Private Atomic DvP on Ethereum: No More Trade-offs

Transcript

[applause] >> Hello everyone. Um Uh my name is Alex. I'm uh going to be talking today about atomic DVP on Ethereum. And if you're not familiar, DVP is a term from institutional finance, which stands for delivery versus payment. Uh our focus at Matter Labs and zkSync has been very institutional for the last 2 years, and this is one area um where there is a lot of excitement despite the the the market situation right now. DVP stands essentially for a token swap.

Um and this is a difficult problem for institutions because the today's blockchain options are not quite meeting the requirements of institutional finance. Um they're facing the trade-offs between several important properties that each of them is actually getting requirement, and I'm going to briefly walk you through the existing solutions and why they don't work. Um we start with public chains. Obviously, Ethereum has lots of fantastic properties, uh and it has been used for uh institutional finance or by institutional finance for a lot of use cases, but it's obviously public by default, and everything you do, all your positions, all your transactions are

going to be visible to everyone in the world, and that's not really working for banks uh who have to adhere to strict um bank secrecy rules. That does not work for enterprises who don't want to disclose their business models to the world, so that that that's just a no-go. You cut off 99% of use cases. So, we're going to skip that and move to the uh solution that they have experimented with for several years now, private chains, institutional permission chains.

Um They work. They have internal usage in banks, in uh financial market infrastructure providers who use it for um managing liquidity between different subsidiaries for internal operations, all of that. They have full perfect privacy because the data never leaves your zone of control. But um they obviously are not connected to each other. And so the value of the the systems is very, very limited. It's arguably more limited than the public chains.

Uh the whole idea of blockchains is it's a network. It's the internet of value, and there is no internet if you cannot connect. Um there is a novice tempting solution to connect them with um external bridges. And the problem here becomes that the bridge operators then see everything that's happening between the chains. Uh but that's the uh the smaller problem. The larger problem is your bridges essentially become your settlement layer for everything that passes over the bridge. So all the tokens that you make exposed to the bridge, you settle on the bridge.

You don't have the security of the origin chain, you don't have the security of the target chain. It It It's You replace that with the trust assumptions on the bridge. If that is okay for you, fine. Uh but you have to be comfortable with this, and a lot of institutions are not. And the third types of solution that uh is um being considered or have been considered for for a while now is what I would call mediated networks. Um It has a mix of properties of the the the previous two. Um And it falls in into you know, you you have different kinds of uh uh these implementations. There are some purely um operator attested systems where you get individual privacy domains

and you trust certain operators to attest to the security of the of the zones and guarantee privacy. But these guarantees are contractual. Um a different subtype of um of a similar system is something like fully homomorphic encryption which is on the one hand cryptographic, but on the other hand you still have a number of operators who collectively hold the full picture of what's happening inside and they can decrypt it with a threshold.

And so you still trust a majority of these operators to to behave honestly. Um and that is not really strict meeting the strict requirements of institutions to have full absolute control over the data with you know, strong not contractual guarantees. So the uh we've seen that and uh we we built the architecture called Prevedium which um is the one that checks every box from uh the requirements that we discussed above. What Prevedium is, it's a private it's a framework for building private chains or private zones that are uh cryptographically secure. So you you generate the proofs for execution for

everything inside the uh the chain. Institutions run them on their own infrastructure. You have absolute physical data uh security or data privacy guarantees because the data never leaves the devices under your control. And yet you have this private atomic connectivity between the the chains and you settle on Ethereum as the um ultimate credibly neutral uh settlement layer. Um and um the uh you know, Prevedium comes with uh a bunch of middle middle layer middleware uh layers that give you the control over individual accounts, transactions. The operator sees

everything inside and can control everything, the full permissioning, the full data properties on you can connect your OIDC directory of users and configure rights there. You can configure rights per roles of the users, per smart contract, per individual function of a smart contract. You have a lot of flexibility there. And you can also do it programmable. But and cryptography or zero knowledge proofs guarantee that everything that executes on a Previdium is correct, even if the operator is not very honest or if if the operator was compromised, they would not be able to finalize invalid transactions.

And what this enables is um um transactions that can spend multiple zones simultaneously at scale executing together, fulfilling certain rules, and we'll talk about how this works on a slightly more technical level. Uh but also very interestingly, um you can set rules that apply beyond your zone. So, what I mean by this is you can deploy a smart contract once as a let's say you're issuer of an asset.

You you build like you you are a bank who deploys a tokenized deposit. And you have a white list of users who can use this deposit or certain set of KYC KYB rules that have to be enforced on every single transaction. And what you would have to do in today's configurations with private chains, you would have to go and do a bilateral agreement with between every bank that you want to operate with. You would have to integrate into their systems. You would have to prescribe these rule books to them and get a contractual guarantee that they're going to enforce them, and you have no way of checking if they enforced it cuz you don't see what's happening there.

And um you cannot really guarantee that that this happened in in the first place. With Previdium, you can deploy a smart contract which will be kind of virtually mirrored into all the zones, and it will enforce the rules automatically without you seeing the data and without you having to be there. It just Whatever is in invalid just won't execute. So, um let's talk about private DVP because it it's the most complex example of the um or like the the most interesting example of cross-zone interaction which evokes questions whenever we talk about this. This is a topic which is hard to

understand like how exactly it works on a technical level because it it comes down to the um legal consequences of what happens if if you uh a part of transaction executes, the other part does not execute, who's liable, shall I go and sue someone, or is it really guaranteed by technology? In this case, it is guaranteed by technology. Here's how it works. Um first, why you need that. Without atomicity, uh DVP in today's banking systems is executed sequentially.

So, you you're like you send someone some stock, and they pay you back on the different rails. And you always have this counterparty risk window where you send them the money, but maybe you don't get the security back. And then you have to go and sue them. So, it only works between a small number of counterparties who you can actually trust, or you you trust yourself to be able to enforce it through the legal system, which limits your options. On blockchain, it's not the case. Like with atomic swaps, you don't have to trust the the person who you're transacting with cuz it it's either going to happen or it's not going to happen.

And so, if we could do that on the in the traditional finance with tokenized assets, we would massively reduce the cost of compliance and cost of operating the systems. Cuz the settlement risk would collapse, the operations would be a lot easier, a lot simpler, and it would be a lot more capital efficient. Cuz you don't have to do um to wait the the settlement time, which is also costing you some money, and sometimes it goes into several days. So, um here's how it works. Imagine you have two zones, and you have uh assets held on each zone, and they want to transact.

The two parties would then agree on what exactly they want to do. Let's say they want to uh you know, the one party says, "I'm going to send you 100 USDC for 100 USDC or 100 million USDT." 100 million USDC. Um they would note down the exact agreement, and they would simulate this transaction. Kind of like signing down the intent of what's going to happen with all the consequences, with with the full exchange of um all the inputs and all outputs of transaction.

Uh with with all the effects. Then, they would generate they would calculate the hash of this kind of mutual contract, which we call cryptographic commitment. And they would put it on a neutral um data availability layer, and they would put this the the hash itself on Ethereum as a settlement layer. Uh so, both party both parties can access the data availability and the actual settlement layer. Data availability on Ethereum can be Ethereum's native DA, or it could be some third third-party place where which both trust.

Then, once the uh the hash the commitment is on the settlement layer, both zones can see this. The zones are L2s on on the settlement layer. They can always read the underlying um chain, and they they see everything that's happening there, and they can access it natively. So the uh once they see that the commitment has been posted and it and it's firm, they can lock the assets on both sides into an escrow contract. So, they put the assets there, and it can only be released upon certain conditions.

Um once the locking happens, the both parties can look at the uh um like at at the settlement layer and verify what's the current state of commitment of both chains. The both chains commit independently from each other. They each of them executes the blocks. If you're not like you you I assume that you're familiar with how L2s work. For each block, there is a new state, and the state has a root hash, which is being put on the settlement layer. So, both parties can read the uh the current state of the

uh counter chain if they know what what to look for. But, they know because they exchanged this information beforehand. They had this script which expe- explains what's going to happen on each side, so they know what to look for once you have the the new root hash. Um and then, if both of the parties see that the commitment has happened, they know that they can release the funds according to the to the rules of uh of the happy path, and uh they get executed.

Um and if the commitment did not happen uh until a certain Ethereum block, they will look at the state of the other chain. They will not see the commitment happening. Uh, and they will revert and and go back to the um um pre-agreed release path, which is just sending the funds back to to each of the chains. Uh And this works for delivery versus payment, for payment versus payment, so for swaps of all the different types, for collateral movement, and it can span multiple zones simultaneously in one large chained transaction,

not only within two different zones. And uh yeah, it can be the uh uh Previdiams can form this cryptographic credibly neutral network by connecting to each other through Ethereum, uh which is now already growing with uh the Kering network, uh uh which is a consortium of uh five US regional banks. There are multiple FMIs and big banks um building uh including Deutsche Bank and and and some others. Some uh I'm I'm not going to disclose now uh much, but the network is now growing and uh would love to talk more and explain if it was not clear. Uh I'm available after

the the talk to answer questions. Thank you all. >> [applause]