Quadrillions: Privacy or Perish | Eli Ben-Sasson, Shaul Kfir, & Eric Saraniecki

Transcript

Now I always sh said that um getting privacy is easy. The hard part is integrity. So you can just take whatever transaction you want and like you know shield it or encrypt it or put it under a hash. But if you have this big uh you know wide network that anyone can participate in, how do we know that what you shielded you know was computed with integrity? How do we know you have the funds that you claim you have? Quadrillions is a miniseries produced by Blockworks and is sponsored by Canton Network. Nothing on this show is a recommendation to buy or sell securities or tokens. It's forformational purposes only and the views expressed by anyone on the show are solely their opinions,

not financial advice or necessarily the views of Blockworks. Our hosts, guests, and the Blockworks team may hold positions in companies, funds, or projects discussed, including those related to Canton Network. All right, everyone. Welcome back to Quadrillions. Very excited about this. This is episode 4. If you have not listened to episodes 1, two, and three, I would highly recommend. Really good episodes. Uh, this might I don't want to, you know, get people too excited. This might be our best episode yet. It's we are going to do an hourong deep dive just on privacy. We have two of the privacy goats joining us. We've got Ali Ben Sassan um who is a yeah a legend computer scientist um very well known for his work on ZK proofs also the

co-founder and CEO of Starkware Industries I think I'm going to get it right that you were a founding scientist at Zcash >> and uh we also have Shaul Kafir uh who's one of the founders of uh digital asset software engineer uh co-authored lib snark I think in 2012 which kind of launched the whole ZKP movement uh 2013 13. You guys were the first to introduce uh the idea of ZKP for cryptoscaling and privacy. And we have Eric who I've already introduced but also a great guy. So >> zero zero crypto ZK accolades. >> Zero knowledge on crypto.

>> You was Ellie's research assistant. >> You were Ellie's research assistant. >> Yes. So the work on Libnark was actually Ellie's work and I was his research assistant. >> Ah okay. So my first question is you know are you guys is it friends or like frenemies here? because you guys, you know, kind of compete with each other, but you know, I didn't realize the personal connection. So, is it what what's the relationship here? >> Yeah, I guess friends and competitors. It can be both. [laughter] >> Uh, wait, I I got to tell you the origin story. So, um, when I was a professor at Techneon, um, one of the tasks that I got was to select five potential entrepreneurs a year for like an excellence in entrepreneurship program.

and Shaw was one and I actually did two cohorts. Schol was one of the five that I selected in one of the cohorts. There was so I selected overall over my tenure there 10 entrepreneurs. I think probably at least three or four sh may know from his uh you know year and the next I don't know if he was the second or the first like there are quite a few unicorn you know founders from that 10 people and then later on I asked Shaul to join as a developer in uh indeed in libnar and we had this whole skipper lab that ended up spinning up both Zcash and then starkqu so that's how we know and certainly not frenemies friends though

Yeah, I a little bit of competitors. >> Nice. I love that. All right, maybe we can start with um just this idea of privacy because I want to make this whole episode about privacy. I'm curious if you guys agree. You know, I I was trying trying to prep for this episode and one of the tough things about this is there's like 20 different definitions of privacy. So, I'd actually love to just start by defining privacy in the crypto sense of the world uh of the word and uh seeing even if you two agree on on this idea. So maybe Ellie, I' I'd ask you to kick us off by just like how how do you think about what privacy means here?

>> Well, first of all, it's related to human dignity. It means that like the stuff you don't want to be seen is not seen by anyone who doesn't need to see it. It's probably just like your everyday definition of privacy. And just the only thing is that like everyone's familiar with privacy and financial applications and it's it's somewhat of a mystery as why is this even an issue on crypto? Um but just privacy means you know people who shouldn't see your stuff don't get to see it. >> What do you think about that?

>> Yeah, I agree. I mean privacy isn't a you know a trady versus DeFi thing. It's just a normal people thing. you know, I I don't want people seeing my stuff unless I choose to like do business with you or if I choose to disclose certain information for you uh uh to you, then then privacy means I get to choose, you know, who sees my my stuff. And um I think, you know, to to Ellie's point, I think in crypto, there's kind of there was an original bug in in crypto. And, you know, Satoshi saw privacy as a feature, but he didn't really know how to implement it well. and he realized that even if you look at Bitcoin talk he was saying hey maybe zero knowledge proofs but I don't you know I don't really know how to do that and then over time this this bug of blockchain is that

you didn't have privacy people kind of turned that into a feature said oh you know internet computer transparency is a feature so I think it's kind of after the fact people trying to justify the lack of privacy and that's why we have all these convoluted definitions of privacy uh and and now I'm I'm really glad that in the last kind of year or two people started coming back to that realization of no privacy is actually uh kind of fundamental thing. It's a human right. It's a business need and and it's just something that we need in blockchain. So I think it's going to become much simpler from now on and we won't have all these kind of convoluted privacy.

>> Can we double click there? So sh you would say that the transparency of a blockchain even even starting with Bitcoin is a bug not a feature. >> Yeah, definitely. I mean, some people have built things on top of that transparency as a feature, but I don't think it's a fundamental feature or even a desired uh property of of a blockchain. I mean, would you accept your payroll uh if if it was completely public or would you be able to do any kind of contracting for your for your business if it was all, you know, posted on Facebook? Um, so, so no, I I mean, humanity has been working for for hundreds of years and thousands of years with with this kind of fundamental expectation of privacy and and I definitely think it's a it's a it's a bug and Satoshi thought it was a bug. He

was very uh very public about that. Um, and and you know, we just didn't have the technical capability to do it until very recently when when added to smart contracts. >> Yeah, it's not it's not a it's not a Tradfi ideal like this is a this is a crypto punk ideal, too. I mean, how could you build borderless censorship resistant money if if you really believe in the original Bitcoin white paper? How can you do that if everyone can see everything that you're doing at all times? I mean, you even even in kind of the extreme, you you have the opportunity for someone to knock on your door and physically take the coins from you. And that all starts with knowing who has what and what they're doing with it and how they participate. So, it's I I think it's a real mistake to say that

this is something that Treadfi is pushing. It's it's as much an individual ideal as it is institutional requirement. >> You mentioned it has we haven't had the capability to do this. U maybe Ellie I'd ask you like you know you've been working on privacy for so long like why if everyone wants this the institutions want it and the crypto punk or the you know the cipher punk movement wants it everyone wants it why hasn't it existed yet then? >> Yeah. So, um, going back to like, you know, we all pretty much have pretty good privacy when we work on, let's say, Venmo or, you know, Robin Hood or Revolute.

>> Um, so why is it even an issue on crypto? And let's unpack that. So, with like Venmo, what happens is you have some trust relationship with Venmo and then they basically but you don't really own your assets. It's like, you know, Venmo, you custody it with Venmo. So then they open some encryption channel with you like some some secret channel. You tell them everything and you ask them to you know do whatever it is you want. Now the whole point of Bitcoin is that there is no trusted Venmo. It is this open beautiful network where its security is pegged on everyone being able to participate. So because of that you have this transparency so that everyone knows the integrity of the

system that the right thing is being done. Now I always sh said that um getting privacy is easy. The hard part is integrity. So you can just take whatever transaction you want and like you know shield it or encrypt it or put it under a hash. But if you have this big uh you know wide network that anyone can participate in, how do we know that what you shielded you know was computed with integrity? How do we know you have the funds that you claim you have? So the problem is one of integrity. Now the solution for that is obviously you know ZK um that's what solves it and um the problem and why this hasn't been adopted is first of all it's a very you know gnarly technology to work with but more

so it just uh leads to pretty shitty UX compared to just doing things transparently. So, it's a bit harder to, you know, come in and out of exchanges. Most of the hardware wallets that we're all familiar with don't support it. All kinds of things that come from this being newer technology. So, to answer your question, why is privacy an issue? Because it works very differently on decentralized blockchains and the solutions to it lead to uh UX that is uh not so so much fun to work with. Do they not support it because the technology is complicated and tough to deal with it or because of compliance reasons?

>> It's more the former than the latter. So, okay. And it's separated. A lot of exchanges, for instance, have a hard time listing Zcash or getting shielded Zcash payments, not because they can't support the technology, because of compliance. But if you ask like, you know, Ledger and Treasure and, you know, hardware wallets and so on, why aren't you supporting it? It's not because of compliance. It's because that generating some of these ZK proofs is just a really it's it's it's another order of magnitude or two or three orders of magnitude more complicated than just generating a signature for you know a Bitcoin transaction.

>> Yeah, it's a bit of both. >> I completely agree with with Ellie that uh privacy is easy getting consensus with privacy is harder and uh and actually the technology has has you know started working on these things very early. So uh you know Zcash launched in uh 2014. It still wasn't general purpose uh smart contracts but it was zero knowledge proof for a bitcoin like uh currency. Canton has been live since 20120. So that's you know five years ago. Um but then the next phase is how do you get a good user experience on top of these things and how do you get it accepted within institutions? That takes time. Getting getting good software ready uh ready for for mass adoption is

something that takes time. uh but the technologies were there and and and I think now we're at that point of having kind of already uh you know dotted the eyes and crossed the tees to a point where it's it's completely ready for mass adoption. >> What do you think about uh in terms of the pain points that exist today? Like you know I'm thinking about a listener listening to this being like honestly things work fine like I use I use both sexes and dexes. My life is good. I don't really care. like what is the pain point that you think we we are facing today that it seems like I I think show and if I asked you guys like one of what what what does the industry need to grow up I think you would would both say privacy and I'm curious about the maybe

the why behind that like what's the customer demand that's actually driving that >> scale I mean like anyone's willing to do something openly and transparently over a few hundred bucks I don't think anyone's willing to buy their house like with all the money that they need to move and everything else along those lines to do. So it it's a scale thing. We keep bumping up into this artificial low ceiling on the adoption of these networks because the wholesale capital markets are not willing to adopt it. People are not willing to adopt these things for um the backends, you know, the the treasury side of what they do.

Like even look at something like Circle. They are massively onchain around the world, but only for USDC. not for how they manage their treasury, not for how they manage their their their um their reserves, not for how they manage the back end of their product. And that's not because blockchains aren't good at that. In fact, I mean, we've proven quite well that they're very good for those types of things. It's just that there are some stuff that when you operate at scale or you do sensitive workflows, you don't it's not additive to be public information. >> Yeah. I want to share with you a story from from my company. So, I run Starkware. We have 200 employees. uh one of the larger you know decentralized blockchain infrastructure teams in the world and uh recently we decided to um offer our employees to receive part of

their salaries over starknet okay and stable coins and you know everyone's doing that so my CFO came to me and said hey look this is a problem right because like you can on a browser start clicking and seeing how much others are getting what is the size of the payroll stuff like that so this is an example uh so we found ways around it but like and we are adding a whole bunch of privacy features to Starknet to exactly address these things but this isam an example of uh you know a company needing to do more business on a blockchain and then realizing that privacy is really needed um and that example happens to be us so like I know this from firsthand but yeah

for myself maybe as I'm deening or aping into whatever the latest uh you know shitcoin or saying, "Yeah, maybe I'm fine with not having it private." >> Yeah, privacy is the missing feature. And I think there's this misconception also that a lot of these, you know, ZK rollups sell privacy and they don't. So, privacy is actually a feature that we have not had until recently an L1 smart contract blockchain that has privacy. That is the unlock. I want to pull up a um a tweet by Tushar at Multicoin where he said um he said privacy is a feature not a product.

Curious if you would agree or disagree with that. I I find it so ironic how uh how aggressive the Salana ecosystem is against privacy because I always use Salana as a great example of an ecosystem getting built around a feature that everybody knew that they needed and was a first principle. Like the way the way I tell the story, I don't I don't know if it's the way they would tell it, but I always say, "Okay, the whole world was like, "Yeah, yeah, yeah, fast and cheap. Fast and cheap, fast and cheap. we need it. And a lot of people didn't take it seriously. They had these white papers that were like, well, theoretically, here's how we would do it. And they didn't have a deep enough respect for the problem. And Salana showed up holistically different than

other people. And they actually were fast and cheap. And then there was a whole ecosystem that got built around that and a whole community that got built around that. Now it's table stakes, fast and cheap, but they're still winning because it was a first principle and it was they were the first to really get there and do it really well. And now that there's another feature like that that is just missing from the stack, it's like they've completely forgotten the exact thing that put them in the strong position that they're in today. That approach of this is a very serious problem. We're going to take it seriously from first principles. It requires a holistically different approach. I can't just bolt it on after the fact. It is one of those fundamental changes. You know, Ellie mentioned UX. UX with privacy is a whole different world. like when you when I

can't just hit any block explorer and see every bit of information that I want just that even that architectural design is different even if you want to create a similar experience. So to pretend like this is not a first principles thing is a little bit I think talking own book and then ignoring the history that got them where they were. And let's not forget that you know they ran into their own issue with trying to bolt this on around the the confidential transaction issue that they found in production. And I'm not I don't point fingers or or laugh at anyone because everyone is doing these things and they're working very very hard. So this is not me trying to, you know, stand on a soap box and say told you, told you, told you. It's more it's because they didn't take it as seriously

as I think they needed to. They ran into that and then they are very quick to just pretend like, oh well, we'll just try harder next time or something along those lines. I think it it is one of those cons one of those core core principles you have to start with from scratch. I actually love the the the response here on the tweet that you have on the screen. So I see Tom Howard. So I don't know who Tom Howard is but I just had an exchange a few weeks ago with him and he is awesome because he is a G Zcash maxi and he was really in good faith engaging to try to understand how Canton does things, what assumptions we made uh for which we're doing things differently from from zero proof and Zcash. Um, so again, I've just kind of came to know

him and he's awesome. But his answer here is great because he's saying, you know, often to have true privacy, you need it baked into every architecture decision of the L1, which often breaks existing L1. It's not something you can bolt on. You know, Eric always gives this example of of, you know, if you're if you try to build a skyscraper on top of uh the foundations of of, you know, a single family house, you're not going to be able to do that. That that's kind of trying to bolt on privacy onto something that wasn't designed for it. And uh, you know it's It's both the, you know, the cultural change, the political barriers, but also all of the foundational architecture, the the design of the data model of the consensus, everything. You can't just add that after the fact. And and I think Ellie, me, people who came out of that

uh out of the Skipper Labs, who came from kind of a privacy first mindset, we built these things with kind of the the non-negotiable feature from day one was things need to be private. And then you build on top of that and you say, "Okay, now how do I get this when things are private?" I love that that tweet because like um you can expand it to all of crypto. The price action on almost any sorry on every asset I've seen so far the price action is first and foremost attached to some mimemetic value that captures something for which it is you know first or best known or something like that. So Bitcoin right money well look bitcoin is not used as a medium of exchange today. it is you know doesn't

have the scale doesn't have other things but nevertheless it's right the expectation that someday you know a layer will be built on it that will allow it that drives its value which is great I love it right Ethereum you know the world computer it is not the world computer it is not today uh the place where all financial transactions happen but the expectation that it may be the basis for that is you know is what drives its price uh decentralized NASDAQ NASDAQ is not running on it probably never will but the expectations that this will be whatever the fast consumer da da da. So now that Zcash which had this uh you know thing about like privacy is normal or Bitcoin with privacy from the start the world is now attaching you know like uh finding or

discovering this uh even though you know we said it many years ago um it's very funny to see how the others who benefited from the same sort of action you know Solana and others are now oh no these guys you know the you guys can you know this cannot happen in this case it only applies in our case but it's funny because it will apply time again right uh hyperlquid you know pumpf fun prediction markets um they are their value often is uh sort of based on the expectations of what the world will look if they become the infrastructure for everything but none of them yet is right >> right uh I'm going to ask a really dumb question that will out me is not understanding some of this uh er Eric said that you can't bolt this on um the

thing that came into my head is well I see people trying to bolt it on um there was an announcement with um that I'll pull up here. It was uh optimism and succinct and there was a blog post. It said uh now we can seamlessly upgrade any existing OP stack chain to ZKPS in just one hour or there's another thing. It was like arbitum rolled out arbitrum zk proofs. So this is me not fully understanding this. Why can't like can Salana just wake up one day and be like I really need privacy and they start to I don't know. Yeah, like I mean Eric said he can't do it, but why can't they just bolt it on? Because it looks like you know optimism's bolting on privacy with succinct here. But tell me tell me why I'm not understanding.

>> This is hitting on one of the most common misconceptions about zero knowledge proof. So zero knowledge proofs um can give you two features. They can give you privacy and they can give you integrity. And what all of these folks are doing, they're improving scalability by using zero knowledge proofs to to prove things faster, to do the consensus faster. What they're not doing is adding privacy on top of these chains. So, so these are not actually announcements about the addition of privacy to these chains. It's just about using zero knowledge proofs to achieve higher scale. So, I don't know if you noticed there, but it actually talked about scalability in the headline. And this is where a lot of people get get these two mixed up. And and there's a lot of slight of hand. I think a lot of the marketing is done on purpose using

kind of the term zero knowledge proofs and and emphasizing the zero knowledge. while they're always very care careful not to talk about it as a privacy feature but about a about it as a skill. >> Yeah. I want to say that for a very long time I tried to fought fight this this windmill right like Doniote fighting I I said guys don't call these things ZK rollup call them validity roll-ups because most of them well there are some counter examples for instance Aztec actually has ZKIC and war have ZK so some of these actually go with ZK but like uh I I sort of gave well I didn't quite give up but I realized even from the start that it would be impossible.

So what happened was that people called things ZK rollup even they don't even though they don't have ZK and now because ZK actually talks about the privacy aspect uh sort of this whole thing gets uh uh you know bungled up. So yeah just adding a proof technology to a chain doesn't mean that it offers privacy. Um, and I'll say even more than that. Even if you do add true and honest zk proofs to something, that by itself doesn't make uh the whole thing private because you have to architecture a lot of the underlying system, you know, as we did in Zcash u and then as others have emulated it with tornado cache and

stuff like that so that uh you use the zk proofs in a way that gives you privacy. So just slapping DK proofs let's say tomorrow on Bitcoin or on Ethereum or on NAL2 does not make it uh doesn't give you privacy. It may give you as the show said integrity uh and scalability but not privacy. So it's just like but it's okay like you know everyone's >> I found a tweet from yours uh four years ago. You said ZK rollup is the term everyone's using. That's wrong. ZK roll up. >> I know. I know. >> And actually >> Vitalic also tried to fight this. Yes.

We are a lot >> I found. And then Shaul, you a tweet from you a year later. You said ZK rolls are not zero knowledge. Can you um explain this like I'm a 5-year-old to me so that I can understand it a little better. >> Yeah. Yeah. I'll I'll try. I have a 5-year-old. I'm not sure he would follow but >> until your 5-year-old probably gets this more than me, Jo. So, try. >> Well, actually, where is I do have the uh >> ZK for babies or something. No zero knowledge proof for five year olds here. But um so the the the fundamental thing about snarks and I won't say Zika snarks on on purpose and and I feel kind of I feel bad talking about snarks when when Ellie you know Ellie is here the guy who

taught me about them but um snarks are really about I want to prove something very quickly about something that happened. So let's say you know I computed the validity of of the whole blockchain and it took me hours and days and years to compute that but hey I want to send you some proof and you can verify that very quickly in in milliseconds. A really nice property that you kind of get for free is the zero knowledge aspect which means you know I I can also add some private inputs that you don't know and prove claims about those private inputs but that's that's optional. And the thing with ZK rollups is that they're not using that optional thing. They're actually taking all of the chain that all the data that exists in the public and they're using that

property of being able to you can think about it as compressed computation. They're really just saying, hey, instead of all of the computers on the network trying to check the validity of all transactions, one computer is going to check the validity of all transactions and prove that very quickly to all other computers. So, one does the heavy lifting and everyone else does the verification, but it's still doing it on completely public data. So the underlying technology, the ZK Snark knows how to receive p private information and to do proofs about that, but that feature is not being used in ZK roll-ups. So people are kind of getting this feature that they're not even using as if they're doing something for privacy with privacy.

>> Got it. >> If I may, yeah, I want to give another like um I agree with everything SH said. just want to like um give you an example uh on Ethereum like uh um why you wouldn't get privacy. Um okay, first of all the ZK property means that I mean the proof is a string of bits and the zk property basically says that the if you look at the strings of this string of bits you learn nothing about it looks like whatever it looks like noise it looks like some garbage. The only thing you can do with it is sort of it tells you one thing only that a certain statement is correct. Now let's apply this. Let's say so let's suppose that

Yano you're going to pay one ETH to Eric in Ethereum. What does the transaction look like or what is the statement? The state let's suppose you have 10 ETH in your account and he has 10 E. So the statement will say something uh go to Yano's account. Let's say it's 1 2 3 4. Subtract you know one from that. go to Eric's account let's say it's a 5678 add one to that that is so the statement and then there are signatures you know you actually own the funds what da da da okay so now let's suppose let's suppose I provided a proof for the integrity of this computation that I saw your signature you know you actually have the funds what is the statement I'm going to prove the statement I'm going to prove

is hey please subtract one from account 1 2 3 4 and please add one to account 5 6 7 8 this is what I'm submitting to um Ethereum now just by looking at this statement both of your privacies have been sort of compromised because I understand now that like oh yano you whatever this account paid that account so in order forget about the zk part right even if the proof doesn't reveal any information which it doesn't you didn't get any privacy in order to get you guys to have privacy first of all we have to move to something like some sort of weird UTXO model but it's even worse than a UTXO model because no two transactions can ever be connected. So a large part of what h what we did with

Zcash, right, is like invent this new model where there are things like commitment uh sets and nullifier sets that takes care of all of this stuff. So that's why just having ZK. So think about optimism or arbitrum. They're pretty much just the Ethereum blockchain, right? Um now you add a ZK proof to that. the statements, the transactions are still revealing everything that's being done. So you get no privacy even if it has ZK. >> Yeah. Maybe this this goes very to to like a fundamental thing which which I think people don't realize which again zk snarks f you know mpc all these fancy crypto names um their methods to achieve consensus on private data but

the fundamental thing that any privacy blockchain needs is um and whether it's something like canton proof of authority based or or you know something that's zero knowledge proof based it doesn't matter um The data itself is sent encrypted only to whoever is allowed to see it. And again, the difference is not in how they achieve privacy, it's how they achieve consensus when not all data is public. But it's still fundamentally the same that you need this data distribution mechanism and you need this way to model your smart contract in a way that's privacy aware that is aware of the fact that not everyone has uh has all the data and that's where it becomes really impossible to build it on because if you don't have that fundamental kind of beginning of hey I have a data model

that is aware of the fact that not everyone has the same data and I have uh I have a a a data distribution mechanism and this is like the software that passes the data encrypted that knows that each piece of data only has a a very small strict subset of the network that sees that data then then it doesn't matter you no tool will help you add privacy on top of that and then once you have that then you can start arguing about the nuances of hey should you do it like canon with proof of authority should you do it like zcash with zero knowledge proof and the likes but really there there are uh very very very few projects that are actually dealing with that problem of of data distribution and and having kind of this this principle

of least authority only a very small subset of of network participants should see each piece of data. >> Yeah. And then and then think about they're talking about just at the network level right now, right? Everything they've been talking about is just completely contained at the core protocol itself. But now go to where Ellie was talking earlier about the compliments, the integrated services, the wallets, the oracles, the exchanges. they now all have to adopt that model and they have to understand what it means for them. So like an an overs simplistic example like we were talking about Salana before how they built a community around fast and cheap. Oracles were not fast and cheap at that time and then you had a whole ecosystem of people that built low latency oracles to be able to support that. So you can't even

bolt on the existing community because the feature is new. Forget the tech being new, right? that there's nothing that exists around the concept of I'm a data oracle that has partial information about the network or I'm an exchange that has partial visibility about collateral or I am a you know ecosystem that has partial information about transfers you don't have any of the tooling and the complements and the and the integrated assets so even if I went to a deeply robust community that already exists like Ethereum or Salana they are starting from scratch around building those capabilities so it's not just about the protocol adopting it it's about the community integrating it and expressing the feature in a way that makes sense and is accreative to the overall ecosystem. So it's even if even

if technologically you could bolt it on, it's no different than starting from scratch from your community perspective because they have to think about how to incorporate the feature into what they do. >> Uh Eric, can you can we maybe shift into like uh customer conversations that you guys are having? And I don't I'd even love to walk through like a sample like a sample transaction or a sample I don't know like Citadel makes a trade that's fully private. I can't see that. But you know because it is Travite they do have to share that. Someone has to see that right? There's like KYC AML. There's they have to send the trades to a compliance department. Like how do you balance the privacy with you know this is TRDFI and there's still a lot of regulators there's still compliance

teams. like, yeah, how did how did you guys think through that? I >> I I think that it's easy to make this harder than it needs to be and it sounds really abstract and confusing, but it's actually the model we're accustomed to already today. So, if you say, okay, the most successful public permissionless network is the internet. It's not Bitcoin or Ethereum that we have this bigger case study in front of us. How how does it work today? Well, just because I have a browser doesn't mean I get to see everybody's bank account at chase.com. Just because I have an account at Chase doesn't mean I get to see everyone else's bank information at chase.com. Chase knows everything about Chase.com, they don't know anything about Bank of America, right? So, this sort of overlapping asymmetric view of the world is really what we're already accustomed to. That that's really the

way things have worked for a long long time. And if you accept that that is a really well functioning way of thinking about things, now you're saying how do I add composability? How do I add interoperability? How do I add velocity to that structure, that market structure? And I think that too many of the conversations that are being had in uh crypto is the same sort of false dichotomy that we have with everything else. Public versus private, permissionless versus permissioned. And and here it's not that black and white. It's not everyone sees everything or everybody sees nothing, which is where too many of these arguments are going, especially as they pertain to ZK. It's much more okay, what is the right combination of entities? Some must know.

They need the ability to disclose. Some must know a limited set of that. And then it's not just at rest, it's in transit. It's not just in transit, it's in composition. So, how do I compose a treasury with a dollar or just swap two assets that have different visibility sets? How do I maintain privacy? You don't want your doctor to know how much money is in your bank account if you pay them. And you don't want your bank to know why you went to the doctor if they facilitate the payment. So it's it's just kind of accepting the reality of these these complicated asymmetric views and then building the tooling and the protocol for it. And again it's it's why it's a first principles thing. It's not something I can just kind of slap on to a fully replicated system.

>> Yeah. And the tooling then becomes easy. Honestly, like this is where if you've built that data distribution mechanism, if you want to say, hey, you know, this regulator, this auditor, this other entity needs to see something, it's really really easy to go and add them once you have that kind of fundamental infrastructure in place already. >> Ellie, um, one question I had for you is it seems like Canton is very much positioning themselves as kind of like the institutional chain. got a lot of trad people investing. How do you think about almost Starkware's like your go to market and your customers and who who needs this outside of just I mean I'm sure you you guys will go after the trad people too but um friendly competition here but how who who else is your your customer? So our mission is to expand the Bitcoin economy and expand Bitcoin

GDP. And if you think about people who have Bitcoin, uh so first of all, you know, 99% of Bitcoin right now is static. Um less than 1% is being financialized, but it is the best form of collateral. And um I strongly believe that if you provide Bitcoiners with a financialization layer, an execution layer that is true to the Bitcoin standard, which really means you own your life, no one else does, right? So it has to be fully decentralized and then it has to be, you know, safe, mature, have good UX, a whole bunch of things, you know, be dirt cheap. Then a lot of Bitcoiners will slowly realize that they can actually, you know, borrow

against this supreme form of collateral in a safe way, generate yield on it. Um, you know, invest u let's say stable coins that they borrow against it and whatever it is and uh also support this growing economy that is true to Bitcoin's uh uh vision which is decentralized, you know, everyone is invited to operate uh based on all of these beautiful principles so that you own your life. So that is Starknet's mission right in to give Bitcoiners and the Bitcoin economy this uh opportunity and this opportunity I think is immense.

I have 100% conviction that a Bitcoin financialization layer will emerge and it will be huge. There's a there's a huge opportunity there once the right uh tools are given in DEX form to Bitcoiners. Now, we announced this very ambitious plan just like one month ago. Uh there were like zero bitcoin um or close to zero bitcoin at the time on top of starknet. Now I believe there's over a thousand that came in over the past month and the numbers rising uh quickly with people who are basically generating yield, you know, borrowing against their bitcoin and believing in this financialization layer. Our mission is to expand the Bitcoin economy in a way

that is compatible with Bitcoin vision. Um, I think Tradfi will be interested in some of that at some point and that's fine, but I don't see ourselves as like uh uh, you know, I I have Okay, I'm the kind of I'm like sort of a blockchain maxi in the sense that I think it's really great that we have a lot of different teams working a lot of different stuff. So, I think Canton is great. I think Salana is great. I think Ethereum's great. Uh, all the L2s are great. Um, you know, and I think that very few of the respectable teams I know are, uh, you know, scammers or shitcoiners or whatnot. There are some of those, but like I have a lot of respect for everyone who's like, you know, dedicating their life to this stuff. We are going after expanding the

Bitcoin economy. We are very much in the decentralized regime. Everything is so that you own your life. So, uh, but and I think Tradfi may want some of that and we're open to to that as well, but we're not going directly after Tradfy in a similar way that, uh, to what Canton is very successfully doing. >> Yeah, if I could add to that, I think, you know, definitely Bitcoin is an asset class and that's something that Trafy is interested in. You know, any asset class that is something that their customers are are interested in. Um I do think trady has you know stratify has different requirements and different trust assumptions than than you have in something like Bitcoin where you know Bitcoin does not accept any type of authority any type of institutional that you know there's a political ideology behind Bitcoin maxis which is complete

separation between you know money and state money and institutions so you need different solutions for different problems and and that is a very different problem statement than you know from the one that trifi uh are trying to solve you know when they're building when they're building friendly services, you know, institutional services for others. [clears throat] >> How do you guys think about the we've talked about like a lot about the chain layer and like the actual network. How do you guys think about the application layer? And one again, many dumb questions by me in this podcast. I'm curious if you can just go get can you just go tell unis swap and hyperlquid and a hey deploy on my chain which is and now that you know transactions on unis swap are private or do you need to build these applications from start to

be privacy first. >> Yeah I think lift and shift there there are things that definitely can lift and shift. They're more like the building block stuff. So the stable coins the the asset classes themselves the the way that that works for the issuer uh on Kenton is very straightforward. So if you're if you're circle issuing USDC on Kenton USDC looks the same to you as it does on Ethereum you see every account every holding every transfer you you know for you your your life is the same so that that's very straightforward process and we have a number of assets rotating into the network uh to get that benefit for the holder they see what's happening in their wallet in their transactions and everybody else is not privy to that information so you get that immediate benefit of being able to

do private transfers and private you uh uh basic transactions and that's very much a near lift and shift sort of process. When you start to think about what does it mean to build an onchain exchange there you have some opportunities to make some new decisions. It's not straightforward that you would do it exactly the same way that you've done it before. Just like again to to go back to the Salana example, they didn't just copy AMMs exactly the same as they were on ETH because they had features that afforded things to do much more clubbike activity. So coming to Kenton if you're running uh lending pools, trading dexes, per etc. It gives you the opportunity to think about what should be public information or what benefits from being

public, what benefits from being private, how would I consider doing that? And you have a lot of opportunity to think about that. The more obvious thing to me when you start to think about um uh the perplexes or anything else that are trading oriented being on Canton is that the the really sensitive information is where people have their position from and what their leverage and their stopout level is. So being able to protect the information about someone's collateral and the amount of risk on their account seems like an obvious straightforward place to start. uh hiding the orders may save you in some me scenarios but also may not necessarily be the worst thing to keep public. So it kind of depends on how you want to think about the trust

assumptions of the exchange. Uh so we tend to focus more on what should you protect from the collateral perspective and what you have at risk from trading not necessarily the trading although you could mix and match and do whatever you want but it most importantly you have a design decision to make. show, can I ask you about um there was an Danny Ryan from uh Etherealize uh because you know I I bring up Etherealize because they're also going after this institutional market and they said uh Canton relies on honesty assumptions trust that counterparties will delete sensitive data that smoke and mirrors privacy. I'd love to just give you the chance to again this is me not being smart enough to know what's wrong here. So you you tell me like what

what's wrong with this statement. >> Yeah, I mean there's a bit of the the asymmetry problem. I actually don't know what he meant. Like there there is [laughter] no you're not trusting in the honesty and and anyone who's looked at you know at how canon is built would would know that. So it's kind of hard to reply other than my my reply which was like you don't understand how canon works because there are no assumptions. I >> I asked people for some like some FUD on Canton and Starkware going into this and this is people people send me well I think Etherealiz said that they're smoking mirrors. So that's that's really all I got.

>> No I I don't know. Maybe a great guy. I I just don't know what he meant because because there is no again I'm trying to see yeah there are no honesty assumptions it is complete complete Byzantine fault tolerant >> um minimizes who has what data so uh >> my my my expectation I mean this is me reading between the lines again we don't really know what they're saying but there there's this common conflation of privacy and anonymity so if you're saying well you know in my example I just gave before about well circle knows what you did yes we've actually designed specifically for that requirement. So, it's not that Circle's going to delete your data after the fact and pretend like they don't know what you did with USDC. In fact, they're explicitly supposed to know what you've done with

USDC. So, I think maybe if you if your assumption is that privacy means anonymity, then I guess I understand what they're coming from. Like, I guess as a holder, you're relying on Circle to pretend they didn't see it. But that's just not what we're solving for at all. We're we're solving for that asymmetric view like we talked about before where Circle knows everything going on with USDC at any given time. It's not about anonymity. It's more like chase.com and the internet. So that that maybe that's where that comes from, but I'm not. >> Yeah, that that is a good point. I I mean in Kan applications, you typically assume that the the service provider that is giving you some service is kind of similar to a web two service provider. They see the data that is that pertains to the service that you're

using. And again, that's not something we we did not try to solve for like, hey, I can move money in my Chase bank account without Chase seeing that. It's just not it like if we wanted to solve that you know maybe we would add zero knowledge produce maybe we would add something else that you know again the distribution mechanism and everything is is really built for that but it's not a real problem it's an imagined problem so so or at least you know for our users it's an imagined problem so um again I don't know if that's what he meant but you know >> yeah fair enough um guys as we think about wrapping up I want to paint a picture of the the future a little bit um it feels like Um what happens in crypto is we move things are slowly what's the quote slowly then

suddenly and all at once or something like that right and it does feel like that's how crypto progresses and DeFi nothing was happening nothing was happening nothing was happening boom DeFi summer DeFi is a thing like onchain purps nothing a little bit little bit boom hyperlid onchain per is a big thing feels like we're kind of on the precipice of that moment for privacy how do you guys think like what is the big driver there. What is the thing that's going to make it go boom basically or make it go 10x or 100x? I'd love to just kind of start painting a vision of the future here.

>> Yeah, I would flip it. It's not the big moment for privacy. I think it's a big moment for real W for real world assets. And the thing that unlocks that is privacy. So I I do think we're going to see in the next few years a huge boom of real RWAs at the scale that we're used to seeing in the financial world coming on chain. And the unlock for that is that you can actually now do consensus with privacy. Ellie, how do you think about this? >> Um, so as I said uh before with blockchain um sort of the mimemetic value capture often sort of comes first.

Well, in this case, you know, as a Zcash co-founder, you can't say that the mimemetic value capture came first. It came after a very long time. And very surprisingly, like uh I didn't expect this. I think many of my other Zcash co-founders didn't expect it, but we're I'm I'm very happy that sort of uh [snorts] you know the collective uh mind share now is is actually going after or interested in something that actually is a very important you know basic uh human value related to human dignity and to true sovereignity of people uh empowerment of individuals. So how will it play out? Well, there will be this mimemetic um value capture and um a lot of teams are going to um add a

whole bunch of privacy features and products to their what they're offering. So, as part of our, you know, mission to expand Bitcoin GDP, of course, privacy, as I mentioned, especially for small and midsize companies, is start being it starts being important. If you want to, you know, transact within this uh Bitcoin economy, you're going to need privacy. So we're going to add a whole bunch of privacy features and of course as a Zcash co-founder and Starkware CEO I'm very happy that s you know that finally I can justify and explain why we're working on privacy. I was waiting for a very long time for the markets to also appreciate it. So okay next first comes the mimetic value capture. Right now everyone's talking about it which is great because it's really important.

It's better than memecoins uh more valuable more important to society. Um, a lot of teams are going to be adding meaningful features. I mean, you'll see some smoke and mirrors and some, you know, as as usual and some claims that aren't founded by anything, but you will see like real serious work by serious teams. Um the true real unlock will be when there is decent UX um that makes it easy enough to operate with it on things people in this case probably more companies who care about crypto are going to start using and uh I would say that you know the direction we're heading with our privacy efforts are exactly towards that we want things

that small um companies and people who are who understand privacy uh individuals like retail and power users um and then small companies who want to operate on crypto like my own company you'll give them just the right kind of privacy with a good UX to do as much as they can uh there will be some UX cost like it's always easier to do things fully transparently so there's going to be some trade-off or a bunch of different trade-offs and we plan to explore a lot of them so I think the true next unlock for privacy is decent UX X privacy with decent UX. That's the big thing.

>> I I don't know. I'm a little bit uh I'll talk my own book a little bit more. I think it's very very similar to what took place with Salana five or six years ago. It's a topic that everyone has spoken about, but very few had the gumption to show up and be sufficiently different to achieve. And having rails that actually deliver on the thing that people want at scale, reliably, and safely means that I'm not a big like build it and they will come sort of person, but we saw that that really played out for them. There was a lot of demand for a feature that for a feature that a lot of people like to push off and say, "No, that's a futuristic problem. We have enough block space today." And it and it just really shaped the way people thought about what they

were going to do on chain. combined with what Shaw said before, there is a big big wave of institutional demand to use these systems and they are very aware of how important this data permissioning is to them. There are a lot of people talking about, you know, trillions of dollars of TVL of stable coins coming for things like international remittances and FX markets and payroll and and I always say, yeah, absolutely it is going to happen, but there's only one place eligible for it to happen at scale. So, you're right. it's coming, but you guys, you know, generally speaking, in these other ecosystems, don't have the features necessary to really to really adopt it. And you're taking so much existential risk to use uh ZK and FHE for RWAs today. Um it's

well worth it when you're talking about the crypto ideals that Ellie was talking about before. it's worth the risk. But if you're a stable coin issuer, uh the types of risks that you're taking in the tech, I I think are very very hard to justify and explain um to your regulators, to your investors, to your holders. Um so it it really is about um making it possible to actually deliver this feature at scale is is one of the big unlocks. >> Yeah, guys, that's all the time we have. Ellie show Eric, I appreciate you guys. Um thanks everyone for listening episode four. Hope you guys enjoyed it. Uh we have episode five coming out soon.

Thanks everybody. Thank you. >> Thank you. >> Thank you.