour to create your proof. So why couldn't it be say 2 hours? Why why one day? Oh, it could definitely be two hours, but uh I didn't wanted to take it too aggressive because some might be like flaming on me like what if the success improver network goes down like what's the fallback um and stuff like that. So it's definitely um configurable like how aggressive you want the protocol to be like

[Music] um yeah in terms of this proof generation definitely. Um yeah in a very happy case we could just like take it down the finality to um like an hour or like couple of tens of minutes like to generate Yeah. Yeah. Yeah. Yeah. or at the tentative. Yeah, I guess there's also can you be censored from putting your challenge transaction in as well, but that would seem, you know, reasonably unlikely that you wouldn't get a transaction into Ethereum, say, across multiple hours. Um, you know, you could have a high gas price.

Um, so what what's then, you know, so I guess that you actually point to a really interesting question. So given the succinct prover network is proving many different systems what's its uptime you know is it like down for a minute a year or you know how many nines are we getting here um like what what we claim is definitely like currently we have some um clusters that we're running for our customers and we provide SLA of uptime of uh 99.9% uh which basically like never goes down. Um we have like autoscaling and stuff like a lot of engineering effort

to like make the system to be very robust. Yeah. Could there be a Oh, sorry. Go ahead, David. Uh just on the same slide. So, uh, Tahhun, I think you mentioned the, um, denial of service attack against the the OP686 light use case, right? Where you're only generating proofs during challenges. Mhm. And you have this um attacker wanting to cause resource utilization at the rollup. Mhm. And I didn't fully understand the defense against that. I understand that the

uh you said something along the lines of you you proved that the um uh system as a whole is valid, but you haven't proven without doing that extra day of computation that that particular transaction is valid. So, how do you uh how do you deal with that? So you're asking like how do you defend against like this uh denial of service attack from malicious challenger right? Yes. So basically um you would have to like prove the earliest challenge games um challenged by malicious proposer by generating a proof and

defending that that game is valid. So the defender is in charge of um generating proofs. Um yeah and uh basically we have we also have this like bond mechanism where the proposer and also the challenger if they want to challenge they'll have to um stake their bond um to the contract and then um yeah it it resolves in favor like whoever wins and takes the bond. Does that answer a question or? Yeah, maybe.

Um, so the disincentive to gratuitously challenge without proof is that you there's an economic loss, right, to the challenger if they if they challenge a valid game. And that's fine. I understand that. Um, I suppose it depends on how much money is at stake, right? Yeah. It might actually make sense for me to pay the bond. If I can frontr run somebody else, for example, or if I can just benefit somehow by slowing down or taking offline this particular rollup. Mhm. So

it seems to me the balance of these economic incentives or disincentives has to be really carefully managed. I wonder if you've modeled that or if it's empirical. I mean how are you coming to those uh those values? Yeah. So that's actually a very good question. Um it's very but we haven't had like a general model for all rollups. We specifically like tailor like the economic like incentive design for the rollups like our customers. Um basically like also based on like TVL their like uh throughput of like the chain and stuff like that because uh it

all comes down to basically like a very simple model of mind where um the bond that the challenger is staking to challenge just need to be um significantly higher than the proving cost for the defender to defend. Since uh then the provers will uh pay for the like the proven network to generate a proof and get some reward for um securing the chain. Yeah, that makes sense. Okay, thank you.

Yeah, which is it's along the lines of the question I had around where does the 5 to 15 ETH value come from? Because you know if proving a block is in the say or proving an epoch cuz you prove whole epochs of blocks don't you? So if proving one epoch is say a thou or one E say $2,000 then yeah I'm just trying to think of you know like because you should be able to prove at the speed of the chain. So yeah it's um so yeah. So where is that five? So you're just thinking that part of that 5

to 15 ETH number is just to disincentivize people from just challenging arbitrarily. Mhm. Yeah. Um I want to talk about like two points. One is that um for optin light we've designed in a way that if a parent game is invalid all the descendants would be invalidated. So would basically have to you don't have like that much of a burden to like keep up the speed with like the chain to like prove all ranges but instead you could just um invalidate some challenged game like

um which is like the oldest one. So that's one and the other like for 5 to 15 ETH um the current proving cost of like very low throughput L2 chains let's say um we're proving like uh like a thousand block of like two second block time it usually takes only like like tens of like couple tens of bucks. So considering that fact and also um the stack OP stack like um like this uh game mechanism requires up to like 700 to 800 ETH in the worst case. So

considering that like 10 to like like five to maybe 15 ETH that I'm like having as ballpark is significantly lower than like what we have had from like the old OP stack um dispute game system but now and also which is like significantly higher than like proving ranges of blocks. Yeah. Yeah. Okay. And I guess the lower the the challenge fee, the more democratized challenging is because more people can afford to do it. But I guess to challenge, you've also got to be um validating like or verifying the block routes because otherwise you might know what to challenge. So that's a pretty big investment anyway.

Oh, by the way, like running the binary to um like like the proposer or maybe a challenger to uh verify the state routes actually like we've did like very nice optimization. So the computing cost is actually very low. We can run basically like under 2 GB of RAM. Um and like very yeah you could basically like probably run it on your laptop as well. Okay. All right. Interesting. Good. Um yes. All right. So it might be some in the order of hundreds of dollars a month um in Amazon web services something like that.

Yeah. And so you know I know we've talked a lot about costs but what about so if if you had a chain you know so that we've got a good analogy for costing. So Ethereum everyone knows the chain you know and we know the dynamics. ballpark. How much would that cost to prove per year using Succinct's latest um system? Do you have numbers for that or is that um you not quite I mean and if you don't know off the top of your head you shouldn't say because you know just in case you're too low or too high you know you don't want to say the wrong thing. Yeah.

Um I'm I'm not sure but uh yeah I I don't have like the exact ballpark but uh to confirm like like the minimum bound I as far as I know it's still over 100k a year but um I consider that to be fairly low considering like the TVL on ETH and like the value we have to secure. Um but yeah, we can definitely get it lower, but yeah, it's still over like it's still like couple of like 100k a year to like prove the whole Ethereum box. Okay. All right. Well, that that's

that's interesting. That's that's a good metric, I think, as a broad brush. That that was what I was thinking it was going to be, but just wanted to check. Yeah. Um does anyone have any other questions? Okay. Well, I don't have any more either. Oh, and we've got a great talk. Um, so yeah. So, go there. I had some next slides, ending slides. Could you Did you incorporate them? Yes, I did.

Okay, brilliant. All right. The merch store is still open, so please get your t-shirts there. Uh, next slide. Um, we have a whole stack of talks coming up. Um, so myself and my daughter Penelopey who are running a game studio in our spare time, uh, we're going to talk about web 3 game design and implementation in two weeks time. And then a week after that, Andrew from Gold Sky is going to talk about um subgraphs and data pipelines and essentially how to rather than you know like going to the RPC nodes of a blockchain to get information, how you can use uh data providers to do interesting things.

um the week after that. So, I've come up with a novel contract where people can claim NFTTS um which is actually part of that game um talk really, but it's um the NFT claim contract is interesting enough all by itself that I'm going to do my own talk on it. Um and ATAM and others have put in a EIP for a universal account recovery um standard. So, a way of um like recovering from you've lost your um secrets and getting your your account back, which sounded interesting. So, Dominic Schmidt is the co-founder of Miden. Um so, they're a company that spun in then spun out of

Polygon and they do ZK stuff. Um, and but it's a limited I mean rather than risk it's a different reduced instruction set. So it's not risk 5 but it's something else and it's super super super fast. And so he's going to give us an updated deep dive. And then um Paul uh Bose has got um is going to tell us all about circles protocol in September um which is a new way of essentially doing peer-to-peer money. Um so yeah another concept again for us all. Um and next slide after that

please. And so if you're watching this here live um go on YouTube. If you're watching it on YouTube, join the meetup and turn up and ask the tricky questions live. Um there's a Slack workspace and sometimes there is example code which is there. So Tahun, thank you again. It's been great having you along. Very very happy and it's good that we've got a a deep dive into how succinct works. So thank you very much. Thanks for having me. Um pleasure to give a talk like uh yeah from now on like I'll be like deeply following up with all your works like from this engineering group. Uh I

think yeah all the questions were like really great. Um appreciate it and yeah see you guys around. Yeah thank you. All right bye-bye. Thanks. Bye.