Patrick McCorry - King’s College London - Ethereum London

yay thank you awesome awesome introduction yes so I've got one question before I begin who's heart of the Lightning Network before everyone has does anyone have any idea how it works we have like two three four okay so I'm not going to explain how the Lightning Network works per se but I want to give you a rough intuition of what's going on there okay so when I'm going to talk about a skilling cryptocurrencies velocity of channels this is a collection of maybe two to three years worth of work and I did it with lots of help of many co-authors Andre Miller you know Ben Taub so you're Bakshi Chris Buckland Sir Michael John and Carlos and it's also funded by the etherion foundation and the Athenian Community Fund so others funding is really hard to do any research so that's all my you know acknowledgments over with so what's the motivation for you know layer two and off team protocols as everyone here is aware crypto currencies don't scale in their current form bitcoin supports roughly seven transactions per second under theer and supports 12 transactions per second and if you guys who follows crypto twitter here by the way lots of people follow encrypt everything the drama recently about the etherium through notes that no one's actually running a foo node because it's too expensive you've seen it I tried to take a screenshot just before and fat maybe I've got the screenshot here I tried to send it to myself on slack because I was a seeing it others sitting there so no that's the wrong chopped where is this no it's not here okay I'll get it later but anyway the whole point here is that because the theorem doesn't scale no one's actually holding the miners accountable okay so what's the trade-off you know what is the why can't we achieve 5,000 transactions per second what is the fundamental trade-off that's going on and I need to describe it in this format okay what we can imagine is that we could support 5,000 transactions per second ever there's 5,000 transactions per second then that's really exciting there should be low transaction fees and everyone here can afford to use the network but the trade-off is that ever there's 5,000 transactions per second then these humble laptops here they lack the competence the bandwidth or the storage to actually verify 5,000 transactions in real time you have 5,000 transactions per second in real time if I can't verify transactions in real time I can't validate the blockchain in real time and that means I can't actually hold the miners accountable if they include an invalid transaction I can validate that I can't detect it so this new network is no longer publicly verifiable because now we have to trust the miners on the flipside evans like the Bitcoin world and we support 7 transactions per second then what is exciting is that I can download the Bitcoin blockchain today and within 2 to 3 days I can catch up to the current network but as you guys made of witnessed in December 2017 when you go past our throughput you know when you go above 7 transactions per second then the transaction fees spiked from two cents to twenty dollars so raise your hand here if you spend $20 on a Bitcoin transaction some people all look at this the Bitcoin maxi's are out I'm only joking but that's really important because well you know more people can hold the miners accountable very few people will use the network it will only be B it will only become useful for people with a high net worth and I don't think that's why most people are in this room you know we're not here the benefit high net worth people we want to change the world a little bit like your wallet like you want everyone to use that now does millionaires so the question is we've thought you know trade-off in mind how how can we scale these networks and there's several ways we can do this you know we can just give up another centralized solution you know we're cypherpunks we don't want that you know we don't want to have a central authority dictating what we do the next question is well can we tweak the consensus protocol you know could we do it coming through ad I get it Corino maybe combine classical and Nakamoto consensus and maybe we can then achieve 5,000 transactions per second but that isn't good enough because while we can increase the throughput we then run into that dilemma where we can no longer hold the miners accountable so what the etherion community is really excited about now it's sharding you know why don't we shard our way to scale now what is charting at a high very high level is the following there's a shard for hotel bookings and they're just shard for tram bookings if I only care about hotel bookings then I only validate the transactions in this chart if I only care about ramp bookings then I only validate that you know the transactions in this chart so the whole point there is that we distribute out the task of validation you only validate the transactions you care about but ultimately it doesn't solve the problem if I care about Hotel you know hotel bookings on trampolines and I care about cross char transactions I still have the validated everything anyway so we distribute out the tasks but we don't get rid of that problem so this is why I'm excited about off Cheam protocols all chiyan is a scalability solution but it doesn't really increase the network's to reboot the whole IAM is to reduce the networks load instead of sending every transaction to the network maybe I could send one transaction to lock up some coins and then I'll add some bulb we can just transact locally amongst ourselves thousands of times and then at the very end we can send one transaction to the network to release the money and give everyone their coins so that's really exciting from a scalability perspective now when I'm going to focus on today or channels this is one exciting way we could scale the network now there's lots of research done on how to build a channel Spielman channels is from 2013 that's a one-way payment channel where all's kambei Bob but Bob can pay Alice then we had duplex maker payment channels and we had lightning channels and this is for the Bitcoin world then we had right in for the etherium world to support one you know bi-directional payments but today what we're going to focus on are steer channels nice steer channels try to take this a little further instead of just doing financial transactions curt a group of parties take a smart contract and take it off chin any arbitrary smart contract it could be gaming VOC you know voting or auctions so you can have five parties they run an auction locally and then they've you know send the final result to the blockchain if we can do that that would be really exciting so what I'm going to present is kitsune which is a very simple way to do this one of our goals was to build the simplest simplest deer channel possible okay now what does they stay a channel at a high level okay now in the summer in Berlin we had to see a cello workshop where we invited seven or eight teams in the world who are all building Stier channels to come and present their solution and it was a fun day who knows seven hours of steer channels tear channels tear channel steer channel it was really exciting but what I discovered was that every team's basically doing the same thing but they have different terminology different language and slightly different ways how they describe their protocols so when I want to give you guys my best description obviously a channel and it's pretty straightforward we have a group of n parties and they lock poins up in the Block Ian and now every time we want to execute the application every single party hasti agreed to it so we consider poker if I play my hand every party will execute that command they'll compute the new state they'll sign it and everybody will exchange signatures once I've got a signature from every party this is neither new state of the game that I have played my heart and we do this for every round of the application now that doesn't make sense it will be clear very soon now what's exciting about a stayer channel is that we need to guarantees first is safety or security you know if I have 10 coins in the channel I should always be able to get my tan coins back out there should be no way the lot my coins up in the channel such that I could never retrieve it the second guarantees liveness what of em playin poker I play my hand I'm about to beat why would Bob ever agree to that state update why would Bob ever sign away a hundred dollars in this case the state channel should guarantee liveness says that if one person doesn't cooperate I can still always continue the application and the application can always reach a terminal state okay so I hope that's clear so far to everyone the idea of us dia Chano now for two to three years there's been lots of research and how to build steer channels but no one's really done an experiment on actually building a steer channel and working out how well it works in practice so at the IC 3 boot camp this summer a small group of us decided that try to build one for real and these were the questions we had like Ferguson for example given an existing smart contract what are the minimal modifications you have to do such that it can be deployed within a steer channel the second question was what applications make sense in a steer channel because there's this really annoying requirement that everyone has to be online and ready the sign stared updates how many applications fit within that category and finally what are the inherent weaknesses as you're gonna learn steer channels are really exciting why one there's instant finality we no longer care about blockchain latency if there's a block every 10 minutes we don't care it's instant the moment everybody is signed on of you remain in this small group of parties running the contracts free you don't have to reward the blockchain there's no central hub the reward there's not even a network it's just a small group of parties in a channel running an up so you could run the smart contract for free but that doesn't come for free as we're going to see and to do this we build the two-player game battleship so you know he's heard about her ship before most people have that's awesome I give this talk in han xue in china and no one's ever heard a bottle ship before you know the Chinese have not played battleship but but one criticism I always get for this work was why did you build bottle ship you know who wants to play battleship on the block chin now the reason we did this is because every stair Chano company every time they offer ties their work they're either building new tik-tok - rock paper scissors chess go they're just building these games so we thought okay let's go build again that's how they're marketing their work let's see how well this works in practice and as everyone's aware boto ship is a two-player game I play as my ships they please their ships there's a 10 by 10 grid and when I take my turn I say I want to tack sail a 1 and then the current party has to reveal if I hit water if I had a ship or of I sank their battleship you know the straightforward game the play now in our experiment we had two different smart contracts we had the application smart contract that is the battleship game then we have the second contract that is the steer channel contract okay and the steer channel contract just locks parties into the game and then as an it controls this dispute process that we're going to learn about to bury shortly so in our experiment bottle ship is already deployed in the blockchain you could play below ship as normal there the blockchain if you want it doesn't have to be locked into a steer channel then Alice and Bob come along and they decide let's do this in the steer channel let's now play this very the blockchain they both cooperate they send their lockup message and now the steer channel is deployed it houses a little wizard Hut you remember runescape it's a little hot for in skip okay now the point here is that the battleship game is completely frozen you cannot play bottle ship on the block scene right now all functionality has been disabled and the steer channel is deployed now how do we play butter ship off chin is actually really straightforward we call this replace by version so every state has a counter and whatever state has the largest counter and has been agreed by everyone will be considered the latest state of the game now the current state of the game is that as Allah's turn to take a shot NAB you guys squint hard enough it'll look like I was just taking a shot from a real battleship you know this is battleship on aetherium really exciting live game okay so how does she lock in her shot she's gonna send Bob the attack command on the new state of the application and she's also gonna stand over her signature that's he's authorized the new state now how does Bob verify that this is really the new state of the game before he signs it it's really straightforward he gets the current state of the game he gets the attack command he executes it he'll just compute the new state of the game and he'll compare this with what he received from Alice if they match up you know that is the new state of the game Alice Bob will sign it I'm pass his signature over the Alice once a perfect Gian signatures that's the new state of the game I'm not really straightforward we can do this for every step of the application and that's exactly how we run the game off chin and that's really cool what they're actually computing and this stage is a smart contract code locally now you could use remix get the evm deploy the smart contract and just run the game locally to make sure you're running the same code as everyone else but this looks a bit too good to be true okay so the question is what a bob doesn't cooperate what a bob doesn't respond you know maybe all's sank his last bottle ship why would Bob ever sign away $100 if there was $100 bet as I mentioned every steer channel should be able to guarantee liveness that the application will always complete says that in this case Alice can always finish the battleship game now the do this we have a dispute process okay where all's can self enforce the game execution herself now how does this work in our example what Alice will do is trigger a dispute and now there's this fixed time period for both parties to submit evidence to the blockchain about what was the latest state of the game I maybe Bob sent an older state of the game okay where maybe he hasn't lost the game yet and then all of us will send the latest state of the game where she is just about to beat Bob after this dispute process has expired any party can resolve the dispute when we resolve the dispute what's basically going to happen is that the battleship game will be reenable with the latest state of the game now that the battleship game is really bold Alice can just finish the game via the blockchain as normal and win the game so that's really straightforward this entire dispute process is just trying to work out what was the latest did both parties agreed off Chian before we re enable the battleship game and that's all that's going on but even this doesn't come for free because now you have this new always online assumption Allison bulb have to remain online fully synchronized with the network and then the Watts out for Marlys disputes so let's consider an example okay maybe Alice won a million dollars playing battleship you know high stakes battleship game you know she goes offline you know she goes the bad lambo because she must be any lumber bro because he won a million dollars playing battleship now when she's offline Bob is gonna try to get his million dollars back so what he does is that he triggers a dispute he sends an older game state where he still has that $1,000,000 and now the blockchain just takes away you know the dispute process is on and eventually it's going to expire now the question is well Bob get away with this well the dispute process expire will he be able to withdraw his million dollars from the contract I'm reversed the entire game or well all's come online and see of the day and she's gonna see of the day cuz he just got here in her Lambo so he brought causes the latest state of the game she gets to keep her $1,000,000 and that's basically what acting against recall as an execution fork Bob tried to fork the execution that was agreed off chiyan by using the dispute process and all this has to remain all line and be ready to respond at just the right time now this time last year we were working on a paper or basically we thought how can we help alleviate this new security requirement it's somewhat a fundamental problem of layer 2 so can we help a little bit yeah we conquer rid of it can we alleviate it so this is where Pisa comes in I'm pieces leaning tower in Italy but in my pictures leaned in the wrong direction is to be leaning towards the moon but I'm not very good at Photoshop so Bunny wants to fix that please help or you can move the moon over there you know that's what I was also told to do but pieces is a countable third party so the basic idea is that before you know Alice goes offline she could hire this third party to wash the channel in her behalf and then if Bob does trigger a dispute Pisac you'd respond on Alice's behalf really simple idea now when we designed the protocol we wanted to satisfy the four following properties first there should be steer privacy if I hire this third party the third party should have no idea what I'm doing in my channel you know maybe I'm playing butter ship maybe I'm playing chess maybe I'm banning assault rifle you know whatever I'm doing in this channel pieces you have no idea what's going on there should be fair exchange if I hire the PISA tower I do have evidence that I've hired the tower and at the same time Pease should get pad so there should be a fair exchange of a payment for a signed receipt there should also be order one storage pieces to just store one piece of information per customer okay they if I hire peas at 1,000 times from this channel Peters is a store one piece of information and I'm practice that's about a hundred 300 bytes it's fine little information and then finally recourse as a fan also deterrent this is the accountability part what a piece Bob collude and they steal the money from Alice Alice should be able to come online and penalize Peter for cheating there should be some financial recourse of Pisa cheats now I'm going to present this at a very high level again we have this D a channel contract that basically only cares about hashes signatures and a counter and it was designed to be compatible with most applications they were the PISA contract and at the heart of pisa I don't need those two things it's more like a service level agreement you know you store this large security deposit and I the contractors wits around for evidence and there's any evidence the third party cheated it will then forfeit that deposit so it's really simple what's going on so how do we set up Pisa we have the Pisa contract we have the third party they've got a smiley face they're happy they're gonna make some money and then the third party sends over money and now this is locked in the smart contract in the Pisa contract and either the guy can start you know watching channels and other people's behalf how do we achieve Stier privacy this is actually achieved by the way the channel was designed basically all Alice houses and is a signature from every party in the channel the hash of the current state on the counter you know I plus one all pizzas should receive is a hush and what's really exciting is that when we route this work you know a few months later most of the steer channel companies haven't adopted this approach so moves to them over a tie on a hush so that means we've Pisa works you get steer privacy for free so how do you do this fair exchange of payment and cryptographic to receipt I don't believe I've got it on this slide because it takes about five minutes to explain I don't have that amount of time but the basic idea is that you know you sent a payment and an appointment Pisa will send over the signed receipt and then what we're going to use is this idea called a conditional transfer all this will set up a conditional transfer repeater where if PZ reveals a secret PZ will get paired the money okay so the high-level it will say Pisa if you reveal the secret of a harsh before time T you get the coins if Pisa reveals the secret that receipt becomes ratified it's valid you can now prove you've paid Pisa at the same time if all is doesn't cooperate then because Pisa has a secret on this conditional transfer it's always guaranteed to get paid if it reveals a secret so you don't have to worry about how it works at the moment but what's nice is that all of us will always get a signed and ratified receipt the Pisa has been hired if Pisa accepts the payment now one of Pisa cheats you know what are they cookies I'm Bob collude and they try to steal Alice's money you know Allah all's comes back online maybe after two weeks she's pretty angry because she lost all of her money but it isn't too late because on the blockchain there's a dispute record there's a record of the dispute and all assisity a channel and olives also has his ratified and signed receipt the Pisa was hired to watch the channel on her behalf so all Alice has to do is give the Pisa contract this sign and ratified receipt Pisa we'll talk to this eh ah no contract request a list of disputes or one dispute in this case and then the Pisa contract will just say well the dispute happened on this state it was associated with this counter aversion according to the receipt Pisa was hired Pisa had enough information to stop the dispute or at least end of the later state Pisa cheated you know forfeit pieces deposit so in this case you know all us can get revenge you know revenge is sweet neither accountable third party has a tear in a sad face because they lost their money now in this key as Ollis doesn't get compensated the service level agreement is that if Pisa feels the serve your channel they will lose a lot of money now there is an alternative scheme where Alice could get compensated we're all as coud get some money back at Pisa cheats the issue of that approach is that any central party with a security deposit on the whole point of the security deposit is to be a fan also deterrent if you support compensation you actually weaken the fan also deterrent and it's really a straightforward idea why that's the key is let's say I'm Pisa I have ten thousand dollars out you know as a deposit Alice comes along I only care one thousand dollars to her channel what I could do is create another account and allocate nine thousand dollars to my other account when I cheat Alice she can punish me he gets the thousand dollars there my nine thousand dollars were good and my second account so how many lost a thousand dollars I didn't lose all ten thousand dollars where normally watch it happen is that in this case if ever $10,000 deposit and anyone can prove that I cheated well one issue is that what if Alice is offline well Pisa could do with the Siebel on the second account is look like Pisa cheated their account and the money over here and then they know yes so if they're equal collateral then there's no risk the allas [Music] if you double collateral there's two issues there I think the biggest issue is that you restrict who can hire Pisa you restrict the comeup not like you have to pay a premium the peas would be double collateralized yeah I think as long as you're like equal collateralize is fine you know there's no risk the others because she'll always get her money back but in that case he still limit her money people who can hire a Pisa but anyway I can talk about that during Q&A if you want there's actually really interesting thing or there's it's like a generic problem for any protocol of the style so it's actually really interesting to think about we never really thought about until we designed this but anyway Pisa is in the first protocol to try to do this over the years there's been three protocols all together there's monitor that was by Taj skilling Bitcoin 2016 and that was designed for Bitcoin and as a really straightforward idea and the customer I encrypt my channel information and I give this to the monitor if the monitor can see a dispute they can perform a decryption and then sand and resolve my dispute now the entry because of Bitcoin is that this requires order and storage so if I do 1,000 payments in my channel have they give the monitor 1000 encrypted blobs and have the store all of that for the lifetime of my channel so that's quite annoying another issue is that the monitor has no idea this encrypted blob can be used to resolve a dispute Zegna decree lots of encrypted blobs and to send it to the monitor and the other stored junk of my behalf now what's Tower was by Rose B from lightning labs and his is an improved proposal there's order order one storage on the watchtower I can verify that this can be used to resolve a dispute the issue is that it doesn't work in Bitcoin today it requires the protocol l2 which requires a new consensus rule in Bitcoin Wizards at least two or three years away which is really frustrating then e of pisa was a design for aetherium so it works today on basically a solves these problems but what is really exciting is that the fair extreme that receipt works in Bitcoin today so we actually improve the watchtower proposal as well you know that's always nice so what's really exciting is that we are building Pisa so thanks to the etherion foundation money Pisa is gonna get built and hopefully used by some layer to projects okay I finally got a logo took me about a year we got a logo for the project you know I'm very good at organizing but what I want to do is like so Pisa has some legitimate criticisms Pisa and the initial paper with a single Watts Tower or a single tower that's watching the job you know really that's a dass factor you daus that one tower pisa kaluza's deposit so we have an idea how to do a distributed watching service well there could be 20 Watchers if 18 out of 20 accept the job then we'll watch your channel and the idea that is that there should be an untrusted untrusted coordinator in the middle so everybody is how to get around that issue what we're also want to look investigate more is that it comes down to that issue about liability one issue is that maybe I'm watching you 1 million dollars worth of channels you know could be 10,000 channels they all out of the 1 million dollars maybe I've only got a 10k deposit you know I'm where that's like a fractional reserve and if I could cheat some of these channels I'm gonna make a lot of money so this paper here's from 2015 and you can actually prove solvency there should be a way where I could prove to you guys that I'm not over collateralized or under Claud realized that the what channels I'm watching you know either it's equal collateral or maybe a slight fractional reserve so that's still on the to-do list to do but I believe that's very doable for Pisa unfine aliy one people one thing people normally ask is out you know why don't you build a side chin you know the side chin full of Watchers then you sent a job up and you hire the Watchers by the side chin that's a really complicated design that really isn't worth the engineering effort you know while you really need is this distributive watching service with 20 or 30 Watchers so that's too much work for us to build but I always put it there because people ask about it okay so I'll start wrapping up I guess you know final thoughts and future work so we're going back to stare channels so stare channels are really exciting as an Austrian protocol there's no latency there's no fees and in the bottle ship kiyose you know you can do 200 transactions off Chian now a battleship team requires 200 transactions on average is about 70 I got that from a blog post but this is cool though we could play battleship off chin this is not normally a game you play on the blockchain because it requires 200 transactions in the worst case but in the worst case it's pretty bad okay so while kuttappan is that both parties agree to open the channel both parties then set up the game they commit $100 each and they're ready to play battleship they're fully committed and then bulb just stops cooperating but they know all as I don't want to play this in the channel the channel breaks down and I both players have to play but ership via the blockchain for the entire game now that may not sound bad but why is this a really really really really really really bad worse kiss now there's a transaction fee for every move and now there's like you know everyone everyone hits like in a video game you now have to give like five minutes for the counterparties transaction to get into the blockchain you know you need some window of opportunity for then they get a transaction in now I'm going to ask you guys a question ok let's pretend you're all playing battleship okay and you have a $100 bet on this battleship game would you guys pay $24 and wait around for 16 hours to do 200 transactions to finish this game weird honey of you do this for $100 one person we got this dear channel maximalist now you know but this is important you know this is human psychology you know always you just reach quit and just give up her $100 obviously and in our experiment actually bought but we had two BOTS playing battleship and when we were building battleship we thought with you know one of their human you know what are they're actually real people not just like algorithms I'm in the worst case scenario you don't risk wit so bottle ship doesn't actually work in this dia channel okay so when I give this presentation one of the first questions is how I don't have a reputation system you're already going to play people with a real reputation and actually building a reputation system on layer 2 or at least four channels it's actually a non-trivial problem you know there's Alice and Bob we can identify who triggered the dispute know maybe Alice close the channel but we can't distinguish why the dispute happened you know maybe Bob didn't sign the state update maybe Bob did sign the state update analysis line we can't identify why the channel broke down because of this you'd have the ponies both parties equally and that makes it actually non-trivial to build a reputation system so that's still an outstanding problem so the next question is well how do you induce cooperative behavior how could you set up the games such that bob never gets disadvantaged bob never has an incentive to make the channel breakdown I mean what my gut feeling tells me is that this is only ever the case if the smart contract is already reasonable to execute on the blockchain if you're doing payments or an auction or a small voting program if you're willing to do that on the blockchain then you'll be willing to do it in a steer channel so border ship doesn't work because you would never play battleship via the blockchain and it was too long is too expensive so you wouldn't do an estate channel in the worst case scenario okay so they're basically the two million problems that are outstanding fresh deer channels now I do want to highlight is channel is only a once more like a very small part of this picture we have you know payments we have auto-ship you have all these little payment channels where people are playing games the others idea of a commission are noncustodial hopes miss rummy in the back work zone sorry romney just identifying you so the idea here is there's no custodial hope and their only job is the cornea payments off chin I get set up a hub I don't need any collateral locked up you guys can all deposit Kines a my my only job is to root your payment's and that's really exciting it gets rid of the big prominent lightning where you need a lot of pre clutter or lockup in order to receive a payment says well I got another question for you guys so if you wanted to use lightning I knew let's say you want a channel of 100 coins but you have to pay a 3% fee so three coins in this case he opened the channel how many people here would do that you know you have to pay 3 coins before you even open a channel to receive payments does anyone here want to do that there you go Bitcoin maximalist I'm only joking there's the receive payments only to receive payments payments so else I call this the event problem where I'm gonna run an event I'm gonna sell 200 tickets one coin each I need a channel of 200 coins to do that I now have the pay three koi or in this case six coins just you open the channel in the hope I'll sell all of my tickets and that's really annoying from yep monopoly money now money Duke into actually noncustodial Hobbes is actually like a side chin in a sense it's very similar in the sense that there's a chin of hashas on the block chin but it's still different from a side chin so our egg Finny's in two seconds using these two little features we can build it off cheer noncustodial payment network and that's really exciting Watchers is what we're gonna build with the final piece of the puzzle and the blockchain is a settlement system on a root of trust it's no longer used for every single payment it's only used to settle disputes and open channels do you care about our vision you can read this little Google link on the I believe a long blog post last week of my thoughts of how this is going to evolve over the next five years I can leave it there they'll give me my last slide [Applause]