Scaling Your Favourite dApp with ZkRollup by Vaibhav Chellani, Barry WhiteHat (Devcon5)

[Applause] well we are actually trying to do some practical stuff like implementing a snog circuit to processor convictions so if you want to follow along you are welcome to yeah so if you want to solve any requirements they are over here and this this link is public I cannot buy a domain so you can use this one [Music] I live in 238 modern all of you Sam yes I created this to curative and it's mostly going to be like me painting what's what how love works and maybe creating a circuit body of light [Music] a little bit on the little show [Music] [Music] yeah so-so [Music] [Music] yeah so yeah so basically the CK column is all about using snuff for them not for their privacy expect for creating such improves so that we can verify it also computation done off scene you know on a smart contract on its eadamson and so forth we basically do all the signature aggregation balance takes changing of the balances for the participants in order to draw lessons off scene and we pass all the transaction together and submit the smart truth as well as the compressed transactions watching so so so CTO of some basically reduce serration and unlike gamma we don't really have to worry about things like theta being not available and users being like if my users office money continuously was their coins so they can come it can be active and some it challenges if anything bad happens right has no such assumptions so us not proves the validity that the transaction the computation of gene is actually valued right so it's um it's pretty simple so we have to mean there's a coordinator and there is a user so the coordinator basically takes other transactions is like inputs and signatures from the users by our vision point of API or anything like that and he basically generates a batch and passes all of the transactions does not suck it the stock does not the processing and Emmitt's operated to the blue - and the Snapple so or anything of smart contract we maintain a balanced system our country right so it's like the local tree and the leaves contain balances and accounts of all the users right and this this route acts of this muscle tree can only be updated by us right so as soon as the patch is processed by our coordinator he summons the snap proof watching and the verifier checks of the proof is correct and the proof is correct the new new route is updated in the consummate contract right so yeah this is why a lot of scenes really amazing to me so it has no it fix it games and it has no likeness assumptions no data availability issues that our nation faces still very very less yeah and basically we can create rule of genes not only for payments we can do something like cryptokey bees we can do stuff stuff like what fair event it like any any sort of smart product right so it's basically a stock storage layer basically you can put in anything you want you know in the chief of the whole country and it will work yeah so for the purpose of this tutorial sort of thing we are using so calm and snog this they're basically dilute based compilers and these are basic commands you can like back to them will mostly need them every time we do a compilation and we create a input right so I'm just going to show how to create one one simple constraint is like automatic answering we are going to see if a plus B equals C and create a schnapps not blue for it right so so that we can go anywhere and proof and like prove to someone that this competition was done correctly right so it's pretty simple as as you can see just like create oh definitely definitely is just like a socket and we I mean and the inputs they are world signal so every every variable is a sort of signal for you can imagine circuits like electronics circuits right so in electronic circuits also we have signals in the inputs and outputs as well so here we are accepting three private inputs yeah calling in a B and C and we have one one public input it's called C right and we create a table for signal color and this this is that we have forcing of constraint we are basically forcing a plus B to be equal to C which is provided a public input so so far we can basically prove that two plus two equals four without getting to know what what the first two variables mean we don't need to know that they were two and two yeah that's one so they can be one and three or they can be three and one we don't really need to know where so this basically creates a constant concern for addition we can do one for multiplication as well like this is pretty simple whatever we need to give as a output we just force of constrain and we assign to the variable so as you can see it's pretty simple right yeah so we are done with the is anyone following the number should again yeah cool so if anyone wants to compile it and generate inputs and so first of all be from the SOCOM's socket we did our compiled version and it's called it's a it's basically JSON representation of the stock constraint in the circuit right and then we basically have to create inputs so the inputs for this would basically be ABC ABD and c so we just put that in a file I can show you that fine [Music] so this thing basically is the keys of Inuyasha yeah so yeah we just passed the inputs 2 4 6 and 24 and we get input on adjacent right which which has all of these variables and then we basically when you have input dot Jason ready we cater we calculate witness which is like the inputs we are going to provide us not that what that input basically satisfies all the constraints defined in the socket so if if this command throws an error with that that basically means your inputs not not going to pass this is not serving something is wrong with the input and this is the does it set up it's currently only on your on your laptop so it's it's when do a pretty unsafe and then we can create a proof and we can just not just verify which is basically tell you of the the proof was right so it if it displays okay and those good if it's either invalid something went wrong your input did not satisfy all the constraints defined so growth is like drops 16 this is the most efficient proven there are some other options you can do that such protocol and help it's like I guess I I don't really know if always been using this yeah yeah so if you are if you guys want I can you know learn these and show you what it's quite do I do we run all the proofs right so I'm gonna operate if someone wants to not be happy do you know debug if there's any issues who so we we are going to verify EDSA signature next so us when snarks is it's much more easier to verify PDSA signature than in syria more bitcoins signature because it requires less lesser number of constraints right so so there's a library called so common and they export a template it's called EDD si si we verified happy heart so this is this a hash function called gypsy because sha-256 is like way too costly to use insiders not see this is like so MC uses much less number of constraints and it's therefore the proven time is low and for the purpose of this workshop this this level of security should be just fine okay so so it's very easy to use this template we just like pass the from the slope you know for a PDSA of key there are two parts the x-coordinate and there's a white 5.8 right so verify we X because the bees and the x-coordinate and here we signed a y-coordinate and this is but parts of signature and this is the message that we want to check the signature against right so if it all gives a calculated goodness run smoothly then your signature was basically correct right yeah yeah you say that this kind of fire is something for the first time yeah the security is not widely researched yet so we will generally tend to avoid this because it's not the security is not really proven at the moment but it's not it's not broken it's it's not flow on either so we so people generally tend to avoid it but it's fine for the case today see is there any medicine works pretty good pretty much yeah that's all right and it's not a school isn't it slow Asians what is the what I intend to be private because this is a sobriety kind no in in this we are just trying to verify a signature inside is not you're not trying to make things private in this circuit yeah yeah because we're doing a while verifying Dominic support from for rola we will have to verify if the if a transactions emitted by a from address is actually signed by yeah so yeah the next part is like very far like creating a market route for given leaves and yeah so that's so in here we we basically have two or three variables which like a path to rule this basically the leaves in the market aloof right and part 2 route poison is basically binary vector so if so if the leaf so let's say as the reef an index 0 in part to route so part the root position at index 0 will basically have 0 or 1 0 means that the leaf is left 1 means it it's right right so we'll see how how that is used later this output signal so what you see seven basically creates ash if you provided inputs the first parameter here to is like the number of you want to give it right so so yeah so if if but five total poison is zero the mark on the first input to MC becomes the leaf itself right so this is how the binary factorization was so so if if this this thing is zero then the first input becomes leaf and because this thing is also zero the second input becomes the sibling right and if if it's one then the first input becomes but in the leaf and the second input becomes the actual leaves that we want to prove the path path for like does that make sense so we then then we basically just do the same thing but over a loop right and like I can just basically copy paste this part over here and as soon as we have filled all the other inputs if we if we do maca root dot out which is basically this this template dot out so it basically gives us the hash of the leaf right so whatever we have passed passed over here doing not out over it gives us a flash so if you give like two and three dot out gives us a hash of those three inputs right so basically used to create hashes of leaves so that we can get them up the tree [Music] yeah and this part is taking the existence of a leaf in a tree it's it's it's also pretty pretty basic we just like take the paths and we assign elements like we did over here Ohio on this but basically just as of if the DX road that we have given if the route given over here much is the route that we have just created inside the [Music] this was basically designed as a workshop so because of bad intentions try to skip it but so so three people this we had to enter this values but I show you this now circuit over here so yeah they've got a and you can buy [Music] yeah so just to show you the circuit whatever once was was missing is present-day now in in this fight it's since present not get up I'll give up the link you know I so it does samples sockets are present here right so whatever was missing over there is yes so so I'm just going to do how deposits work how we drove up in a run-up chain right so basically operator it's all third transaction and like let's say a snack that's supposed to be up in international right so the operator if he if he has 20 run excellence he picks up top docked in according to the correct nuns and he provides it to the snack circuit and we go from Route one the route and we submit all the transactions and the South broken chain so yeah the co-state the transitions work first off for so the account is we basically like this of the x-coordinate of the public the y-coordinate the balance non-standard to indict right and the leaf is basically the hash of all of these but for the walk so we're just going to do back in slowly but we can enable of gene we can actually have multiple tokens trading this simultaneously and the operator can accept fries in any or all of this right so this is how come looks like since of Kiev and on satellite and the balance history is this so we change the account route every time to be somewhat a batch on sale yeah and in a transaction we have from we have from from index which is like the leaf index in the local tree and we have to waitress open time yeah so it was it's too like they're pretty interesting so what we do here is the deposits happen totally on chain 5 so as soon as someone or deposits it's a one one eat it's pushed to and I as soon as someone deposits someone does the second deposit what the deposits are together and they are like a tree straight route right so yeah this the first first first deposit the second deposit and it's the hash then as soon as we have a third deposit then you paid for a deposit affluence is as it's done to be create a hash and we combine them together so what what what what we can do is whenever we want to include the deposits in the role of chain we just pick up the latest food and we attach it to the existing balance stream so so we create a volume to suffering and snap proof is created which which basically just proves that this is sleeve was empty and the depository has been inserted over here yeah yeah so this was the holder downstream and now the new mobility comes of that that whole thing the deposit Ruth gets place no idea [Music] so we're doing all the drawing is also like a simple state transition like metal transfer state to state transition so like people just send their tokens to leave index 0 which is which can only receive tokens Leif Leif Leif Leif number zero cannot actually spend any token this defined in this norm so he was have to do a transfer to relief index 0 and then they can go on scene and then they can prove in the latest local group that reduction buoy friend X 0 and they'll get their token back from the deposit right yeah [Music] the assumption which I don't you need data Philippines [Music] so so with every stop proof that is somewhat daunting we submit a condensed form of transaction right so using that anyone can come and prove that like Biscay of all the other transactions that have been processed in the latest non-resident on chain so third data validity is same as a theorem gene dismisses the being it seems like it is this example really have any council houses or their systems they transition function from trees trees and you're trying to show that yeah so it's under state transition function right it's just like you're done in science math we basically say that let's say Alice's transferring $50 to Bob right so in that people check if Alice exists in her dream if she has 50 dollars to spend and then we basically change his let's say is 500 right so it changes balance from 100 to 50 and we increment box balance if it exists in a dream from zero to let's say 50 and we update the stock saga maca root yeah so this is all state transition happened and we submitted the updated Prudhomme she doesn't smell good yes it's not really bad it's pretty gerald yes generally you yeah you can restore anything inside the leaf and right just a transitional weight sample you have it some conditions anything that man yes so this is basically just like doing all the checks inside the stock um I think I'm going to skip all the steps and we are going to go to the final circuit so I can show you what's actually happening for correcting multiple transactions you you just do the same thing with a for loop for the number of number of projects when you want to process right now who says only one but I have the section over here which you can [Music] yeah so yeah so often there was a previous page so the thing is as soon as we process one input we should update the accounts tree otherwise if a leaf is printing multiple times inside the same batch then it may be able to double spend right so let's say in a batch Alice was Alice had only 50 bucks and she was able to get both of those from the same batch so if we don't update the root after processing every transaction then when the vendors not discreet processing the second condition of Alice the circuit will never know that previous transaction already spent 250 bucks gotcha right yeah so this is every standard we we expiry take the inputs as like the previous account rules the intermediate root since this is all just for one's actions so it has only one intermediate root if you want it to do multiple this would be an eye and here is fear of the pounds these are all the balances the balances in an Internet heading and co-ceo provide all the transaction input right which is like the send up of key sender balance this yoke of receiver balance amount of the sender signatures and the proof of existence for sender and receiver right and we output new after processing everything right so in the so since I guess part three we we did a part where we and but - we did a part where we showed the existence of Merkel please I guess yeah please existence right so do you think this M plate over here yeah so using that we are basically going to prove that Center account exists in the previous account which is provided I input right so we just passed the of ease and balance ARP do the same thing for all the senders given given the pathway and then we just do a simple signature thing that if the center has actually signed the message yeah and then we create a new leaf - so the v5 previously could contain like of key balance which all strip tease then after after spending 50 is leave like perky and zero so we need to create a new ash for this and we need to update the accounts root so this this this whiskey or puts the intermediate and using this intermediate root we basically check if the receiver exists in in the Breanna if we exist then we credit the receiver with whatever amount was sent by the sender yeah yes he is very typical center and this is where we created the receiver and then we basically just they create a new moon you leave for the receivers in and we update the route of the new mobility with updated balance and we switch switch switch we can summit on gene so many fight down that just right so that we basically rules that stay trans transition that was run off scene was valid and we pushed our next mountain for it out what was it check that transaction course boys official that the transaction touch previous transaction so effectively at home majesty account information previous application matches [Music] yeah yeah so basically so let me give you face the question you can be found directly so you're basically asking if the accounts would summon it over here if it had if it had the correct balance that Alice give me if it did not then when I submit launching the previous row - which is submitted on a one-to-one match with the inputs emitted over here right so it has to it has to be changed that makes sense yeah so I want to do they like greatest man contract but why I dislike generate verifiable this basically creates what all of the proof that we need to push the punches like if you guys want to try this out and maybe we can do that now yeah are there any questions this yes Oh I think this link of the wolf [Music] [Music] [Music] [Music] lady Tommy a burger that 20% yeah so sometime so that basically assigns the signal value and yeah let's say signal right let's say there are two signals a and B and I want to like put the input in C and I want to make sure it checks like there's a constraint that C should always equal a plus B at that time I do that and bracket and equals right so there's a link in this workshop which which basically directs - I did three slokas on how to use not use and circum explanation on how to use of the this is level 4 although work days of the sample subjects and input rousted files it's going to be enough after the conference everybody else learn anything [Music] oh sorry we can actually you might people you can use multiple circuits from a single circuit so for multiple projects it's hard to know what for the for single projects have to give intermediate room after after processing every week right so just putting of what it was yeah it gets pretty big that's why did not we take like of my with the balance yes definitely what is a side of the committee for immediate connection it is in especially I don't really have the number right now but yeah there's a link here if you if you if you want to check how different answers book there are is is it an input file so we have we do it so very deep regenerating Angie today yeah yes they are so the language that allows us to verify the pulse energy theorem so then the last step over here if you if you this thing then it really create a verifier soil it agonic for now and then you can just deploy it remix and take the loop so each part it's not easy yes so if you want to follow along it's like pretty simple all the code is present here you just have to move but in your most of the files so if you just clone this then it should go pretty well for you on this and this link is valid into both departments over here yeah well I can be mean to disbar quickly do this show how it works [Music] I decided to seriously create a file called sake not common hobby business over so I have this fight so is I have this fight ready now I just have to do the compilation of Korea [Music] it's basically the isms of the gun chains and then I can this meaningless [Music] this is very important started dissing for me it's basically the way was ABC and D right so just to remind you we are we are the cutting up a chain that is I should be see [Music] so calculate witness runs correctly which basically means that we are running the input that we created against all the constraints and the socket then it basically means other proof which is generated would most likely be correct we can I can find changing the input and see if it breaks right yeah so if I if I change any inputs and you must be don't don't eat the sea seething then it will be series to show that the constraint does not match right so you can do the same thing for very fine EBD is a signature ring of Motor Vehicles like proving that a leaf exists in a mockery and creating a muggle rule all of that stuff yeah I'm gonna try [Music] processing a single transaction and so in the file structure [Music] yes you if people do the fourth folder or single yes it basically has the socket and yeah it's a fire code and it has all the public and private involves although yeah same as a you need to provide a local but you need to provide to calculate witness to get a witness [Music] and so it HUS just the numbers they're listed here I mean they're they don't really they don't need anything like wherever they're bad enough or they're kind of like random but yeah link to this thing is because short you're a spacey let's say that the length of this name is short because it's simply I just understand like the length this is array of whatever five numbers as young as the survey is very simple you have exactly exactly so so so so what of okay with the growth plan seems the witness is vitamin of almost similar to take one given on the number of inputs you are getting and this is obviously so the constraints that are there versus the computation that happens like how does that like if the constraints are like you know for example communication perhaps you said I mean I there's lots of commutation there but there's very little logical constructs about language sites the assertions that you make like here you have assertions tonight about those arguments but then you dope you main produce like bindings inside of a circuit to like buy new variables and say they're like pulse of this so like does that make sense like when you make circuits like visitors like what constraints on things matter versus like just raw computation really yeah so like every you will know it so let me request so why you trying to get an intuition for like his idea of Constraints my company versus like raw computation error so like I could say something like a Gillette binding in this language where everyone says like let a equal hash of these things versus like a plus B equals C is like they're searching so you want to see what diminishment yes so with yeah it's just like come yet I mean in some languages it takes longer but that's just a girl but like when you when you get off it's always yeah so it's like if you had a Dex you would spend like 0.0001 percent of your time how big it is always yeah so can we do this same thing we just have to write and use sake but that we defined in the previous parts and we really have to check the center's leave receivers II the balances and we need to update the two like posting a single transaction you guys can try out the best parts and I'll be here do a twirl [Music] the same circuit that was present in the website so I just like of us today as to st. amounts and I just go through how to create the inputs for this and then maybe you guys can write for this workshop is basically created a script with it's like 10 it's the input for your sake so we basically here create a new private key and we declared it that it's Alice's private key and we create a box private key right and we have palaces property we have both puppy and we are basically using these two helper files from sagami-ya and we basically created a bound for Alice and Nikita come forward and we hash the puppies and the balance is together as it was during the tutorial right and we used in C and then we greater leave account for Bo and we create a DFAS provoke and we and we will disagree tenets of initial account root for both the circle so since it's only two account which need to package together we get out mother aside then we need to do a simple transaction and from Alice to Bob and Alice needs to sign that connection so we sent our private key over here and we get a signature you that we generate a new this first visit like to send 500 to with year list in the previous state state or our heart 500 organs and bobcats 0 so after transferring Alice should have 0 right so being with the intermediate route as soon as we process a leaf we need to create intermediate room so that is is not able to spend the 500 tokens she spent earlier again right so we create a new be so agreed a new leaf ash and we declare it as the intermediate room then he update though Bob succumb right with the money he got from Alice and we did a great early match for it and that's the final rule and we pass all of this as inputs we must all of this has inputs to the circuit and we dump all of this data in input or JSON file and when we're not and we basically run calculate witness it uses these inputs to generate a witness and later we can use the witness file vehicles like do you want me to write over you [Music] so certain thing takes a while because this socket has not not not many constraints than the previous month and it basically uses the circuit so so like every signature verification has its own constraints taken mobile root has its own constraints right so it takes a while this will be the input file for us if I try to change the input already nation after this it won't work [Music] [Music] yep you're saying that like you know sha-256 s that's it yeah so it is enough lots of punching so yeah but in theory like right over when you're saying is that the USS satellite once you're saying that built the calculation is celery brewing so what if is there I guess about us there I said like there's something that you did it once is there are some money of like kind of like some roll up jet where you just like you did that one time that you made so you basically have to grade improve every time you create a new batch right now so yeah at most we can do or we can like paralyze it sounds like using like what a lot is we can predict if I process this is this path of transactions the new vocal rule with this and I can interval start processing next next pass while the proof for previous verses being good yeah so I click create the proof before coming every part because it takes a lot of time if you guys want to try it out maybe you can run these commands I can I can try it with running but it takes a lot of time depends on the number of constraints forward but this it won't take like it will take like 2 minutes [Music] [Music] yes so so this clustered setup is basically one party right now but I guess I didn't leave people have been working on doing him MPC you will not GS as well so so it's like multi-party computation and a lot of people on the set up and they're supposed to discard the toxic waste so that's it then people participate and even if one of them is honest then it should be fine because we are we have to participate over here if we can basically clear like it's false proofs but if we had multiple participants like let's say 100 200 times yes a lot of things if you like want to ride out and be there do about and I will do if you have any motion and stuff I think there's a log-log slide so you can actually write if I close but I guess how people are still working on a compiler so I guess it should be out [Music] which of these life is to reduce and which you have to throw away is there anything that you are using change I guess we will have to create new language for the new blooming systems yes so I guess you'll have to create a subject of the compilers just for a lightweight from Sikkim language through the harmonious constraints that that what can almost probably stick from there if there's a new moving system of you can maybe use that the optimizer [Music] yes why did you want to be stars [Music] [Music] so these these things would be Elena by the month makes me alone betting I want to have any personal collection of clothes what's your name pass it on we're going on [Music] I have I have some links get out this was one day and we have been working on a thing for grown-up things enormous xxx what it does is that it does not pushed around us announcing so when you try to push down that small chain that that basically limits the amount of traumas and that we can close it with the amount of transactions that can be submitted in we are limited by the gas gasoline but if we don't push restaurant chain and then we can process a lot more drama and in a single batch so this is for things like if you want to make sure when you say about that is it possible to live like a proof constraint in this language also like basically like what I would say it's like these arguments satisfy like let's say you wanted to run something like in parallel or whatever like I had some which is like yeah the arguments to this thing also satisfied like this relationship between each other and I wanted to express the fact that there's a proof of this in you all right I guess what I'm saying is that you what are they parallel and saying I said really expensive to do of course a lot of really expensive just wanted to express that like it was like a match up if you did to create like certainly between the two of them like rather than having like one function in describing you could break it up and then basically like you don't save you time by right two smaller pieces that waiting post like a larger set drivers because you have you have tons of constraints or whatever if you that are all related in parallel by splitting apart I guess you already straightened them off in two different circuits so yeah basically this nazi was first time because the circuit the constraints of those circuits haha combined and they're taken in to move like when me Jenny generator proof was those ones constraints are still added to the constraints of the Buddhism something yes so there's no such thing as like multiple circuits one one one there is kind of this idea of putting multiple nesting snakes are you just like he loves it and you had some initiatives about the data that like some of them meet some of them are like yeah so you can [Applause]