ZkPodcast: zkSync and Redshift: Matter Labs Update

Transcript

[Music] welcome to zero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me Anna and me Fredrik this week we're sitting with Alex glue coughs key from matter Labs welcome to the show Alex hi Anna hi Fredrik thanks welcome welcome back I suppose yes Alex has been on the show before actually last time you were on the show is Alex and Alex from matter

laughs your colleague Alex blast-off was also here true I think it's definitely worth listening to that episode before this one because we're not gonna spend so much time on kind of you and matter and roll up and a lot of the sort of basis but that said I think we will do a quick kind of summary of what we had talked about in the previous episode so yeah last time we spoke we talked about matter labs work on a version of Zeke a roll up I remember you described Zeke a roll up as sort of an overarching category of constructions and you guys were working on on yours so I'm very curious to hear what's new since then so is the Corolla

is actually a name of architectural approach to scaling talk chains and we were working on the specific implementation of Izzi Carol up for ethereal and we made quite some progress over the last year we had to review our approach our particular architecture make some beauts changes and it eventually led us to the full-scale version of the vision which we call the kissing so originally you had this idea for something called Franklin is Franklin now is he kissing yes that's their name okay so not only did the architecture change but the name changed as well got it

so then I guess the question is what then is the case Inc exactly well the kissing is the completion of the vision sites what we call the this is the the full package of how scaling will work on layer 2 blockchain to have all the useful properties we want from a scaling system Ubud we want trustless security without relying on any assumptions but we also want some properties which will make scaling useful in constructing in the in the context of mass user adoption and if we talk about mass user adoption we are speaking about people who are used to

services in online banking in web ecommerce which are very different than what from what we have right now in blockchain the things are fast things have instant confirmations people take their privacy for granted or at least they don't assume that all the transactions are going to be visible to all their friends and relatives and so on so we want all these things to be the part of the package and this required some more trade-offs and more additions than just a viewer roll up and this is what crystalized is the casing is this at all related to sinking of a blockchain in the way that we typically

call it like there's warp sink or fast sinking you know I've I've seen Zeke async being mentioned in the context of replacing those is that the case at all or is it more like reinventing the whole system and and that's how you avoid having those things in the first place well that's just a way for us to emphasize the importance of being fast for instant confirmation spoiling just sink and in you're in with or with the transactions you want to make um so it has less to do with sink in the blockchain in fact see casing is very light client friendly so the users will

not need any heavy computational or bandwidth capacities to be able to verify the casing transactions and be absolutely sure that they are correct so this is similar to the approach that made me solo or coda takes that you get a snark that that tells you you are on the right chain and you like this is the state route that you can trust basically exactly this is similar to those approaches because with easy key snarks with zk0 knowledge profess in general 16 journals proofs we can have a very short proof that everything is correct we don't have to verify the completeness of the entire blockchain because we are a layer 2 solution so we always rely on

the security of underlying layer 1 and if we're a layer 1 is a theorem or a polka dot and you still have to do all the work necessary to verify that chain so we cannot replace that but everything on top is very succeed and easy to check I actually a question about your question Fredrik warp sync aren't those things that isn't that something that happens more unlike layer 1 like this yes well I mean it's something that syncs layer 1 yes but whether or not it happens on layer 1 like warp sync is not a an official etherium protocol so it's layer 2 in that sense it's not officially part of the etherium spec and it's you know

passing snap state snapshot around on the p2p network but this is a massive now like 10 gig snapshot or something and it's yeah heavy to pass around passing around just a snark instead would be a lot easier awesome also I I realized I just used layer 2 potentially incorrectly I know that from our show that we did with 10 burn a we actually try he redefines sort of the layers and I've actually heard it redefined a few different ways so there's like layer 1 layer 1.5 layer 2 layer 3 where do you think like I realize these are you know changing templates of how to how to think about these projects but where do

you think ZK sync is well I have a strong opinion that this is hilarious ok because you actually don't add additional layers of security on on on a system you still let all the transactions verify being verified by layer 1 so it's essentially an extension of layer 1 it's not quiet layer 1 layer 2 but it's not layer 1 either so we put it in between I what what exactly is it is it a library is it a piece of software this is actually something I've never fully gotten also about roll-up like is it a spec is it a set of rules so it's a protocol it's going to be a platform you can think

about it as an extension of the basic block chain so from the users point of view it will be very similar to just using the underlying blockchain so let's speak about the theorem or theorem you have some accounts you have transactions you have code which you can put on these accounts and make them summer contracts and all of these things will be possible on the casing just gonna be a separate address space so from the component point of view is the key sync is a separate network of nodes which generate blocks which hold this state because somebody has to store the state of chain if it's not been stored on on layer one

which connects to the layer one network and broadcast some transactions to make state transitions but apart from that it leaves a separate life hmm and this is why we have a we will have a token to govern the participation of the validators of the separate network got it that was actually my next question was like is this then like does it have its own token and you just mentioned validators will it have a validator community as well they will have will we will have a governing body as a smart contract of some kind where you use your tokens to vote and you use your tokens to participate so you will need to get some tokens in order to be part of this

community because we cannot make it permissionless since we need to govern the way the blocks are being produced the sequence of the blocks but we cannot make it permissioned either because then it's gonna be a centralized system it's very important that the system remains sounder should persistent be censorship resistant you need anybody to be able to participate so in order to balance these challenges we introduced talking but this token is not gonna be something users the end users have to deal with because we want to don't want to introduce any friction on the anterior and users is going to be completely transparent they use just the same way the they I used with normal chance

you mentioned the participants of this network are responsible for data availability like the storing this data this state somewhere if it's not on layer one is this an incentivized action then is that incentivized by those tokens or why why would they store that well we need to generate blocks quickly and I confirm transactions quickly and for this the validators need to keep the complete state in some place where we which were taken quickly access and this is of course a incentivized action because the validators earn fees from operating the nodes but the end users can always query the validators to get their state or if the validators are not

cooperative they can always revert to the full archive of the underlying layer one blockchain right so it is incentivized but not as aw and not as a separate entity you can just join the network as a state store and you join there as a validator and presence we try to keep the number of roles low for now we only have two roles the violators themselves who produce the blocks and we also want to introduce Guardians who will be something like incentivized full node users only have one purpose to check that the validators do not from censorship yeah like a fisherman yeah

well more we call fisherman something is this is this token and this cause I guess it's all an ER c20 built on ethereum is this a standalone blockchain so these will be this is a standalone blockchain but we will be able to bring all air-sea 20 tokens onto it oh and seamlessly oh yeah because you actually have to bring how do you do that what is that then is it a well it's a fork of aetherium no it's it leaps on a theorem we have a contract and a theorem so in order to have some funds in the easy key sink you first have to move

them from a theorem to this mark under then they appear magically on your account in the case sink and then you can transact inside the casing and while you transacting they just remain on the same smart contract in part and controlled by the casing is this like a bridge to something I was gonna say let's break down the magic a little bit so you know how do you build the blockchain is it is that I mean now a fork of a theorem in the sense of forking the network but fork of like the guest code base or is it something that you build from scratch and and yeah is it bridged or how do you actually you know confirm that those tokens exist on that account on anything well that's very simple we have this smart contract

which holds all the funds and the smart contract also holds a state the state or commitment to the states of a Merkel root of the state and the state keeps the track of all the balances in the casing so whenever we have a change in the casing which is submit a transaction to etherium and change the state and update this merkel route of the state so the state and all movements of all assets are constantly being tracked by aetherium itself we can always call back to theorem and prove that we have certain account in certain certain balance and certain account it's just you it requires a separate blockchain to

have all the different transactions being compressed into into separate blocks and we post a single state change per block on ethereal while the block can contain thousands of transactions and I remember what we talked about in the last episode because I remember thinking well that's so weird if you're still writing so much to the main chain where do you actually find savings and I think what you had described was it wasn't in storage it was rather in the transaction called a no data or something exactly so in order for us to keep the state correct we actually do not need to publish

anything we just rely on the magic of zero knowledge and we submit a short proof that this new root hash is a correct representation of some state however in this case the users will have to rely entirely on the evaluators who keep the state in order to know what's what's going on because they while editors can withhold the Delta then the new changes and then despite the route has been correct nobody will be able to prove that they own some assets in in this hash this is what we abuse the layer 1 for which is broadcast the data through the transaction input on layer 1 this way we make it available to all the full notes for crafts and turn to all the

users who want to listen or who want to retrieve this data later so this is just a recovery mechanism for data going back to that question now what is that blockchain like is it your sort of had suggested it might be like the death code base for it like what what is it maybe it's a separate node written from scratch in rust which holds the state and which has a separate network which exchanges blocks and transactions and then we have we come to consensus what's gonna be the next block and then this block is being broadcasted a little everyone was there something special in the way you built that like did you need is it a sort of could you strip out a lot of the other things that normally

would go into building a node or yeah like is it I'm trying to yeah I'm also always curious about why people make the engineering choices that image and and I think why build from scratch is this a valid point when there are already a bunch of nodes out there or frameworks even now for building block chains so it's always curious to hear why people build from scratch or or do what they want to do but I think it's I think it's cool to have done that but I'm sure it's a lot of work to know well of course we're gonna use the components so for now we don't have the complete implementation of the decentralized

nodes we focused on the most complex and difficult part which is your knowledge prose circuit the the availability the interaction with the blockchain the decentralization who is something we're still working on and of course we're use ready components so we're not gonna write our own via to be layer we're not gonna write our own consensus mechanism and so yeah I guess I wondered if if because zero knowledge proof sands in case narcs are at the heart of it like did you have to keep that in mind in the building of this part or is like you just mentioned a circuit designer circuit what is it what would it be in the note it's well this circuit is what we call these the program which converts to zero knowledge pros well it's the this is the

arithmetic circuit or algebraic circuit and every time we produce a new block we have to produce the zero knowledge proof of our circuit which proves that the state traditional is correct so of course we have to take this into account apart from that the consensus and peer-to-peer network part is not that much different from other clock chains we just make different trade-offs based on on some properties for example in layer one block chains your highest priorities security and decentralization so you take certain choices there and

you you want to make sure that consensus mechanism you use is secure if you use proof of stake then you solve all the subtleties of proof of stakes there's just nothing at stake and long-range attacks and so on in our case we can rely on layer 1 already existing for arbitrating different situations so we place much less security on our consensus it's a valid point though I I know exactly what you mean because we we have the same discussion and polka dot wear pair chains are just responsible for their censorship resistance essentially and that is a much simpler

thing to secure than layer one like the real a chain precisely so we just take use of the bility to contact the layer one and to do some operations there and to punish lis misbehaving validating stairs our design choices are responding Li less difficult but also because we solve censorship resistance in a different way we can have a higher requirements to validators concerning the resources so the master wants block chains such as the theorem or polka dot and something once neat to make sure that the users can run full nodes which operates

smoothly under low resource requirements from ordinary laptops of users we don't need that because our users all use live clients and our fishermen or guardians can only monitor a fraction of transactions they don't have to monitor all of them it's much easier for us let's say let's try to say ok all the validators have to have powerful servers especially because they need to generate your knowledge process which are computationally intensive anyway so this these are just different trade-offs you just mentioned that if there was any sort of I don't know if you said conflict or if there's any issue a resolution would happen on the main chain in terms of proof of stake because it's gonna be a proof of stake for the validators so whenever they have double

spent or double signing attacks we can always resolve this on layer 1 instead of trying to build a complex consensus protocol which results it in in itself how though how would they how would the main chain know that say if there is an equivocation and some validators signed two conflicting branches of a block chain you can always present both signatures till they are one okay you present them both whereas for a pure proof of stake block chain where you have to resolve situation on the blockchain itself it's a bit difficult because now you have to prove which of this two branches is actually the correct one but what what would happen if they both presented us to the main chain what happens well then you would

slash the validators who perform at location but how do you know oh like how would you know which one is right and we'll it depends on the rules how I suppose the whole world so for example we have certain sequence in which leaders ought to be elected then we know that this leader is the right one okay excellent that song but essentially we can just slash all we can just honor all all the changes by equivocating actors and continue from the previous state which is known to be credit is this where you imagine that like Guardians play a role in finding these things and reporting them to the main

chain and like submitting in those transactions or actually not really because in our case it's it's really really simple the consensus on the casing is only needed to decide what's going to be the next block once we have the supermajority of signatures for the next block anybody can anybody from the validators can submit it to aetherium or to the aware one which were using and then if this block is being mined then this is gonna be the next block because the correctness of the block itself is secured by zero knowledge pros so we only need to make sure that there is no that was pen so whatever block is is has been pushed and was mined on everyone is is fine we only need guardians to make sure that there are no transactions

which have been distributed by users which are not being included in blocks for a long time yes that would mean mean that we have a case of censorship if we have a lot of capacity and we assume that we will have a lot of capacity because of our high throughput volumes of thousands of TPS there is no reason for validators not to include these transactions so we can then subjectively assume that there is a censorship going on and then the guardians who noticed this can stop forwarding for the validators who engaged in this activity so essentially going back to the conflict resolution

if there is an equivocation there's two blocks produced they're both submitted to the theorem Network aetherium then decides which one is correct than to include and rejects the other one or exactly and we don't care we don't care which one wins what's important for end-users is that they get their money back so how the way the the consensus is being used is whenever you submit a transaction you're gonna get a receipt from the validators who promise you to include these transactions in this transaction in the next block and this receipt is going to be signed by 2/3 of the validating stake and now if we have an equivocation then you are eligible for

compensation for this transaction which you can which we can always attribute to malicious validators and we can always make sure that there is enough money validators attribution to to pay you back from the security deposit which is going to be huge so of course you always have the risk that there is a run on the on the security deposit and I think the the valid it has created a lot of fake transactions but then they're going to lose a lot of stake without having any profit from it yeah it's very similar to double spending attacks on proof of work block chains which are always possible

if you spend enough money but it just so against the incentives of any rational actors that is unlikely to happen so if you have so you can always quantify it and say ok to revert the last ten blocks of Bitcoin or aetherium you have to spend this much money now if the entire volume of the transactions throughout this period is much less than the amount of money need to spend on a double spent attack it's very unlikely to happen it can only happen if you have some state actors who are trying to mess up with the blockchain that is an entirely different story who are who would be a validator for Zeke async who are these actors oh

the viola very anybody can become a validator who has enough resources to generate the proofs which is actually solvable because you can do it in a cloud so you can always rent out capacities on Amazon digitalocean any other cloud provider and you just need to purchase some tokens which are going to be available in a completely permissionless setting because they're gonna be sold on automated auction as well as from from other players and you just take those tokens and you can become a valid until you get the slot to produce your blocks will there be like are you planning on doing sort of delegated proof of stake as well like

having or is it is this a simpler proof of stake that you're thinking about we will have something like valid delegated proof of stake with guardians because the Guardians will delegate their their votes to the validators who they think are honest God and interesting thing about guardians is that they do not need to secure ultra hardly there their notes the Guardians can run their notes on ordinary laptops which are not secured or on any in cloud instance because there is no slashing conditions for them because they could they can never incur harm to the blockchain the validators

will be solely responsible for the security bond from which the transaction receipts compensations are being covered so the only thing Guardians decide is just who is going to be the next validator and the worst thing which can happen if all of the Guardians or majority of guardians is being are being hock is that the chain will stop for a while until the this guy's hold out their private keys from cold storage and change the the hot keys on the notes I mean I suppose if all of the Guardians delegates to a validator that is or a set of validators that are censoring

then they can essentially ensure that the network keeps censoring that's sort of the worst case basically these are absolute correct yes before we go to talk a little bit about what you've actually built in and when you're planning on building I want to go back a little bit to what you have built so it sounds like you've built essentially the state transition function for your chain and your you said yeah we will leave reuse networking consensus 1 over from from something else do you already have in mind what that's something else is on well yes we are considering three options substrate is one and link components from substrate tender mint because it's the only proof stake a

block chain which is currently in operation and we know from real life that it works and then hot stuff from Facebook because it's optimized for the use case which we actually have it has the low latency its dollar able to increasing of latent self of the actors but we actually assume that the validators are gonna be powerful just as Facebook is him set for fall day about it yeah but would you with hot stuff I mean this there is there on you know you still need to solve networking and everything else all the other packages is is there a thing that packages hot stuff already maybe like something like an SDK yeah I think they offer some

stuff but we can also also replace the components so we can go for lis p2p and we're building on the rust stack because we believe that trust is most superior language for security applications as of today and we prefer packages which have been built in rust and which actually have been tried in production because otherwise we're on a risk of doing a lot of debugging or already code so one of the things that you are sort of billing ZK sink as is a it's very UX friendly or like it having a focus on UX what does that mean actually in this context that

means first of all that whatever we design we always have the end-user interaction in mind so we imagine how the users are going to actually use it in some specific circumstances and then we work our way back from there to see how we need to design software API and the user interface to match this needs so for example you want and you take the case where users want to buy something online you just want to press one button confirm its bought and they have immediate confirmation it's really simple but it's hard to build the system which will actually fulfill this

problems but I think when I hear the word UX I think like user experience like user in this context is not like the person pressing the button are they like I realize they might be built they might be using something that's built on seek a sink but seek a sink is not the final connection point to the user this is correct but we were thinking from the end-user perspective and then we think all through this layers if we want this user experience for the Anteaters what API should we offer to the developers who can build this application and what should be the SDK looking like and if we have those api's what should be the

consensus people can like in order to be able to support them and so on so we can all the way back step by step do you also care about like - developer experience in this case though I've heard these two fight like sort of defined is slightly different absolutely we're we're very inspired by companies like stripe and Twilio and bunch of other Silicon Valley companies who have this thing that very stuff just works as a developer you can rely on them you just open the documentation and you know that you're going to be able to find whatever function you need you're just gonna try it out and immediately will work and this is our very very very important priority in our development

lifecycle to make it like this but we're gonna be no company which offers stuff which just works I think you have a point in the split of uux and directs might not be completely clear from layer 1 or layer 1 point 5 perspective where you know yeah it is an end-user really going to use this thing but I think if I worse was building with UX in mind in layer 1 I would mean it to be like I'm building something so that someone else can build something with good UX and if I'm building with dev X in mind then it's like so that someone else actually can build something good you like the

tools that they are able to do that with a reasonable time and experience and here it sounds like UX like the core UX benefit here is speed just the ability to very quickly transact and know that things are working correctly this is correct additionally to this we want explicitly expressivity well if this is more developer experience stuff but we want developers to be able to build interesting applications which users actually want hmm I'd say it's not enough to just have transfers you want smart contracts and you want them in some you want

interaction within this more complex and so on ah that's actually that leads to another question then would if you build on ZK sync do you build fully on ZK sync or do you build on aetherium do where do you deploy a smart contract you would deploy it on ZK singer oh really ok it's a smart contract platform at the same time yes of course that didn't occur to me before this okay well that's the functionality was still working on because we're gonna release the framework for writing zero knowledge proof which will eventually be supporting smart contracts this month it's called sync framework and it's a rust like language for defining their

knowledge compatible programs it's essentially a subset of frost I guess the question is what does that compile to does it compile to R 1 CS now it will combine to a virtual machine which then can produce our one CS and then which can also interpret the code interesting so our goal here was to build some programming environment which allows anybody to create zero knowledge compatible programs without having to understand the nuances of our 1cs programming and so that they can build these programs in an efficient way without having to do a lot of jungling and dealing with branches and some some

complicated stuff which r1c has limitations impose on you so before we move on to talking a little bit more about like the actual snark construction I had sort of one last question about CK sync and that is is there a reintroduction of like a plasma like economic game or economic mechanism in the writing onto the chain so we don't need any challenge games because we we are not relying on fraud proofs in the case Inc they being based on zk roll up architecture we have proofs of validity yeah so every transaction including the block is being verified by layer 1 the

only exception to this rule is the transactions in the fly which have not yet been included but we want them to be instantly confirmed to the users so for this we use circle transaction receipts where the operators just make a promise I promised included transaction on our next block so this promise is of course less strong than one the the validity proof once we have the transaction closed in the block and the journal which proves generated which takes approximately 10 minutes right or it will probably go down with a better provers and better proving hardware but for now it's approximately 10 minutes so

during this time you can use your transaction receipt to rely on it and say ok I trust the validators to include it and if they don't then I have to go on the main chain and challenge them and claim my compensation or at least claim damage to them and slash their their security deposit but of course it only works for smaller amounts if you're about to if $1,000,000 they're probably just gonna wait ten minutes it's still faster than Bitcoin and then you can be completely sure with guarantees backed by the layer one itself so tying into the discussion about smart contracts I think next natural question there is well we know if we have an r1 CS circuit

that gets compiled into a zkp that usually depending on the snark needs a trusted set up so the question is does then every smart contract need its own trust it set up or do you have some sort of Universal set up in your smart well we have several different constructs which emerged last year some with Universal snarks with Universal trusted set up which just needs to be done once for all circuits some others which do not require trust set up at all so the example of universal snark is Blanc and Marlin examples of completely trust less setup is Starks and redshift which we

created last year the trade offs are always in the context of proof sizes so the trust less versions tend to be much larger and proof sizes than the the ones which you have trust to set up which essentially compresses information in some way so we can we rely on this external common reference string as a sort of dictionary in from information theoretically we can somehow outsource information over there you just mentioned this term redshift this is your start your actually your snark what is it is it a smoker a stork you just

kind of put it in the same category has this got your own terminology within the great minds in the space so we I'm I'm gonna follow the elements asan's approach and say okay snark is success on interactive argument of knowledge which is a great term which encompasses all of the system's ass extent means that it's exponentially less computation to verify the proof than to make make the proof or even to mediate namely compute the reputation Starks are 16 transparent arguments of knowledge which could strictly speaking reapply to redshift as well because that's what it

is it's transparent but Starks are traditionally been reserved for fry based Starks something stark where's building so we probably are better off just calling a redshift a transparent snark amazing it seems to be the trend in other things as well we're talking to fractal and they also called everything a snark not a stark despite being transparent huh so then what is redshift and where does it come from what do you take from to build this so redshift is a r1c s by snark see it's it's a snark which takes r1c as a written circuit or program as input and can generate proofs

in a transparent way it is derived from proof systems which are based on polynomial commitments where we replace the polynomial commitments from bearing based constructs with the one which is based on fry so what you do use fry we do use crimey okay okay okay but then it wouldn't would not then make it a stark according to your definition justify well Starks is just a very specific name for a very succinctly is not our one CS place I said we want to avoid that and for people who are who heard of those terms and have certain understanding of

Starks redshift uses our one CS based earth mutation whereas Starks have a very specific approach dramatisation for which we don't have yet many many convenient tools and they are still being developed which are potentially much more powerful but it it's just very difficult to build them as of right now and will be probably a bit difficult to build them in coming years whereas for redshift we can just take any existing r1c as circuits and gadget libraries and construct proofs or import existing circuits and construct proofs for that you just sort of mentioned before a few different

snark constructions like plunk and Marlin are those also ancestors of what you're doing or are ye is your ancestor an earlier snark so a redshift is a transformation we can take any proof system which is based on polynomial commitments oh I see it's Blanc or Marlin ok and make a transparent version out of it I'm trying to picture if it's dealing with a comparable problem that like supersonics dealt with or so yes maybe in a different way supersonic is this is essentially the same idea where the polynomial commitment from bearing bearings is replaced by polynomial commitment on

class groups so it has a different set of trade-offs we just so we our estimate is that supersonic is going to be difficult to use in the context of a theory on blockchain for example because it's going to be more expensive to verify the proofs on aetherium I see so it sort of falls into the same category but you built redshift specifically for this use case which is building on it there you're like you're always using etherium 1x as your main chain and so everything has to sort of is a waiver on yes ok does that like so this is a new construction that you've made and you've

Specht out I guess are you for sure gonna use it or is this like you wanted to put this out there and it might be one of the things that you use we are certain we're gonna use it and there is a reason for this namely since we are not relying on bearings it's much easier for us to create recursive proofs so we can embed verification of other circuits into a compound circuit for a block for example we can verify that each of our thousand transactions executed some smart contract correctly this is interesting so this is Aaron I know in

the episode that we did with Isaac I actually asked the question and I realized in the Edit that I don't know if it was totally understood I had asked about like batching versus recursion but then I understand I realized that batching is also something you can do in a snark and by batching I meant batching transactions and not batching I actually don't know what your batch in a snark but you batch something else it's like a technique so there was these two things and what I'm at and what I'm wondering is are you doing could you potentially then do both you could do this like batching in a recursion way but also batching transactions this is actually a very good question and we're arguing both so

in on the top level we have the batching where we have a lot of transactions which are put inside one snark which means that this narc just grows in size we have more and more and more constraints we have thousand times more constraints than is required for just one transaction but then the recursion means that on every single piece of it we can verify something more which goes underneath mmm-hmm so yeah we're using both approaches right we batch verify many transactions I did expect to go I didn't realize that that was a property of redshift that it also enabled recursion you just makes recursion more efficient okay because

with you can still do it with bearing based constructs like plunk or grow 16 even but it just requires this very specific loops of elliptic curves which are which can be computed efficiently and we only know a few of them and they are much less efficient than the curves which are fast which are being used in current version of roll-ups that makes everything just much more slower and more expensive whereas with redshift we can have infinite recursion it's just the normal calls how does it compare to fractal does sound very similar

corrosive transparent well it can fit in plunk or Marlin the difference the redshift is we can have a hitter genius circuit which does different things and then still verify sufficiently so to be able to say which is going to be more efficient for structured circuits we would need to do the benchmarks fractal might be somewhat faster but we just have to verify this but for us it's important to have the ability to construct heterogeneous circuits at least as the second level of recursion because we want people to be able to write programs or smart contracts which

perform different things not necessarily repetition of the same operation many times you already mentioned the proof computation time and that it's roughly 10 minutes and in the current setting but what are the other properties of this system what's the proof sighs what's the verification time what does this actually mean in terms of throughput for the system so I have to make a shift correction 10 minutes is the time since you submit a transaction until it's been included in the theorem block so the actual proving time is going to be much less okay and we expect with the current efficiency of the progress and potentially using some GPU or other hardware acceleration we expect

this times to go well under one minute eventually yeah yes so for now the proof sizes of red shift are in scale of some kilobytes with the work is still going on so you can find some preliminary numbers in the paper and a print but we we are working hard on optimizing this as well cool so another thing that I'm curious about is using snort it it sounds like you're only using sparks a performance thing it's a the scaling solution not necessarily a privacy solution but what are the privacy

preserving properties of this system if you publish a smart contract is everyone aware of what that's my contract is of what people what functions in that contract people are calling is everything transparent or or what are the privacy preserving properties Tiffany so for now we're focusing completely on the scalability aspect of is a case sink because it's much more important to get a lot of people to use it first before you can benefit from any private preserving properties with privacy you always want a huge anonymity set if your anonymity set is is Vitalik Rotarians puts it your anonymity set is medium you actually have a small and

limited set and if your anonymity set is small you actually have anonymity set of one so you you actually want a lot of people first to be on on the platform then you can add some privacy in order to make it meaningful it also needs a lot more of computational resources and this is the second reason why we want to focus on scalability first to optimize approvers to make sure that things are really really fast so that the cost is negligible and then we can easily increase it by a factor of ten and nobody's gonna notice but it's the same in a very essential part of the vision of the casing to eventually offer privacy and it's gonna be going very

gradually so we'll first add privacy for payments not for smart contracts which is much more difficult then II further research is required to make smart contracts privacy preserving their I approach is like zegs II but they require very different way of thinking about smart contracts from the developers which is gonna create another it's gonna just raise the barrier for entry for developers slightly higher which we want to avoid in the beginning but eventually we believe in privacy owned by default in the casing because anything else introduces a lot of friction for end-users and our goal is from the beginning to be a very user

centric in new york's eccentric platform so things must be very simple you don't want your private transactions to be a lot more complicated and cumbersome than normal transactions and we know that some friction will have to be introduced but if you have different layers so for example if you have to use some mixers additionally to your normal operation this is gonna be very very inconvenient and like lowers your anonymity set further down so we think that it has to be a part of the basic features I mean we talked with Aztec about the fact that they were planning on at least exploring this idea of building private smart contracts offering sort of function

privacy in the same way that sexy would but in a smart contract construct in your case could you use that absolutely so I think that with smart cards being separate and it is essentially separate different depths using different types of smart contracts we can perfectly combine that we can have public smart contracts for things like defy for example where you need some transparency and transparency is more important and you can have smart contracts from something like what at stake is building for different things for users who want to make private arrangements between themselves or

engage in some dark trading and so on so I think this is gonna be much less of an issue it's just the basic privacy for your personal finance has to be preserved at the platform layer and everything else can be learned layer 3 in our case I got one question from a listener Makara also known as bad crypto on twitter and she she asked the question how much TPS does ZK sync provide in both a test environment and production ready or close to it environment well we had a test last year on a theorem in production which produced 100

TPS and it was limited by the amount of funds we were ready to waste in this test it just was very expensive in our case the bottleneck is cerium gas fees not the zero knowledge production or the the full malt verification so we had tests where we run very expensive very large circuits and they clearly show that we can do like up to 10,000 transactions per second but we are limited by what we can publish on a theorem as a part of roll-up does that mean like in a test environment you actually can get more because you're not

necessarily working directly with the main chain we can get more if we increase the guest block limit of etherium so for because of this we can exactly tell what our throughput limit is gonna be so for simple transfers it's slightly above 2,000 transactions per second if we used the entire theorem blockchain obviously there are some other transactions on the theorem as well so probably half of this capacity is realistic but even if we get to hundreds of transactions per second it's gonna be comparable to levels of paper hmm so people handles or handled last year or something like 200 or 300

transactions per second so if we get to those levels we're gonna be in a very good position already so far like everything we've been talking about has been like eath 1x and building on top of that what does what does eath 2 or I don't know these other kind of sharded or multi chain paradigms coming out what does that mean for what you're building it actually doesn't change a single bit the the only thing might be different is that the gas cost will go down maybe maybe not we'll have to see so from the architectural standpoint everything remains absolutely the same

this is eath - this is Sifu yes what about like have you are you also looking at building like will ZK sink also be usable on cosmos or like with a cosmos zone or with a polkadot pair chain or with I don't know what the other words these are the ones I talked about the month it's perfectly possible to build the casing on other block chains rather than aetherium and we're actually looking into them we just want to see the concrete use case first we were focused on building something which can be used immediately today yeah and launching as soon as possible and once we see the demand on other chains we

will totally support them because the cost of switching the layer one chain is relatively low we just need to rewrite the smart contract part but we don't have to change anything in the vertical part in the notes apart from the interaction is with layer 1 it's an easy switch it would never be a shard though would it in itself um aetherium 2.0 has something called execution environments oh yeah which sounds rather similar to what we're doing because it's a separate execution environment for a different type of transactions but we have to see the final designs and I would rather abstain from commanding until we have something

which actually can be tested and we see and understand what it is got it yeah it's kind of become kind of questionable what a shard and aetherium even is because now they're talking about these execution environments they live on the they live across shards lives on the beacon chain but then they're like executed in some weird like spiraling fashion and auto balance maybe and it's kind of hard to even define what a shard is at that point but I mean you I think it's in a shorted system I think it's perfectly reasonable to think that there is a shard or like the equivalent of the capacity of one shard being taken up by a rollup system of

some sort and that that seems like the perfect fit actually then if you want really fast transactions or this kind of structure you go to this char then you do that there so I think we've reached the end of the interview I'm out of questions I don't know about if you have any questions not really no I think we've covered a lot of ground so thank you so much Alex for coming back on the show thank you guys as well as a pleasure thank you very much and to our listeners thanks for listening thanks for listening [Music]