J3 FA 06 Sina Habibian Doge Relay The Collateralized Peg

build this without needing to fundamentally change either of them without a hard or soft fork - dogecoin specifically and as you'll see this kind of created a perfect stage for us to build a proof of concept for true--but so the outline of this talk will be first getting coins from dogecoin to aetherium so you know the process of sending these coins proving to that if you're in real a contract that you locked them and minting the the Wow tokens and then the second part of the talk will be around when what happens when you burn these WoW tokens and receive doge coins on the original chain so the doge - a theory MPEG so fundamentally what does this relay contract on the etherium side need to do you just sent a Doge transaction locking up your coins so you need to prove to this to this contract that that actually happened so you need to give it a miracle proof of this transaction rolling up into a transaction merkel root so you know the contract rolls up that miracle proof it's like yes it checks out but more importantly it needs to verify that that transaction miracle root is in a row isn't a real Doge block header because otherwise you could just give it a proof for something that's that didn't happen on the canonical Doge chain so what this thing needs to do if you see this person who's kind of a submitter similar to BTC relay is passing in information into the smart contract which is the purple square and they could relay you know proofs of transactions but more importantly they need to actually real a block headers Doge block headers to this contract and so you know anyone's welcome to submit a block header which is really just a data structure with a height a timestamp a difficulty transaction offer mirco roots and a proof of proof of work field and the contract needs to verify if the header is legit so it does a bunch of calculations it checks you know that the height is calculated correctly the timestamp falls within the allowed range the difficulty makes sense more most importantly it checks the proof of work and that's when things get tricky so dogecoin is proof of work is the script hashing function dogecoin was a fork of lucky coin which is a fork of light coin and script was chosen specifically because its memory hard and computationally intensive to calculate so what you do as in standard proof of work you have all these fields that you don't have any control over such as the transaction America route the height these things and then there's a nonce that you do control as a miner and basically you have to pass these through the script hashing function to create a correct block hash and the relay contract needs to basically verify that that hash was correct ie take those plain text fields pass them through that function and see if the if the hash was actually calculated correctly the problem here is that this simple hashing function doesn't fit within a theorem gas limit so when people had the idea of building this bridge you can see here it's from two years ago and fatality actually posting this where people were experimenting with different ways and what he ended up doing was actually splitting this calculation into a hundred and eighteen different transactions where basically the contract would just like move up you know do a bit more of the script hash save it state do a bit more save it state and it's really not feasible and script specifically under the hood how it works is 2000 to 2050 steps of the salsa 20 hash function so basically the inputs come in and then there's 2050 steps where the output of each step is fed into the next hash function and and specifically the second half the second half of the second thousand 25 of the steps refer to data that was generated in the first thousand 25 so that's what makes it memory hard you need to actually keep all that data around and I'd like really makes this complicated to be done on chain so you know as the legend goes Alex Magnussen kind of created a bount add a bounty to incentivize people to go and build this thing people donated a few thousand eath that at today's prices is worth one and a half million dollars and about a month ago true but actually true bit in collaboration with Oscar gambit in Ginsberg and quaint fabric actually demonstrated this on the rinkeby test test net and we got part of the bounty which were fully putting towards this open source art project which is which is its own story so basically we're not taking any of the money for ourselves because this was such a cool community effort we're giving the whole thing back towards creating a massive physical version of this bridge which will be in Central Park and it'll be like a physical block chain and it's in whole snow it's it's own whole story so you should go there's a write-up of it on the true bit medium blog you can go check out so we've talked more before about how the Doge to etherium peg works so I'll just cover it quickly and then we'll move to the reverse peg so this is kind of the architecture of the smart contracts at the top you can see the Doge blockchain and anything below that line is is happening in in aetherium and there's really two participants in this protocol there's the person at the top it's really hard to read this but the person at the top is providing Doge block headers to the purple rectangle which is the Doge relay contract and the Doge real a contract that needs to verify the proof of work but it can't do it itself so it basically kicks out to the this set of contracts on the left the two green boxes which comprise a specific version of the true--but protocol so the second participant in this protocol are these people on the bottom here which are the verifiers so within the tribute protocol basically anyone can submit a computational task anyone can solve that computational task and then the verifiers are watching that solution and if they disagree they can basically challenge it and each of the the solver and the Challenger need to have stake deposited into the contracts and in the case of a dispute basically this verification game begins which generally it's it's the way the true--but protocol works so it derives insight from the fact that both the solver and the Challenger agreed when the perp when the program started so it's at step zero both of them when they started running this they had the same program the same inputs and the blank virtual machine and after they ran through the entire program they obviously disagreed on what the results were because they got different answers so the Challenger basically queries the solver for their state at the halfway mark of the execution so in the case of scripts since it's two thousand fifty steps it queries the solver for its state at the thousand twenty-five step and that state is literally a merkel route of the of the vm that the solver was running of the entire state so in the generic true--but protocol it would be a web assembly vm where we take the linear memory the stack the locals and kind of put them into a miracle tree and create a certain single route from it in this case it's the variables that are used within the salsa within the script hash function so the Challenger plays this interactive challenge response protocol with the solver until they resolve on one final step the only the first step of dispute which then runs on chain inside of this the smart contract on the left here at the green one and so this was a specific implementation of the trivet protocol which allows us to run 99.9 percent of the time run the script hash fully off chain and get the result back on chain in the case of the dispute you only run one single slice one single salsa 20 hash on chain and then the green contract in the middle makes relay saying yes this hash is is legit the contract adds that block header to its list of known block headers and then all is good so it's kind of it's a relatively complicated protocol and we have a more thorough demo of it online if you look it up so just to kind of close the loop what this means is the Doge relay contract has a way now now has a list of the canonical Doge block headers so anyone was welcome to submit headers to this it's it's checks that the proof of works are correct and it keeps track of the heaviest chain you know it allows some time out for the heaviest chain to emerge and then say when you're a hundred confirmations deep then someone can submit a transaction miracle proof showing that their Doge transaction actually occurred and that they locked up their tokens at which point the Doge relay contract makes a call to the red Red Square down there which is the Wow er C 20 token contract and makes and mints an equal number of death Doge tokens for that person so this is the forward peg Doge going to etherium so the the etherium to Doge peg so this one's more complicated so I mean it's complicated in its own way so if you recall basically side chains have been a topic of discussion for a long time block stream side chains paper came out in 2014 various protocols are exploring that cosmos polka dot BTC relay all projects that are trying to build side chains and link them to a kind of route chain and but in this particular problem it's actually more complicated than most of those constructions the first issue is that Doge is aut XO block chain so you don't have smart contracts basically all you have are a set of unspent transaction outputs which you can provide with some data too unencumbered them and spend them in some way the actual programming language that you're working with is a fork of Bitcoin script so you don't you don't have the turing-complete vm that we have in etherium you can't keep States between transactions so all the data that you pass in needs to come in at once and then either enable you to spend that UT EXO or not and and Doge is an existing chain so whatever we come up with needs to be practical it can't really involve a hard or soft fork so we originally talked with the two main dogecoin developers and dogecoin has merged mind with litecoins so it's like even more complicated than a standard blockchain to fork you need to convince to TIF you know a whole community of miners that are outside of the ecosystem exchanges wallets existing tooling so you really want to be able to build this without modifying so we started coming up with ideas right off the bat you know the most ideal idea is to create something that mirrors the etherium side so when these Wow tokens were burned you can see that that you know burn event or that transaction sending the coins back to the relay is itself linked to any etherium transaction route and so you could design a new lock up code on the dogecoin side which can only be unencumbered if you provide it with an ethereal merkel proof along with all these block headers before it but then you'd also need to allow for a challenge timeout so that other people can provide heavier or alternate chains so you quickly realize that this is not feasible especially without a hard fork or a massive change in dogecoin then the other existing solution is what people call a federated peg so this is this is something that our SK has actually implemented already and it's relatively simple so all it says is that on the dogecoin chain I send a transaction to some address that address is a simple multi-sig wallet so let's say it's complete controlled by five key holders you know you send a transaction in in the real a contract that at that address is hard-coded in so if someone provides a miracle proof of someone having sent money to that transaction min-soo the Wow tokens and at any point if you burn these tokens you just kind of have to rely on those multi-sig holders to send you your money back and you know you could you could pick these key holders to be reputable people in the space and you know they could be a Syrian foundation consensus true--but dogecoin core like any number of things but at the end of a day it's a centralized solution and you're relying on people to do things out of altruistically so we started thinking could we improve on it and the first kind of interesting idea that we hit was we could use the flexibility of aetherium since the other chain is aetherium we could really like impact what's happening on the dogecoin side so what if you made these multi-state key holders actually deposit stake into the Doge relay contract right so going forward through the peg is the same way send the Doge transaction while tokens are minted but then when you want to go back you burn your Wow tokens raid then a timer starts ticking inside of this Doge relay contract so it's like 100 blocks ninety nine blocks ninety eight blocks and within that time someone needs to provide a transaction Merkle proof that a Doge transaction was sent from this multi-sig to that address I just burned the coins otherwise the multi-state key holders get slashed so you're kind of keeping them honest by using their aetherium stake as collateral and also in addition to that if anyone ever proves that a transaction was sent from this Doge multi-sig somewhere without a corresponding wow token burned beforehand you can also slash the operators because basically they've gone rogue and they're spending the coins themselves so then we started thinking about this is the multi-sig actually necessary and the answer is no because well there's first a problem in which you any of these key holders could be punished could lose their stake because due to the misbehavior of other parties that they don't have any control over so if three of the parties you know decide to sign a transaction and send money to themselves they could they could end up getting the other two slashed or if not all of them are up and this timer runs out they could you could slash all of them and and it's actually a crypto economic scheme so the security of that comes from the collateral that these people have an aetherium in the Doge relay contract so it's actually the same security if you change this to being one Operator a simple a single Doge address so this kind of makes the scheme more flexible there's a Doge relay contract on the etherium side anyone can really deposit some eath into it and in that function call provide a Doge address and basically say that I'm becoming an operator from now on right this is my address this is how much collateral I have and from then on anyone who sends money to that Doge address will move through that bridge and then when they burn their coins that timer starts ticking specific to that address and this user is supposed to test send them their money and why would people do this because they can receive fees and return for allowing people to use their bridge so it's another way to get a yield on your on your staking then we run into some issues so how much eath collateral do you actually need per Doge that has traveled through and been minted as well because if you think about it if the value of Doge increases relative to eath then this collateral is no longer enough so then the person who just had the doge coins and sitting in there UT EXO will just spend them and we like to hell with my steak you can burn it because now I've actually made money so how do you deal with that issue and the second point is how long do these bridges stay open because if I set up if I become an operator for a bridge and then someone mints eath mints Y tokens through me am I able to close my bridge what kind of guarantees do I have there do I just have to give up my coins forever and that constraint on its own will prevent most people from participating so that's kind of one of the core issues so now we're kind of the next three slides are three different kind of ideas we have for moving forward and this is open research so if you have any ideas please come and talk to us so the first idea is kind of a natural progression allow this operator to state a bridge expiry time when they create it so they make the call they provide some each stake they provide their Doge address but they also provide a block number at which the bridge is no longer open and you know the contract would enforce some minimum blocks in the future that you need to set so the bridge is actually real so then yeah they create the bridge people send the money they go through what happens if the expiry date is hit that means that the person gets their each stake back and since they got their stake back they can move the Doge to their own address and the bridge is basically effectively closed that means that the Wow tokens that were met that were minted through this no longer have a real bridge or real Doge backing them so they become worthless so that's that's the big so if you think about that what that means is different wow tokens that were generated through different bridges have different lifetimes they expire at different times and a token that is going to exist for longer before it becomes useless is more valuable so the wild tokens actually become non-functional which is which is kind of a problem on the other hand you could imagine that sure it's it's not ideal if ERC 20 tokens are not fungible but maybe this isn't a real RC Tony token right it was generated by another bridge you can you could kind of add an extra method or something which tells you how long the token has to live and contracts that are accepting it can just do a quick check and be like is this token going to live long enough before I return it back to the user so there are ways that you could make this work but it's not ideal this is the first proposal the second proposal like totally different axis of thinking so the operator I want to operate a bridge send I stake some eath into the relay contract and at that time I'm already required to have enough doge and sitting in that address so I provide both the Doge and the each stake and I immediately mint an equal number of Wow tokens that I just contained I just hold all of them and then I can go to the market and sell these Wow tokens to other people so wow tokens get created they get dispersed around the market and then at any point if I want to close the bridge I need to buy back enough of these while tokens and burn them to be able to close my bridge so this the pro here is that the Wow tokens are fungible they no longer have timelines attached to them it's up to the bridge operator to buy them back whenever they want to close the bridge and burn them the negative is that this is not really a bridge because you can't just simply send Doge and receive web tokens you actually need to send those and have an e steak to then create wild tokens so it has a higher barrier to entry and what if the operator actually can't buy back all the way that they need on the market when the time comes or they want to close it has its own problems the third one which is kind of a more recent idea and it's not fully fleshed out is to create different tiers of exchange rates and this is you know it's getting complicated create different tiers of exchange rates at which Wow tokens could be could be collateralized by the eath so when you want to cross one of these bridges you actually state what ratio of collateral you require and so that's one part of the design the other part is that operator is basically when you open a bridge it's just the only parameter is when you open it so its first and first out and then when someone owning those wow tokens wants to burn them and receive the doge back the person who the operator whose bridge is the oldest is responsible for making that transaction so I means the sooner you created the bridge this sooner you get your money out and the more fees you collect because all of those transactions go through you originally till your capacity is filled up so this again skips the bridge lifetime problem kind of steps to the side because as an operator you're making a conscious decision to open a bridge and you know where you stand in the queue and what the volumes are that you need before you can get out and it also puts the onus of thinking about exchange rates to the Wow token holders so if they have a wow that's collateralized by eath at you know a 1 to 0.1 ratio they know that if the exchange rate changes beyond this that the operator won't return their coins anymore it'll just take the UTX oh and what that means is that all of the doís minted at this exchange rate basically becomes useless so it's similar to that original design it's non fungible between these different tiers of exchange rates but it's fungible within the tiers and yeah so ongoing research like I said different ideas the design space is kind of restricted but that's why I think it's cool to talk about something like this here or there's a lot of people who've thought about these things so it's it's an interesting project we can try different things and I want to give a shout-out to sunny and Jim Posen who have been external collaborators and a bunch of others that were talking to and giving us ideas and yeah that's it [Applause] any questions yeah yep yeah so you they're back they backed by one by one with Doge but the operator is kept honest by their each stake so if the value of Doge increases beyond the exchange rate at which they originally staked then it makes sense for them to just run away with the Doge yeah yeah there's there's interesting parallels between the number of different projects and one of our more kind of loose creative sessions Jason had the idea that you know this is a Doge Doge themed bridge so there would be the there would be the fungible Wow tokens but then there would be no there would be non fungible Wow tokens because they have different times that they live but then you would be able to feed them with fungible food tokens to extend their lives so other people would be able to come in and stake or add to your collateral to extend the lifetime of an existing coin yes yeah so BTC relay one is completely altruistic so people don't receive any rewards for operating for providing information to the relay contract and then right um the other the other difference is that BTC relay is basically getting Bitcoin block headers into aetherium as data points you know as points to use for for as sources of randomness or something like that but there is no actual complete bridge where you can move bt you know you can't get BTC tokens on aetherium and i think if that was possible that would be actually a pretty compelling use case like can you imagine if you could integrate with half BTC as an ER c20 token you could have the security of the Bitcoin chain and then use those tokens with you know within smart contracts within decentralized exchanges so I think that could itself create a bunch of use but at the end of the day I think this in particular it kind of stemmed from you know community initiatives it's a research it's an interesting research project like I don't think it's you know the most important thing that the whole space was working on but but it has interesting learnings where we can use in other protocols yeah exactly did you know the added complication is that dogecoin is merged minds with litecoin but since we're not creating a hard or soft Forex that wouldn't be an issue but as far as I understand like there wasn't actually ever a solution forgetting for connecting the reverse part of the beat of BTC relay because of all these restrictions so if that was there you know you already got the data here so you could build the entire bridge and actually get the BTC ERC 20 tokens but it's hard to do so I think if we managed to make it work here that construction will also work yeah and also like I'd actually encourage you to look into that art project as well because that's its own hilarious adventure yeah any other questions alright thank you guys [Applause]