Mina Protocol 🛠 Mina zkApps: Zero-Knowledge Programming with TypeScript

[Applause] [Music] hi guys uh my name is jack and i do developer relations at owen labs which is the company that incubated the amino protocol and uh today i'm here to talk to you guys about the amina protocol and zk apps for people who don't know the mena protocol is a layer run blockchain uh that is kind of built with zero knowledge proofs at the center and so this impacts both the way that the blockchain itself works in terms of consensus and stuff and also the way that developers uh you know build applications for the blockchain and so we'll kind of get into that in a minute um yeah so hopefully by the end of this presentation you have kind of a sense for what mina is and also a sense for how you might go about building an application on mina and why you might want to do so um so here's kind of our run of the day uh we'll talk about mina and zika apps architecture uh then snarky.js which is the typescript library that we use to write zero knowledge proofs um for mina we'll go through a hello world example and then i'll direct you to places where you can learn more and we'll do a quick questions and answers um so the kind of first we'll start with mina mina probably you've seen the marketing our marketing is full of this idea that we're we're 22 kilobytes other blockchains grow because you have to remember the entire history of transactions in order to be able to to kind of verify a recent final state um mina works differently because it uses recursive zero knowledge proofs to to basically uh prove that all of the previous transactions are valid and then prove that all of the new transactions are valid inside of zero knowledge proof that can then be you know put inside of another zero knowledge proof and so on and so on and then so this is useful because the zero-knowledge proofs are fixed size uh they they always stay uh uh well the zero knowledge proof and a couple of other things total to 22 kilobytes um and this is useful for some things like bridging we'll touch on this in a minute but it's it's also kind of uh just a good thing to keep in mind as we go towards uh how you build applications using mina and and and why you might want to um because the the benefit of mina is not just that it's very small but but also that it uh it enables a huge amount of things that you couldn't do on on a more traditional blockchain um so uh yeah amina is the sync it's small uses recursive zk snarks to compress the blockchain into a single zk snark uh and and this uh proof system that we use is called kimchi um it it has uh some some kind of qualities um from uh uh plonk and and uh and halo 2 um and then some things that are kind of all its own um uh it's trustless uh it's recursive um and it's pretty efficient um it has some some cool custom gates to let you do some some useful things really really efficiently um and so you know uh how does an ethereum d app work well uh you tell ethereum what you would like it to do and it and it does this on your behalf and the result of that is that anything that you want to do on ethereum is going to be public and if you want to to kind of make it private you have to really think a lot about how you're going to do that so so there are ways to obfuscate the public data but it's usually not simple um and and it it's pretty constricting in terms of what kind of applications people have developed over the last you know five years um mina zk apps work significantly different uh the computation actually happens off chain um and so you you write your smart contract in in starkey js our typescript library that i'll get to in a second um and and the user just runs it like they would run a code that's a part of like a web app like google drive um and and so you know how do you keep this secure how do you you know guarantee that users aren't um doing things that they're not allowed to do and that's what we use our zero knowledge proofs for so um when you interact with mina what you're doing is running the code yourself you're running your transaction uh on your own computer and then you're generating a proof and and the the relevant state updates which can be nothing uh you cannot update the state at all or you can update the state depending on uh you know kind of if that's something that's useful to you or not um the advantage of this is that it's uh scalable in the sense that um there's no gas model you can just um the only thing that the amino blockchain is doing is is verifying your proof and and that's the same amount of work every time and it's the same size oh cool okay um yeah so it's the same amount of work and it's it's the same size and so um this means that every transaction um well every zk app transaction costs basically the same amount it varies based on uh you know market demand uh and and congestion but it uh there's no like gas model and so you can do a little bit of computation and that will cost the same amount as doing a huge amount of computation um the the only limiting factor is how long you want to sort of wait for your computer to do things on its end it also is is private because you don't have to send any of your information to ethereum this makes it really kind of easy to see that if you do all the computation on your computer and you send a very small zero knowledge proof and you've done a lot of computation well there's no way to commit to all this computation inside of this tiny zero knowledge proof and so you have privacy by default um and and then you can you know uh kind of open things up as much as you want to so you can you can start with a level of privacy that is sort of so extreme that it's uh it basically makes the applications useless and then and then you can go all the way to this place where you just make everything public um and so you can pick any anywhere in the middle on that on that kind of slider whatever fits your your use case well um and and yeah i think i kind of touched on this but the off chain execution is basically unlimited it's only limited by the the uh kind of computer hardware that you have that's generating the proof and the amount of time you're willing to wait um so you know what is this useful for so uh here here's kind of an example of uh something that uh mina can do that is is kind of unique and so this would be to to prove that i have more than five thousand dollars in my bank account um without revealing the exact amount or any identifiable information about me and so you know this is useful because you might want to to kind of just use one quality of a piece of data without having to give that data to uh everybody and in the case of a blockchain you know the entire world and so um you can uh you know define a smart contract that will uh go through your financial data uh and prove that you have more than five thousand dollars uh and and not disclose uh the exact amount of money that you have it's you can write a program that will basically like only throw true if if uh if you have more than five thousand dollars and and you don't have to um to to uh run that computer on i'm sorry you don't have to run that program on um on somebody else's computer in order to to prove that it's it's ran correctly um so something else that's interesting uh about kind of mina and it's succinct quality is that you can actually uh bridge mean a state to other chains uh much easier than you can um in other blockchains where the the the total size of the chain grows significantly over time um and and if you're interested in that you know come talk to me at our booth we'll be here uh the next two or three days um so zk app is is what we call these uh you know decentralized applications that use zero knowledge proofs um and uh this word kind of includes the smart contract and the ui and and this is cool because uh as i said the the smart contract is written in typescript now which means that you can actually just you know write it in typescript publish it as an npm package and then import it into your front end and and just deploy uh basically your your front end um so a snarky js contract uh is compiled into basically two artifacts um the code itself remains and this is like you actually run the code that the contract developer writes directly when you use snarky.js but in order to constrain this code and make sure it's executing correctly we use um approver function which is uh something that runs locally does the computation and then generates a zero knowledge proof that it ran in the correct way and um and a verification key which is a is a sort of like a commitment to the state of the the code um at the time that you you publish it to the blockchain so this this is how you ensure that nobody's changing you know what the code does it's kind of how you identify it and when you deploy the verification key to the the amino blockchain it creates something called a zk apps account which is uh it's just like a normal mena account except for that the way that you can interact with it is now determined by whether you can create a valid proof and then you would include that with your transaction in order to um kind of uh just like in order to be able to interact with the the account at all you have to have a valid proof and so you can set the account up in such a way that you'll only be able to generate a valid proof in the event that you'd you know meet some specific spec qualification that would uh be uh basically what you have programmed the code to do um so uh yeah you can see here's i guess a demonstration of that you send a transaction and it updates the verification key for one of these accounts and then you have a smart contract on mina and you can't send the transaction without a valid proof and you can send the transaction with a valid proof um and so every zk app is compiled into a program which has um the input arguments uh and the on-chain values um so these would be the values that you know you're taking either from users or from the current chain state and then outputs which will be a list of updates to perform and a list of preconditions related to to the on-chain state um and so uh when you run the smart contract if you run it correctly you can get a valid uh verification key and i'm sorry uh proven key and you can send that to the mena blockchain along with the state uh transitions that you want to to take place and uh as long as the the zero knowledge group is valid uh mina will will update these states um okay so kind of getting into snarky.js a bit more stunky jess is written using typescript it's a typescript library and you import it just like you would uh any other typescript library in practice it feels a bit like react to use it feels kind of like a framework for for defining zero knowledge proofs it's very easy to use and it fits in nicely with uh existing tooling which is really nice because uh kind of like a part of our vision for snarky.js is where we're really ecosystem focused we want to make it so that people can write code that other people will use that way if you have somebody who's you know really good at cryptography they can write a library and if you have somebody who's sort of uh more entrepreneurial they can they can use this library to make an application um and and uh i think yeah javascript and kind of the ecosystem around it has really um kind of led the way there in terms of how do you get a bunch of people sharing as much code as possible um so uh we have our our developer tooling is called the zk app cli and you can just mpm install g the zk app cli and um zk project name and and you'll have a project ready to go it'll scaffold everything and uh set up testing linting all the stuff you need to deploy to the chain it's very straightforward to use um and uh yeah you can you can clone it now so yeah z apps are written in typescript using snarky gs we use existing open technologies it runs in the browser and node.

js you can use existing javascript and typescript libraries and tools we kind of touched on this um you won't be able to import like a an uh like a i don't know like a javascript cryptography library or something because it won't be sort of it's it's a bit like how you can't import like uh jquery stuff into a react project um it kind of has to speak the same language but you you can still use a lot of the stuff that you'd want to um you have uh really really good vs code support intellisense and copilot uh work that's cool um and so okay what do you uh what kind of like data type do we use when we uh program uh these zero knowledge smart contracts uh we use something called a field and this is an element of a finite field which is kind of like a math idea that's not super important to get way into uh for most practical purposes it'll end up feeling a lot like a uint uh 256 but um uh it's a it's a little bit smaller um so it's it's basically an unsigned integer with some added caveats which are that you can overflow and division works a little bit differently um but we have to use this data type because it's what makes the zero knowledge proof possible um yeah so we went through this that's the field type in snarky.js um and then in addition to this on top of this field type we've implemented some of the other types that you might like like booleans unsigned integers actually we have signed integers um and we have something called circuit value which you can use to kind of describe even more specific data types that you might want functions are just normal type script functions we use a decorator in order to kind of tell snarky.js that hey this is something that's going to be called by a user and data are also normal typescript classes so you can see sorry yeah we just have a function here pretty simple uh the the only thing that's interesting is that instead of using the javascript infix operator that would be like the the plus sign you know x space plus space one um we have to call this uh add method and and this is because snarky.js needs to um keep track of what we're doing and and we need to be working with this field type so you know javascript doesn't have a field type um and so we have to you know call this method in order to be able to do addition or multiplication on this field type um other than that it's it's it's pretty pretty much what you would expect though um so yeah we'll walk through a hello world example really quickly and then probably have done some time for questions um so we'll write a smart contract with a single state variable named x um and it will have a method update that will let us replace x only with its square um and we can only update it if we control a secret admin uh private key um so this is kind of like uh yeah this is how you uh you know gate who's allowed to to call specific things it's sort of a more general model than than like probably people are used to with ethereum um so if x is equal to three and we call update um you know nine with our secret key then then this should work um and then if we call update you know 81 this should work and and uh if we call you know um three to nine that works but uh nine to seventy five uh this won't work so to write a smart contract we just extend this smart contract uh class in snarky js so we're making a smart contract called hello world and zk apps can can they they can by default they're associated with um eight uh field elements that are stored on chain and so we don't have a lot of on-chain storage by default because we expect that people will use these uh field elements to store commitments to off-chain storage or storage on ipfs you know you can put the data kind of anywhere you want you just need to store a commitment to the the to the data on chain uh and so we use this uh state field decorator to basically say um we're making this variable x uh and and we want this to exist um on chain as as a as a field type um so we could replace like field with bool or something else and that would work as well um uh yeah override deploy to configure the smart contract that's not super important uh in this case initializing this state oh i see so um yeah we're we're um in this case this deploy method is the method that's used to you know put the smart contract on chain um and we're you know calling this dot x set to three so we're going to take this uh state here um x and and we're gonna set it to three as the contract is deployed um and then we also have this uh party set value this self update delegate admin private key so this is a method uh basically we're ensuring that the person who calls this contract will have the the private key a smart contract can contain multiple methods each will have its own logic so here we've got you know this method decorator in front of update means that update will be callable by users and it takes in uh you know a field element uh called squared and and then also a a private key called admin um and so uh these describe how people can interact with it uh once it's deployed um and so in this case you know we'll take uh x we'll get it from the on chain storage um we'll store it in the variable x we'll square it using you know the square method and then we'll assert that it's equal to its square um and then we'll set x on chain to squared so uh if you were to pass in an x that wasn't the square of uh the prior x this assertation would just fail and it would be impossible to generate a valid zero knowledge proof um so uh finally we'll take this um admin private key and we'll actually convert it to a public key so this is a totally constrained method so we can pass in a public key directly into a method that we're calling because it all happens on our on our local machine and then we can compute the public key from that and then in order to make sure that only the the person who owns the associated private key can call it um we just use this this uh account delegate assert equals admin admin private key um and so this basically means you know make sure that the person who's calling this is is using the the uh private key is i'm sorry the public key associated with um with the private key that we pass in um and so what happens under the code when we run update nine with our secret key uh we run some code in the method uh with some arguments and the result is that uh um uh x goes from from three to nine um and so that's kind of like what changes on on chain and then for our preconditions we're we're just uh changing um we're making sure that the admin secret key is associated with the admin public key and then that uh the person calling it has the admin public key um so yeah this is kind of what these contracts end up looking like we define a bunch of state up at the top um then we deploy uh then we define a deploy uh method so this is what you use to deploy the contract and then we have methods that are callable by users which are preceded by this method decorator if you're interested in learning more you should scan the qr code because it's cool and it's full of good information um and yeah i'll give everybody a second and then we can uh yeah open it up to questions oh it's not working that's not awesome okay uh yeah go by the booth and scan the qr code on the banner sorry about that um i must have broke that at the last second um so uh here's the information that wasn't from the qr code so we have a discord um with a a channel called zk app developers this is a great place to get information if you're interested in learning about you know zero knowledge applications and and and starting to develop them yourself um and then we're also on on twitter and and we have our github repositories um and of course the the main thing is the docs uh if you just search minadocs in google you'll get our docs and we have tutorials and and and some explanations of uh kind of what's going on and how to get your head around it so that's it i think does anybody have any questions yeah um okay so the question is you know we're talking about computation on chain and off chain um and where does zero knowledge come into this what what can the prover hide from the verifier um and so i got that okay cool so um yeah how this ends up working is uh basically when you when you create the zero knowledge proof and you send it to the chain that that proof really just says i did some computation correctly it doesn't really disclose anything about the computation uh and then you can kind of choose what you would like to disclose about the computation um and so uh if you have something like uh let's say that you have a um i don't know let's say that you want to prove that you have the private key associated with like an ethereum account um you couldn't do this on another blockchain very easily with without i mean you could sign something actually sorry that's a bad example um so okay let's the better example is a sudoku so let's say that you have like a sudoku and we've committed to like the puzzle on chain and we want to prove that we've solved the sudoku but we can't send the solution of the sudoku to the chain because then it would disclose you know what the solution of the sudoku was and then people wouldn't be able to use our cool sudoku app to get an nft by proving that they have the the right solution um so in this case what you would do is is you would uh prove that you did the correct computation to figure out that uh you know the sudoku is valid um but you wouldn't actually disclose what sudoku you input and so this way you can prove i've solved the sudoku but you you don't have to tell the chain how you solve the sudoku and that way you know this uh game can stay fun long-term because after one person solves it it's not solved for everybody yeah the so the question is is the verification sort of a claim that something is true as opposed to uh i did all this computation and i'm showing it um and and so yeah the the the proof is basically a claim that you did the computation correctly without having to show it so you can kind of think of it almost like um like uh imagine that like doing the computation correctly gets you like the digest um to uh you know some chunk of data and and uh when you when you do the computation correctly you can kind of like figure out what like one of these like good pre-images is that that is basically the zero-knowledge proof um and then if you do the computation you know incorrectly then you would just have to guess over and over and over again um in order to find like a fake zero knowledge proof basically um yeah yep um so the there's kind of like three parts so we have like a plonkish arithmetization scheme um with some cool custom gates and then we have um uh we use like the inner inner product argument um that uh halo uh two and and bulletproofs use um and then we have something called pickles and pickles is kind of the like thing that wraps this whole proof system that allows us to do recursion well and it informs the design of some of the other parts of the proof system too but really the the um what it's doing is it's basically uh you kind of have like two proof systems and one proof system is um able to generate proofs that are easily verifiable in the other proof system and the other proof system is able to generate proofs that are easily verifiable in the first proof system and so what happens is you generate a proof and it's verified in in this other proof system and then this proof generates a proof which is then verified in the first system again um i'm sorry say again yeah no um so uh kimchi does not kimchi is our proof system um i don't know there might be some way to to make something like that possible but it's not um uh it's it's not like uh it it's not something that like intuitively makes sense or is like would be an improvement uh given our situation yeah so um yeah so snarky.js is calling something called snarky which is a ocamo library um that's basically um working with stuff is at a pretty low level underneath that um yeah and so come to the booth and we can talk a bit more about that and uh yeah i might even have to probably somebody on the crypto team i mean i'm sorry owen knows better than i do oh yeah we'll be here all night all day all night all the days all the nights uh yeah cool i don't think there's i don't know there might be more questions but i think i'm out of time so uh yeah thanks guys