Building a zkEVM - Jordi Baylina

well hello everybody i'm george melina i'm the technical lead at polygoneremes and well i'm doing a kind every time that i'm going to a conference i'm just trying to explain a little piece of the zika vm that's actually what we are building right now in hermes the approach just for just for the people that don't know what we are doing we are trying to build a decay roll up it's sdk that's fully compatible with ethereum that's of code to opcode we are working hard we are very advanced we have a proof of concept today but today i want to focus in a specific place and the specific point of this zika vm and is that roll-ups must be decentralized in hermes first and knowing polygon hermes we care a lot to do on the centralization so we talk we think and we thought and we would think the protocols and the roll-ups must be decentralized the experience we have in hermes what was interesting was like the first version we created a decentralized protocol for choosing who's going to be the operator the operator is the one that generating the proofs and so on we created what was called proof of donation or proof of burn if you want and the idea is that any participant in the chain that wants to generate these proofs they can buy a slot and in the canon of an auction and once you earn this slot about maybe 10 minutes for example you can create as many proofs as you want and as you can and you will receive all the fees on there this was interesting because it's actually it's a decentralized protocol but had some drawbacks okay here i'm going to mention some of them first is that validators this is a highly specialized procedural and body liters at the end they become quite centralized there are service level risk imagine that during 10 minutes even if they buy the blocks but the the servers so the operator that earns a slot just falls so this will affect maybe it's not therefore but in 10 minutes maybe they cannot fix the issue and this will affect the remaining the rest of the networks this is the decent drawback the other is the complexity of the auction so this auction you have to beat you need to predict how many transactions are going to be you need to discount that in the price that you are bidding it's um it becomes the model quite complex so and the other thing is that in the bootstrap process when you know generating this proof is not still it's not still profitable then there are some you need to protect somehow the network the network can be attacked very easily somebody just can buy very cheaply these uh slots and then the network will stop so these are some of the things that we realized that from the protocol didn't work good so and we were thinking in a little bit what should be this protocol and you know it should be also permissionless it must be efficient it must avoid control of a single party protection for malicious attacks so you everything needs to be solved and we become to we came up to a very very simple uh well very simple idea this is the one that i want to present here the idea is well this is something similar that for example the optimistic relapse they're already using and they has to have like two operators or two two roles one is the aggregation phase and the other is the computing preface the aggregation phase we call it well sorry the sequencers the sequencing phase and an aggregation phase the sequencers mainly take transactions anybody in the network anybody can be a sequencer and that the idea is that sequencers just collect transactions and they push it on the network and the and the provers or the aggregators they just build the proofs so we come up with a system that looks like this we have an ethereum blockchain and we have two kind of transactions transactions from the sequencers and transactions from the aggregators when the transactions from the sequencers are mined we already have a state these transactions all the transactions are going to be processed even if the transaction is invalid a invalid transaction is going to be a no operation transaction so we have a deterministic state so once the transactions is mined we have a deterministic state and we have what we call it we can call it a kind of a finality we already know this state is not going to change unless there is a rework in layer one of course but once it is minded in the the sequence of mind these transactions in the level in the in the blockchain this transaction this state is is there and in the second step later on maybe one hour later two hours later or whenever the aggregators will convert this implicit state it's in a state that is not on chain it's in a state that is a result of computing of executing all the transactions so everybody anybody can calculate that's not on chain so actually the aggregators will create the state and put it on chain and it's at this point where this state is consolidated and for example you can do some exits but for good normal payments or for normal transactions in layer 2 so anybody can just check this this intermediary states this is the very simple this is a very simple idea okay so this is a the it will be the the roles of the sequencers and here um the most important part i'm going to jump some some some slides forward okay the the most important part here is how the incentives works okay so the the thing is that all layer two transactions all the fees of the layer two transactions go to the sequencer okay so the sequencers collect transactions and they become like a miners okay they just collect transactions and they know that all the fees of this layer two are gonna are gonna go to them in another part the sequencer in order to mine in order to make the transaction we'll have to pay a fee well first it's gonna it's going to pay the gas fee of the ethereum and we'll go it will pay also some matic or some other tokens in order to to in order to be able to send these transactions uh on chain okay the second then and then the idea is that the aggregator the what the prover will just collect this fee okay so the prover of course have to pay that that the the transaction fee the the ethereum the layer one fee but it will collect the the the it will collect this fee okay this fee um so and the idea is that the fee uh from the from the sequencer perspective the fee it will be increased while there are a lot of blocks so while there are more as more blocks there is spending to create the proof this fee is going to be increasing and the under the the what the what the proverbs what aggregators will get is just the average so the number of pending blocks divided by the total so the total so the total collected matic or the total collected token divided by the number of locks so that means that if the network is accumulating pending blocks pending uh to be processed the price is going to be higher so somebody will uh at some point is going to be profitable that the that the the the approvers or the aggregators would generate the will generate the proofs okay here this model i try to explain very quite easy but this model has a lot a lot of advantages the first thing is that the sequencers for example this is valid for example for role apps and for validiums uh sequencer can put all the data on chain it's a normal rule up or they can just put a hash and maybe a proof of storage somewhere it's kind of a validium okay and this is part of the sequencer the second advantage is that's really fast you know the the transactions are processed once they once they sequencer just mine these transactions okay and another important thing is well here and i want to finish with that there is another advantage it's more uh kind of this opens kind of a business model here and it's the aggregators now we can have different kind of activators who's going to be aggregators maybe the wallets manufacturers mainly the changes maybe the people maybe the different applications that they are somehow collecting they will collect the transactions and they will get the fees on that okay so this opens and like a new market like kind of a kind of measuring kind of aggregate so just these sequencers will collect on that and the provers is just first come first serve if you have a good shoot service then you will be able to prove here is a first come first serve maybe here we are thinking maybe to introduce some randomness to be a little bit more fair but at the end you know the money is there the money is in the chain and the aggregators they cannot do anything they just consolidate a state but they cannot add transactions remove transactions or do anything and we know that if the money is there somebody will do it okay and they of course they have the incentive to collaborate or so here another thing that you interesting here is for example in the in the aggregators so the aggregators there is a risk here uh that the aggregators you know there is a kind of a collision imagine that they send the same transaction in one aggregator and another aggregation aggregator so this this could be for example over a span of course one aggregator one aggregator uh so when when you the the first transaction that come this is gonna be processed but the second transaction that's a double span it's going to be a no operation so from the system perspective is going to be no problem the problem is that the second one the aggregator that the degree sorry the sequencer that didn't the sequencer that didn't uh pro so that includes this transaction that's an invalid transaction they will not collect the layer 2 fee so they have an incentive not to put invalid transactions and the other thing is that well just as the technical detail for pink people here is that the the how we solve so the ideas that we include in the transactions we include the transaction field that's the sequencer so the idea is that there is no no uh front running attacks because if when i push a transaction sequencer maybe some other sequencer could steal that transaction so we include a new field that is this the sequencer signature this is but we want to be compatible we want to be compatible compatible so the trick here is that instead of including a field that's going to be the sequencer we are going to use the chain id so each sequencer will be able to register a specific chain id and then this transaction is going to it's not gonna be valid if uh it's half a different if it's minus from another sequencer so this allows for example to solve these uh uh um this um uh well this problem this this is stealing this front running these front running attacks okay so this is very much the con the the protocol it's a proposal we are still thinking on that we published that in in the ethereum research and here is just open for comments and just wanted to present here because i think it's an important so it's very simple but it's an important step just to decentralize uh to the central lights the rollups with this system as you can see anybody can be a sequencer and the and somebody is going to be uh uh somebody's going to be an aggregator or approver and there is no central party there is no centralized there is no censorship resistance so at the end you can be your own sequencer so in the worst case you will have you will be a sequencer you will create your transaction you will put it on chain and so on there are other details for example signatures we can sequencers will have like two ways of putting transactions one is incurring the signatures will include a lot of data under the signatures the other is if you have a lot of transactions in the sequencer you can generate a zero knowledge proof that aggregates all the that aggregates all the signatures and with that way you you you save all the data storage uh there okay so this is very much any questions any comment any uh proposal we are we are absolutely open and we hope hear from from you that's it thank you very much