Vitalik Buterin: The need for standardization of L2s, smart contract wallet | ETHTaipei 2023

can everyone hear me okay okay perfect uh then um so I think uh first of all uh a lot we have uh as an ecosystem a lot to celebrate this year right uh so um in uh 2022 in September uh we had the merge and after eight years of uh ethereum the network uh nine years of uh ethereum the idea and uh well probably three or four years of very active development ethereum has uh finally switched over from uh proof of work to uh proof of stake yay um so the this is like you know a very big change to the ethereum protocol it required uh you know writing a huge amount of code creating an entirely new client um change the the consensus layer changing over how they existing execution lawyer Works to make it talk to the consensus lawyer um it required a huge amount of coordination um but you know fortunately uh it's uh happened very smoothly for users right from the point of view of a user you know if uh you do the thing that you know you normally do it and download the yeah the software update for every hard Fork um and in this case just do this one extra step of um also downloading the yeah and running a consensus client then you could just go to sleep before the merge wake up after the merge and everything works right and you know if you're not running a full ethereum node then like you know even you don't even have to do that right so it's a huge upgrade for ethereum's functionality but from the point of view of a user it just basically yeah looked like another day in ethereum which is a big success right that's uh you know generally the way that we want upgrades to happen um and there's a lot more uh upgrades that are going to happen right as so there is uh the transition to scalability um what we call the surge uh so that includes uh Roll-Ups it includes the um on L2 on L1 it includes the uh eip4844 and some other measures to try to increase the amount of data that is available on chain um The Verge which starts off with the switch to Vertical trees uh that that will allow what are called stainless clients right clients that can verify the chain without holding any state themselves and then in the longer term this basically means uh using ZK EVMS on layer one right so that you'll be able to use asyndark to verify an ethereum block uh The Purge protocol simplification so starting off with the aip444 so the clients don't have to store the full history but then also going into trying to simplify the protocol Banning self-destruct is one of the yeah top eaps right now and a few other things dealing with Mev dealing with centralization risks uh The Scourge um and basically everything else including account abstraction which is really powerful for some art contract wallets including multi-sig wallets social recovery wallets while it's using different kinds of cryptography and lots of other things and this is uh the sporge um so that's all that's all no one um on L2 uh we've seen uh Roll-Ups right so another big milestone is that Roll-Ups this year are finally starting to hit this Milestone that it calls uh stage one right so this is a set of Milestones that uh yeah identified in this post I made on ethereum magicians last year which is basically pushing Roll-Ups uh to uh try to like actually yeah you know have their proof systems whether it's optimistic or zika's dark or whatever else on chain and um you know and basically not just people D6 right because uh in our ecosystem we have a lot of figs that call themselves way or twos but actually are just multi-cigs and at the time like basically all of the major Roll-Ups uh were except for the non-evm ones like I don't know Fuel and and uh Loop ring and a couple others that I'm missing were just all multi-cigs right they were working on proof systems but they did not actually have them and polygon um you know as of the end of March actually yeah you know has their approved system turned on they do still have a multi-sig but the multi-sig has a you know a very high threshold it is I think six of eight with uh eight various independently distributed participants uh so it's uh it's basically a huge number of uh of people or like almost almost all of this group has to agree um I guess it's not a huge group of people it's uh but it's you know a diverse group of people and the great majority of them have to agree to kind of override what the uh what the code says right and they have plans for two kind of over time remove that mechanism as well uh and uh other Roll-Ups are kind of following on pretty soon right so arbitrum I know is like I forget ether at this summer there's this Milestone by this point where they're very very close to it um and then um you know optimism and scroll and uh Tycho and uh all of those are kids here you wanting to work on this as well um there's a team in the in the starkware ecosystem Kakarot which is like continuing to work to work on uh on Roll-Ups so Roll-Ups are finally kind of turning into you know really properly being real Roll-Ups which is amazing and I'm an overheading actual Milestones here with actual proof systems on mainnet uh further work on privacy Solutions so there's uh Aztec uh which is continuing to improve um you know Nocturne is doing stealth addresses more and more groups uh starting to appear social recovery wallets um Argent has existed for years um Soul wallet is uh actually based on erc4337 so it's like very uh you know pushing to be standards compliant and to be a kind of drop-in replacement for better mask so that users look they don't can't they're not just using it as a a wallet for spending uh but actually yeah I'm going to do all of the ethereum interactions non-financial applications sign in with ethereum um you know the reset uh interest in web 3 social networks so a lot of things are happening on way or two as well but there is an important way in which these things are not like the merge right so the more the nice thing about the merge as I mentioned is that the mirror in the merge the user could mostly just go to sleep before The Verge wake up after the merge and they get all the benefits of proof of stake with a lot of these transitions things are really not that simple right now so the challenge is that there's it's not just a sub some change at the protocol level that users and developers can forget about it's something where users need to like really actively think and change their behavior developers need to really actively take a change in your behavior and like this is true at every level of the ecosystem right and in order to make users lives as simple as possible and make sure that people actually benefit from the Privacy transition and the scaling transition and to the smart contract while the transition the ecosystem really needs to do a lot of work to make the solutions that it's building actually work for just basic workflows that users actually have so very simple one right like just paying people and a particular real world use case of paying people like let's say yeah you know you ask how um you know you need to pay someone you have you know you have to ask like how do I pay you and this is exactly the sort of thing that ens is for right and this could be an in-person conversation this could be over um you know signal or telegram or whatever um I mean if Bob just needs to quickly answer you know that's what EDS does right Bob can just say hey I'm bob.ease and like Bob doesn't have to try to speak this you know complicated 40 character address um you know but um and uh Alice doesn't needs to copy paste the 40 character address that's uh you know just all very convenient right and the challenge is that this whole scheme is uh designed in a bunch of ways around the kind of existing layer one based and not very scalable uh and not very privacy preserving workflow right so everyone can publicly see all of the payments that Bob receives of bob.eith and they're in one address they're basically docs they're tied they're tied to you know Bob as a person and sure you know this uh could be not his uh you know passport name but it's uh you know connected to a social network if Alice sends uh payments to Bob then someone could like look at the social graph and determine hey this is Alice and Alice is really close to Bob and all of these things um so and it's uh you know there isn't really a way to have the convenience of ens and at the same time like have privacy here um right now and then ens also is something that is uh exists only you know on o1 now you can obviously use ens to store L2 addresses you can use it to store arbitrary mattresses or whatever uh but uh you can even use it to store Bitcoin addresses like or ibands for like Fiat banking if you want but like Bob can't actually create a DNS name without sending L1 transactions and today registering an ensem is like reasonably yeah affordable but remember back in even 2021 when you know we were in the middle of a bull market and fees were higher like registering an L1 name often cost like more than fifty dollars I think sometimes even more than a hundred dollars and you know if we get back to those conditions in the future it could easily be even more Concepts right so in the whole point of the roll-up Century roadmap is that we expect people to live on Layer Two protocols right um you know we expect people to be able to have entire lives on uh various lawyer two protocols without needing to kind of go down to uh to L1 and send transactions to L1 almost ever ideally we want it to be possible to never do things on Owen and you know if like the Roll-Ups that should road map thing actually ends up happening and if um you know blockchains end up being super successful then like we could easily see a world where every L1 transaction costs a thousand dollars right and if we're in that world then you know but um it's a lot of users are going to have no choice but to do things on ltos so can Bob make an El ANS name on L2 this is the first question um what if Alice and Bob are on different Alters what if um Alice is on Optimum Amazon Barbizon polygon what if they're on multiple Alters like what if their Alice is on optimism and arbitrum Bob is on polygon and an arbitrum do we have some kind of like set intersection protocol where Alice can first kind of automatically declare to Bob hey I existed these domains that I have enough money in these domains and you know Bob says like hey you know I I have this one or well I guess he you know since Bob is setting his address but like Bob would might wants to declare you know Witch Hill to his Barbizon um and that Alice figures out like hey I can pay Bob over here over here over here and let's choose this one um you know do we might we wants to have protocols that work like that um you know what if they're on like can we try to use the facts that um you know Alice and Bob will realistically probably be on multiple all two is two hour Advantage um and uh finally you know how do we preserve privacy right so ens on l2s this is actually something that I complained about in some public forum posts I think about two years ago and to the ens team's credit um you know they've done a lot of work with a ccib uh which or erc3668 and you know this is actually happening right so basically you know what the what they're doing here is uh they have a mechanism where you can have a contract on L1 that owns domains and then it can allow subdomains of those domains to be somewhere off chain as long as the contract specifies a way to verify it on chain now the reason why I say in Alpha form here is because I believe oh yeah I'm actually not not sure the latest details I remember at the end of 2022 this was only using uh basically signature verifications from a Gateway so you have to trust the Gateway and then signatures from the game way get verified in the contract and so it's not a trustless way to have a domains on l2s um but if you know it's absolutely totally possible and like it may well have been done already so you know feel free to ask the ens or optimism team and check uh but uh you know basically the contract on L1 could just be verifying Merkel branches against recent uh State on l2s right I mean so you can have domains on optimism and like there's this thing called Opti names and you know you can have the names on optimism and um basically Bob would be able to register a sub domain of in this case ecc.ef and register and move it around uh fully on uh on the ultimate simulator too but then um you know he'd be able to use it for other things um so it's not perfect because Bob would not be able to get like bob.eath and Bob had to get like Bob dot stuff so main.

ies but like maybe that's fine right and um you know maybe that kind of opens up more namespaces and um you know maybe make some shorter names more accessible um you know maybe there there's going to be like 50 different you know names that are on optimism and you know we're going to do the same thing that we did for traditional domain names and uh you know if uh uh like I wants to have an L2 domain name then maybe someone's gonna put like Li K dot ethon optimism and I'm going to be vita.lik.esn like people are going to do fun stuff like that uh but uh you know we're getting there right oh so L2 transition for domain names is one of those things where like fortunately um you know we could report a lot of progress right which is uh I think really good and really important um across the way your two transfers right this is the other thing uh which is uh let's say Alice only has coins on uh arbitrum and Bob wants to get um money on a scroll like first of all that should be it should be automated and like possible for uh Alice to just like make that payment automatically from inside of her wallet like Alex should not have to make extra clicks just to send the payments to uh to Bob if uh Bob is on scroll like that whole process should be just not in the background there are cross L2 uh gateways like there's hop protocol and there's a bunch of others but like it's not standardized enough in my opinion like what I personally want to see is I want to see like a uniswap style protocol for doing Crossway or two transfers like just between an L2 and L2 right now obviously you don't need a protocol if you're willing to go through L1 right if you're willing to withdraw and then redeposit then like you can just do you admit do it directly but you know even when we have CK Roll-Ups you're going to have some period of time uh before it you actually get a commitments to layer one uh and then um you know you'd have to give it you'd have to go back to Layer Two and and then uh you know you'd have to pay transaction fees on layer one and four withdrawals and deposits they're higher than for regular transactions so it might cost a thousand dollars uh you know especially yeah in some future but um you know environment where blockchains get used more often um so it's um you know this is a challenge right and uh for cross-all two transfers basically what what their ex these things do is they are kind of these marketplaces with liquidity providers where you can give the liquidity providers coins on the arbitrum side and then the liquidity provider gives the recipient coins on the squirrel side um it's not like like well what I would love to see it is like a uniswap style protocol right like the nice thing about unit swap is that it does not depend on specific third parties it does not depend on servers it basically is just nothing but a contract on a chain right and even smart contracts can talk to you to swap so what I would love to see is just like a variation you know simple uniswap style protocol you know no governance still third party dependencies though anything we're just like you know Arbitrage participants could come in use users can come in it can be called by smart contracts and it's fully decentralized and uh you know and we can just reliably exist it'll expect it'll still exist in the same 4 10 4 10 years from now just like you know uniswap V1 still exists today and if he wants to use it you can still go and use it um stealth addresses right um so this is an interesting use case so basically if LLS like if Bob wants to accept payments to Bob dot if without revealing to the world that all of the payments that Bob receives actually were received by Bob right um so what a stealth address this is a scheme that was originally invented in Bitcoin land but it's uh extended to ethereum land uh basically the idea is that Bob provides on chain key that we call a meta address um or like or I guess the vet or rather the meta address as something that Bob right Bob can register it with bob.ece or Bob can just directly give them that address to whoever needs to pay him um and then that meta address allows Alice on her side to generate addresses that belong to Bob and Bob can detect those addresses belong to Bob and Bob can figure out how to spend from those addresses but no one except for Alice and Bob can determine that that address belongs to Bob right so from anyone's point of view other than just Alice or Bob this uh meta or this ephemeral address that Alice generates just looks like any Asia middle random address but from Alice's point of view is she's sending to it and from Bob's point of view Bob detects uh in the ephemeral puppy registry this is Bob does a calculation with all the ephemeral puppies on chin and Bob detects like hey you know this um ephemeral address actually will uh um you know if you generate it with this uh with this ephemeral a string it actually leads to in Azure s that has assets right uh and uh when bought so Bob cannot see what all these uh um you know ephemeral addresses are but just uh the ones that belong to him and if Bob finds one that actually has assets then mcbob can actually spend it right so um you could actually extend this really nicely with uh zika snarks right so this is um an interesting uh kind of different way to do a stealth addresses that is it requires more complex cryptography than what happens here like this is all basically based on Diffie helmet right like you know see like basically you have sub-generate address function of the ephemeral private key and uh Bob's pop kind of meta POP key or the ephemeral puppy and Bob not a private key and then you know this is all up to curve multiplication right like literary times Big M is Big R times a little M uh but um here it's uh you know it's a kind of much more generic uh basically yeah so imagine Bob has what I call a key store contract and in the key store contract um you know Bob like the whole point of this is basically just to store Bob's uh spending public key and like this actually doesn't even it's not going to even need to be a traditional public key it could actually just be a hash of the private key right because we're not actually going to be using regular signatures because we're going to have a ZK stock but Bob and Bob's key store contract is going to have some kind of commitments to Bob's spending key and also the rules for changing the spending Pub key right so this could be some social recovery system then Bob has a bunch of addresses and you could even have like Alice could generate these addresses right anyone could generate stealth addresses that belong to Bob um and Bob can generate these addresses for himself um and any the way that anyone generates them is that anyone picks one of these like random assault values and then make sure that Bob has the random salt value and then the basically inside of one of these stealth addresses I mean uh but here I haven't drawn as though it's in storage but like actually you could use create two and you could basically set it up so that the address itself is just a hash FB store in R1 right so this could just be the address and then when the spending logic instead of checking in the storage it just text like it just literally uses the address opcode to check what the address is um and then that's going to be a hash of B Store um so and the or or like something that like some piece of data that's connected to vstore right like you obviously if you're using Create two like you don't want it to be literally created by the B Store right like it would be created by something else uh and then you would have like some commitments to b-store as an argument uh and then like you know that would create an address right it would be like so but it would but the point is that it's a hashtag like contains B Store somewhere in the hashan and then you can say it's like random data and other parts um so spending from any of these addresses requires a ZK snark that proves uh that proves like several different statements right so first of all the zika stark has to prove that the prover knows what B Store is and that the prover knows like so these other R values that basically derive Bob's address from uh or or the proof that Bob's address is connected to b-store this is not a public link right if all you see is b-store in the address you you do not have any way to tell that this address is connected to bstore and the reason why we need these random values is basically so that you can't have someone like look through all the key stores and you know hash them and I'll try to figure out what all the addresses are right because so these are like 32 byte random values and like you you know you can't go through all of them right so the prover has to like proves in zero knowledge that the prover knows like what this address is then the prover proves knowledge of a Merkel branch from a recent State Route all the way to the spending Pub the spending public key inside of this keystore contract so the approval proves and vertical branch that goes from the state route all the way up all the way down here it has to be a recent state right now this is like a Merkel purchase between branch in the future it'll be something better and then finally the spender has to prove that they know the the private key that corresponds to the public key here right um so and as I mentioned before like this doesn't have to be elliptic curves this could just be a hash pre-image so spending requires the CK Stark and if you do it this way then like you basically have complete separation between the spending logic and the addresses and the really nice thing about this right is that this is social recovery friendly like you can have a social work a cell tool stealth address scheme where you do social recovery over here and if you do social recoveries here you're automatically changing the spending Logic for all the stealth addresses and because the spending logic is wrapped inside of Ezekiel Stark nobody knows when the spending logic actually changed uh which I think is beautiful um social recovery and uh this should be multiple uh multiple l2s right so this is actually a real challenge that I had when working with the the uh Soul wallet team basically you have an account on arbitrary we have an accountant optimist so we have an accountant polygon if you want to change the key do you have to like send a recovery transaction on all of them or could you do it in one operation um another more subtle problem one of the nice things that current uh the current uh you know externally owned accounts kind of like the address system lets you do is it lets you receive money even if you've never done anything on chains or register your address right like so if I off chain generate an address and give you the address you could send me assets I could spend those assets until I spend those assets I don't have to do anything on chain now how does this work here well let's say you never initiated your account on Tycho right Tycho is another L2 roll up you've never initiated your account there and someone sent you assets on psycho could you change the key needed to access those assets right could you change the key needed to access an account that you never actually initiated and with this scheme if you make like the the this hash be inside like actually just be the address um kind of well not like directly this app so like as I mentioned like it's some different thing it's like a hash of something else and then the address would be the create two um then that you actually could do that right because even for addresses that don't exist yet when you spend them from for the first time the spending will have tickets start because you get started a um like be a proof of a Merkel branch and it'll be a proof of a specific Merkel Branch um and uh you know whatever that which will be in one particular place and you know that we'll have some Pub key that you could actually change right basically keystore address separation but across domains your key store contracts can be in one way or two and these addresses could be in totally different way or two is you could have your key store on optimism your addresses on arbitrub Kakarot and polygon whatever uh whatever else non-financial apps right this is kind of the last thing um so an app can generate its own key and you can transfer the key to sign in across devices um but and the thing that I think we want is to move towards is like you know the ethereum wallet being able to generate or at least change this kind of signing key so forecaster works this way and I think they yeah they wants to move in this direction um you know sign in with ethereum kind of as does sort of similar things but like right I think one of the challenges to sign in with ethereum is to okay be become better at supporting signing in across multiple devices and then the challenge is that what we want this whole ecosystem to support smart contract wallets and support lawyer twos and this should be totally possible it's not too hard probably one nuances from a privacy perspective um a lot of these non-financial things they're moving toward trying to be more private and more Ezekiel is an arc based and like here you know you're really using the zika stocks for privacy where look they're seeking Stark based identity solutions that the Xerox Park team and other people are working on and all this stuff and in this case like if we talk about social recovery there's like recovery of the wallet recovery of control and then there's recovery of encrypted data right and like these two are different because you can recover the wallet by changing the key but to recover the data you have to recover the key which is a different problem um and uh recovering the Kia is like a more risky thing right and like if you look at how signal Works signals recovery process is like well you can recover your accounts but you lose all of your pro all of your private messages right and like for their use case it's actually not that bad a trade-off right so it's application specific maybe you need a a recovery strategy for encrypted data maybe you don't maybe recovery of encrypted data is like lesser like is something that can accept more risk of data leakage than recovery of control maybe not and like it's it's very application specific so conclusions are I think scaling is happening the L2 transition is happening privacy is um happening you know it's uh it's definitely a long process and there's definitely yeah you know the whole uh kind of you know regulatory rabbit hole and like trying to figure out the best way to handle that but at the same time give people actual privacy a lot of things uh things to report on that but that also needs to you know wait for a kind of what that would require its own whole presentation smart contract wallets are happening um so um you know the like Soul wallet has Alphas that are kind of actually of the sort of metamask style browser wallet format but the user experience needs to adapt to all of these things and we need to make sure that like existing user workflows can actually properly and fully take advantage of all this stuff right like smart contract well it's you know adapts all need to support ERC 1271 so there's one contract wallet friendly um you know privacy like ens addresses need to how have some way of being a privacy friendly scaling ens addresses need to be manageable on L2 right just like all of these little things and I think you know as an ecosystem these are just things that we all need to you know really be mindful of and I expect this will happen this will all happen uh because you know we're finally seeing scaling.just be theoretical but be a very practical thing but it's something that like every developer I think really should start thinking thinking of uh right now so okay great I see yeah one question um L2 competitions are quite aggressive what's my take on making them coordinate together so other I've actually been impressed by how much coordination is happening right I'm like there's definitely competition and there's definitely like polygon versus scroll Wars on Twitter and all of that but at the same time like lots of these projects are totally cooperating on zke evm design like scroll and Tycho and others they're all working together with the and and even with the EF team on uh you know the uh pseek evm project uh they're all uh there's lots of engineering level collaboration happening there's uh you know more and more standardization level collaboration happening so okay yeah on a technical level I'm actually impressed by how much is uh is happening already um and I think um you know the more the conversation kind of focuses on the technical side and uh the the more that uh things can be positive some another thing is like I think if we can try to kind of limit some of the more harmful kinds of competition which really happen on the marketing side uh by just agreeing on more queer terminology right so I try to do this with the stage zero stage one stage two thing and I tried to do this with the type one two three four thing um like the the type one two three four basically being about like how close you are to being a ckvm and you know the more that we can kind of agree on like you know what doesn't doesn't count does this what doesn't doesn't count as that the less we have the less we end up having these culture wars of like oh you know this is what it means to be a ckvm and our project is the real evm and their project is not a real evm and like basically the more we agree on queer definitions the more like everyone like people have to push their energies on of actually achieving the technical goal instead of like trying to have the best marketing strategy to convince people that they are a real Ultimate when they're actually not right so but you know even there too like I'm I'm optimistic I think things are already much better now than they were than they were a year ago and I think they'll keep improving um standardization for um eap4337 and 5564 and some of the other eaps I uh so for 4237 um I actually think uh the long-term roadmap is going to be to start enshrining it in protocol more and more over time right so the whole kind of fully off chain of 4337 idea was uh to help it develop faster but in order for it to fully benefit from um you know censorship resistance and maximum maximize the efficiency and all of these benefits like I think it's going to have to become on chain over time um and uh but before then like I expect it to be standardized across lawyer twos first and uh you know both uh Soul wallet end up and other wallets are like there's actually a lot of wallets that are starting to support it um so I think that's something that's kind of going to start to happen um you know slowly I mean the bigger standardization problem is uh like basically making sure that all the dapps support ERC 1271 right so at least like signing can happen across all these things I mean honestly like the DAP level support for different wallets is like terrible right now and I yeah like there's just lots of things that just don't even work with the brave load right like guys stop us stop assuming this is better mask like you know if uh like if everyone just assumes everyone uses better mask and like assumes really tiny details that are around how metamask works then you know we're not going to have wild competition and we're just not going to have progress right so I think you know being much more standards compliant if you are building a dab have some of your testers use Brave wallet used to you know use um some of the erc437 wallets that are coming out and like make sure that you're actually compliance with all that that's uh like that's the standardization problem that does really need to be solved right um and then for I mean the ens on l2s um I mean obviously I mean they'll finish kind of rolling out um actual Merkel Branch verification uh so we can actually have a trustless implementation and we have multiple providers so it's not based on what like one provider's URL and we have a huge number of providers that people can can fall back on if the first provider doesn't work like you know all of these different things so I feel like it's uh you know things are going in a good direction but I mean there's definitely a yeah a lot more work though like application and what developers can do yeah yeah no no thank you guys for listening I mean hope you're you you know all of you guys are having a gonna have a great time for for the rest of the day thank you vitalik I hope you do this next year in Taipei thank you absolutely