STARK: From Paper to Product by Oren Katz & Daniel Yanev (Devcon5)

I'm Warren I'm from Starke where our mission at Stark where is to use proof systems to bring scalability and privacy to blockchains we are a team of slightly over 30 based in Israel we've raised the slightly over 40 million dollars in to equity rounds plus a generous grant from the theorem foundation and the first product we're focusing on right now is a start based scalability engine for exchanges and what I'm going to talk about today is how stark it helps solve the blockchain scalability problem and then I'm going to describe the stock based exchange engine that we've developed so in January 2018 in the middle of the US government shutdown President Trump took his first State of the Union address and for some reason he neglected to mention two of the most important things that happened right about then which is that the start paper was being published and Sark where the company was incorporated and we started working at last Def Con we demonstrated for the first time working implementation of a stark prover and verifier running in a browser on a smartphone using web assembly this was the first time this was demonstrated up until then Stark was widely regarded as a very promising technology but one that would take years until any practical implementations come out in January this year we demonstrated a first demo of a stark exchange Starke which for the first time had a verifier running is aetherium smart contract at that time the the scale of the system was 10x data theorem the throughput the system could support is 10x out of a theorem we're constantly working on improving that and two months later that jump from 10x to 200x in June we ran in collaboration with 0x on Rob stone on the test net at the alpha version an alpha version of Stark Exchange stock-exchange stark powered exchange which ran a few weeks of actual live traffic from from by Nance only last month we hosted in Tel Aviv the Star Wars sessions conference which also included a star 1:01 open workshop for developers where participants could build a stark prove er from scratch and we're constantly working on improving the system scale as I said before the best running implementation we have today is 700 X the throughput of aetherium which brings us to over 2000 trades per second that we could run which means that the average cost in terms of gas per trade is under 200 gas now this is always going down and specifically with the AP 2028 coming in Istanbul which we're very proud to have shepherded through that's going to go significantly lower than that and our next MEC next milestone and this is in large part we're going to talk about today is to deploy on maintenance to launch first commercial release of a start powered exchange comes annually with a partner but first what's dark so Stark is a zero knowledge proof protocol with specifically nice characteristics the main ones are that both verify running time and the proof size itself are only logarithmic with regards to the original computation the prover running time is is nearly linear and with nice constants actually against any other protocol that we've compared it against to date it's at least one order of magnitude faster Stark is also applicable to any general computation so generally anything you could code star could also true and then there are two cherries on top of that one is that Sark requires no trusted setup and the other is that Stark has hardly any cryptographic assumptions so the only thing you need to work for first Stark to work well is the existence of cryptographic hash functions which makes it a very future proof in two aspects one is that it rests on the same lean and battle-hardened crypto that's pretty much the rest of e-commerce that's been around since the 70s really and two it also makes it plausibly post quantum secure so how can proof systems and Starks in particularly help with scaling blockchains so permissionless block chains are often referred to as a distributed system but actually if you look at them more closely you can see they're actually more of a duplicated system you have a large number of nodes but each and every one of these nodes actually performs all the computations and stores the full state of the entire network so this boils down to a very low glass ceiling in terms of the amount of operations the network could actually carry for instance in the case of trays that we were handling right now typically on chain trade today cause something between hundred fifty and two hundred thousand gasps which means the network can't do more than three or four trades per second in theory but what if we shift this balance and for a given computation we'll have one party run the heavy computation and on top of running the computation itself we'll also do some extra work and produce a proof a stark proof attesting to the validity of those computation now what the rest of the parties need to do is just to verify that truth which like I said before is a whole lot less work than the original computation itself note that with proof systems there is no trust assumption with regards to the prover as the verify never accepts invalid proofs so you only need to trust the verifier it and it would never it would never accept any false claim so this is not a fraud proof mechanism where false claims may may be accepted and hopefully later overturned in this case only valid statements only valid States will be updated on chain so in the blockchain case instead of running all these heavy operations many times on chain you could basically take the heavy heavy lifting computation wise off chain it'll still be heavy but it'll be done at AWS cost rather than a blockchain costs and all that's left to do unchain is just the verification this requires very little resources now Stark is especially a good fit for this because of these nice attributes that I mentioned before this way you could actually increase the network throughput by several orders of magnitude while still enjoying the security of the main chain but you may say well this is nice but this is good for big computations and aren't any big computations are in theorem today and you'd be right actually the network network stay exhale limitations actually prevent big computations from being run on it today so to this I say two things one is that using a Stark based system you can have big computations so if you're a developer who's not developing some V app today because you're concerned the network won't be able to carry it then you're highly welcome to come and talk to us and the second thing is that for simpler computations such as trades for instance what we could do is we could batch a large number of small operations together in a big batch and prepare one proof attesting to the validity of the entire batch and get the same scale effect that way because again it's the same logarithm equality of the verifier so verifying a proof for a very large batch hardly cost more than verifying one for a smaller batch so up until now I described how proof systems and star could help scale blockchains in general now I turn to the engine that we've built on top of this which is a Stickle ability engine for exchanges and now I'll briefly explain how that works so these are the main players in this in this drama at the top left you have Alice and Bob there are stars and pretty much any presentation here they're moving from room to room so there are the users you have the exchange itself then you have the stark scalability engine that includes the prover all this is off chain and then on chain you have two main contracts one is the Stark verifier and the other is the Stark Exchange main contract that keeps the system state so users trade on the exchange pretty much as they would today on any centralized exchange the main difference is that they need to sign each and every order with their own private key now this is an important feature because this is basically the core of this system being non-custodial which means that neither the exchange nor the stark exchange engine can actually move people's funds around without their signatures so if the exchange is hacked nobody could actually touch the the funds of all the people that are there the exchange also pretty much the same as today does the matching and then it sends the stark exchange engine all the trades to be settled later on chain so the the users in the exchange are pretty much as as any exchange today the users don't need to wait for anything coming later they could continue trading immediately what the stark exchange does first it batches a large number of transactions of trades like I said before and then for each of these trades it inserts within the proof a proof that the trade itself was valid so we need to prove things like the orders were assigned correctly and the user has had enough tokens to transact and the transaction balances each other out things like that for every trade once the proof is ready it's sent on chain and then the Unchained verifier accepts that proof if and only if it's valid and once accepted it also updates the stock exchange main contract and updates the state now this would be a good time to explain how we don't just take most of the computation work off chain but actually also most of the storage so instead of keeping the up to date balances of all the users on chain which costs a lot we take that off chain we store that as part of the stark exchange engine we organize that as a miracle tree and only the root of that Merkle tree is updated on chain so this means that within the proof in addition to attesting to the validity of each individual trade we also attest to the validity of the change in States so the the state before the batch the state after the batch correctly depict the actual changes that are part of the batch one of the nice things about the stark power exchange is that users can now trade on the exchange from their own private wallets so the way this works is when the users let's say Alice wants to trade on the exchange she first deposits funds to the exchange this is a regular theorum transaction to deposit it to the exchange contract and then it's picked up and written on chain as well under her private key so this is pretty quick and the rabbit in the picture and then while on the exchange everything is very facets again the same as any centralized exchange today hence we have three rabbits here but here we have a small issue what if Alice needs this money on chain now for instance to pay Carol for something so pen Carol is also a regularly theorum transaction which is pretty fast but her get her funds off the exchange she need to withdraw and to withdraw as a slightly longer process because she'd have to wait until the proof is actually accepted on Ching hence the turtle so what we need here is a fast turtle so luckily we found one by the way turtles actually walk very very slowly but they swim quite fast almost as fast as Usain Bolt runs so the equivalent of the turtle this neat mechanism that we've devised that we call conditional transaction so a conditional transaction is something that happens off chain only if something else occurred previously on chip and I'll give an example with this case of a fast withdraw so Alice wants her money fast on a theory so the first thing she does is she signs the conditional transaction transferring money from her off chain accounts the exchanges off chain accounts pending the exchange has did did a similar transfer on chain earlier so she signs that and provides that to the exchange operator the operator first checks that she has enough funds off chain to do this and if she does it just moves the money on on chain to her account so Alice now got the money within one aetherium block now the exchange could actually submit this operation this off chain operation through the proof and since the unchain operation it relies on has already happened this will now be accepted so the transaction will be executed and now the exchange will get in funds off chain so Alice could use this mechanism to to get a quick withdrawal another thing she could do is you get actually they actually ask the exchange to transfer the money on chain directly to Carol and then the conditional transaction will rely on that on chain transaction so what happened here is that Alice actually paid Carol Unchained directly from her off chain account this could actually work with anything not necessarily just paying care about anything you could actually do on chain on layer one or that could be attested to on etherium so it could even be things like paying Dave on the Bitcoin network since the Bitcoin transaction is something that could be attested on on etherium or it could be open a CD peon maker or any any other defy application that relies on their one alice could actually directly access that directly from her off chain account at the exchange okay so far I was talking with my engineer hat on but now let's all put our business hats on and take a look at crypto trading today from the perspectives of both the exchange and of traders and I want to briefly touch what historic powered exchange can provide them with so today when people trade they pretty much trade on centralized exchanges a centralized exchange being fully custodial is basically just one big honey pots of tokens which is highly risky and now what a trader could do with this risk is one thing they could do is they could just accept it as part of the cost of doing business and take the risk note this is not just a theoretical risk it's estimated that last year somewhere between 1 and 1/2 billion dollars were worth of token were hacked off exchanges another option for traders is to limit their exposure to any one specific exchange and split their our funds between several different ones this is not necessarily capital efficient and it basically boils down to both trader and exchanges leaving money on the table but with a Stark we're powered exchange you have other options in terms of custody you could you could do self custody like isolate like I explained before you could have your custodian trade for you on the exchange you could have even more complex schemes in terms of custody all these boil down to this honeypot being eliminated and the risk being great lowered another benefit of a stork powered exchange is that it's much easier and in this scenario to move funds to an exchange often exchange in between exchanges so this will also greatly help traders from a capital perspective so today if you trade crypto you have the option you could choose between risking your money at a centralized exchange or enjoying low liquidity and a poor user experience at a decentralized one with a star powered exchange we essentially break this trade off and you can enjoy the scale the liquidity and user experience of a centralized exchange without taking this honeypot counterparty risk now note that what we've been building these last few months is a production grade system it's not just a stark stack it's a heavy-duty system that it could actually handle a large scale in production and could be integrated to any exchange so we're already already saw that in addition to this using these neat mechanisms such as conditional transaction and some others that I have haven't described here users can also seamlessly move between their off cane account at the exchange and all the wealth of the defy application that's currently exists on atheria they could use them directly we also talked about how in addition to trading this system also supports payments to aetherium or even to other blog chains but it doesn't stop here Stark is a generally applicable protocol like I said before so pretty much anything any financial feature the exchange we want to offer we could also include in a stark truth so we can for instance include things like interest-bearing accounts and margin trading and do that at scale while still remaining trustless but this is not the end of it on top of this you could also add front-running protection I won't have time to go into that right now but you can come and talk to us later and notice that up until now we haven't even used yet the zero-knowledge quality of stark add back to the misc mix and things start getting really interesting because you could start having privacy now today as far as privacy go goes you have the exchange operator basically telling telling you trust me I'm not going to use this to your disadvantage now with a start based system you could actually have real privacy including privacy from the operator himself so from this perspective start to do to privacy the same thing that it did to to custody before now you don't need to trust the operator because they're good because they're a good guy but you can trust them not to cheat because they can't even more importantly you could have regulated privacy so you could have privacy including from the operator while still ensuring that all the regulatory requirements are being met so things like truly dark pools suddenly become possible note that with these features that actually makes a Stark powered exchange not just the best crypto exchange it actually has features that don't currently exist on any traditional exchange as well so with this an exchange powered by by Stark where will not just be the best crypto exchange out there but actually the best exchange out there crypto or non crypto so one more thing we are very happy to announce our first commercial partnership we have partnered with diversify to bring a stock or powered exchange to real users on production come January and I'm very glad to invite Danny on of the CEO of diversified to talk about our cooperation [Applause] thank your for the fantastic introduction I'm here at diversify we believe that users should always have control of their funds accessing applications through the safety of the choice of wallets now when it comes to trading so far this has come at the cost of a great trade off his word mentioned the trade off with speeds liquidity user experience and even gas costs now over the last 12 months we have worked hard to bring our users a great user interface getting feedback from our lovely users we have developed a way to match against the external liquidity pools to bring our traders fantastic markets and now with the help of our friends from Stark where we have the last piece of the puzzle instant settlement low fees and high scalability so the days of trade-offs when it comes to non-custodial trading will soon be over now I'm going to do a quick demo to show you what this looks like practically this is a pre-recorded demo those of you who've tried using the Internet will probably understand why so here we have the diversify trading interface on the right hand side we can see our balances so here we have our own chain balances and our off chain balances locked in Stark in green so we have just under a thousand bucks ready here we're gonna do a trade to show you what that looks like so the green is basically we have available to trade now so we're placing a trade let's have a look at the order book now this you can see this order book is incredibly thick so we can place a trade of like over 100 eath without moving the price at all and the reason why we were able to do this is because since the users funds are locked in stark we can guarantee settlement ie everyone has followed their end of the deal so we can match against an external liquidity pool in this case a centralized exchange which allows us to bring this to our traders [Music] now let's go ahead and actually place a trade we're gonna be buying some e which this from a few days ago so this person is happy that they did this probably and so we're gonna do a simple order just to execute quickly at market price and we're going to select the amounts and we're going to buy now we're going to sign this with our with our signature and it's already executed actually we missed it so it's been executed we can see it in our history instantly and more importantly it has been also settled instantly so again if we look at our balances we have our new balance available to trade so as as we mentioned earlier the trade offs in experience when it comes to noncustodial trading will soon be over now this has been a demo however this will be live the beginning of next year so please stay tuned and give it up for a stark web and I think got some yeah that's it I think we do have time for questions if anybody wants ask yeah oh sorry I just step up to the microphones with my ass yeah great great talk um I'm curious like what do you see as the advantages of aetherium for Stark where to build on like what you know got you all to build up on this and and and what do you see as potential sort of downsized to aetherium that might make you want to move this technology elsewhere if in either of their present today or if they became present so Stark is not specific to theory it's a general technologies not even specific to blockchain the reason we chose to focus on a theorem is because it has it has a few a few things we need one is it has a rich enough language for us to be able to build a verifier that can run on chain for instance Bitcoin doesn't but other chains do have it and also has a very big developer community so there are a lot of applications being developed there is a lot of there are exchanges running on top of the theorem there's a big bigger ecosystem but like looking forward we're not gonna stop specifically at the theorem we could build similar things and other chains as long as they have a rich enough language Thanks can you tell us about the data availability program for the miracle tree that hold the state of the exchange so this first phase the way we're gonna handle data availability is that we're going to have basically a committee of a few trusted parties that's going to accept all the data and for each proof that we submit on chain the proof will only be accepted not just if it's not valid but also it needs to be signed by enough committee members that have indeed attested to the fact that they have the data and that they have indeed calculated and saw that this data maps to what we've submitted as part of the truth thanks to the talk did I get it right that the metro agent is centralized and you just can say I don't want to executive order that is true at this phase we just will start to find the settlement process the matching is centralized now this has ups and downs the main benefit that you have here it's a lot quicker and you can't front run it the downside is yes it's still sensible do you have any kind of solutions for it or so so we have thoughts about how we could Storify the matching as well but we're not there yet get it thank you that that will be coming and sometimes like thank you for talking it sounded very bright and shiny like kinda without disadvantages solving a lot of problems even for me it sounded like it's going even into later to territory by my problems it solves so there should be some drawbacks first of all it is the layer to solution you're right the reason it's like it's a lot simpler than many of the other layer to solutions like in there to you have I refer to you briefly before you have a two major concepts you guys really use fraud proofs or validity proofs so fraud proofs is where you say okay let's say we have some channels of something in layer two we update that on chain and we're optimistic about it so we may update things that are false but we expect somebody to catch that and contest that and then overturn it that's a much more complex system of what we're doing here and it has a lot more drawbacks what we have here is since we have the power of Stark or proof systems basically this means that whenever we submit a proof only valid proofs will actually be accepted that only valid states will be updated on chain so it makes things actually lot simpler because there are a lot less cases to consider it's not a simple system altogether but that's why we weren't working on hard on it for the last few months and slightly more than that and we believe it the user experience at the end of the day is pretty pretty seamless don't feel that you're running on top of something complex then we one more quick question do you need some kind of set of validators or some specs separate network that will begin some some things or it just works completely on normal smart contracts in theory so on chain it's just a regular smart contract there is a verifier contract there is a main main contract of the exchange all on chained off chain we have this Sark engine that we're operating that runs as part of the versa Phi in this case and the only thing you have on top of that is this committee that I mentioned before that you're going to have several other parties that are not us that will actually need to get the data and attest to the fact that they've seen it it's valid thank you that's all so how do you compare yourself with idec's with ibex yeah well I Dex today as far as I know don't yet have any such scalability solution so they actually do the settlement on chain I think they're planning to what I did announced earlier to solution yesterday okay I'm not too familiar familiar with a solution as far as I know it's not true system based which means it's like in this category I just referred to that's called frog juice which means you could actually update false things on chain and hopefully later overturn them which makes it a bit more prone to attack and complex but I'm not too knowledgeable about exactly what they did what are these statics your quacky oh I see and also would you open like margin trading in the future oh it's on a road map so kyc is really question to you it's not a matter of stark Dixit's yes so um yeah can we see I guess depends on the on the exchange itself and in our case we don't require kyc because all the assets is traded on diversify are basically crypto - cryptos it's only digital assets and we don't include securities and sort of jurisdictions are excluded to be able to create this kind of friction this connection the exchange now margin trading from the stark perspective we're definitely planning to handle that which means that the stark engine will be able to support it again it's a matter of it's up to the exchange of when and how exactly they support any feature I know if you have a statement on that yeah so thank you very much [Applause] you