An Intro to Zkopru

all right thanks for joining us everyone uh today we are very lucky to be hosting once up lim all the way from korea and he will be introducing to us um z a quick introduction onestop is the author of zikopro and project coordinator for the pse group in the ethereum foundation so that's short for privacy scaling privacy and scaling expirations so without further ado uh what's up to you uh thank you for inviting me here a lot and i'm really happy to be here and today i'm gonna share uh what is zico pro in more kind of a more educational purpose i guess like just for introductory stuff or about the how the privacy works here and why should we concern or think about when we build some building layer to stuff so yeah uh let me start my talk about zika pro yeah uh the reason why i started the zico pro project was like i remember there's like 2018 or 2019 actually i i don't remember the exact date but once i traveled with my friends and uh went to a restaurant and splated the bill using mainnet at the time and my friends just registered my address to the to the either skin watch list and they were watching that i am my account is getting liquidated on the maker now so actually it was a pretty frustrating experience that oh there's really no privacy financial privacy at all so there was a uh reason why i started the privacy protocol so around 2019 uh we i mean very uh founded a psc team at the time and i joined the team and we started to build a protocol from the time yeah so basically um private transition protocol mostly depends on your txl model actually i have never found any other solution to preserve the privacy transaction right without the utxo model um so that is because to it is pretty difficult to hide information uh with a general state uh machine like so let's see how it works at a a briefly so the first mission is like for example transferring 5000 usd from at least about um in this case uh let's assume that uh there are alice has uh two coins now this is a utxo model so two coins now the first one is uh 3000 usd and the second coin is in 4000 usd and then uh alice uses these two coins and creates new coins probably this is a basic utex model right so it doesn't nullify the uh spent coins here so you can see that the total amount of the usd should be same before and after here so all this spans these two coins and creates a 5 000 uh usd coin for bob and the remaining for her here okay and then uh let's think about uh uh in a more graphical way so uh we can think like there are two unspent coins and uh we make a transaction that spans these two coins and we generate new coins here and then mark a queen a and coin b are spent so uh we can have we can have these two kind of polls so the first one is like unspent and the second place is spent and actually without removing the the coins from the unspent coin poll instead of that we add spent coins into the spent coin poll then in this scenario how do we preserve the privacy here like so to preserve the privacy here um [Music] we have to hide the value and also we have to hide the transaction drive um i mean the hiding the transaction graph means like uh we want uh we want to hide this transaction we want to hide the information about which coins this transaction is using to generate new coins that means hiding the transaction graph and also hiding the volume is like oh this transaction spans some coins and generate new coins but i i won't let you know the exact detail of the amount and the address so we should satisfy these two conditions here so the first uh to hide the transaction graph uh actually it should be work like the forward network i mean not the i mean the torah network so i'm sorry thor is my my colleague in the team yeah by the way yeah so it should work like a torah network like uh a span coin x there is a spent coin x but we don't know uh with which coins we have spent uh to mark this x yeah um so then how how can we do that it's about the combination of the merkle tree and the zika snark actually this is a commonly used scheme which is called membership proof using ck snark and just for your information there is another way that we can do this private membership proof uh with a better efficiency which is called caulk c-a-u-l-k which is based on the vector commitment but uh in our case actually this is designed like i three or four years ago so it is a uh it is based on the merkle tree model now so but the basic is pretty similar so i'm gonna explain with the merkle trim model uh i think that uh maybe some of uh some of our members uh i mean if colon pro members are familiar with zika snark or but some of them are not familiar with what is the kids snark and how it works so this is a a simple diagram about how the historic works um so um zk snark is a protocol to guarantee some logics so for example uh this is a program so we have some public input public information um just a moment please let me i need some [Music] laser point here does it all right okay great yeah uh okay so we have some public inputs here um oh my god so this is a a a program so we have some public inputs and private inputs and what we want to do is like these public inputs and private inputs satisfy some conditions some logics for example public inputs can be like 3 and two and private inputs is like six and we are just guaranteed that three multiply three times two equals six that the logic is like just multiply multiplication here so uh zika snoring is just a a um protocol that guarantees public inputs and private satisfy these logics uh then its result is like there there is some public output and also the proof that a these all the inputs and circuits are satisfying the every conditions and we can guarantee that uh in a cryptographical way so the verifier can just verify using these public inputs and public outputs and circuit information and the start proof then okay this proof is true or false then let's see how it works in the market tree membership proof yep um okay so you you got you you are all maybe familiar with how the merkle mercury proof works right so this is a root and we can just construct if you want to prove that this green leaf is one of the one of this growth then we just make a miracle proof like using this sibling one sibling two and sibling three and the hash of the leaf and the sibling one and hatch of the sibling two and this one hashtag sibling three and this one ship the right and we're gonna verify these uh throw the ck snark so here i just marked the private inputs as green items here so which means like uh here is a leaf and there's a leaf but you don't you don't want uh let others know the information about this life and also if you let others know the sibling information it actually it is also revealing the information of the index of this leaf so we also want to hide these sibling items too so these four nodes are should be the private inputs here and the public inputs here is the root value so we are just compressing the group data into one merkle tree root and we are just we're gonna say like oh this one is one of these scraps this leaf is just one of this work and the circuit logic is simply the miracle proof so uh node one this is the node one is the hash of the sibling one elephant and node two and the three and root volume should be the should be the calculated node three here so this is so you can see like in this diagram we have a logic or a medical proof when and we have public inputs the root volume and private inputs the leaf and the sibling values and then we can have a smart proof that this one is one of these verb and the verb file you can verify this uh using a a z snare that okay this proof is true so this is how zk snark and membership works okay is there any question um i think we'll just keep your questions to the end probably [Music] okay um okay then yeah uh and the uh next is about about how do we make the utxo pool uh to uh for for a further privacy on the for the anonymity for so what we did is like um making it as a as on a pan-only merkle tree this is a little bit a tricky i mean a pound only merkle tree is kind of a very big sparse merkle tree so we are assuming that the other leaves are the stars from zero and we are just pulling the items from the first index from in the zero one two three or four um this is because uh if we just construct a local tree the standard merkle tree we have there we cannot use a kind of a some fixed constant data which can reduce a little bit of hash computations later so we use it upon only mercury for the members proof um [Music] actually this was like too much information i guess and yeah and uh then let's see about how what should the protocol look like so uh utex support uh should be apparently multiple tree and the nullifier pool should be a mapping or sparse local tree i mean uh we construct a merkle tree for the unspent coins and also we need a space that we gonna mark some spent coins and we can implement that using mappings if we implement this as a layer to solution then we can we can just write a smart contract code to describe the protocol so we can use mapping or we can also use a sparse mortal tree like this one is already used so as far as multiple tree is a miracle tree that every leaf is zero starts zero so and has a fixed depth fixed size so for example we have a sparse merkle tree which step this 5 then we have 32 items and every item ours every item is zero and we can update the item like let's assume that we updated the item of index 10 then we can just prove that times leaf is not zero which means it is already used so sparse mortal tree is usually being used for proof a non-inclusion proof like um okay then uh let's go back so there's a youtube support with a panel in mercury and multiplier loaded fire pole with a mapping or sparse merkle tree and um then let's try to write a circuit with these informations then what should be the public uh signals the public signals should be the nullifiers i mean the spent coin nullifier here you can just think like nullifier is a hidden value of of these pant coin so you are revealing nullifier instead of revealing the detail of this pant coin so public signals here can be nullifiers and the root of the utxo pool and new utxo you have generated using the using the transaction here and the private signals should be the details of the utxo i mean the details of the eutx includes all the new utxos and expanding utxos too and also the mercury proof of the spending notes and also the energy proof and then we just write some conditions like here it's a nullifier uh should be derived from the commitment which means like i mean lollipops are from those pant coins and the ownership proof should be valid and the mercury proof should be valid and the spent amount and the a new utxo should have a a same amount of the total total amount of the sum okay [Music] then here's another question like um this is a just say in example of implementation of the uh private transaction protocol uh using ck snare scheme and the con the question here is like and how the recipient can get the new coin so let's think about we hide every volume which means that we also hide the owner then how the recipient can get the new coin when we just when we receive some fund using ethereum mainnet then you can just check from the ether scan and then there are some public values so you can just know that oh you i received some it but in the private transaction pro private traditional protocol uh there's no way that you can know the details so there are uh two types of brain the first one is interactive way and the second one is non-interactive way so the first one the interactive way is like giving you some information i mean the sender gives information to the recipient and then if the recipient sec accepts that transaction then it goes to the goes to the block so we can use the mpc or scenario signature here and uh advantage is like we can guarantee that the recipient receives the front wall but the disadvantage here is like the recipient should be online every time to receive coin because it's a interactive way so the example of the interactive protocol is mimblewimble actually i started the privacy protocol with mimblewumble at first and then switch it to a non-interactive way which is a good performance it's zero for single point now so the non-interactive way is like the z cache is using the non-interactive way it is using the mammal field so encrypting the transaction data using the dp hormone key exchange protocol and the advantage is like the recipient does doesn't need to be online but there is actually there is a kind of a pretty a a big problem here i is like every user should try the dis decryption for every transaction to discover my my utxo i mean every utxo has memo field and every user should try decryption for average transactions memo field using the own ecbh shared key so for example we have a thousand transactions and also we have thousand users then actually uh in the world the decryption happened like one million times it's kind of a a little bit of waste of computation because that is only for like to find my to discover my utxo for user so actually this protocol also has a some um disadvantaged stuff but pretty good for the user experience definitely so this is the reason why we are using the non-interactive way yep okay then uh we have to think about the compliance too i mean recently this is pretty yeah everyone knows there's some things happening like there's also some dark side of the private suit protocol terrorism or monument rendering or tax evasion etc so actually it is pretty important to keep keep it maybe some people are [Music] wanting the 100 of freedom like representative sensor resistance stuff or something else but actually this is kind of a implementing a tool that i some party can censor some transaction without a without yeah actually there is a tool to sensors and transactions i mean this is a layer to protocol and layer to protocol i mean layer two means that the coordinator the block proposer has a huge power to censor the transactions so we are using that um in that point here so what we are using here is also the z cash rate the supply protocol like having an expanding key and viewing key together so if you have a viewing key i mean to spend your utxos users should have the spending key to spam the utxo but the details and the memo field is encrypted by the viewing key so if anyone has your viewing key then they can decrypt the transactions for you so i i guess that um some government can run this kind of own layer to private transaction protocol for their own domestic payment system in that case government can reject some transactions from users who doesn't who didn't submit the viewing key and if they submitted the viewing key then the government can track the transactions and also tax them or they can just prevent some money laundering or tax evasion etc so this is a use case for the standing community system and i think that running a layer 2 protocol layer 2 network on top of ethereum is a pretty good choice for some like other governments like other nations uh because it gives a a lot of connectivity to the worldwide finance system which is ethereum and also along with that they can protect the privacy and also have some the auditable feature there yeah okay so to implement this protocol we have a some um pretty complex logic here so we have some spending key and drive the viewing key from the spending key and viewing key becomes the nullifier see it and also it becomes a public viewing key for acdh ecda ecdh and also generate a firmware key and create some shared key then create public spending key so using all the stuff we can make utxo and nullifier and also we make some sequel for address with using the spanning key and viewing key so it's a pretty complex but uh if you're interested in the how it really works inside then i i think you can just take a look at the document documentation for about the account model um and also i think i need to explain a little bit about the mammal field here so uh why i am explaining mammal fuel here is because this is a layer two protocol which means the call data is the most expensive here so compressing call data is pretty important but uh aut axo has a kind of a two 256 bytes of data um maybe it is it is like 280 or or so but if we use uh the one-on-one encryption and decryption then the encrypted cipher text is also cost 280 bytes of call data so what we do here is compressing uh some data like uh we have a token id instead of putting all the 20 bytes of token address so it means like we we have only a limited number of tokens so we register tokens on the smart contract and then the token id is just a modular 20 of the a modular of the say token address modular 20. so maybe thai or usdc can't have a same token id like so for example if the token id is like seven then we just look up the token addresses which modular is seven and then for example then we have like okay we have some 30 candidates then we are just trying every uh token addresses to decrypt this memo with the 30 candidates so with this logic we can just reduce the call data a little bit and yeah uh yeah this is how we are compressing the memo field data and yeah then let's talk about the deposits though the deposit is the first step that users use zika pro don't worry so to use zika pro uh you need to deposit a note and at first it should be the public information because you need to put some it or put some token to the smart contract and that is definitely cannot be private then uh the coordinator i mean the actually the product accumulates this new deposits into a mess deposit object so we accumulate the deposits and put them to the layer 2 block at once later so once a mess deposit object is committed then the coordinator can include that committed mess deposit into the new layer to block and the next step is about the withdrawal so users can submit a withdrawal transaction to the zika pro network taxi and a withdrawal transaction spans the utxo and create a withdrawal node instead because expanding your textile on the layer 2 and creates a withdrawal knot which can be used on layer one and these withdrawal notes will be finalized will be recorded in the layer on one smart contract as a form of invocatory and then finalize after the seven days of finalization uh so here actually recently we got a pretty fun idea for about the optimistic roll-up and the secure olaf for about the finality for example uh for zk evm like so to verify a like a plot uh it takes like uh 30 minutes with a multiple aws machines so it means like if we implement a general stacey k rollup then the minimum block period is like 30 minutes which is not good for the user experience definitely so there is a uh very recent ideas like having a hybrid product here optimizing rollover and secure all together so we just submit the blocks every 10 seconds and generate the zika proof in parallel so people can use that as in an optimistic way without finalization but after 30 minutes it they will be finalized with the ziggy pro and also it is good it is pretty good uh in terms of the security point of view i mean zk proof is also is a actually it's pretty new and relatively not i verified that much i mean we really don't know where is a some uh unknown vulnerability in the protocol so if we have the fraud proof and the zk proved together then we can protect the vulnerability using the optimistic broad probe together so recently these hybrid the products just came out and we think that it'll be yeah it might be pretty fun to implement those like also for this private trench protocol or some general state secure wallet or reciproc and there's also some withdrawal feature that you guys may might be already experienced in optimist optimism spread so there is a seven days finalization but you can just withdraw instantly using help exchange or etcetera this is like a prepaid system um okay and the other one that i want to introduce here is a subtree insertion but i would say called i mean c-a-u-o-k called better than this solution i guess but this also pretty makes sense i mean let's assume that uh when you have a 32 depth merkle tree how many hash computations you have to do to add 100 leaves to the merkle tree it's like 3200 cash computation so actually a verifying like 32 computations i 3200 computations it's not a um easy stuff in zk snark or also on smart contract for the guest codes so if we have a way that we can to reduce computation then it'll be pretty good so what we thought is like having a subtree insertion it's like this is actually a 32 death merkle tree but we divide them into a 27 depth merkle tree and the subtree of five depth and making this merkle tree and then adding these leaves to the to the main merkle tree in this case to construct a five death merkle tree um like you need to compute to construct a five death record tree it has 32 leaves inside it and to compute the root of this tree you need to compute like about 32 times and then we can all we can uh almost cover the 100 leaves with only three subtrees which means you need to compute only like 100 cash computations not the 3200 computation so it's like we can reduce the cash computations by 32 times compared to the very um with a simple mercury insertion approach so yeah which means that this is 32 times efficient compared to inserting every leaf i buy it like to to add some leaf um yeah yeah i mean this subtraction is like 32 times efficient um and the one thing that we are very uh we are thinking about the optimistic world very much while we also have the zika role is because we can describe more complex protocol using optimistic role because we can define the average challenge cases using when when we implement the more optimistic role so in singapore cases we have a lot of challenge cases like point deposit the deposit is not committed and for the header header has some involved deposit rule either has an invalid transaction root or parent blog is a slashing blog and like this so we have a bunch of some challenge cases and doesn't it just look like kind of a a yellow paper of ethereum so every we can write everything as a smart contract code so this is pretty powerful so i hope that i also think that's he can roll up we should do the ck roll and also we need to improve the camera but i don't think that we don't we won't use optimistic role in the future optimistic role of approach also has a good advantages like i mentioned the hybrid approach and also we can write a really complex protocol using these optimistic parts okay [Music] i want to show the our challenge cases a little bit here so we have a contract in the repository and you can see some challenge cases here like so if you want to know about how you can write some optimistic role of a product of the optimistic follow-up protocol then i think you can see those cases like we have a header validator then we validate deposit through and validate transaction route and valid migration rule and etc and these functions are not should not be called i mean if anyone is like called then it means like slash so you can check some how we validate the blog in in the repository in more detail and also we have a documentation about how the transaction looks like and how the block structure looks like a very detailed at the documentation page so i think you can see more details there okay and there are only three uh more stuff that i want to share today the the the next is private dynamic swap private atomic swap is pretty important to implement third-party applications on top of private transaction protocol so using the private atomic swap we can implement merchant service so when you buy something on in in the restaurant then you give some your token or your it and uses just some nfp or something else so this is kind of how to buy some digital assets in a private way so uh this is a pretty important and also the ano another example application is a private a exchange so let's assume that you want to exchange your hundred eighth or hundred one e uh with others and you don't want to reveal the price i mean let's assume this is an rtc like you can do altis in a private way if you use private element as well and we are also having some fun experiments using the socialist millionaire protocol of which is for a matching the orders in a private way and then we use private dynamic swap then you can do the otc in a pretty private manner and the next one is about the privacy tech scenario which means a centralized coordinator can generate a fake volume of transactions so this scenario is like i am running my zico pro network it's an l2 and i am the coordinator and my friend just came here to use zico pro network but actually every transactions were fake transactions made by made from me so if it makes some transaction actually i can subtract the transaction graph a little bit so this is pretty bad for the anonymity and privacy stuff so we added a borrowing option for the coordinator selection which means uh to be a coordinator i you need to burn some if to be the coordinator and re-auction that so for example my friend alice is a coordinator and for the next round she brings like 10 if then if i want to be a coordinator i should burn like 11e and later actually alice will get refund and burn it there's not not burnt but stick but uh i should burn like 11 it more than alice to be the coordinator the reason is because it's like the powers of tao trust is set up ceremony the in the powers of tal trusted set up ceremony if you participated in the ceremony then actually yourself is pretty safe because if you didn't reveal your toxic ways to others the powers of tao ceremony is only dangerous when every participants rebuild their toxic waste so if any if any one of the participants destroy the toxic waste in a appropriate manner then the product is pretty safe burnt oxygen is a pretty similar concept so if you be the coordinator then you can add some your own anonymity sets into the pool then it lets others very hard to track the transaction graph so this is pretty important for the for the 4d anonymity so we added this burn option protocol for the coordinator selection okay so yeah um this is all from today's uh presentation that this is tldr like it's private transaction and isn't withdrawal private atomic swap in my viewing spending key and the gas cost is pretty cheap like 8.5 000 gas per transaction right now but it can reduce if we implement the a proof aggregation and a little bit more optimization then we can drop that maximum like 5 000 yes so yeah this is it from um me so thank you for listening my presentation today all right thanks thanks myself um just a quick check uh how much time do you have yeah i have plenty of time it's okay okay okay because there's a long list of questions and uh i'm not sure if we can get through all of them um but uh since you have time uh before we jump into questions from others i always like to ask our guest speaker just to give a quick introduction for you personally like um how was your introduction to ethereum and how did you join ethereum foundation wait what was your story uh yeah so uh my story like yeah i started the private private protocol like i really don't remember the exact year but uh i had a talk at the deaf konosaka and met barry there and barry has some [Music] idea to improve the protocol so we started to work together and there was the that was when i joined the term foundation um so uh but like can you share how you joined ethereum as a space like even before that like okay it's like i guess it was like five or six years ago i uh actually i did a startup before like 2013 and made a starter with my friends and sold it to another company like 2014 and from there i learned a lot of the capital modern capitalism there how the startup works and how the corporation works and how the vc works to be honest i felt that there is a pretty unfair game so i just started to fall in love with the officers like linux because it was pretty shocking to me that there is no incentive to contribute to the code and you know that code is a one of the most valuable means of production so isn't that sound like very communism stuff like they're giving up their incentive for the means of production right so it was pretty shocking to me and i was very i i started to think about the culture and officer stuff a lot and and around that time i discovered ethereum so you know that we in interim we we just share everything so it was a pretty shocking culture for me to me and i was also naturally getting fall in love with ethereum yeah nice that's a really good story uh didn't expect that yeah cool okay so uh on uh one day when you when you come to kl we'll hear more about it i'm sorry one day when you're here in kuala lumpur we can hear more about your story yeah yeah i hope so okay but uh so questions um from the audience i think shironjin asked um like uh to clarify ethereum does not use utxo um yeah so why did uh uh zico crew use utxo i think you mentioned a little bit about how you don't see how privacy can be done yeah right um [Music] zico pro is not a standard protocol we just did an experiment with optimistic approach and also with cj smart and what we want is deliver shipping this protocol and build your own tool using these experiments and yeah i just wanted to clarify a little bit for about our approach here and what why we have to use a utxo model is because to hide the transaction graph yeah so utex or motor is the simplest way to implement the hiding transaction graph like i mean uh this is a the diagram of how zico pro transaction works so a for payment uh there's there should be some info and outflow and what we want to do here is like the sum of the inflow equals to some of the outflow but we don't want to reveal that what kind which coins is used for the those inflow and and yeah so to implement this model actually the con model is too much we don't yeah we don't need to use a cloud model for that and uh what are some trade-offs uh with you deciding to do utxo wanna try this yeah uh i imagine you can correct me from wrong i imagine it's probably not uh generalized um as a rule up uh yeah right you do of all kinds are there any other trade-offs that um you decided so if you don't use utxo model then it is pretty difficult to make it private yeah okay cool then uh okay actually um just asked um whether the optimistic approach was something you always had in your initial design um [Music] yeah whether optimistic versus zk versus any other approach out there maybe not even doing a roll up at all was it always your original design to do an optimistic ruler at first for zikopra yeah yeah eras like um [Music] to be honest at the time we didn't have a a good proof aggregation tool which means it is pretty difficult to make zkzk roll up i mean um this is already using a zika snark and we need to verify the zika snark proof is valid or not so rolling up this ck transaction using optimistic role of z copro and rolling up the zk transaction using z care all of the zkg roller and at the time we didn't have a a proper tool for the proof aggregation so optimus rule was the only only possible choice at the time so are you saying today you could do a zika zika rule yeah and we can do that in the uc here all differently but uh i think hybrid approach is better yeah okay cool and then justin asked whether um whether zikopro differs from bitcoin lightning in terms of the zk smart implementation at the prover output side um actually i'm not familiar with the lightning implementation so i don't think that i can give a good answer here um then maybe um one related question would be like as far as you know are there like certain groups of categories of approaches towards uh privacy uh so like one simple kind of type could be like uh to have mixers versus roll-ups versus your own native blockchains and to have it interactive this is not effective but like do you have is it like a map of different approaches towards privacy on blockchains um [Music] briefly so we can use privacy for finance but we can use privacy for social identity too so recently we are more focusing on the social identity which means like uh allowing you to vote privately and anonymously so there are some two big a use cases for the privacies of personalized finance and the other one is a social identity stuff and technically uh the most important is the membership proof and we don't have enough implementation using coke now because it's really new stuff so i guess in few months we may have a multiple implementations of the members producing caulk but the proof size might be pretty big so it will be pretty fun to see how we can compress that using zkz here all up there yeah okay so uh a lot more room for exploration for the plc um so when you mention hybrid approach right uh so theoretically can hybrid approach also be used by the current optimistic roll-ups and the current zk roll-ups yeah definitely so it doesn't have does it it doesn't have anything to do with privacy in that sense like you could use it just for scaling yeah right nice um yeah that's a cool whole new rabbit hole but chichon asked um what is the decentralization strategy of uh zikopro and how are you going to start things off when you have maintenance yeah so decentralized plan uh the foreign option is the decentralization strategy for us so we don't think that there should be multiple coordinator single culture also can work well but there should be a way to be a coordinator when you want to be so this is the way we implemented the decentralization for the coordinator selection and uh for the main delivery we don't have a plan to deliver this mainnet it's a research experiment but we are pretty sure that everyone can use this for their own product like so uh personally i really encourage other governments to adopt this system then maybe i think i can just get give some supports for implement the system for their government or uh maybe or their cbdc or et cetera yeah so we don't have any any plan to deliver this to maine yeah that's that's really that's really cool so cbdc's that are naturally private i think would change the conversation towards cvdc that a lot of people are having so yeah uh thanks for your for your public service um uh but but so one question on the on the burn option right so um does it mean that uh the auction continually goes higher and higher like um permanently or indefinitely so like it goes from 10 to 11 to a thousand to 10 000 the auction runs three years every round i mean yeah okay okay and at the end of the round uh only the last person who wins it actually spends or burns their eaters right right right nice so um when we talk about uh zikapro uh roll up um what are the sort of roles uh that are involved like other rollouts we have sequences potentially even data availability committees so is it just the coordinator or there are other roles as well coordinator is a sequencer here and what coordinator here is like generating block and also verifying the snark is what the qualitative does here and just ordering the transactions is there any data availability kind of mechanism or kind of role there is an idea to implement the instant finality is like a coordinator gives you a signature that the transaction will be included in the next block at the index so if your transaction is not including in that index in the next block then the coordinator will get slashed okay okay so we've but we haven't implemented this but um is there an actual i think uh i read in your medium post announcement that there is a about to have been a test net so there should be one right now yeah we have a test net now okay uh how how do people how do people like get in like um deposit or uh you can go to zika pro network then you you can use an application there test application there and it's on goalie and optimism tesla too optimism guruli i guess uh yes yeah after reason only but maybe it will be uh terminated in few weeks i guess so we need to uh it's an optimism proven then because the ones that are about to be interpreted okay yeah but but basically if as long as you have let's say gorillae then you can just deposit to this uh bridge contract and then use the network nice all right we should probably do this at the next uh meetup um uh yes it's kind of hard to find testnet unfortunately and then related to this is um so to the sequencer right so you mentioned just now that a sequencer could potentially censor a transaction um right so how would they know because it's a private uh up right so you don't know which wallet belongs to which person so um let's just say there was some uh uh terrorist that um um was found like how would let's say the coordinator in this case know that this transaction is being done by the terrorists instead of by someone else so for that we have join key so coordinator can reject transactions from an account who didn't submit the green key to the coordinator does it make sense um what would be the the role of the viewing key here like can the terrorists just provide the viewing key to the viewing key lets you see the details of the transaction um okay so when you say details you mean like the amount and the from and the two prices right okay okay so so then it's not 100 private like um at least for a particular transaction you are exposing your details to one party who is the coordinator you don't need to give your viewing key for every time so if you if you don't give your viewing key then it's 100 private but if you gave your viewing key to someone then actually there is not private at least for for that for for them so okay so we have a kind of some two cut two approaches to achieve the compliance the first one is having a global viewing key stuff which means government have a has a only one viewing key and and then we add some encrypted information to the memo field together but this is pretty uh it we need to use more call data to support this kind of global viewing key and also if the global viewing key is a leaked then every transaction just becomes transparent so yeah okay so um is it um allowed for a user to make a transaction without exposing a viewing key like can the coordinator allow that to happen uh yeah it depends on the coordinating implementation so okay yeah so it's like theoretically if i wanted to keep my transaction completely private i could um bid for the auction or that particular transaction right right and you can 100 guarantee their privacy uh well so really did that uh kevin just asked what would prevent a bad actor from taking up the poor data role um aside from having to spend a large amount uh bad actors from taking out the coding role um [Music] we don't have that tool here so to prevent that bad actor you need to spend more i mean they would have to be keep on burning their eat if they want to keep being the cognitive forever right so yeah let me clarify a little bit uh here we implemented the protocol and the coordinator selection logic is very modular the borrowing auction is one of the closing selection logic for the decentralized version but if a government or if a city wants to implement their own coordinator they don't need to use this production stuff and and and uh would that be naturally there'll be transaction fees right so yeah all right the coordinator will also earn from their transaction fees right right okay anyway so um moving on a little bit uh so uh chichwan asked earlier um who asked but in case of a transaction fraud or smart contract bug how would zikopro address this issue considering the implementation of encryption of transaction or data privacy after finality of the utxo z-corporate channel okay um i'm going to send this here just in case so you can read inside the chat yeah i'm writing it in from the chat so smart contract bug transaction proud after the finalization um we thought that there might be a migration tool at first and also there is a migration feature too but um once this kind of a transition from other smart contract bug is happen in the protocol then actually it is 500 ruined so it is pretty important to have a very 99.99999 perfect contract audit so so we had a lot of some internal audits and also external orders too but actually that doesn't guarantee this protocol is 100 safe so that depends on the trust like oh we can consider that you can consider this protocol as safe or not yeah so it might be cool for like let's say small communities to try it out um and then accept that they are find somebody completely burnt and then share some feedback to yeah yeah that also be a summer approach but uh i would like to say that if anyone is interested in this kind of a very destructive situation then it will be a pretty good research topic and experiment topic yeah yeah because we don't have that yeah yeah then um so um there's a question from sichuan uh is the corporal written using circom and what underlying proof system are you using right circle and graph 16. ah okay yeah and um well i think you've kind of answered this question already uh has uh zuccofu undergone a trusted setup yeah yes okay uh and how much gps i think you mentioned it was sorry how much dps do you expect zika pro to serve um [Music] the maximum tps is like 100 transaction per second right now yeah the maximum transitions per second is 100 about 100.

yeah okay and um so going back to the atomic transactions um so um i believe it's not uh fully uh generalized or composable uh on sql so what kinds of um smart contract type transactions uh can be done um on the zygopro network yeah so uh honestly we have only two example applications to use private dynamic swap is the merchant and merchant service and the private exchange so would would it be possible for let's say any future implementer to build other um applications on top um yeah why is it like very restricted uh i i think it was pretty restricted like it is pretty restricted to feel something on bitcoin network isn't it so yeah it's pretty similar we can build something some script using the memo field and also we can add more logics using the optimistic rollups challenge challenge logics but actually this is a utxo model so it's pretty restricted yeah all right so like um i'm trying to imagine like a cbdc that's trying to do like cool interesting things like i know auto charging taxes or doing some smart stuff with the uh with the digital currency but then probably not in this case like maybe they would have to apply some other um layer or some other role up through that charging is also also pretty possible in using current zika pro network too because the coordinator can only accept the transaction with the utx that includes the etxo for the coordinator all right um okay then um i think um gonna try and finish this before 9 30. so if anyone has any last questions feel free to uh shoot them in or if i missed any uh please feel free to place it again in the chat um so one question i have is uh so there is this eip4844 um to do a blog um inside the mainnet transactions um and that's generally to like make it cheaper for uh optimistic roll-ups um i believe uh make it cheaper to have call data inside something i correct me if i'm wrong uh does that apply to zikopool as well like does it matter to you yeah so because this layer 10 affects a lot from cold data cost so yeah definitely yes okay and um if you imagine there's like like a hundred governments or cities or different people who are running uh their own implementations of zika proven uh that would also be essentially competing with each other right for the layer one guest class um kidding um yeah that could okay yeah but then they'll look at other sort of uh scaling uh answers i guess if you reach 100 governments using zika crew that's uh very ambitious already yeah [Music] oh yeah okay so um chichon asked um if uh how can someone let's say in the etl community contribute to zika crew or any other pse projects uh yeah good question um you can explore the repositories uh psc repositories actually uh our previous org is like oh we don't you can use this explorations and we have some bunch of some projects here but actually there are also some other projects not here like uh gopro where is the trust you can explore some issues over there yeah uh and also um we are uh if we are preparing a rep use web3.xyz stuff i mean actually this is from um our another ef member that uh let you explore some [Music] good first issues here so you can also find some privacy and scaling exploration issues using using this tool yep okay thank you for your question nice and so not to forget joe asked um how would nfp transfers work when it comes to zikapro yeah uh yeah our another one t list is like having erc 1155 too but we are uh supporting only the ear system to one and how it works is like um um [Music] yeah i think you can already you can take a look at the eutectic motor here and we also have some nft field here so it's like just transferring one nft or transfer some erc20 or it on me so that we have some three options you if you want you can transfer years to any or you can transfer it or you can transfer nft yeah nice um all right so i think probably the last question before we let you go um we've heard a lot about zika pro but uh your role at the psc as far as i understand it isn't limited to just uh zicor proof so in like a couple minutes do you mind sharing other cool interesting projects that the psc is working on that people here might be interested uh to find out more about okay so i am also coordinating projects inside the team so i guess it is a good good chance to share what we are doing just one place um okay oh yeah you can just go to the apply ckp.org and we have a projects list here so uh interrupt tls notary coco offensive set zk key but let me introduce some uh fun stuff here so um the rate limit liter fire is a protocol using a schumer signature that reveals your private key if you send too many messages at a given time yeah so it's a it's a it can be used as a spam protection protocol so we are trying to apply this to multiple some use cases and unirib and uneurope social is a reputation implementation using a uh on the anonymity anonymity anonymous identity so for example you can you can prove that you have a certain amount of reputation without revealing your real identity and these kind of things can be used for the new types of social media which can be pretty censorship resistant but also pretty can be might be resistant to a a some bad content yeah so we are trying these experiments too and vls wallet is a a scaling tool using viola signature so it's we are uh yeah you can you can use that already and also sema 4 is the we are making semaphore as a standard protocol for the membership proof i mean zk identity so you can visit semaphore then you can see some kick setups and boulder plies and the documentation about how it works and zj keeper is one of the project we think very important that is [Music] recently we are having more and more ck related applications but because of these characteristics of zkp it's pretty difficult to find uh if there is any kind of a hack or a leak of information or etc so for example you generated some witness using your browser but the broader application was licking your information like but then actually that is pretty difficult to figure out which account is linked because everything is private or everything is like hidden so someone can generate some fake uh proof continuously using the uh leaked information so we it is pretty important to have a secure environment to for the broader zika style proof generation environment so this is a project for that and zika evm is a ck roll-up implementation of the every vms um of course so this is a key of the ck roll up and may see we are using mesa for the contracting voting and anti-bribe system so this is also we are trying to apply this macy to some um other use cases uh as much as possible uh yeah and actually tiana's nu3 is also pretty cool that um uh this is a um i mean this is a a little bit stealth so i think that um i'm not sure that it's the right time to share this but uh yeah if he yeah this is based on rsa but um yeah i hope that we can have another time to share about the chelsea train later yeah that would be amazing um yeah and uh like kitchen said we will try and get other people and other pse projects to share as well um if it's anything as uh exciting as the one today i think we'll have a lot of content to go over so uh yeah thanks everyone for joining i think today there were some very very good questions and uh most of all thanks what's up for your time uh we've gone more than an hour and a half so yeah thanks thanks a lot for sharing your time with us and let us know whenever you're in kl at all we'd love to post you and we'll show you around um malaysia and industrial office thank you so much all right yeah all right so uh thanks everyone we'll be sharing the recording for this uh later and um see you guys oh yeah uh bye-bye thanks up uh just a quick uh note uh we got we are going to have like a start-up malaysia coming up at the end of this month um so for those who are interested in learning knowing more of the recent projects that will be for if so and also for the recent start net house hackathon we will be sharing those as well so uh it's a good time for you to get a get our hands a feet wet into the development of the start community in the start net ecosystem uh it's going to be like from a to z we are going to show like the front end to the integration and to the how cairo is being written and the testing so yeah we have two projects to showcase so that's pretty cool thanks to if so for giving us the opportunity and thanks uh stunner house also for giving us opportunity to to hack and build fantastic projects so yeah i look forward to seeing you guys all right thank you john um and we will most probably have the next in-person meetup on the 8th of september um not confirmed yet but uh most likely um sorry 7th of september so um we'll let you guys know more details later and if you're in the meetup group you will get the notification when it is created so again thanks a lot everyone and thanks a lot one stop for sharing your time with us thank you bye-bye thank you bye