Truebit - Trying to Fool a Blockchain - Dr Christian Reitwiessner

[Music] yes so it's yeah if your name is so great because with this with the theorem we now have this awesome Turing complete world computer and because it's Turing complete it can do anything other programs can also do and this means smart contest can now verify solidity source code but just recompiling it they can analyze the stock market they can verify state transitions in private chains which means you have chains that connect to each other they can evaluate neural networks and thus you have artificial intelligence on the blockchain and this in turn means that smart contracts can improve their own code by analyzing it and we can even do fully homomorphic privacy preserving elliptic curve CK snark mixes stuff boom but yeah I mean you all know that this is not really true because these smart contracts are really expensive and they need a lot of gas next slide please yeah okay so yeah these tasks are too expensive and they won't fit into a block and then the the usual thing what you do is you you go off train this means there's a task giver a smart contract that asks some program to be executed and then there are workers which register with this system and compute the solution off chain and yeah the problem is if two workers submit different solutions than you some some have to decide which is the correct solution and the easiest thing to do there is just take the majority solution so the solution that has most workers submitting it that is not really stable there are easy ways to exploit that especially if it's easy to add new workers and the question is can we do better and this now comes to the the true--but project or in general interactive verification of off train solutions or off train computations and it's a cooperation with loyal Lou and Jason toys who wrote a paper about that I will also give a talk I think tomorrow about oriented and the general framework was already published in 2011 so this general interactive verification mechanism but we want to take this mechanism and and put it on the blockchain and add proper crypto economic incentive ization to yeah to do that and the the idea is to achieve similar trust levels as direct on train computations would would do but at a fraction of the cost so this is basically about a way how to scale the blockchain because you can take expensive computations of chain this is so as in all these approaches we've also seen it in the previous talk about state channels it always has a yeah privacy component too but it's not 100% safe so we're focusing on the scalability here mostly and how distribute works so we still have the same framework where we have a task giveth at publish the task and then workers submit solutions but now we don't take the majority of solution instead we allow solutions to be challenged so if two workers do not agree on the solution then the yeah this so called verification game starts and the verification game is built in a way so that the honest actor will always win it this there's no way that the honest actor can lose it and no not yet please and so it's also really cheap because they are the only on train part is that you only have to store hashes and then at the end of the whole process you have to do a tiny come Oh step and yeah this means because the the the honest actor always wins you don't have a 51% attack but in 100 percent attack you have to all the the workers have to collude for it to fail there's a small fine print although so we have to assume that transactions are processed in time which means we need a censorship resistant blockchain which is not and we need an upper bound on the of the delay for a transaction to be processed okay how does the verification game work in detail let's assume we have a computation with 1 million steps and at each of these steps the parties can be a Merkel tree of the full memory and then they okay they don't have to compute it at every step by the time steps sorry and it works as follows so [Music] slowly slowly please so we have step one and step one million they have the same input but different outputs and then we then the small contract takes a look at the at the middle point and asks again for the route hashes and next place and then we see the route hashes are still the same and what we're looking for is a single step where both parties agree on the previous route hash but they disagree on the next route hash and because they agree here on the middle point but they disagree at the end then that in this in the right-half there must be such a point so we again ask in the middle of the right half and there they disagree and yeah and so on we again ask in the middle of the yeah yeah so yeah and this continues a bit and in this case yeah we found a certain step where the previous route hash is the same but the the following route hash is different next slide please yeah and it so in this case it took 20 rounds for 1 million steps [Music] and after we have found this single step all the information is published to the smart contract and it verifies this single step so access to memory is used via via mocha proofs of course so this is really really cheap okay so 20 rounds sounds so 20 rounds and comparisons 1 million steps sounds really good but the problem is that we have to do this on train it does not work off chain because the two parties have conflicting incentives and this means it takes at least 20 blocks [Music] but there are techniques to further reduce this and more importantly we have this verification game but because of the fact that the honest actor will always win it it will never be played at so at least so if you lose it you of course have to pay a fine you have to you lose you lose your deposit and so there's a great disincentive to to even try it and you can of course try it but it will cost a lot of money yeah specific numbers if you take a look at the one hour computation of 4 gigahertz processor you get roughly 14 times 10 to the 12 steps and if there's a disagreement then you there's a protocol that finds the cheater in ten rounds and in each round you have roughly 600 bytes of messages yeah okay next slide please so how do you practically use it the idea is that the tasks are implemented in c c++ or rust so anything that can be compiled by LLVM and we use a special back-end called lan i the reason is that Lana is a very very simple virtual machine or an open virtual machine but a very very simple machine and it's easy to implement this single step as a smart contract and so if you have this task then so then you kind of post the source code of it into the system and you provide a fee and then workers can compile it to land I execute it and yes I've made their solutions a potential bonus that will come out of the system is that we can have swarm as a real actual file system for smart contracts so you can have smart contracts and yeah just regularly open files read and write and so on okay I think there's one more slide yes so the current state of implementation of this project is that yeah we have some proof of concept code we're now working on the the actual incentive and penalty structure and we're looking for some research grants in that area and for the implementation we we successfully apply to function for a banks on blockchain labs grant thank you for that and yes so that's the progress so far okay yeah thank you [Applause] [Music]