Martin Derka and Jan Gorzny I Quantstamp Announcement | Pragma Paris 2023

foreign [Music] this is our last demo for today and then we'll have one more interview to go before we go into networking and kind of talk to all of us and each other so without further Ado let's welcome our last demo for today Martin from con Quant stamp and he's going to talk about how do we actually now make all these attempts to make L2 transitions secure so please welcome Martin on stage [Applause] hi everybody my name is Martin I'm from Quan stamp quantstamp is a security company we do lots of audits we audit smart contracts we audit blockchains we ordered layer twos and so through these audits we are actually accumulating a lot of knowledge and you know from my position I am the head of new initiatives for a very long time I've been wondering how could we use this knowledge that is accumulated you know at our company to kind of contribute a little bit more to the public good and and greater good of the Greater ethereum Community and so you know when November came around and uh the ethereum foundation published a round of community grants focused on l2s I was thinking hey let's apply let's do something okay so I'm here today to tell you about the two grants or you know I will be speaking about one of the grants my colleague who will be stepping stepping on the stage halfway through uh will be speaking about the other uh Grant uh so I'm gonna tell you what we did where you can find it and I'm going to invite you for some future collaboration okay um so the one grant that we applied for uh was concerning block explorers for l2s right if you take a look at the landscape of land l2s you have a whole number of chains that you know build and roll up to ethereum right you have your optimism arbitrum you have something like ZK sync uh you have actually a boatload and all of them are somehow different now when you look at the landscape of block explorers uh the situation is actually not that great right you have etherscan which has been adopted as let's say industry standard it's a great product it provides great user experience and you know many of these layer tools they actually work with etherscan and use their services but if you are looking for something open source you will probably find lots blog Scout and you will very quickly realize that it actually doesn't give us so much it is not designed to be working with uh layer twos it actually you know doesn't show you all the information that pertain to layer twos and so when we were applying for this brand we were actually thinking whether it's possible to fix this right we were asking whether it's possible to define a standard for an API that would be working as a data source for implementations for open source block Explorers so the teams are hackathons such as these you know Global hackathons they can actually come and they can develop a new block Explorer front end that will also provide you know great experience similar to etherscan or maybe even better right and that they can feel that this is going to be actually a useful project because the blockchains the layer twos will be supporting these data source endpoints that they actually will require and on the other hand we also want it you know for the networks that are building uh these l2s to have block explorers available to them because it's really important during the development process and then you know for the community and the adoption is really important for them to actually be able to see what data is on the ultra Network and what is happening with the network in general right so here I have the slide we were actually trying to define a standard for an API that sits right in the middle between the block Explorer and between the chain and it puts its potential indexer the other block Explorer can consume and you know the blockchain in some form or some middleware can Expose and feed data into it and we did it we Define whole methodology around this process so you know first we actually did take a look at all those l2s that exist and we were trying there's like you know 30 to 50 right now and we were trying to distill this list to some representative samples so you know we picked everything that we thought that kind of matters and that captures all the variety of data and data models that exist on l2s and then we dissected that we actually defined the data models for this shortlisted selection and using that we tried to Define requirements for a Blog Explorer so we sat down and we said hey so if I now want it to develop a block Explorer how should it look what should it provide to me as the user of this blog Explorer what features should it have what data should it visualize you know what data flow would I kind of expect right and so you know that way we formed kind of an opinion of what an Explorer should be but then we need to cross-validate it so we actually went back to etherscan and to all the other block explorers that we were able to find and we said hey did we actually do this right did we you know forget about something right are there any additional pieces of information that the blog explorers show up show to the users and that we might have forgotten and once we had that we refined our own requirements we made sure that they are a little bit more complete and based on this whole thing we have proposed the API so the API currently we've decided for this API standard we've decided to expose it in the form of a GitHub repository so this giant QR code that you can see on the slides that actually leads to that repository normally as researchers you know we publish long papers in PDF format right this was actually not the project that would be suitable for such a way of publishing we just decided to expose a repository to the public so what you can find in that repository is pretty much everything that we have done we have defined those requirements for Block explorers you will be able to find you know the methodology the reasoning behind our decisions and we have also exposed an open open API definitions of you know what these endpoints for an API should look like and so we did that we wrote it up we published it on GitHub and now we will believe that it's actually the community's turn to take a look at it so as I said I'm inviting all of you for some collaboration in here especially if you are participating at the hackathon that's going to be happening over the weekend and specifically what I am asking you to do is the following so first of all take a look at our work right we've done a lot in here so please take a look and review it we are humans we make mistakes as well we were really trying not to right we spent a lot of effort in here uh but please do review it and let us know what you think you know the repo is open for PRS there are contact informations in there please do that then if you like it uh what we have actually defined in here is a standard that is fully modular because you know we currently have some sample of l2s that exist but it's sitting right now at this time maybe tomorrow there will be new l2s maybe they will have new features right maybe you know in half a year the world will look completely different differently so we have decided to go for is a modular design in here where you can extend the design with additional features for the specialized l2s so if you know of such an L2 go for it open a PR extend the standard and then finally this is a standard for the API so you know try to use it try to implement such an API right pick your favorite scroll pick your favorite optimism pick your favorite anything and Implement an indexer that will be capable of exposing this API or on the other hand if you're a front-end developer imagine that somebody has implemented such an API and that you have a data source and try to come up with a front-end beat etherscan make it better okay so this is an invitation for everybody who will be hacking during the weekend now because I'm not so pretty to look at for 15 minutes I will be passing the word to Ian thank you Martin um I'll hold the Applause because I'm told we're running over time so I'm gonna make this very quick uh my name is Jan gorzner I'm head of L2 scaling at uh Quan stamp and Lake Martin when the grants uh were opened up in November we thought how could we contribute to this space and being a security company we naturally thought let's look at some security issues and so that's exactly what we did and the goal was for this grant to set up a security framework that complements and expands the stuff that's already out there so you probably are familiar with L2 beat and maybe some other Frameworks that exist and certainly some issues that might uh be common inside of our roll-up space but we found that some of these were slightly inadequate or totally inadequate depending on sort of the questions right in particular l2b does a great job of a lot of things they do things like um you know is an escape hatch missing right you look at that and you can say see very clearly on the um on the website that yes it's missing or no it's not but what does that really mean and does it matter that it's missing or not because if I need an escape hatch that requires you know a lot of ZK Hardware because I have to do some proofs is that a useful Escape patch to me or what is the outcome of not having such an escape patch in this feature or in such a roll-up so what we did was we we also did a bunch of effort and we we put together 130 or something pages of questions that we think people should ask of a roll-up we don't Envision most people will do this you know every day all the time and we hope to put into some sort of a web app so it's a little easier to use but for now we just defined everything and at the end of the day you sort of look at the classical hacks that we've seen or the issues that that can affect a roll-up and we give you a sort of a scoring based on what the answers to those questions were so you know if you if you have an escape patch you'll score fairly high on its feasibility because it exists it might be lowered if it does require a special Hardware again we took the same approach we looked at what was out there we wanted to look at the attacks we looked at all of our favorite Roll-Ups we looked at all of your favorite Roll-Ups um and we tried to figure out you know what's out there what's missing how can we improve it and what is unique to Roll-Ups is it something is there something that people really need to look at for the system when it's not um you know a side chain or something else that's sort of closely related and then we tried to expand on the areas that we thought other Frameworks were missing and we then went a little further and tried to suggest some areas for future research so I'm going to speed through this slide for time but like the other one we have open sourced the work as of today we we've looked at this or we've opened it up for you guys to look at sorry um and so we also want feedback you know did the questions do the questions make sense do do the ratings make sense would your favorite roll-up score poorly and if so is that because they're actually underdeveloped or is that because our tuning is a little bit off we'd love to know those answers um in particular we'd love to see exactly how you know concrete examples fit into the roll-up we have some ideas and some drafts but we aren't able to publish it in a nice clean form just yet so we do want to do that if you want to learn more we will be giving a more detailed talk about this at the l2b event in Warsaw in the end of August or you know come talk to us or you know send us an email and in the interest of time I'll end it there so I want to thank each Global for having us uh the ethereum foundation for the grants we do have one more that is in progress on roll up compression and we'll talk about it at some point but for now thank you [Applause]