L1s vs Rollups zkVM vs zkEVM | Zac Williamson, Alex Pruden, Brendan Farmer, Alex Gluchowski

we can be friends after this where you come I come not have to give any talks except at the beginning of the week I'm very happy oh wait this is I'm sorry that's yours thanks for agree to do this all right all right let's get started okay so this is going to be a really really good panel everybody um we got some OG's on the panel let's give everybody a big shout out um okay so let's start with some context we're here today because we all believe in this amazing technology Co ZK and ZK has been at its core very complicated finding Market fit product Market fit in um in the past few years and I believe we found it right we found one scalability and two privacy as the main benefits of ZK in the blockchain context so here we have two camps here literally represented on both sides of me so we got uh ZK sink and polygon on the right hand side and we have Alo and Aztec on the left side of me so according to this privacy and scalability use case uh the architectural design of the blockchain are also different vastly different right so we got the DK VM Camp uh which is here to solve the uh the privacy issues and the dkm right solving scalability of the ethereum problem so we're really going to just Dive Right into those issues and really figure out the the differences the different perspectives um I'm going to just give a preference by saying I am a big ZK fan you know that's why I'm working in this space but I'm going to take off that Maxi hat and just be a skeptic for the day and really push everyone on the panel you know why we're doing the things we're doing so there's no right around answers but different perspectives so with that let's get started shall we okay so first of all just quick intro uction in 30 seconds the name your title and your project please okay Alex CEO of met Labs coinventor of ZK sync ZK sync is a scaling protocol for ethereum it's a it's the largest ZK Network today on ethereum um with a mission to bring zero knowledge proofs and like basically bring the entire world on chain with zero knowledge proofs because I believe that this is the the only technology which can actually scale web three to the entire world while preserving the key values that we hold dear in the world of blockchains uh hey everyone I'm Brendan uh I'm a co-founder at polygon I work on ZK stuff um uh Hae from our team pointed out that this is the only panel that he's seen that has the word versus in the title and so I guess I'm debate uh I'll real quickly real quick um introduce myself as well I'm the head of BD Alo uh but just so you guys know I'm going to ask the the most hardcore questions to Alex over here my boss over here just to be impartial don't worry about that go ahead Alex uh Hey everybody I'm Alex uh I'm the executive director of the Alo Foundation just briefly Alo is building a new layer one blockchain uh with a ZK VM based on ZXI with really the goal of you know the focus being privacy and the idea being taking you know how the internet went from unencrypted to encrypted bya the transition from HTTP to https it's what Alo aims to do with web 3 uh in addition to that I run Z prise which is a nonprofit initiative to help accelerate CK proving and before all that I was an investor at a16z hey everyone uh I'm Zach I am the CEO and co-founder of Aztec um and coinventor of plunk so Aztec is a privacy preserving Layer Two for ethereum so our thesis is that privacy is really the missing link required for blockchain to hit the mainstream and reach into everyone's lives and not just Cipher punks um and that having Rich composable privacy in a smart contract framework uh is what's required for us to really add jet fuel into this world computer that we're building all right [Applause] okay so first simple question let's start with that um in your own Wars how what um I should say what is the difference between using ZK as the tax St for privacy versus as a rollup let's start with Alex G over here um I I I actually don't think there is a that much a difference like Alex just brought up a beautiful analogy of HTTP and https and how it upgraded the web to and brought our lives online um if you think of https it does not only provide privacy you know like confidentiality of your communication it guaranteed the Integrity of communication you could finally talk you know like you can use any device access your online bank access your medical records work uh accounts and so on and be sure that this this communication is going to be protected and you're going to be talking to the right party doesn't matter who is in between like all outers internet providers you don't have to trust them it's a trustless communication between any point on the interet to any other point the ZK is doing the exact same thing for the world of blockchains for the web 3 uh it provides like from a different angle like it pro unlike https which enabled Integrity of communication the ZK enables the Integrity of computation because the blockchain network or like a network of many blockchain blockchains is essentially a global distributed computer which performs distributed computations on a huge shared state like this state can be sharded can be different chains but it's like you can consider it like just like the internet is probably one Global computer with different systems same in the work of blockchains and to communicate trustless and seamlessly and without Capital costs you need the this this layer of integrity and this is provided by ZK so I think we're just like leaning into one or another property of this technology but it really has this two facets yeah I think that's a nice way to put it um I think that uh you can think of rollups as uh uh e z Roll-Ups as being sort of a way to constrain the operator of a chain to only behave in a way that's valid so uh you can take a chain that processes millions of transactions off of ethereum and you can prove and you can guarantee on ethereum that all of those transactions are valid and so you can scale by moving compute off of uh off of the main chain um I do think that it's like it's important to emphasize that these systems are not mutually exclusive iive like we can have rollups that also provide privacy and we can build uh private uh you know applications and and smart contracts on ZK VMS uh as well and so um yeah I think I think that like ZK just opens up a huge design space for both privacy and scalability any things to add on that uh yeah I think no this is a perfect Point too I mean since this panel is all about versus I think this is a I think I I would share a different perspective so I think uh I agree that rollups and https uh I guess in cyber security there's there's three concepts that are often cited confidentiality integrity and availability or authenticity depending on who you ask and I think what we just heard about from rollups is the Integrity of computation and I actually am not a big fan of the term ZK rollups um because I think the Z ZK snarks the ZK stands for zero knowledge and the you know the academic term means you know the the verifier learns nothing about the statement being proven but in most rollup designs including those deployed today you know by the ver by virtue of how the structure is set up where you know user submits a transaction to aover theover kind of learns the content of that transaction to generator proof that then technically the verifier on the on ethereum you know doesn't it doesn't reveal anything but the blob that's posted alongside the rollup transaction for security reasons can effectively be reverse engineered and so it doesn't really get you privacy today and I do think it's possible theoretically to imagine a world where you can do a ZK ZK rollup and and Zach should weigh in on this but I think it's it's theoretically or I think it's practically quite complicated and so I my and my personal view is that scalability is one reason that people have cited that ethereum has not been more widely adopted but I would argue that the lack of privacy um the ability for people to you know to not hide what they're doing potentially in financial transactions is more what holds the space back so to me that has to be the starting point and the prerequisite for further adoption actually ZK stands for these days for zipped by cryptography well we we'll have to debate that on another panel yeah vitalic said so so like no need to debate so yeah I'm uh I think I'm obviously more with Alex here um but to articulate my thoughts um what um uh Alex sorry Alex and Alex uh Alex and and Brendan were saying about um scaling privacy being roughly equivalent at a very high level yes but I think that's like saying I mean yes both cars and trains use internal combustion engines but they they very they serve very different purposes because blockchain is not just a computation environment it's an execution environment which defines an interplay between computation and state and how the results of computation update persistent State and if you want that to be privacy preserving that requires radically different choices to be made when designing your network architecture and your system architecture which then leads to radically different choices in terms of the actual zerge cryptography technology stack that that that you select because you have different resource priorities so um yes they are sort of the same but we're rapidly seeing a large bation in Technologies and architectures between scaling networks and privacy networks or scalable privacy networks and um I think the further the space develops and the more that various Network specialize in refine we're actually going to see more of a Divergence between these protocols and the the more difficult it'll be to reconcile those technological divergences yeah I I I I would maybe just clarify at this point that um like in a ZK ZK rollup you're using ZK for both scalability and privacy I I would definitely not disagree that the if you want a privacy preserving smart contract execution environment that that does not look like the evm like I I don't think that anyone would disagree with that just cool all right so I think I'm going to go into the evm cam here the dkbm side um and really understand the Unique Designs that make you different right from from each other so U no polygon is using uh using metallics definition a a um type one right type one or two I would say um and then you guys Alex uh SS CK sync side it's more of a type four so can you explain you know what are the trade-offs there how did you come to that decisions start with Brendon please oh with me um yeah so so I think vitalic framework for uh classifying zkm um uh it just ranks types of zkv ms on how close they are to the to the evm to that's used on ethereum and so uh a type one would be aover with the ability to prove blocks for existing ing chains so you have to change nothing about the chain and you can just generate proofs um a type two is uh offering an environment that's functionally identical to for developers and for users but on the back end it uses different uh Primitives for like the state tribe um and then as you progress further down uh the the the classification framework um you you I I I think it terminates at a zvm where it's a different environment than ethereum but you can use a compiler to take some solidity code maybe with modifications and run it in in a Type 4 zkm so um so like I want to ask the audience a question have you any of you run a virtual machine on your computer like if you have a Mac you're you run like I don't know virtual box and then you put some windows programs there right like you can do that um and you can run any program in the exact same way you just take the binary code like for Microsoft Word and you run it on on uh on the MacBook right it will be in this window it will have like you know like the keyboard maybe will be like slightly whatever but it will be slower or the other option is you can take this Microsoft Word code and you can compile it natively for your Mac and then you can run it super smooth and fast and maybe you can use some um Native features to Mac because your menu is going to be like more natively integrated and so on so we thought uh if you're going to be like if the future is ZK and you're going to be running like native uh ZK applications and they're going to be much more perform like massively outperform any uh emulated approaches that it makes sense to start with with this compiler approach you can always add an emulator on top of that like for some spe specific cases like maybe you want to run you know like just sport some special contracts and have the same address between different chains you should be able to do that but that's more an edge case the default is you take the code and then you compile it and this is why we chose the type four approach to begin with the most efficient most performant uh way and if you if you check the fees like right now ZK sync is by far lower cost than any other rollup ZK or non ZK like by like at least 50% margin yeah hold for Applause uh so Applause so so one uh one thing to point out is that fees are are uh massively determined by call data which has nothing to do with the I I I I would just emphasize that if you look at proving cost the proving cost is largely determined by the efficiency of the underlying proving system and if you have more efficient proving systems then regardless of whether or not you're doing a type two or a type four or type one you will most likely have a lower proving cost and so I I think like our uh sort of thought process and and design decision was was based on the fact that if you give people an equivalent environment to ethereum where all the developer tools just work all the the smart contract code just works then the uh the differences between and I actually see Jordy in the audience is uh the man responsible for the first type two uh zkm but it's it's a much better experience for uh for users and developers because it's an identical experience to uh to the L1 hey that's not fair that you planted majority back there I want you to know but no I actually I have a so I have a question on this it's just a neutral uh question that I'm genuinely curious about is the goal I guess for for both of your projects um you know is like this this characterization or this categorization you know kind of implies some kind of progression do you all view like is is it uh is it the goal to get to the type one and if so why and if not why not no so so so for us like we we see different uh ZK VMS and different ZK VMS as satisfying different use cases so uh like if you have an existing type one chain there sorry an existing evm chain like uh like cell or uh you know BSC or or polygon posos is like a really good example then uh you might not want to migrate that to uh a completely different zkv uh uh execution environment and so it's a nice thing to be able to take a type 1 prover and instantly seamlessly start generating proofs for that chain uh if you're starting a new chain you might prefer to make a different tradeoff um and use a type two for for lower approving cost um if you have a nonm application or nonm execution environment you might choose to use a zkm and that that's something that we're working on at polygon as well um and so it's not like this progression where where every chain terminates at type one uh I I think that there are trade-offs and and and developers should be free to make those trade-offs I agree with Brandon I I agree with what Brandon said and I want to highlight a specific use case for when type one will be necessary and this is why we we're also going to bring it and you guys are working on this uh it's proving ethereum layer one blocks themselves because once you can prove their one blocks then you can have your phone like a a wallet on your phone verifying these proofs and be sure that the ethereum block that you're currently watching at is valid from Genesis and all the chains that settled on this on this blog are also valid and you basically turn every single smartphone in the world into ethereum full node but like bringing 1 billion full nodes to ethereum is a massive decentralization boost and like this is what's going to happen Okay let's move on to the BM side and see how that debate goes right um So within the virtu like you building your own virtual machines on both Aztec and Alo but you have very different approaches to that too Aztec is at L2 and alos is on L1 explain your perspectives there start should I stop go ahead well for us it was kind it was a bit of a um no-brainer because of our well maybe just because of our um backgrounds in in the ethereum ecosystem but the way we see it like why is privacy useful privy privacy is only useful if you have value you want to hide um because you know nobody nobody cares about how many you know magic beans you have or and so for us we wanted to from the kind of commercial perspective we wanted to build as close to the layer that had um value on it that was a source of liquidity so that it's very it's much much easier for um for people to bridge into Aztec use Aztec based applications that we're tied into the ethereum ecosystem um and mean that can be happened through trustless biders because our consensus is derived from ethereum so that was the commercial reason but the other reason which was really something which um just a general like philosophy that I I try to apply with Aztec is PL to your strengths our strengths are um cryptography cryptography engineering and building products and systems using that cryptography um we are not uh consensus um Specialists we don't want to build a consensus Network um uh we felt like that would just be an ample around our neck and the maintenance overheads of maintaining that consensus network over time and making sure that it was upgraded to use the latest Innovation so it didn't become uncompetitive would be an unsurmountable source of friction for us yeah so I actually think it was a no-brainer to not build on ethereum um for the following reason um I so as an investor I remember a time when everybody said no one wanted to learn solidity they're like ah we need to have viper or whatever we need to like have you know we need to create languages that are close to things people already know because you know no one's going to want to learn a new language and I remember remember a time when people said things about I know we're at an eth conference but salana where people were like ah it's another layer one who needs another layer one no one's ever going to adopt that and I think the reality is that um you know PE there it's still very early days and I think what will ultimately drive people to adopt things is where they find real utility and in my view uh cryptocurrency web 3 in general for has not really found a killer use case outside of uh speculative applications there are some I think promising early areas but I think for the most part I think if you just look at onchain activity you can kind of convince yourself of this you know most of the use cases are speculative and I think to to get around that we need to build an environment from the ground up that's purpose built to enable privacy but also enable programmability but maintain that permissionless that makes Bitcoin and ethereum special and I think if you do all that then I think you enable the potential for new use cases identity is one that I'm very passionate about and I think those use cases themselves I think could grow to be you know billion or even trillion dollar industry someday um and I think when you have the when from the perspective of a builder or an architect I think when you add layer there's two ways to build there's starting simple and then adding layers on top like building a layer cake which is I think most how most people kind of think of ethereum you have layer one layer two I mean Bitcoin is another example you have lightning Network and you've got other stuff right but I think the trade-off there is every layer that you add there's now an interface between layers and many times that interface you have to uh you know that's added complexity that you have to deal with like we just the the whole concept of a ZK of a type 1 through type four ZK evm kind of gets at this you're like okay well I don't have the bite code is not quite compatible so I just got to assume some different things about what hash function I'm putting in for this op code you know so there's just different assumptions that get made and I think after a while you get away from these core things that make a single monolithic blockchain unique compared to other types of software so that's why we decided to build a fully integrated new layer one from the ground up up to enable what I view are novel new applications that aren't possible anywhere else can I can I just do a slight slight rebuttal or maybe just focus on one point which is that you mentioned that you know like the current applications on ethereum on blockchains are speculative and that you know and I maybe I'm maybe I'm reading too much into this but I might have H like detected a slight bit of disdain and contempt in your voice and honestly I used to feel that way and I've changed my mind a lot because um you play the cards you have the cards you want to have as in there is a trillion dollars in blockchain today a lot of vibrant applications and the current activity that has been created by blockchain has created the environment in which we can build and design these these Advanced protocols and systems that what you call speculation is literally paying your salary and it's paying your bills um and well likely possibly you're going to have to draw your first users from because those are the current people that use web 3 so I guess I would say like don't don't don't piss on your users I can't reut that sorry for being a bit bit hush I I I also don't think it's like a unique thing about crypto that there would be uh a technological innovation that's accompanied by a financial Innovation that drivve speculation if we look at like the development of railroads and those were enabled by the development of the joint stock Corporation and if you read like uh like what robber barons and like their offspring and their fail fail children we're we're uh we're telling each other it it sounds like shitcoin trading like like like they say I only pick the Railroad stock that goes up and like I I I I I just think it's like maybe a little bit shortsighted to view like what's happening at the very very very early stages of the development of this techn technological infrastructure as being sort of like dispositive or reflective of what's going to happen even in the near future that's fair but I do just want to characterize so I think that's all fair feedback but I do think well so speculation can be a positive force but it's not I think we would all agree it's not the end goal right I think the end goal is we have real useful application we have railroads that actually carry Freight and do things that everyone including outside of this conference sees utility in so that's the only clarification I would make okay I promise I'm going to ask this hard ball question to you first Alex so Alo has um started four years ago I guess this question goes to ask Zach to Aztec right six years ago why haven't you launched yet sorry I told her to ask this one um look these are very complex systems and we only have one chance to get them right uh and that's the nature of building blockchains um and I think in particular the choice with the tradeoff of the choice to build an endtoend layer one that includes you know a programmability layer its own BM a language and a unique consensus algorithm that kind of accounts for all that and maintains the properties of privacy permissionless and programmability um is hard and there's a lot of ways it can fail and because we only have one chance and because everything is so self-contained you kind of can't really launch until it's all together so this is the you know this is one explanation for why I think it's easier I think it's frankly easier to launch a rollup at least launch one but I would argue that many rollups themselves are kind of incomplete I think there's many people who kind of view I think in the long term this goal of having a decentralized sequencer but uh from my view I think that you know most of those conversations happen theoretically and I think when you look at what a decentralized sequencer actually is it is kind of the completed product which looks a lot like a layer one blockchain so um your question why haven't we ships we have ships that's very unfair so in 2019 Aztec shipped Aztec 1 which was a confidential transaction system for ethereum in 202 21 we shipped estc 2 which was the world's first ZK ZK rollup uh and in 2022 we shipped estc connect which enabled Aztec 2 to interact interoperative with D5 protocols and L1 and provide a privacy Shield so we have shipped we've not shipped The Grand Design and the reason for that is the technological hurdles we've have to overcome are fists and we've had this process over the last six years where basically we've taken the best technology available which we've often we've had to invent in house because existing stuff wasn't wasn't good enough and we take that technology and we push it to its absolute bleeding edge and create a product that uses it and launches it and it's only been in the start of 2023 when we had confidence that we had all the all the ingredients in place to build the full programmable private SM contract vision and so that's when we we made our move to actually you know put up put our foot down and grind on building that um but I guess to really answer your question it's um yeah it's shipping to takes longer when you have extreme technological barriers uh in your way that you have to kind of pickaxe through Minecraft style um through invention so I think I wanted to ask the rollups here right since that was mentioned by Alex the single sequencer you know making it very decentralized and do you think it make the chain less permissionless less what permissionless oh of course like the the centralized SE concer does make the less permissionless because the operator can can sensor it so this is why we have been working for a long time on making a decentralized ler to consensus and we want to switch to it as soon as we possibly can because the permissionless is the nature of blockchains this is one of the most important like three top most important properties but along with verifiability or trustless in other words and so the reason we even launch the centralized sequencer in the first place is because it does not compromise on trustless right so like even though it's like I mean the transactions in L2 are kind of like permission from from the sequencer but it's the user is not permiss permission to exit like they can always exit because they they can prioritize transactions in layer one through priority que so if they don't like I mean if if if they are not welcome in the system they can always leave so this is already a very important piece of permissionless there but of course we have to transition and we will to to decentralization very soon this year yeah completely agree with Alex G i i I'd also say that there's like I know Alex you've expressed maybe some frustration about the rollup road maps in the past and I I think it's really really important to to like emphasize what Alex just said which is um if you're launching an L1 decentralization is essential for security like in order for your funds to be safe it needs to be decentralized and that is not the case on a rollup obviously like if we think about the the like maso's hierarchy of chain needs like security is kind of at the bottom and then if we move up like obviously we care about censorship resistance and permissionless but th those are like you know like we we need to think about decentralization as being an instrumental goal to achieve those things um and like to to really be be specific about what the requirements are for L1 and L2 to be secure okay um let's let's move on to the next question um the uh performance of the chain right so you know Alo to do proving it takes five times the time um as opposed to CKC right so that because we use client side proving and why do we care about that yeah so I think um look so the proof system that we have is a little less performant than some other choices particularly those built on plony 2 or Stark based systems that have more performant provs um but a principle that we really try and build for is this this permissionless system where a client can be aover right and this is very similar to how zcash Works um you know zcash you can send a z transaction to a z address that Shield it effectively right and I think there is an interesting distinction happening right now in the space as to whether or not that's an acceptable trade-off whether or not it's okay for there to be only one PR or maybe a handful of of proving marketplaces that have specialized Hardware that can generate the proofs or if you want to have the ability to a proof be more democratically available you could say so we we very much feel at least I personally see that there's definitely going to be a world where proof generation is outsourced because people are not going to want to pay the costs associated with it either in time or money but I do think it's critical back to this core core principle that I think Satoshi really first you know kind of enumerated around permissionless and it got and really if you look at the if you read the Bitcoin white white paper a principle that's very clear is and and part of that is egalitarianism like like there were big Banks and there were not big Banks Banks and Satoshi wanted to build a system to not recreate that and I think very much for me a principle that motivates me is making sure everyone can be aover right and there doesn't have to be a bottleneck that comes at a cost of performance sometimes right depend if you're if you're generating a proof on a client side MacBook it's not going to be as fast as you're as you're running several you know servers in the cloud that can recurse and potentially aggregate a bunch of proofs together can I quickly add a comment so I running over um sure I broadly agree but I also think that it's it's um it's very Danger to um like in this space we have a lot of ideological um overheads I guess you would say that companies have to operate on we need to be our decision making needs to be normally Democratic maximally transparent and things like we um eonism everyone can run approver not everyone shares those views and it's very easy for other people to kind of um abuse those um those ideals um by shipping faster By ignoring them uh so I think that's is something to be mindful of um like on our end for example to be honest it's a it's very nice to have if any anybody can run a full a full like rollup Pro for Aztec but you know for V1 you know that's not something we actually care about that much because that can happen like two three months later you know you get the ctech na down maybe you need to run a really beefy compute to make a rollet prooof um but then you know in six months the tech advances you're good what we care about the most is client side proving because our clients have SE because it's privacy which is the same as you um which is necess an enormous number of architecture and technological changes to our protocol um to enable that rapid fly sight proving um which also just means there a happy accident proving a all of fastic is a lot less computationally intensive than as ekm um but um yeah yeah and I would just say I think one thing that I think about here is I I completely agree ID ideology is not the basis to make a a decision around a product I think what users will use it for as the basis to make a decision around a product but I think for the certain use cases and I mentioned identity a couple times as one is that I think is incredibly important as you pointed out like a user's identity information is should is secret like if you have to send that to a server to generate appr proof for you you're kind of you you you've kind of created a a more expensive version of ooth in my opinion and what I think is really novel if you want to implement a protocol like ZK creds you know you do effectively have to rely on uh the the client who has the secrets to be able to to you know maintain that secrecy for that use case to work but so so it's really important to emphasize though that like a lot of those use cases are completely compatible with ethereum like the only time that you truly uh cannot build a privacy preserving use case on the evm is I believe when you have an like you require anonymity for payments and so like a lot of the identity use cases we're already seeing being deployed on ethereum on uh on l2s and you could say yeah it's like expensive to verify proof proofs but with proof aggregation we we can amortize the cost of of verification on on the that's really not the point but oh we don't have enough time to to I'd love to argue that I'd love so much to spend a few minutes arguing that oh man we got to have a sequel to this panel all right yeah we have to um yeah let's let's end on a maybe merer note here what are you most excited about in the DK space in the next 12 month start with Alex um the uh rise of ZK Networks with Hyper chains we call hyper chains connected with Hyper Bridges like many blockchains feeling like a one seamless big zik Network yeah I think uh further developments in in pushing proving systems further pushing the technology further and uh yeah the polygon agay so um I'm most excited about applications and built by many of the developers than in this audience on any of these protocols that solve a real world problem that my grandmother finds utility in yeah I'm with Alex there um but uh things that particular me are basically identity you can link identities to cryptocurrency accounts un like uniquely then you you mean that enables blockchain to tap into the real world and affect real world identities cool great uh let's give it up to everybody on the stage thank you Alex G Brandon farmer Alex kudin and Zach Williamson thank you