Plasma Cash: Towards improved Plasma constructions by Georgios Konstantopoulos (Devcon4)

so I will try to make it as technical as possible so apologies if it sounds like too deep of a dive but I want everybody so like you have I have 20 minutes so in 20 minutes you'll learn what plasma cache is how it works where it works where it doesn't and why it's the most like viable like solutions currently at least at the current research levels because all the other solutions I'm of the personal opinion that they're quite let's say optimistic and ambitious and it will take some time until we have them like in production so much late yeah so who knows here how plasma cash works like has tried implementing it in a in a low level essentially oh okay okay so the point is that they are their plasma constructions the original plasma paper they it was very very important because it gave the notion of what plasma is it should be like satoshis vision thing the Telex region whatever you wanna call it however it was like totally unrealistic has it's called MapReduce construction it had like a bunch of like it they dream of the three of chains and now everything communicating each other like the Supreme Court I don't I'm not of the opinion that it works so this talk will be highly opinionated on what I'm saying how plasma is involved so take this with a grain of salt this is not expressing their general let's say opinions of the plasma community I guess so yeah test test one two and the point is okay anyway the thing is that the plasma it works like with a classic side change transaction you have like a mention the sidechain you deposit funds you do whatever you like on the side chain you can take them out but the thing is that in order to get scalability we actually need a consent mechanism advances faster than the normal making it and a chain mechanism and you cannot do that like in my opinion by definition you need to like make some compromise on either the internalization or the security aspect and so what we're doing is that with plasma you construct essentially an non-custodial sidechain because at any given point in time if there's some involved state transition you can go through this exit game and can like just get your money out within a certain challenge period yeah maybe I'm not exactly sure like yeah I have like a bunch of nice like shapes and all that to explain it so like the whole difference between like plasma cash and like the other variants it's because the plasma casts it's non fungible with it is in the family let's say of plasma protocols that it's the securities enforced by the non fungibility of route change deposits so each coin you deposit it has a unique ID it's different from each other and you can use it to have a sort of like a single exit game where like each coin is unique you don't have to use the whole priority queue construction to go through your to make multiple exits there is no need for the masses exits construction which is like very important because currently and all the other plasma non plasma cash variants designs they require mass exits and I will make the claim that mass exit currently aren't viable due to how like let's say primitive like our signature aggregation works on the we cannot verify enough even if you do a multi signature and you compress it and you do a threshold signature on all of them you cannot actually like verify the whole thing on the EVM yeah and like okay okay so Jeff just said like explain why storks are better than XD based checkpoints and whatever or Isolators so first of all quantum resistance okay so the argument is plasma cash has a very big let's say disadvantage that whenever you passing coins around and as the side chain for the progresses the coin Hugh story grows linearly so I have 10 blocks I need to pass around 10 blocks worth of proofs and this sucks so what we can do is one can just pass around the proofs - we can do checkpoints but which is a very brilliant construction by Kelvin however let's thing it's it requires so much social coordination it's like on the level of the mass exits and I'm not sure if it works so on the contrary what you can do is that you can use the RSA accumulator they are same letters recent construction which you like assign a unique prime number to each leaf and you make some black magic on it you can somehow prove compactly there that the consistory is valid and the final the very sexy alternative is that you can just take the whole history you make a stark proof you put it on the back on the black box without any trusted setup or anything that you don't like you just have a combat proof that can be x power that can be transmitted to your receiver and actually in these cases we never need an unchanged verifier to do that because I'm just I want to prove like let's say the Jeff I just want to tell him that you know I have this going take it and he proves it on his own and the verification is really very fast and yeah quantum resistance because we need to be like anticipating the quantum computer it's they're coming to get us where's my slides more ya Q&A please actually yeah I'm I'm pretty sure I can answer like any technical questions so hit me with your best shot and if I don't answer here why do we need to worry about quantum resistance if we're not even sure if the system's work it like we're gonna we're gonna multiple times well my gosh is it is it because that's it's gonna exist in perpetuity for a long period of time and then we need to be like looking ahead like protecting against so to rephrase if we didn't have a quantum system scheme in one year I believe it's much better than investing six six months in an on quantum system scheme so I'll just time in for a second so I think the danger is is that we encrypt all this data and we have like arc browser history encrypted and then somebody gets a quantum computer we're all screwed right okay so how do you get started firstly Kelvin and friends have done like a great great amazing educational effort with the site called little plasma dot org if I'm not mistaken but I am of the opinion that is the time we're going if I don't have slides but I am the opinion that I literally cannot show you how one thing works if I lit upon you like to if I give you ten links it doesn't work that way so I've been writing a plasma paper like okay we talked about my work right and I've been writing sort of plasma paper that it's like a 20 pager that you read in maybe two hours and you can like understand everything plasma this vine that I'm working on so you read it and basically you should be having like a pretty good idea of what's going on and implementing a plasma contract isn't actually the hard thing let me near the client software is the hardest thing because the smart contract you need like you define it like you give it like you need to do this for exit this to withdrawal this to deposit that's all there is to it and you had a submit block function to commit the molecular route and that's it but the client software it needs to watch it needs to cache state because if you pull the medical proof you need to save it because if you don't like and you restart your client you don't have the proofs you assume that the whatever entity is providing you the day that way will provide you the data and if you do that why even bother with plasma which is I'm pretty sure there is some like plasma variants that assume some sort of data availability and you shoulda never assume any any kind of it so yeah just read learn plasma like I'll give a link to the paper at the end yeah anything anything yeah but again my opinion I don't think light client verification works on mu P I'll put very contrary opinions of always with a grain of salt so I MVP it requires you to validate the side gene state which by definition it contradicts the scalability because if you need to do full client validation on the light clients you can never run like a secure plasma gene on your phone you can never like validate the secure plasma chain on your phone and you do that because otherwise you cannot be sure that the plasma change is not a fractional reserve like if there is a also from it and you didn't take note so yeah that's why like I'm a very bullish on the plasma cash because everything that happens on chain you know at that moment so ok plasma okay so why is plasma you have the maintain the sidechain like you deposit some funds you do the fund whatever you like we talked about this already so I will skip this through the big detail that we need to like insist on is that each block must be submitted and the gas cause for this they kind of stack up I actually really like this purple color it's very satisfying so you checkpoint each block and the moment you consider transaction finalized this is like security property that you consider transaction finalized once the block route has been committed and the witness data the Medical Branch for that transaction that you're looking for is made available to you because if that data is not made available to you you literally cannot know if the transaction was included or it was censored so just a moment to just say that plasma cash is real it's working right now it's live right now you can do NPM install like this thing you can run this command these are two real addresses and you can get connect to rinkeby via fu or your own node but nobody runs their own nodes unfortunately yeah and this is like how the thing like looks from the inside that help we have a bunch of commands the user needs to do the very very minimal amount of things just the deposit transfer exit withdrawal that's all you need to do I'm of the opinion that you never should like force the user to do anything we are watching it's all on the client software and yeah whatever like you can demo it if you want like I won't do a live demo because it's total like hubris it doesn't work so okay I've written this thing like you should try to read it give me feedback and so on I'm basically trying to do what I said before I'm trying to do a very like concise overview of a plasma cash works and what's it about and soon I will have like some more like formal notation with how the exit game and the finalists in the state and visions work so first of all like why it's real we didn't do it like in pretty realistic timeframes I believe that I started working on it on me and we had like an implementation within a month and a half so it's real we have low data requirements for the light clients like okay it's not really low but it's lower than any other available solutions I will claim it's low and you can have like this modular architecture where if anything that you don't like you just add the plug-in so this whole naming convention thing I'll talk about also so I believe that this is very good code you slide like to like get people to understand like what are the difference of its variant so the ones that we are working on and much thanks to Ron J for maybe name wrong - for all the discussion for this is that they whenever you depose the coin on this violence of plasma cash its coin is unique so you have this like this gives you like a very simple exit game and it's very like the security's tight and what you can do is that but it has some problems it doesn't have like fungible payments it doesn't history goes like hell so what you can do is that you can either like you some magic like I say accumulator 0 in all its proofs to prove the coin store in a more compact way and the other thing is that we need to like if we want to do like fungible payments with multiple ones you can apply the other technique that you break a coin down in 100 pieces and you have the user transferring the sub pieces of it and whenever you're speaking about the coin you're actually talking about a range of coins or just you stay tuned yeah I'm very I'm a very big fan of states on plasma but we'll talk about that later so the other variants there are the plasma MVP ones which I argued earlier that they require too much data and they also require they they also require sort of priority queue construction for exits because if the operator or the operator is basically able to create a huge utak so which exits the whole chain which would make the fractional reserve and you need a mass exit which to my knowledge there is no working mass mass exit scheme to date and on top of it we're not the more viable plasma which first off to like solve you to make us better and most viable plasma one day I don't know and yeah you can use narcs to verify the state transitions from like one thing to another so currently what we have is that we do transaction routes so anytime you submit a block you don't actually submit the state route so it's not the latest state so you need to like go literal a whole block history well in this case you just have the state route and it's like it's there you know it's there because you have this whatever black magic box that it it proves your assumptions so I'm pretty sure this is a good taxonomy unlike which are the violence of plasma and they're okay to be fair these are the variants that are based on payments and the payment the violence are based on smart contracts I'm not well-informed women but very very fun so to do like a quick technology primer so the main data structure that we use in plasma cash it's a sparse medical tree it's basically a tree which has all the it has like whatever leaf amount you want it's all pre computed so it's all like in the default values it's the hash of 0 or whether or not one you want and to prove their inclusion of an element you do in the classic way that you just provide the Myrtle branch with the siblings everything I'm assuming that people know how it works and the fun part is that you can actually prove non-inclusion by giving an proof of inclusion of the zero hash of the hash of zero at this leaf and this is very convenient because we can this is what basically makes plasma cash work and you can actually have some very nice optimizations on top of this so because all the values are computed when I'm giving the miracle proof I'd not need to give like 32 bytes every time whenever I want to give the default value for a sibling I can just give a bit field and this like it's really one bit where it's 32 bytes and in this very simple example so like instead normal is a miracle path you have been house of zero and they and the higher lever one that's 64 bytes well with the optimization for the bitmap it's two bits and much love to the world theme for singing this up and having a working implementation so the usual suspect Alice deposit five ether was like the actual flow so so at least deposits like five III do this part contract the smart Condor amid some deposed event that the plasma chain listens the plasma thing is supposed to create a new block one new block per deposit this is not a security requirement but it makes proving like it's an optimization basically this has been asked a number of times just to post the coin and you get a new blog this isn't necessary but it's better and what it does it is it creates a plasma block and get literally a five ether bill if you will and the thing is that the transaction flow it's like you took so based but it's one input one output I cannot break a cone I just say new owner and that's a new owner just like catch yeah so I will just go through a simple like example of how they deposit their transaction flow work so deposit always deposit the five is like the five III example so five if they're like it just appears Alex gives the current Bob but the thing is that at this moment Bob must actually verify that the Cohen history is valid and now let's consider that there is a new blog where Alice does a very Bob who is the latest valadon over the doesn't move the coin and if Bob wants to give the coin to Charlie Charlie must not only verify the inclusion block one and two he must also verify the non-inclusion in block three which is why I was I spoke before about the non-inclusion proofs in sparse milking trees and he needs to do that because considering the fact that there might have been a transfer from two to three the two to three would make the to two for a double spend and we don't own double spins so yeah and she does that and she exits by by providing an ancestor there has been some discussion lately that there might be a way to optimize this to not require an ancestor but I'm not sure about the safety of it if you want to evaluate it fine but I haven't been able to evaluate it but basically the thing that we know that works parent rates you give it a coin in the parent coin and you use these to exit and I will go over the exit game play the game let's play it like very soon so the whole plasma constructions they work based on a challenge period like the classic dispute period where I make a claim I put up a bond I wait some amount of time and if nobody challenges yeah my my claim must probably be right right it's all like crypto economics I hate that word so the time currently and they bond amounts are totally arbitrary I'm not the opinion that somebody just wrote the first MVP implementation maybe it was David actually like it just put like seven days for an exit period and everybody said that's it the Holy Grail or baby vitalik say I don't know but the point is that currently there has been no game theoretic like proper analysis unlike what the deposit what the challenge periods should be and what the bond amount should be and I'm very interesting to that so if you have any return please speak to me and yeah so this is like a good takeaway from the presentation that we model each coin has its own state machine so state machines like it's yeah we have the initial deposited state and basically you define the transition function that whenever you want to go from one state to another some certain things need to happen and what you do it's simple whenever you want to go from deposited to exiting you start an exit and you put up a bond let's start exit you put whatever proofs you like it doesn't matter and there are two types of challenges the one type of challenge is the interactive one and the other is the non interactive so speak about the non interactive which is simpler so the non interactive challenge it is essentially I see a claim and I instantly challenge it and the exit goes home like it like it never happened right and it's a simple form of challenges however they interact the challenge is essentially in order to finalize an exit it must not have any pending challenges in any outstanding challenges so what you do is I start at exit somebody else challenges my exit and in order for me to be able to finalize my exit the word exit has been sent many times you need to actually respond to the exit and like you have let's say you have a counter a challenge counter that goes up and down and all the way to finalize it's when it's at zero I hope this slide is clear because it's like more or less the whole like construction of how it works and now I'll talk about the challenges so I'm hoping things are clear so far because like this where we examples let's say that Alice has a coin eight block and whatever you like and Alice spends the coins you give it Bob or whoever else and Bob maybe then gives it Charlie so the thing is that Alice isn't forced to exit from a later stage you can always go to a stale scene just say I'll exit so yeah she can do that but the thing is that she needs to wait seven days or whatever to do the exit and at that point another entity they can challenge by providing a spend so Alice a signal makes the claim I am the latest owner of the coin and the other very MN and then a challenger comes and says no you're not basically if that's the whole thing that you need to know about it and this is the one type of attack that you can do and this shadow to Carl because he did like a very good like specification which is explained all that stuff I used it you should use it the other alternative is that you do a double spend so the example I was talking about before I was considering the fact that the Charlie Webb or Alice prime note plasma prime is actually like it's not a colluding party so what can happen in this case that Alice gives the coins Bob and Alice in collusion with the operator they double spending so they give it themselves some other friend of them and what happens in this case if Charlie wants to exit the coin he needs to provide the parent as I said and the whole like exit game here that words that you need to provide the coin that is in between and this actually proves the double span because you say no I owned it before you did and yeah and the final example of like the ex game it's like when you're exiting a coin you actually so when you're receiving going you I shall validate the whole time in history but what if you don't so I want to say in this example like to try to imagine that the radar doesn't exist it exists but it's like the response state so let's say that Alice gives a coin and that the operator they collude with some party to give a Cohen to Bob so they make an invalid state transition so to say in plasma MVP if an invalid state transition happens the whole change has to move which is impossible so what you do is that if somehow Alice somehow there is a transaction that gives the coin to Bob and Bob starts transacting with this coin this is an invalid state and if Bob Charlie Dylan aren't malicious parties they will check the consistory but they're trying to steal the coin so Dylan tries to exit and at this point at the seven day period Alice can say no I am the latest of the owner of the coin in this example what you can do is that you can actually respond to the exit so this is the interactive challenge the previous two they were non interactive in this one when you make an exit when you make a challenge you can live also some amount of time to respond because if Alice made an invalid exit in an invalid challenge somebody would should be able to respond so that's there where the radar who comes in that you should be able to bridge essentially you should prove that there is actually spent from Alice to Bob and invalidates here challenge and there can be a number of these so you can have like multiple challenges with invalid histories and the final result is that you want it to be you can only finalize the exit when it has to do so from my experience like towards building a client like it has been a pain to actually like keep like on the implementation part has been a paint like I actually keep the plasma contract and the plasma team in sync because you have essentially cron job with submits blog to the main chain and today I Syrian whatever you want to call it and the thing is that you have to make essentially you mustn't make any synchrony assumptions at any time like any state that isn't chained it must be checkpoint but if there is a delay or if for some reason the the cron job submits a block twice you change our out of sync so you're the main chain contact it's a block 10 and the plasma chains block 9 so that's not bad and and also relates the second bullet point that whenever you're listening so the plasma chain actually listens for main net events to actually like modify the state and you need to apply them in the right order because if you don't the state will be botched and so it's a problem on the client-side so this was on the operator side lets it have a correct honest operator or a software on the client side you also like whenever you go offline you need to save the block that you went offline and when you go back online and you check everything that happened while you're offline it's like it sounds like bad but it's like actually what happened with full nodes but I guess it's our approach towards full nodes but we like very light clients and yeah I'm very much of the opinion that you need to keep the client light if you need to store too much data on it it's bad but also you need to be able like yeah just catch the satyr so if you download some data just keep it there and don't discard it this may sound obvious but yeah yeah so we should be able to do better so currently this is like better is the enemy of good good is good enough currently it is workable it is done but we want to do better we want to reduce the two main problems I want to solve is reducing the coin history and making fungible payments and this pretty much what the plasma prime construction is so I'll just give a brief overview of what happens so the non fungible coins it's a double-edged sword because it gives you this nice security providers but you have like you cannot make the payment so you like so the one approach is that you have a change provider so I send Jeff like seven ether and gives two back to me but you need an atomic swap transaction which before plasma Prime from the dream it didn't exist and the other approach it was the plasma debit by Dan whoo I love them but he's not sure yeah plasma David which basically like instead of a common like having a certain value it can have any value between 0 and that value and you can think of it as a liquid like a liquid that goes from zero to that to its max capacity and essentially if you're able to reduce the one like liquid by a certain amount and increase the other one by another amount essentially we have simulated a transfer from these two it's very neat because it also has the notion of transferable payment channels because if I have a coin if I only call him that is like with some balance and they transferred somebody else it's essentially that guy who has now it has the payments on a loan it's very very convenient and the final approach which is the cash flow defragmentation whatever is that I deposit like one ether and instead of depositing one is there I get 100 0.01 in three coins and I can move them around and so on but the problem with that is that if I have let's say like 10 coins in a row and I send the middle coin suddenly I have to like I have two subtrees and the whole technically efficiencies of this technique is that you can exit multiple coins by exiting the sub-tree by proving it with whatever magic and yeah and the other approach is like how will we reduce the history right so first little checkpoints the LDR it's like you have a coin and you instead of validating from its deposit which is like 10 10 million blocks ago you filed it up to the last checkpoint so you pick the checkpoint I'm arranged to be like manageable however I claim that this requires too much social coordination because it involves the operate or advertising it's it's complicated and the other approach is that you can like simply like mess make less frequent commitments but this hits on your throughput and your capacity because if I have like you basically say that if I have like one gigabyte of history and they commit one time every 15 seconds it makes sense to say that if I commit one time every minute the coin history goes down by one fourth by to the one fourth the other approach to use the probabilistic structure with the bloom filters but if the bloom filter has false positives and it was shown recently that you can actually like pollute the bloom filter yeah in other words the accumulator so without human leaders what you do is that the goal without human leaders is that you succinctly prove the inclusion or non inclusion of something and you either are set middle which is the current like approach that people like or it is another alternative which is paying based which I would like to discuss the plasma called life later and the final thing that magic black box the snark stark toolkit which I was at the historic presentation yesterday and I was informed that it is possible to actually do budget proofs and everything we need like with Starks in a realistic time frame so that will be like lovely if we can have it and yeah okay there is this other thing so currently the UX sucks you need to wait seven days to exit the coin if you need to xtogo my appearance that you don't need to accept the coin but it must be there so what you can do is that you little like tokenized exit so I make an exit instead of like owning the exit I can get the near c71 or whatever non fungible and I can sell that around and whoever owns that coin it's like a coupon and you can send it and you can after the exit period has passed you can withdraw it and the whole construction is that this creates a whole market for exits where instead of like pay if I if I'm exiting five if essential somebody else is probably willing to buy my coin for four point nine five weeks because they have a lower term preference and this party it makes sense to say that it will be the operator because they're running in the chain and they don't care and they also run a full node anyway so they they know what's valid in not and the second one is the optimistic exit so instead of exiting so when exiting you need to provide medical proof signature whole lot of stuff it's a lot of data so that the gas can go from 100 thousand to like two hundred thousand and maybe more depending on your proof size alternatively what you can do is that you can assume that the exit will be valid and admin on one more challenge they equipped economic approach which is it's nice because like you can essentially reduce the cost of an exit like 60k gas like for to store operations but you you you are denial challenge and yeah some the final takeaway from this presentation the technical stuff it's it's all it like you should look into it it's not complicate and talk to me for learning about it plasma doesn't improve finality so this called 1 million is actually per second dream it's it's not real what you do is that you increase the capacity that you can for spare 15 seconds because currently if everyone can handle like was it like 9 million gas per block or eight what you do is that you can put the whole information that happened on the plasma chain in 32 bytes and storing 32 bytes it's cheap so if we have like multiple plasma chains yeah oh yeah the scale a build it can be 1 million transactions a second but still settles every 15 seconds if the data is made available and yeah essentially just think of it as a compression literally maybe not because you assume at the compression mechanism but the thing is that you just take everything you put very little later on it and if you follow some certain rules of the protocol like watching your good and yeah it's a noncustodial sidechain thank you very much and these are the repositories go check them break it if you can yeah yeah and have it take any questions maybe is their microphone thank you for your talk what's the problem with allowing atomic multiple transactions to be atomic within one plasma block because you cannot force the operator to include both so what you can do is that you can construct a game where one transaction is depend what you want in atomic swaps is that atomic is a bad word actually so like either both happen or none happen right so this matches your exchange use case I guess so the operator you need to force them if they include one transaction but either they must include the other one or if they include the one and they don't include the other one that one is invalid right and you can do this by essentially like doing a two step game we just like similar in the classic atomic swap construction between chains you just you commit to a pretty much and you give the pre-much to each other in here evil but yeah maybe Karl is better to asked like in depth on how their atomic swap works because I haven't been looking the prime how they how it's being done quick if it's quick I'm from data exchange protocol and we were trying to enable micro payments using plasma cash and milli the POC so we came up with episode but I want to know your thoughts how do you think micro payments can be neighborhood using wise don't you want to use the payment seventh question you have the engineering toolkit and you need to use the right tool I do not believe that plasma is a right to you know I think Georgio's needs a lot more credit for actually implementing plasma cash which is pretty amazing so thank you George yours [Applause] you