20240322 ETHTaipei Workshop_ZKBankai @G Part 4

and the agregator need a small machine that just so does one worker has one adapter recuit so all the workers right now all the workers they can do everything I mean the thing is that there is very unbalanced put the same size but actually we have three kinds of proofs no with the AP 4 for four we have six but this proof is very is very big and these are the rest are blood small so at this point we could have like different kind of workers and this point is just a single so we have a single worker and and the the theator can ask them or you do this or you do that the difference is that generating this proof it's about 2 minutes and this is about 10 seconds well actually this this is 2 minutes obvious it's less than minutes okay so this is a single from the worker perspective it's generator so when you have a batch actually you you generate Rec the output of the recursive so this part is single stru three proes then we have the recursive part and this part the final these two last ones it's also a u a single operation in the so we have three three operations basic proof Agate proof and final okay and uh yeah the this is this is about 2 minutes this is about 1 second is it fair to assume that these workers in the cluster need to be like collocated very CL can be actually the cool thing here is that we are this we are using for these uh provs we are using spot instances you started with Amon we are with code political reasons but yeah but we can have them both or or it can be U it can be can be volun can be anybody that just connects to there IDE you want that in the same region or not not necessarily I mean the information that goes I mean you just put the input of the group which is not is small and and the output is a proof which is small so it's not they can be running uh for example here we have some development uh uh machines okay sometimes okay let's connect that to the so we just and it's very flexible uh actually we scale that uh so we have a kind of a script that if the network gets a lot of traffic then spin up more provs uh and if the loads the traffic then they stop the Ms and we are using a spot in which is this option you can do this relatively cheap and yeah and having running sometimes running 60 70 blers in par o it's depending on the traffic can be normally normal cases right now we lower l uh but uh two three provs in small depending on the traffic yeah why I because I made no but it's um um is very uh so yeah there is one trick but uh so here gives you meditation meditation it's very easy to read and test and to verify um so uh and uh with her1 cs in cir you can convert very easily to PL PL like and pl even if that you are using five we're using PL so that imization uh is WR at the end it's a set of pols and are just uh relationship identities of those pols so we have this conversion uh out of the box I me really I mean it's very very very flexible and for creating the circuits circum is very intuitive and it's very clear also uh mean for example with the last uh uh the last improvements of circle we are using for taging uh so that allows us from the security perspective give us uh a lot of uh security uh and there is some tuning WR CC that do a lot of security in there so we are using extensively all the circum tooling for for and we have a and the idea is that we have a kind of a template that given a a pill so given a start uh um the template for for very we have a template that generates the Circ from so we have a template we have a script that generates automatically the circle I mean it's an automatically generated circum out of a uh plate that think that does everything depending on the polinomial that you have the SCP you have from justs it could be done with other things I agree but with ccom it's I mean for us has been working very very very very well also for the last for the final I mean it's the same I mean we are very FY stocks the template is almost the same is different because this so all these CS they work with uh Vol long spr field the last one we are is working with a B uh play field so the simp is different but the structure I mean the idea of the is is the template is the same okay and yeah I mean this is uh I mean been working very well okay and I'm joking a bit but the fact that uh we made silcom uh uh give us a lot of knowledge and here in silcom we added for example the the because this is a blish like for in C we had this idea of custom Gates so in C you can create a a circuit that's we call it a custom template uh that cannot have constraints and you are assuming that you are going to have a custom gate uh in the in the appr that's going to verify that okay and so this for for this for this Rec circuits has been very very uh work very very well but could be done also in Hollow 2 or in blony ory hold on okay again I'm just I'm just saying what what we did okay what's better is just try it and yeah maybe there something better okay I don't know I'm done I don't know if there is some somebody else [Applause] thank you I mean I learned about the question subjective way earlier but this was very very very helpful I mean I didn't do to this death although I wanted I mean it would have taken me around 34 years basically 1 years yeah you uh I'd like to invite Daniel to the stage and probably talk about the work that has been doing with scroll and the scroll the recent upgr also thanks for support for the sessions all right I'm not going to use this actually but thank you so much um okay let me just do a little bit of housekeeping here we've got 20 minutes left in this space okay so I don't know how long someone's going to do a kzg talk um I'm trying to kind of dynamically reroute what I'm going to talk about here um are folks I wanted to leave it as like a literal white boarding session where we're just going to talk about like okay what does it look like to have to upgrade a ZK evm protocol from using call data now to like adapt it and think like how do we get gas prices down as much as possible so maybe I'll start there if anyone has questions interest or anything else be conversational we can dive into something specific and then I to give myself a hard stop and whoever's doing the kcg thing can tell me how long you're going to need and we'll go from there so who is okay can you do your thing in like 10 minutes is that going to be okay uh we'll figure it out cool all right so basic problem set um basic familiarity with like the idea of roll up look pretty good there um similar to everyone else you know in the context of scroll we're going to have a bunch of transactions coming in we have an offchain protocol we have a smart contract on ethereum that is going to then like take a bunch of those transactions that come in as that's coming in this call data and then later on um that smart contract block but later on we'll then have a proof to pass on that is kind of like finalize State transition from those transactions right okay so that's super basics of where we're starting right now everything is coming in as cat right we're using ethereum itself as our data availability layer because we need to like have all the great things that that provides censorship resistance being able to sink your full node just from L1 data all these ni things and so in the past right where where we are uh submitting committing to batches of transactions um and these batches under the hood we're going to use this word called CHS underneath that um and then we kind of like context before right what we were able to do is in that smart contract we were able to basically pass in all the raw transaction data has call data and call data you know when you are using call data your smart contract and then do stuff with that call right so what it would do is it would find the boundaries in that batch of the chunks or some metadata somewhere in there and then it would create hashes of every single chunk and then store that to Smart contract so that later on when we go to verify this thing the hashes of this transaction data can be passed in uh as inputs alongside our proof or rather reference those things when we pass in the proof right so that is how we con strain our proof on the L one to the wrong transaction data that's how it kind of exists right now does that kind of make sense am I explaining this coherently here okay cool so now the question is with this upgrade to uh 4 44 and side by side with that um you know really the goal at this point right is like gas is too high um in the US a presidential candidate that's going on this platform called the rent is too damn High I like the gas pric too damn High anyways we have really high gas prices we have to figure out how to bring that down everyone's super excited about blobs that is one way that we can do that the other way that we need to be doing this for em it's going to be transaction pressure right um so these are would be like the two things I plan to talk about we kind of like get into the new gritty about how to design a protocol to make sure that we're doing these things but still making sure that it's sufficiently constrained from the L1 protocol smart contract perspective um okay so does anyone have a preference which one I di into going faster transaction compression okay cool um nice the wi track less for this is going to be good um what we can do in transaction compression so right now we are passing in just kind of like raw transactions right full information uh along with the signature as called right that is very expensive to be doing on the L1 so there's like lots of loading grou optimizations uh that we're exploring for next part for get conversation here um one of the big ones is uh just finding things that we don't actually have to include for us to be able to still reproduce the state right that's the goal of that L1 data and so one of these things um that can just be like inferred uh from proofs and everything else is like nonstate right um it's not that sexy of a game it's like one bite but it's like still one bite less than call for every transactions we can drop nonis from all we commit one side um another thing that we can drop is we can drop signatures um this is actually uh kind of exciting because signatures are big um and we'll get into it in a second but these are really hard to compress with generic compression algorithms like the iny of the signature is very very high um so because of that these are very nice to draw um I don't know if it matters does anyone know how many bites is in a signature how 66 I don't know we'll say that perfect um okay so we can drop on and signatures uh we can also do things like apply just generic compression algorithms right things that like you know uh you would you would use anywhere else um and so in that context right we get like I think 2 to three um by applying uh sorry I can't remember the name of the compression algorithm that we're going to use it's a great one it's a open source C standard uh what we're going to be looking at Facebook might made this um okay so we got one B from that 66 my not over there say 65 bytes from that we get like we can say 2 and A2 uh to one compression that's the other way around through standard and then things get more kind of like exotic after that so then you start looking at things like um right you can start thinking about things like to and from fields from transactions right when you think about the um number of bytes we use to represent a pub key or a account right that is a very very big size uh I wish I would have memorized the actual numbers here um but in actuality we are not using the total space uh of you know the addressable space there is much much larger than the actual number of addresses which exist right what we can do is kind of create mapping or essentially an index over all the addresses that we've seen right so um you know I have ZX ABC and we can map that to one and then you know BF down here can get mapped to two and so on so in our compression algorithm we can start replacing very large um things like addresses which are also hard to compress and stand things uh and replace those index just make sure that we're doing lookups as we're doing deep impression there um okay I think these are kind of the major techniques um Jordan am I missing one more less maybe the the the distinguishing between State full and state less compression stainless compression would be just a F this uh gentic right that the state or even I mean sing are State less more complex uh but for for addresses and you want to have a state that helps you to compress here is where you really can get a lot of good impression uh but then you need to maintain this uh State uh for yeah and I think maybe like I don't know if this is a variation on that the even these generic algorithms this is you don't do much this is what they get one and a that's a uh compression right one and a half something and you can like when you're building these out though there's like a mode where it is just kind of like learning as it's compressing over the data that you're feeding it or that stream um to find patterns or whatever else or you can retrain that on data so that it doesn't have to learn over those stream another thing looking at what what uh radio of compression you want to have the one more time so how much uh uh data savings after compression are you going up have you done any numbers yeah so um let me just pull them up this seems more interesting than this okay so our compression game we've done a lot of uh benchmarking and so compression gain from like nonsense signatures just to give people like an expectation that is like 1 to 17 so that is like um 1.1 to 1.07 so very tiny right 7% or something not that big of a deal um but when we get into doing um so we've tried compressing at the chunk level and we've tried compressing at the batch level batch level is more efficient and once we do Z standard on the batch level drop the nons and signatures um the maximum that we have seen is um 4.22 without this so up here so basically these things right here 4.22 and then if we also do indexing over the um addresses we've hit like 4.

95 I think all of these are also in like when you max out the compression level of these algorithms um which I don't know is going to be like something that we can sustain in the context of the sequencer as well so um these I think would be upper balance of what we see when we decide to like compression what was that coration yes cuz all of these things I guess that's the other side of this right like this is something that is like a unique in the ZK context right but we're going to have to then decompress these things in circuit right so anything that gets done in a protocol side we're going to have to like redo that in the circuit side as well so so what's the are you dropping signatures or how how are you how are you are you compressing them or so here this is dropping the signatures for the DAT that it's committed so there's like a few different ways to approach that one is just say in the snark itself you've verified these things so maybe it get published on an alternate da that's like cheaper you don't need for certain security guarantees and then I think also that map have to be published right cuz you still want to have uh when you decompress the transactions on the L line you want to have that which sign yes but we wouldn't be decompressing on the L1 okay sorry sorry yeah recovering yeah because really what we're just doing there is like attesting to that when it comes to the proof time we like um that constraint there is like happened in the ZK proving side of it and the yeah it's not going to be public input into that circuit that is the 444 part of the conversation but yeah it's okay so for information numbers this is approximation transaction but numbers managing between 5x and 7x that you're saying right now the the compression okay um can you that you do um well here very much what you mention we are not going to use this uh general purpose uh compression be much maybe the big one mention here is the for the values uh the voles you can use again a folding point compressing especially if you are working with uh pen you're working with pen they send the users you just play the fact that the users they will send 5 74 5 5 6 78 said 74 they play with small numbers so if you comess them with Point uh Bas values they comess well that's one to and the other is in this databas so the same the same way that you have ADD index addresses you can have also uh database of data uh General data uh uh CH that and especially for a lot of Ali that are reusing NF NF has a going many times so I mean you can don't have an extra compression because this is normal compression you do anything but the fact that you are repeating using the same same value and this is this is that this give us extra uh extra extra compression so but yeah I mean here of course this is our estimations and see just a random data operation going be zero so depends very much uh on the kind of transactions these are just but yeah thinking about a five uh five compression yeah and I think the I don't know there's a lot of fun side Toop TOS here because um this is also just assuming we use post the transaction data and not State diffs one kind of Distinction you want to follow up on that um and then the other thing is that figuring out how to then like so right these numbers are not consistent for a transaction uh and then so on the protocol side you have to start thinking about how do we price this gas we are passing on the L to those users um and so that's been fun area of research too right it's not just how to get it as low as possible but make it fair as a protocol to be priced again just okay I think I went over the time that I told you I would take so yeah [Applause] thanks thanks Danny for the fish I'd like to invite NAU to probably help us out with K all right let's see how much I can skip the theory part so we can do some stuff but I still want to show the slide so it become a easier came me four p n all right how much time I have 30 minutes until Ki us can we can we okay because I I thought I originally I prepared I'll actually be K by hand for a small baby f can actually see all the financial operations uh but I'll try to SK uh so first why do we why are we interested in ch there are two main reasons um so first motivation is almost all the mod SS are basically they have one single for have a functional uh commitment plus add that's pretty much uh other big motivation now is this is live now so uh that's probably two big reasons why you should be impression so with that side I'll probably explain uh how KD actually works uh but before that uh I'll give a a basic setup what do we need for first fi so Feld typically a prime order p and then is CH such that