Polygon Nightfall, an Optimistic ZK Rollup Privacy Solution

[Music] [Applause] [Music] i think uh with the head we are ready to move on to our next talk and now for this one i'd like to invite paul and titania for talking to talk about polygon nightfall so without further ado let's welcome paul and team hello hi everybody paul brody here uh so i'm the global blockchain leader at ey and wow so just i was watching the last presentation that is a very tough act to follow but we are going to do our best i'm only going to take like two minutes before i introduce my colleague tanya who is is incredible but i want to talk just a little bit about the history of nightfall and how it became polygon nightfall at ey there's a kind of a couple of things that we've spent a lot of time thinking about one is what is it that enterprises need right and there are a lot of brilliant people like sandeep and others who have been thinking very heavily about scalability right but one of the big challenges for enterprises is we can't enterprises can't just use a mixer right because enterprise tokens and assets are often they are unique they're often attached to business contracts that represent a kind of complex business relationships and so we have spent a great deal of our time over the last five years really pretty much non-stop over the last five years from a research perspective thinking about how to enable privacy at scale now the first version of nightfall i think you know back when gas back when ether was a hundred dollars a piece we spent three thousand dollars worth of ether just to build our prototype zkp based supply chain and move some tokens around them and that was an amazing piece of work and it proved the case out for us but we kept iterating and where we ended up earlier this year was with nightfall 3 which is a zk optimistic roll-up technology and uh we built that out and in cooperation with polygon we're really turning this into a layer two system where we can everyone can access private transfers and payments at scale with very efficient gas costs directly on the ethereum mainnet so that is kind of critical to our goal and when we started talking to the different layer 2 providers and there's a lot of them out there and they're they're all populated by incredibly brilliant teams but the relationship that we struck up with polygon with sandeep in the team was incredible because at heart they understood a couple of really critical things that we shared with them a huge commitment to public blockchains an unshakable commitment to the ethereum ecosystem right ewa ey we are without a doubt the biggest sort of large enterprise investor in the ethereum ecosystem we pour our energy into this ecosystem and then thirdly we're both very committed to zkp technology both for scalability and for privacy and so that match the relationship that we built over that has been the foundation of the work that we've done we are so excited about kind of where this is going it's going to be i believe we are all underinvested in privacy that enterprises need it for sure it's an absolute requirement but i think far too many consumers and individuals are underselling their own value by not investing more in their own privacy so i very much look forward to that and i am incredibly delighted to hand over to my brilliant and talented colleague chaitanya conda to actually explain what uh polygon nightfall does and give us a quick demo chatanya over to you don't forget thank you paul um yes i'm titania and i work with uh eui's blockchain r d team today i'm going to talk show you a live demonstration of what polygamy nightfall does um and hopefully a very wise man once told that live demonstrations especially of tech nature are a courier seaside and one that i repeat salmon again because i always end up with a short end of the straw i hope today is not one of those days for me let me share my screen as i walk you through okay now i hope you all can see uh uh powerpoint presentation so i'll give you a bit of context about what polygon nightfall does before i give you the nightfall demonstration itself what is um what is polygon nightfall um you all must be pretty much aware the very first iteration of nightfall was built as a privacy protocol or it still is a privacy protocol what it enables us to do is to do private transfers of erc20s 720 ones or eleven fifty fives between two parties such that the contents of that uh transfer is private so nobody can see the value or the token id at the same time in the not the recipient is also anonymous um so it's a it's essentially a privacy protocol now just to give you a high level summary of how it works because uh this is not the point of our talk here uh you have three kinds of transactions you have deposits transfers and videos in with the deposit what you do is you take a token out of l1 and you put it into lsu when i say alto here it's really a shield contract that sits on l1 and you take any tokens of vrc20 of a certain value when you submit this proof quality deposit proof which then provides the equivalent commitment that holds the value you've just deposited a commitment is is just one way to obfuscate the contents of a token um in terms of a deposit that's really not private because when you move tokens from layer one to layer two or back to layer one that's not where we get privacy we get privacy when we're within layer two itself so now moving on to the transfers where we actually get uh private transfers itself what we're going to do is in order to spend a token a user will first have to create something called a nullifier a nullifier essentially spends the commitment they own and there's no way to connect a nullifier to the commitment it belongs to so all someone who's watching the blockchain can see is that something has been spent but they can't see what has been spent and how much is within it um at the same time when you're transferring something to some other person what you're going to do is create another commitment of equivalent value that you've just spent um and obviously because it's obtusated instead of commitment the contents of the commitment itself were not visible so the value is hidden once again and also the other piece of data that would be as part of this commitment is the public keys that the new recipient owns and so this new commitment now belongs to somebody else anybody who's watching the blockchain can't really see who that recipient is or who received this new commitment now withdrawals are pretty much the opposite of deposits uh pretty similar to transfer you're going to spend the commitment you can't um you when you spend when you create a nullifier for a commitment there's no way to associate what commitment which is nullified so no one can see what commitment was spent and you have an equivalent uh value being released from layer two to layer one um the layer one part again is visible for everyone to see so you would really want to uh do transfers with privacy inside uh layer 2 that's that's the whole point of how you like you'd want to use polygon knight for now um this bit of work that i've just described about has existed for some time now it was first released back in 2018 so what's different between the question then and now is that it does optimistic rollups um the very beginning the cost of the transactions that we've done were quite high they ranged about in the hundred dollar nature uh back in the 2018. the reason why it's quite high is there's generally a lot of data that's been stored on the smart contract in certain in terms of what's held in a merkle tree all the commitments and nullifiers and you also have you're just sending one transaction at a time you're not really batching up now both of these changes have already been modified where the smart contracts are up to my such that we really don't store any data that's not really required to be stored on a smart contract and two we also batch but what optimistic roll up does it takes it to a whole different level where you're really not doing a computation itself on china anymore you're you're really providing what the end state of a computation should be and in case that is wrong you're expecting a challenger to challenge that the end state that you just provided was wrong by doing this you're saving all of the gas costs of computation itself and at the same time you're really being able you're able to scale a lot more in terms of having higher transactions throughput because you can fit more data into a block now so that's how uh polygon knight 4 uses optimistic roll-ups polygon knight 4 uses zero knowledge proofs for privacy so that's the zk part and it uses optimism for scalability both in terms of higher throughput but most importantly lower transaction fees now just to give you where this sits in the layer or in in the current ecosystem of later solutions um later solutions exist in the form of both off-chain solutions and on-chain solutions with on-chain solutions there's usually two approaches one tends to take lately you either use zero-knowledge proofs snarks or stocks of some kind or you use optimistic roll-ups using both of these and you can either get the benefit of privacy with some very good scalability or you can directly write it as just purely a scalability solution where polygon nightfall is is it's an optimistic solution that uses scalability but also provides privacy you would know of other optimistic solutions such as optimism and arbitrary today which are built to be scalability solutions um from scratch and so moving on now just to give you a comparison of private transactions if you were to do an optimistic version of a private transaction as opposed to a z case version of a private transaction what i mean is using optimism for scalability versus using zika for privacy and zika for scalability there's pros and cons to both of these a very good pro for an optimist optimistic solution is that the gas costs are way way lesser um so the gas cost of polygon nightfall is about 9 000 gas per transaction and that comes down to about two dollars at 2.5 dollars today and based on various um at gas prices of course that number is calculated based off of 75 um as opposed to zika solution zika zika solutions which tends to be more expensive in terms of gas now on the other hand with aztec like solutions which is zika zika solutions they have finality uh much faster than optimistic solutions they have finality pretty similar to what a layer one would have optimistic solutions tend to have a one-week wait periods predominantly because you would want to give enough time for challengers to challenge bad blocks if if there exists any one way that polygon nightfall circumvents this is it uses the concept of instant withdrawals a feature that is provided by using liquidity providers for fungible tokens such as erc20s and so that using liquidity providers with instant withdrawals which is a built-in mechanism you wouldn't have to wait one week it could just be the layer one finality as well um the other big differences between the two approaches is that polygon nightfall being an optimistic solution uses something like of fraud proof fraud proofs tend to be ones that are only submitted in case and invalid transactions upon the blockchain zika solutions on the other hand work on valid proofs which means you can't submit an invalid transaction to the blockchain to begin with you've got to have a valid transaction that will verify the proof um generally uh or with zika solutions as well you have computational resources that both of these use and with a polygon nitrile exclusion it's generally it's relatively lighter in terms of the kind of xenon zero knowledge proofs that you would do as opposed to an entire zkzk solution um that is on a very high level what polygon nightfall does but before i move on to showing you a demonstration i just want to give you a quick overview of what are the various players involved and what do they do in inside a polyleg and knife system so here you can see three players you see a transactor a block proposer and a challenger transactors are users who generally create transactions such as deposits transfers and withdrawals and then they submit them either directly to the blockchain or they can also submit these transactions to the block proposes um the transactions that you submit to the block proposes usually are transfer and withdraw transactions not deposit transactions those will have to be submitted directly and always to the blockchain and block proposes then take all of these transactions that they receive from various users and they put them into different l2 blocks and they submit these l2 blocks into the layer one which is ethereum in this case each layer one block an ethereum can hold more than one layer to block depending upon how big these layer two blocks are um and that would exist on so the state of l2 blocks uh the final state they hold will exist in layer one inside uh layer one blocks now you have a third player called challengers who are continuously monitoring the system what they do is that they will take these blocks that are put up these l2 blocks that are put inside the main net they will check the validity of both the blocks as well as the transactions within the blocks and if everything's fine with those blocks they do nothing but in case they do find a wrong transaction or a block that was uh created wrong they will then create something called a challenge this challenge will basically prove how the blood that is on the main net is actually wrong uh when i say mana sorry ethereum is actually wrong and if that proof verifies then challengers will succeed and two things will happen one the block proposal who just proposed the wrong block will be slashed and two the block proposed the block proposal would have submitted something called a stake with every l2 block that they create and that stake will be released to challenges as payment for the work they've done so that's the incentive mechanism that the challenges would have and block proposes their incentive mechanism is that transactors will pay them fee with the transactions they submit to to to be put up into a block and so those are the different participants and finally i will not go into further details about off-chain transactions how block proposals are registered how challenges of challenges are submitted uh just to give a bit of a road map before i move on to the demonstration currently this protocol that i was just discussing about it has been deployed into the test net uh and we're testing it rigorously to catch any obvious or not obvious and uh all sorts of bugs that we could think of once that's done uh the next step would be is to have a proper security audit of the protocol and then it would be there would be a restricted value maintenance deployment and when i say restricted value it would be the amount of transfers would be pretty small originally and there might probably also be a bounty program franchine and tennessee after the main deployment and finally they will be after the main deployment has been successfully run for quite some time of course the restriction will just be lifted and for there to be no restriction in terms of the transfer at all um those are that's everything in terms of context now i will move on to the fun part for you but the scary part to do a tech demo of me this this here which you see is a polygon nightfall wallet it's very preliminary looking just because we're much more focused on having this test of itself rather than having to having it part of pauligan's website already but you can imagine it to be as sophisticated and as beautiful as polygon has their wallet today and it will be part of the website too um so this polygon nightfall wallet uh is run by any user who wants to use this layer to solution to do transfers of private nature um all of the keys both that pertain to the transaction the keys that would be used to send transactions to the ethereum blockchain or the keys that correspond to the layer 2 itself which is the secret keys that will give you ownership of commitments all of those are stored within user's browser none of this will be inside a server anywhere so th this will have proper privacy for for a user and everything in terms of privacy sits at the users and in their browser now another thing is you'd notice that here we have erc20s any rc721s and obviously deposit transfers and withdrawals for all of these um something else to note is ers11 for twice is also possible it's just not part of this demonstration right now and uh yes that's pretty much everything uh before i go on to give you a demo um so firstly i will start off by doing a deposit of erc20 and to myself which means when i when i create this transaction and i sign this transaction what's happening is that the very first transaction was to approve the shield contract it takes some erc20 balance uh from my erc 20 contract and send it to itself and the second transaction is to actually send it to the blockchain so what you see here is i have an element balance of a million i had and now i moved 10 of that to layer 2. but it says pending deposit so that's interesting right why is it not part of l2 already we've got to remember that it's it's a roll-up solution where lots of transactions are required to be put into a block at the moment all i have is just one transaction before i go any further i just want you to show what other players exist here so the one who is running the browser this this wallet here i'm the user i'm one of the participants in this in this network the other users are sitting here so you have our blog proposal and you can see that a blog proposal was started and they've registered themselves onto the layer one contract and they're listening for any sort of incoming events and then you would have a second uh player called the liquidated provider who provides the services if an instant withdrawals required and then you have a challenger who is continuously monitoring the system to see if there's any bad block proposed um other than that this is just the transactions being run up and a bunch of logging that's not very interesting um so today right as we speak there's four players all up and running the system so one one transaction was created it's still pending so now let's create a second transaction this time let's do an erc 721 transaction um i'm picking a token id1 i'm submitting this from [Music] i'm approving this first uh in the erc 721 contract and then i'm actually submitting the transaction so what happens now is that this ersc 721 token has to move from l1 um to lc and since everything is pretty quick what you have not noticed is that initially it was a pending deposit but as soon as a block was created what what that means is that it is now in l2 so the l2 balances have been updated so we've created one deposit of the rc20 that was 10 and one one other deposit of year 721 so that's where you see these balances in l2 the current block size is just you for the sake of demonstration i did not want to create 20 transactions as you were all looking at it quite boringly but obviously this box says this can be much bigger than that and very quickly let's see what our other players are doing so we have a blog proposer blockbrookwood just said oh i created a good block and this is the hash of that block that i've just created and this is the current balances for the user myself so both of us are doing our jobs quite well and we're both pretty happy now what i want to do is i want to do a transfer i want to do a transfer to often erc721 let's say to somebody else the default address is to myself but that's not fun is it so i'm going to do a transfer to somebody else and uh let's pick a token there's just one token in there in layer 2 for the moment in the rc721 i picked that and we'll submit this transaction um i'm signing this transaction to be sent to the blockchain and pretty soon you will see that this l2 transaction that i have goes into pending up flow once again it's pending because it's not been proposed as an l2 block onto l1 yet we need a second transaction to create some blocks so i'm just going to create another transaction in this case let's say a deposit of 10 of erc 20 and i'm going to sign that as well okay now you will see that oh well let's update again now you will see two things have happened um a block must have been created yes indeed it was a git block was created um so i now have a balance of 20 because i i had 10 originally and i just added 10 more and i'm less by one erc721 token so just to quickly give you an overview there is a second account here obviously that i used to send it to and that second account has a balance of vrc uh 721.1 uh just to give you a quick understanding of the second account for the moment i'm just running the second account in the browser myself the keys the level layer two keys that we're using are very different here but layer one they're both the same people because i'm the same person so my layer one balance according to that actual address is still the same but under layer two i have two different accounts and these are the balances of those two different accounts uh but you can extend this logic to anybody out out there in the world this it doesn't necessarily have to be me it would it would run the same way now just going back to my original account and i'm just going to quickly log out and log in again okay now let me retrieve my balances now i'm going to do something else here which is to do a withdrawal of of an erc20 i will click on withdraw and i'll submit 10 but you've got to remember if i just click submit right now uh there's the problem of finality being one week and i really don't want to wait one week i just want my transaction straight away because i need to look for something badly so i have the option here called instant withdrawal so i'm going to click on instant withdraw and i will click on submit and and then i will confirm that transaction and so now you see i have a pending outflow of 10 which means i should pretty soon withdraw 10 out of layer 2 and that should end up in my layer 1 balance at the same time i need a second transaction for this to be blocked so i'm just going to create an erc721 transaction of token id2 i will sign that too and then i will let's look for the balance in a minute okay okay so you'd notice that uh well another step actually and you notice two things here one i've just given myself an rc721 token again into l2 so there's that but there's also an update to my l1 balance um i moved 10 out of my pending outflow into l1 balance which meant i was able to instantly withdraw um the the ten dollars instead of waiting for a finality of one week now let's just see what the liquid liquidity provider saw so the liquidity provider received an install withdrawal request of some for this transaction hash and he provided or she provided me with with the money straight away uh the the mechanism behind this is this um when i create an instant withdrawal what i'm doing is submitting a request that i'd like to instantly withdraw this token and i'm this is the fee i'm willing to pay uh liquidated providers are listening to these bans those are the events that they're listening to and as soon as they see an event what they're going to then do is to basically create accept this this request that you just made and transfer the subsequent amount for me while taking on the wait time for the wait time i would have gone through of a week period onto themselves so liquidity providers like challengers are continuously monitoring the network so they would know if they give me the money straight away today is that safe or not they would know that because they're continuously checking all the blocks and all the transactions and all the blocks by doing so they know that eventually after a week this transaction will be finalized for sure because there's no bad block before this this transaction and there's no way for this transaction to be removed from the network considering that they will do this verification themselves provide me the liquidity that's required straight away and they will receive the money that i would have received a week later so that's what's happening with the liquidity provider so just one final interesting case i'd like to show you i'm going to do just two deposits for this of erc20 okay that's pending i need a second uh in a minute or two you will see there's a pending deposit of 20.

you will see that i now have an l to balance of 20 but let's just give it a few minutes and we'll see something pretty interesting okay now you saw i had a balance of 20 or 30 earlier but now i only have 10 and 20 were moved back to pending deposit so what just happened with something naughty let's look at it um you see there's a block proposal here and clearly so far block proposes has submitted three good blocks but the last block that he just created with my to deposit he purposefully created a bad block with of type incorrect root and he submitted onto the blockchain so what happened was as soon as uh this block was submitted because that was part of layered layer that was that was a block that's part of le ethereum now in layer one my balance got updated saying well your balance is now 30 but clearly somebody was wanting the network which was a challenger a challenger was monitoring monitoring my network uh the network of ethereum and then they realized oh this is actually a bad block let's take a look at that they notice that i just received a block here queue new block proposed event i've just received a blog proposed i'm going to verify the validity of the blog purpose that's what they would have done so as soon as they verified there was a warning they said block checker block invalid with so-and-so issue and as soon as that was that error was was picked up it then tries to create a commitment for the challenge which is challenging incorrect route and eventually it would have submitted the challenge to layer one our challenge commitment has been mined and sending reveal which is yes we will use to reveal the challenge itself and the challenge would have been provided to layer one layer one will then do the computational steps of the challenge itself and on successful challenge it will do a rollback of the entire state until the first bad block was until where the bad block was um when that happens a rollback of all of the transaction state is done and the rollback was received by everyone including the challenger so that's what happened our state was rolled back where we still have 20 waiting to be deposited and um i don't have that balance yet now what happened was i only have one proposal as you can see and as soon as this bad block was submitted this proposal was basically slashed so they're no more the proposer now on a good day if i were to have another blockbuster right now these transactions would have ended up back in the mempool for the second block proposal to have picked up and they would have submitted for me so these transactions would have eventually made it back to l2 without me doing anything and that's just the way the entire network works and the different players are interacting with to give a proper valid transaction state to the system uh that's pretty much everything well in terms of demonstration um i'm happy to take any questions now tony i gotta say you keep saying that like live demos are career suicide but the reason you keep getting picked for them is that you always execute them and then look like a rock star so thank you thank you so much i'm sure karthik is going to tell us that because of the time constraints there are no questions but really a truly brilliant i'm so proud of the work that you have done r d team that has done and the work that we are doing in cooperation with polygon to make this real i apologize that's that's mostly correct uh there there is one question that i do want to ask a quick one that came in but before i ask that question i want to just say i've just been looking at hundreds of comments and everybody's just been extremely happy with how easy you made that to uh to understand and follow and of course the demo work so i just want to make sure that i point that out it was a super um conveniently well made easy to follow presentation that covered really technical topics so uh so thanks for that the question is is a simple clarification that came in from one of the listeners and the question is would challengers be able to reverse transactions made a mistake uh such as kind of getting invalid uh wallet address or any other keys and kind of just how does the uh if it's possible to reverse a transaction upon uh finality i guess uh so yes there's a one-week finality period um you know you really have to do any sort of challenge within that period um so there's various ways a transaction or a block could be wrong either the transaction that was submitted to begin with was invalid the block browser still went ahead and submitted it as part of a block or the block itself that was created with these various transactions was malformed um and that was submitted onto the network what then happens is that block now is part of layer one let's say other blocks were continuously proposed on top of these blocks as well um at this point a challenger was looking monitoring the system they would pick up this very first block proposed that was wrong block they will then submit a challenge that challenges that very block and when that happens all of the blocks along with this block and the ones that come after will be rolled back so that entire state is basically rolled back up and when that rollback happens that rollback is not just happening in layered layer one of the blockchain everybody who's keeping track of their own state in terms of commitments or transfers or transactions they will also have to update their own state so block proposes challengers and users they will all update their own state according to the rollback that happened i i'm not sure if that answered your question to carthage i hope so too uh we'll uh we'll see if there's a follow-up question that comes in and if if there's any uh still any confusion or follow-up questions i'll just ask them directly over email and connect you uh both so thank you so much with that um with that amazing presentation and we are ready for our next talk thank you [Music] [Applause] [Music]