zkSummit6: Challenging the Properties of Validity Proofs – John Adler – Fuel Labs & Lazy Ledger

Transcript

[Music] so welcome to the second talk of the day now we're going to be hearing from john adler who's going to be talking about the properties of validity proofs in the context of blockchain scaling do leave questions in the chat as he's speaking and at the end i'm going to do a q a so take it away john thanks uh so today i'll be talking about challenging the properties of validity proofs in the context of blockchain scaling so contrary to what was said before this will not be some sort of uh optimistic versus zka roll up debate or anything it'll be specifically

about how validity proofs and their properties mesh together with uh the base blockchains that they build upon yeah so a little bit about myself my name is john adler i'm currently with fuel labs and laser ledger at fuel labs we're building a high performance optimistic roll-up and at lazy ledger we're building a new layer one blockchain that is focused on data availability and ordering and separates out execution to the application layer which makes it maximally scalable previously i was a consensus where i did layer two scalability research and i wrote the first concrete description of the design paradigm that is now known as optimistic rollups so a brief overview of liberty proofs

versus uh another construction called fraud proofs i'm sure most of the listeners of this conference are more than familiar with validity proofs and their properties so this will be extremely short uh validity proof is really a compact proof that a computation in other words some function function on given inputs is correct and a fraud proof is a proof that some computation is incorrect uh which of course you know knowing that a computation is incorrect doesn't really tell us if it is correct uh so when you combine fraud proofs with a timeout uh you you have the scheme where if no fraud proof is seen within the timeout then you'd assume the computation is correct okay uh so now let's discuss can validity proof scale blockchains and

this is indeed a very interesting uh way a very interesting use case of validity proofs that has risen to prominence in the past couple of years really uh with the introduction first of zk rollups along with other uh things like layer one blockchains that use validity proofs and so on uh and you know what date it dates back to quite a few years ago uh generally the idea that you want to use this uh this compacting of some computation and verifying it very cheaply uh it seems like it might be a good way of scaling blockchains right so we want to know do they scale blockchains and do they give us better properties and guarantees done for example

using fraud proofs and the reason why you would want to for example use fraud proofs instead of validity proofs is things like approver costs and not having to make additional cryptographic assumptions so if you could have the same security using fraud proofs instead of validity proofs and the same other properties uh that would you know be uh that would take away most of the reason to use validity groups but not all so the answer is maybe which is which is a terrible which is a terrible answer but it depends really how do we define scaling and how do we define blockchain uh before before we know if validity proofs can do these things we need to know what scaling is and we need to know what blockchains are and what properties they have so first

what is a blockchain uh this will go blockchains first then scaling so blockchain is the data structure here's the picture from the bitcoin design paper with arrows in the wrong direction so blockchain isn't particularly interesting it's just the hashtag chain of blocks the blobs of data what do we really mean uh when we talk about what is blockchain or you know blockchain ecosystem and blockchain projects and whatnot what we're really talking about is this permissionless consensus that's what i really mean when you say things like blockchain there should be the ledger technology state machine replication and whatnot it's what is this what is permissionless consensus and consensus is of everyone agreeing on the same thing uh permissionless being you know you don't have to ask anyone for permission

to join the consensus process which of course leads to some problems because if we do this naively if you don't have someone giving out permission then you can have civil attacks an example of this is consider consider a system where you want to vote for the next president of some country and then you have a system where literally the only thing you need to do to vote is you just create an account online you just create a username and password and there's absolutely no verification that's being done or anything like that you know other than your modulo the site being permissioned uh there's no there's nothing a government issued ids uh permissioning this system obviously this would be

really terrible and you should never do this because it can be civil attacked anyone can just create a fake id if you don't have some way of metering ids or throttling ids so how do you solve the civil attack problem while you add some sort of sybil or resistance mechanism such as proof of work or proof of stake which are not consensus protocols under themselves rather they're just ways of uh resisting civil attacks uh and then you can layer consensual protocols on top of these simple resistance mechanisms such as the longest chain rule okay uh now how about blockchain censorship uh you know you have this permissionless consensus protocol this nakamoto consensus longest chain with brew of work

uh can a majority of hash rate arbitrarily change history or not change history in any way possible but change history at least within the execution rules can they change history and censor transactions for free within the rules of the longest chain fork choice rule proposed by nakamoto consensus and the answer is yes they can uh and the way you avoid this is the nakamoto incentive because nakamoto didn't assume that a majority of hashrate was honest and this is embodied in in the section on incentives you spend a whole entire section on this and the this is the whole reason that governor consensus works which i'll read

out here if a greedy attacker is able to assemble more cpu power than all the honest nodes he would have to choose between using it to defraud people by stealing back his payments or using it to generate new coins he ought to find it more profitable to play by the rules such rules that favor him with more new coins than everyone else combined don't undermine the system and the validity of his own wealth and there's an entire section spent on incentives and this leads to an interesting property which is nakamura consensus taken as a whole is subjective and specifically we'll focus on this last paragraph and the last part of the last sentence and the last part of the sentence he ought to find it more profitable to play by the rules such rules that favor him with more new coins than everyone else combined

than to undermine the system and the validity of his own wealth emphasis on this last part and what specifically is being described here again if we go back a few slides the cost of you know just within the longest chain uh longest chain rule of doing a 51 attack of arbitrary depth is is nothing it's free uh especially you know the marginal cost uh and the marginal revenue of mining blocks is about the same uh there's zero cost for doing an arbitrary length 51 attack so what nakamoto is describing here is something outside the longest chain fork choice wheel is some penalty that is applied through social coordination not something in protocol okay so let's kind of consider what happens if 51 or you know some

majority of miners do some long re-org let's say a one-week reorg on bitcoin what do you do there are different penalties that you can apply in this situation such as decreasing the price of the coin uh changing the proof-of-work caching algorithm whatever we won't really discuss what the specific penalty is but before you can even apply a penalty you have to convince everyone that an attack happened and within the protocol you can't convince anyone that an attack happened objectively uh one thousand block or one thousand twenty four block reorg looks like a 1023 block stale chain because some idiot was mining on some chain that he shouldn't have mined on because he just wasted his hash

power it's indistinguishable you need subjectivity you need some synchrony assumption there uh and this social coordination mechanisms mechanism that we can use to convince everyone that an attack happened that a 51 attack happened like a reorg we can also use this exact same social coordination mechanism to convince everyone that a censorship attack happened conveniently so this leads us to uh this this first blockchain property which is that over some long period of time you know in the order of weeks not not minutes uh enough time for people to source lee coordinate uh blockchains are censorship resistant uh where we define census

resistant as if a transaction pays sufficient fees here sufficient fees means uh you know they pay more fees than everyone else let's say not that you know they pay more than the standardness fees uh it will be included in all possible canonical chains within this period of time and blockchains have this property again because they are censorship resistant because this is necessary for the nakamoto consensus to even work okay so now that we know there's censorship resistance how can we actually model this when we you know if we if we want to see what the cost of things are and what not we need a model of this how can we model the cost of a successful reorg or censorship attack naively we can model it as the cost to mine the longer chain but actually not

really because miners will recoup the cost of you know mining blocks because they get the block rewards so naively the naive model is that the cost is free and indeed in protocol the cost is free but this is not nakamura consensus nakamoto did not describe a scheme where the end cost the total cost of attacking the chain is free he described a system where there would be some penalty left as an exercise for the reader that would be applied if something like a reorg attack happened which again to detect and convince everyone that re-org happened this is a subjective process so the neve model isn't actually nakamoto consensus it's a different conclusive protocol the correct way of modeling it is that the cost

of doing a reorg over some long period of time is infinite because the successful rio or sensor type attack will never happen okay and let's kind of consider a case study here uh to show what happens if we if we model uh we model our blockchains as case a uh where the cost of attacking a chain is free and where you just follow the longest chain rule as intended to quote the ethereum classic developers uh you know everything is working as intended you end up with this situation uh you can uh you know three three thousand six hundred ninety three block reorgs and you know this number just keeps growing every time ethereum classic gets reorged uh because they follow uh you know paradigm a

where there is literally no cost to doing a reorg at which point miners can reorg the chain to arbitrary depth for free and this includes reorganizing the chain all the way up to the genesis block thus stealing everyone's coins and apparently this is okay clearly clearly that's not the blockchain we want we want to be using okay uh property two uh blockchains and passive security uh where passive security is i can go completely offline for some long period of time i can come back and things would be exactly the way i left them do blockchains or again permissionless consensus protocols do they provide passive security uh let's do a case study of ethereum uh i have a contract at this address oh xbb whatever and at this block you know 1.4

million i deploy my contract it has a particular byte code you know particular semantics is going to do certain things okay so i block 1.92 million which is a bit under three months after i deployed it this contract ether which is approximately 12 million ether give or take was moved without authorization from the contract or rather there was no contract code that was executed that could have led to this ether moving and yet this ether was moved and it was moved because of this because of the dao hard fork uh that that contract address was the the dao's address uh uh and you know this this was applied through social coordination

so blockchains are definitely not immutable they can have things like state irregular state changes being applied so you can't simply walk away and come back and assume everything will be the same if you did this did this with a dow then you would find your coins under custody of the ethereum foundation when you would expect your coins to be under custody of either the dow contract if it was properly written or an attacker since code is law okay so you know you might say well ethereum this only applies to ethereum because the theorems of scam they did an ico blah blah blah well let's also consider bitcoin so 15 off codes were disabled in 2010 which was close to one year after launch so this was not you know before launch or anything

and any script that has uh one of these disabled op codes in it isn't a valid script so it'll always evaluate to false and therefore any coins that are locked behind a script that includes one of these op codes is completely unsuspendable so even through a soft fork uh we can end up with you know i have coins and now suddenly mccoins are effectively burned because i can no longer spend them even through soft forks and this doesn't only happen our ethereum and happen on bitcoin and a cap can happen on any chain so the second property or rather a lack of a property which is that blockchains do not provide passive security uh and this should surprise no one because again permissionless consensus protocols involve subjectivity and social coordination

blockchains are simply tools to facilitate social coordination they're not governed by math or they're not governed by cryptography they're governed by people okay enough about blockchains let's talk about scalability and scaling uh for for you know to start off this this topic uh here's a tweet by james prestwich which was uh which was uh uh uh it followed some previous tweets uh some previous uh tweets and threads on twitter about the scalability and throughput and so on of things like zero knowledge proof systems validity proofs and whatnot and draw-ups and so on charting so you know james here defines

scalability as being able to validate more transactions on the same hardware or rather like a higher transaction rate and throughput is processing more transactions across the whole system this is a pretty good starting point but the key thing here is the difference between scalability and throughput is scalability is a constrained there's like a denominator there which is the hardware or like some cost uh which is a very important point because a lot of blockchain projects will say uh you know we're super scalable we can process a thousand transactions per second ten thousand transactions per second but that's not scalability that's through but scalability you have to include the cost of hardware uh if you don't if it's easy to process ten thousand transactions per second just

require really expensive hardware okay so what is scaling more precisely uh and this is i think the first kind of concrete definition to this extent of the word blockchain of scaling and the blockchain con in a blockchain context that i've ever seen uh so there's no anna definitely said that this this talk should be it should be novel uh so this is probably the most novel part of the talk let's give a concrete definition of the word scaling or can we let's let's give a definition that's as close to that as possible uh so we'll define scaling as the worst case cost to run a node that can produce valid blocks uh and why do we want this definition and why do we

want to produce valve blocks why is just running a full node and verifying blocks not enough we want to be able to produce a new block so we can spend our coins uh just if we know all the pass blocks are valid that doesn't allow us to spend our coins uh which means that if we can't produce a new block our coins are burnt effectively right so we we need to be able to produce valve blocks and that is uh in in my opinion and this definition here a key component of scaling it's not just the cost to run a full node but the cost to run a node that can produce blocks and this is the worst case cost because of course when we meter our systems it always must be in the worst case especially in a blockchain context because blockchains are adversarial we

can't use average case okay so what specifically do we need to produce a block uh well we need a merkle proof for every coin we own uh but due to the way merkel accumulators work we need the entire current state essentially and to get the entire current state we need the entire chain history in other words all the blocks to apply every state transition uh and then once we you know once we applied all the state transition we have the current state which gives us implicitly american proof for every coin we own so that we can produce a new block updating the merkle uh now the you can get around this somewhat by having things like a utxo data model uh by not uh by not having uh state routes and so on uh but that

generally makes things complicated so we won't really we won't really discuss this well we'll assume there's some state commitment uh because state commitments are very nice all right so now that we know about scaling and we know our blockchains let's see how do validity proofs tie into this how are validity proofs used in blockchains and this is of course where the fund begins because you know we're at the zk zk summit here not uh the blockchain somewhat uh so how do validity proofs tie into blockchains and the reason we want to know this is that if you use a validity proof on top of a blockchain and this could be a layer one blockchain like like like a that uses of liberty proofs or it could be a layer two blockchain uh uh you're always kind of restricted by the

base blockchain and what it gives you okay so do validity proofs provide additional security for blockchains let's start with full nodes so validity proofs don't provide additional security for full nodes obviously because the full node fully validates every transaction uh if validity proof shows you that all the transactions are valid you end up in the same spot so no no additional security for full nodes okay do validity proofs provide additional security for things like like clients and this includes things like roll ups or other layer two constructions well validity proofs do add security to light clients that don't have any sort of security mechanism you know a light client that just trusts a majority of the hashrate dishonest is

pretty dangerous uh because you know as we said before you need uh you need to be able to convince everyone that an attack happened but if everyone is just running a light client uh they might not be able to be convinced that say an invalid state transition was included on the chain because you don't have any way of proving it to them right like a reorg didn't happen a censorship attack didn't happen but an invalid state transition was included if the if you have no way proving this to a light client other than saying well just run a full node well obviously that's not that's not great it's hard to apply a penalty and make it stick uh if you know 99 of users are running like clients and they're insecure like clients so you know validity proofs add security to there but the validity proofs add

security or more security than fraud proofs no they don't because using a fraud proof plus a timeout that is long enough is perfectly fine and perfectly secure because this is you know blockchains are censorship resistance this is a property of blockchain networks and social coordination is needed if they are not uh so if you know if the timeout violation is if the timeout is violated uh the base blockchain will be in trouble because then you won't be able to socially coordinate anything okay so durability proofs help with scalability uh which recall scaling is the worst case cost to run a node that can produce valid blocks and to produce blocks you need to do two things first is download the entire

chain history in other words all the blocks the second is apply every state transition to get the current state okay first downloading the entire chain history does do literally prove sell for this well no you still have to download everything okay second applying every stage transition to get the current state well also no because okay you know the state transition is valid you know that if alice sends coins to bob you have to update alice's balance you have to update bob's balance uh and the thing that you know a validity proof here would help you is you don't have to verify alice's signature and you don't have to verify that alas had enough balance alice you know verifying that alice had enough balance is trivial it's you know simple less than or equal or yeah a simple less than or equal

verifying a signature is not even remotely close to bottleneck it's a pure computation it's embarrassingly embarrassingly parallelizable state accesses and state growth are by far by orders of magnitude the bottleneck bottleneck for blockchains nowadays so blockchains or validity proofs basically don't help you because they don't target the bottleneck they don't provide any scalability for applying state transitions so i mean i spent most of this most of this this section talking about how they're not useful how the approvals are not useful but where specifically are they useful and why would you want to use them they do in fact have very uh unique use uh useful use cases uh the first is low latency like clients

uh and not secure like clients because again we can have secure like clients within uh the blockchain model that we discussed earlier of you know it i'm being censorship resistant but you kind of have latency like lines which you can't do with fraud proofs and this is especially useful for things like non-fungible tokens and the zk roll up and you know just in general having low latency like lines is is not bad it's also good in charge of context uh if if you don't have to wait for potential fraud proofs to cross shards it means you can have a much much higher security guarantees and in a shorter context where you know thing nodes are like clients of all the shards uh without having it without having to wait on it for a timeout

uh the second thing of validity proofs are uniquely useful for and this is especially relevant given what we saw in the previous presentation in just the previous presentation uh which is that validity proofs do provide a compact proof that some computation potentially arbitrarily arbitrarily complex was done uh they don't scale state transitions but they do scale computation and this is especially nice if the computation is a very large or b does a bunch of state reads but not state rights so it doesn't really do a state trend like it's a very small state transition but potentially reads from a bunch of states because again your state accesses are the bottleneck uh if you can show me that something is valid and potentially reads a bunch of data which

you know would be very expensive and you know doing those state reads would very much be the bottleneck if you can prove to me that it's correct and say here's the final result apply this one small stage transition well that's great and this is especially relevant given the previous talk with the increase in use of things like uh general purpose zero knowledge proof some validity proofs uh that allow for not just you know an asic or not just you know some small thing like oh alice transfers money to bob but rather general purpose computation uh then that is indeed something where they're very they're very interesting and lastly uh privacy validity proofs can be zero knowledge a fraud proof can't be zero knowledge uh just by the definition uh

if it's if it's zero knowledge then you have a data withholding problem so visibility proofs are zero allow for zero knowledge which which means that you have some privacy okay so what are the takeaways of this uh of this talk when you build on top of a consensus or permissionless consensus protocol that means that you inherit all the properties of the protocol that includes the good properties and the bad properties and validity proofs aren't magic and they can't let you get around these properties and don't roll your own consensus uh which is borrowed from the mantra don't roll your own crypto uh there are very specific ways of modeling these consensus protocols which is what i've tried to

discuss and introduce in this talk uh or you know in in a more meme format read the freaking blockchain design paper which is here there is an entire section on incentives and we very much have to model things like blockchains as being censorship resistant blockchains is requiring subjectivity and social coordination which leads to other properties and don't try to roll your own consensus protocol don't try to make up a consensus protocol that isn't that commodore consensus that doesn't actually exist and that is poor when you evaluate your systems okay uh with that the the slides are done which means it's question time hello so i've not seen that many questions so i'd like if there are any

questions please put them in the chat um i was kind of wondering like what's your alternative when you when you give this definition of scaling and then you say validity proofs don't necessarily improve the scaling as defined what's an alternative what are you what do you argue for uh well it's hard to improve the scaling of state transitions of applying state transitions there's not really much you can do like if you have a state transition okay you have a database i mean we know how to make databases and we know how to make state transitions or like apply transactions into the database so there's not

really much you can do in terms of applying state run sessions we've already peaked uh in terms of right like we have like you can do batching and stuff but like that's that's about it uh the things that are really interesting is not in the state transition itself but in the rest of the execution can you do things like parallelize execution and so on and so on uh and validity proofs have uh the nice benefit that they're you know succinctly verifiable so you don't have to worry as much about what is the prover performance i mean obviously you want proof of performance to be lower because of cost uh but you know it's not as important as uh it would be if you have to execute everything but in terms of when you say parallelizable execution are you talking about sharding are you talking about

systems more like solana like deeper parallel lines more more like systems like selena uh sheridan has issues which we won't get into but yeah so systems like solana for example they espouse the idea that they do something's wrong uh which we don't have to get into uh but they do something that's right which is that they take the kind of some of the ideas of you know ethereum smart contract system as opposed to bitcoins your predicate system and they say okay can we make this higher performance on the same hardware uh they also unfortunately in their main configuration also require much higher much higher node costs but that's orthogonal to the work that they've done in parallelizing stuff so basically they say things like well

if a transaction tells you which states it accesses then you can execute transactions concurrently and you and you know if if something screws up then you know the block is just straight up and valid and ethereum you don't have this so you have to execute transactions sequentially right so now you just have a bunch of like wasted cpu power hmm do you see the validity proofs and something like that parallelization working in tandem in a really good way or does it actually cause problems um i don't i don't really know if it's applicable because i think a lot of the proving of validity proofs like the proven computation is parallelizable

and the verification is succinct so the verification isn't particularly it's not expensive it's cheap it's it's it's the sync verification uh so you know parallelizing that is like okay you can do that but it's already succinct uh the proving while people are doing amazing work on building out uh you know parallelizing the provers so that is being that is being done okay we have a couple questions that i can ask from the audience now uh do you think that validity proofs have advantages over fraud proofs where on chain data availability is not required uh i think this is in the context of a volidium would you anna would you agree that this

is in the context of a volidium i i don't know if i i don't know i think okay i'm going to assume i'm going to i'm going to assume this is in the context of the lydium so for people who may not be aware a zk roll up is one where you post all the transaction data to ethereum like the roll ups transaction data to ethereum and you provide distinct proof that the state transitions are correct of the lydium you keep the data off chain and you still provide a proof that some hash of the data produced you know valid state state transition but you don't show the data which makes it you know you can have way more throughput with that with such a system uh i don't actually think validity proofs have any advantages or fraud

proofs for validiums and i don't actually think validiums even exist as a separate cryptoeconomic construction compared to plasma uh i wrote a detailed description of why that is in our fuel in this security analysis for fuel you can find this under our docks uh under some obscure hierarchy like i think concepts uh concept something security analysis uh but essentially the problem about valydia or validiums whatever you wanna call them is that if you actually go through every single edge case you find that you can't construct a lyrium that doesn't reduce to a plasma which is like a really odd result johannes maybe you want to clarify that too if you're if you're listening to

that answer if you want to sort of confirm that that's what you're talking about anyway sorry keep going john oh that's it for this question all right next question do you have any examples where you or others have used validity proofs in practice for the applications you actually mentioned uh i don't work on validity proof stuff i work on fraudproof stuff but in terms of have others use validity proofs in practice for the applications i mentioned uh well in terms of well i listed like three unique things wherever the proofs are useful uh the last one being privacy so you know there's there's the cash uh the second one was uh scaling computations i think so

the guys at uh starkware just in the previous presentation are working on things like you know general purpose cpu style starks so they're doing that approach i think the guys at matter labs are also working on something there with their zinc language and their zinc vm uh and the first one uh i forgot was the first one let me let me scroll up maybe the first one oh low latency like clients uh so this is being actively uh well this is being used for uh zk the for zk roll ups uh i think star wars is building out uh a zika roll up or lydium with uh what's the what's the company that this is like non-fungible tokens the games

immutable i mean immutable something beautiful acts so they're building out as you get all up for immutable can you go back to that slide with those three points actually yes so but this is not okay this is not validity proofs to compress light clients to make them smaller this is the low latency like clients yeah i mean because fraud proofs work with like clients too yeah and i mean like lifelines are small early clients already small enough so okay um there's another question here do you see validity proofs do you see validity proof as another type of segwit

e yes and no so a follow up to the question was that segwit expands the block size and validity proof squeeze the transaction i would say to a certain extent yes uh so one thing that segwit did segwit didn't just make the block size bigger for the sake of making it bigger for those not familiar with the bitcoin segregated witness proposal uh or scheme because it's not a proposal anymore it essentially takes the signature out of the transaction uh moves it somewhere else which is not the interesting part but essentially uh it it means that the signature is not doesn't have to like be part of the transaction as it was before

and moving this witness away means you can do things that are more flexible with it uh which is actually something that i think this it's a brand new paradigm that not too many blockchains use uh the pre-segwit and like bitcoins like all bitcoin and ethereum style and a lot of blockchains uh use the scheme where a transaction center signs the transaction sends it to a block proposer and the blog proposal just lists a bunch of transactions and put them in a block but this new scheme of things like moving the witness somewhere else and doing things like potentially having a validity proof over the transactions or having an aggregate like bls or snore signature for all the all the signatures these

kind of things it's essentially the block proposer malleats witness data in the block uh because after all witness data is basically saying you know uh here's you know here's some data that witnesses that this thing should it has authorization to happen and really the transaction sender shouldn't like combine witness data with a transaction there's no need it's the block proposal if they include a transaction they should be the one that's saying yes i have this witness data i have witnessed that this did in fact have authorization to happen and if they didn't then it's an invalid block there's no reason for the transaction center to do this right so this idea of segregating witnesses is actually very powerful i think it's a brand new not brand new but like

i think it's going to a blockchain paradigm that increases in uh in use in the coming years uh because it's extremely powerful being able to do things like aggregate signatures it's you know the block proposer is going to take a bunch of transactions and create a bls or snore aggregate signature out of that which is very similar to you know say you know the validity proof of that the transactions are valid and their signatures are valid those are things you know there's huge overlap but you know being able to do this means you fundamentally need you need a fundamental change in how you model block proposals you need block proposers to be able to mallead witness data so in that context i think that the proofs do have a lot of similarities similarities to segment robert z asked i would argue that fr oh i would argue that fraud proofs are

worse than validity proofs the argument for that is social consensus layer two is obviously reduced from layer one layer one has a strong social consensus why take that risk um well there's no social concerns needed for their twos uh this is the social consensus or social coordination is needed for layer one uh as i described before uh and you know let's consider the case of ethereum classic uh you have ethereum classic that you know had a 3 500 block plus reorg 3600 and this number keeps increasing you know if your if your paradigm if your social contract is saying we just accept the longest chain it's whatever it is it's working as intended which is the ethereum classic philosophy uh then

the you know let's say you're not even building like a layer two you're not even building a zk roll let's say you're building like a zk the validity proof system on top of your layer one blockchain so every single layer one blockchain is like there's there's you know some some validation logic there that every single block of the zk proof attached to it right uh so in this case we're not even dealing with with layer two here uh is there anything stopping the miners from reorganizing the chain all the way from genesis and stealing everyone's coins the answer is no in protocol you need social coordination right even at layer one so this is nothing to do with roll ups uh there's nothing to do with layer two this is actually something that is required for layer ones to even work if if you don't have social

coordinate a social coordination component miners just within the protocol reorganizing the chain is free and they will do it just all the way to genesis block why not because they can because it's free then you need a social coordination component to make it not free once you have that well the social coordination component can detect both reorgs and censorship which means that censorship attacks off systems that use the layer 1 are impossible and this includes smart contracts that have timeouts auctions uh all of d5 uses timeouts and auctions basically except just you know the core of unity swap but everything else like all the lending protocols everything else gdps they all use timeouts uh all of these systems would just straight up

not work if if uh even if you use validity proofs that they are one the straight up would not work unless you have social coordination oh yeah i'm wondering if robert has a follow-up to that but i don't know if he has time maybe he's writing let's hold on for just maybe another i'm trying to think is there anything is there anything else that you feel like one of the thoughts i had as you were describing this because this is very much a case kind of against using validity proofs in the way that they sometimes are used what are the counter arguments to that like what have you heard as counter arguments

to the counter arguments to which to my whole points all my points well to the point that validity proof should only be used for these particular cases and not for others oh no no no validity proofs can be used elsewhere uh the argument here is more that uh given our base blockchain given that it requires social coordination uh validity proofs aren't more secure than fraud proofs but that doesn't mean that they're last more okay it's not it's not an argument saying you should never use them it's more just like if you were to compare the two yes and you know the the answer is why why wouldn't you with the answers of course you could uh there's nothing wrong with them just like there's nothing wrong with using fraud proofs they're unique validity proofs are uniquely useful in these categories uh just like cloud proofs are uniquely

useful and you know potentially being cheaper because you don't have proof costs potentially they're more flexible and so on and so on but both of them can be secure and both of them are both useful for a large variety of applications okay cool robert did come back with some more points here which is he agreed with your points but miners he says miners are not responsible for observing layer two to provide fraud proofs layer one can't do it with that fraud proofs could lead to a wrong state transition have you have you heard that argument uh i think i i mean i don't know if there's robert's argument but i have heard a lot of weird takes on optimistic roll-ups and other optimistic systems such like

justice channels which is well it's weird because you don't really you don't really hear this as much from channels but that's mostly because i don't think optimistic was explained that well to the public by by its proponents uh but you know optimistic roll-ups aren't secured by layer 2 game theory they're secured by the layer one game theory namely that layer one is censorship resistant uh it has nothing to do with uh player two being able to be censorship resistant or they are two having social coordination or being able to provide fraud proofs uh you know for optimists to grow up specifically you just need one honest party and that honest party could be yourself right like if there's part you can produce

continues here saying validity proofs can make a wrong state transaction like the thing is validity proofs make the wrong state transact uh transition impossible yeah i mean versus there is the argument that if literally no one is validating let's say an optimistic grow up or a layer one blockchain then you can end up in in trouble uh but the you know what is what is the chance that literally no one in the entire world is is verifying is validating this thing assuming that it is any use like obviously if no one uses it and no one validates i something like okay well you lost 100

bucks and you're the only person who is using this thing you know like too bad for you uh but you know if it has you know millions of dollars on it then uh you would expect you know or billions of dollars you'd expect you know the commencement commensurate amount of nodes running on this thing just like there are nodes running for ethereum and bitcoin brandon farmer just asked how do you compare the proving costs for validity proofs and the cost for locking up capital for fraud proofs how do you model the risk of fraud proof producing nodes being offline especially for systems with super high throughput uh so for the first one is that you don't have to lock up capital for rapproof the fraud proof is either valid or is not if it's invalid then the contractor rejects it if it's valid then it gets

processed so fraud proves that you don't have to lock up capital uh you do have to lock up capital when you produce a block that being said you don't have to lock up a lot of capital you just have to lock up basically slightly more than it would cost to uh produce the fraud proof let's you know let's give it an order of you know let's give it a factor of safety of even an order of magnitude it ends up being that you know it can be very cheap uh to like and not only that it's not like you lock it up forever you know if the if the timeout for this fraud proof is two weeks then and you know even if we produce a roadblock you know every you know every ethereum block you can compute you know the maximum amount of capital that gets locked up

over time uh it's not not too interesting yeah capital lock up capital for layer two operators okay so we're talking about the bond for the blocks yeah like the bond for the box doesn't have to be large because it's basically just covering the cost of a fraud proof which presumably you want to make that small so it's it's pretty cheap in terms of how it compares to proving premium cost the answer is i don't know because i don't run approver uh so how how do you model the risk of fraud proof producing nodes being offline uh i think i cover that uh and it's partly in the previous answer which is that uh four systems with super high throughput or more specifically for systems with a lot of you know economic activity you would expect that there will be a lot of nodes and because

and that's because if there's a lot of activity uh there are more people that want to do things with a chain right there are more people that want to do things like chain analysis there are more people that want to do things like accept uh there are more exchanges that want to accept withdrawals uh there are more applications that are building on top and so on uh so the more activity you have you should expect the more nodes up to up to a certain amount there might be diminishing returns but you'd expect the more activity the more nodes so like the more activity there is the last chance there is that you end up in this the situation where there's literally no one validating an optimistic roll-up cool i wonder are there any more comments or questions these have been great

and yeah there's a there's a slight delay between us and the chat so give them a moment so i guess if there isn't then i guess we can wrap up here um we have next up a break so we act oh oh man this is the problem with the delay okay now there is another question uh conversely the more activity there is the greater the cost of running a node right yeah i mean so this applies to zika rule ups too because again we have to consider the worst case so if if you're saying the greater the cost to run a no that means uh you're implying that there will be fewer users of the zk in the zk roll up the more users there are which as you can see is also absurd

uh yes the more system is used the cost of a node will increase but you can bound that cost and this applies to both optimistic and zk relapse okay now i'm now i'm worried that there's going to be a question coming right as i end [Laughter] um but if not i would say we can sign off i don't know if i should do it maybe anyone speaking just tell me if i should bounce now or if we should stay on i don't know how you're feeling but anyway um thank you so much for speaking john thank you so much thanks for having me and thanks for the questions it was great being here

uh and i'm looking forward to the rest of the talks thanks very cool nice um yeah and so for to everyone who's in the session we are going to now head off to um the break where we will actually not have any videos but you should definitely try out the networking area there because you'll be introduced to participants and maybe you'll meet somebody new and then we'll see you after that break in about 45 minutes