J3 PAIN 03 David Knot Plasma A Blockchain Scaling Story

hey everyone my name is David and today I'm going to be talking a little bit more about plasma yeah plasma is super cool you can use it for a lot of things and hopefully you'll learn a little bit more through the stock so here goes I was actually practicing the clicker usage and it did work I could I think so okay well plasmas uh like I can do this ad hoc but I would prefer slides Oh awesome so today I'm going to kind of divide my talk into three set segments one why it matters scaling and plasma in particular to what's happening right now Carla covered some of it earlier I'm just going to give like a few more details about it and then three big picture the plasma vision so here goes so why it matters scaling it's the name of the game it's what everyone is talking about there was just an event in Barcelona about scaling so it's kind of important but why is it so important well aetherium is wonderful but in its current state its single-threaded and this is fine for one computer it's even fine for two computers that are running all the transactions but as soon as you get to around twenty thousand computers trying to process basically the entire transaction throughput of the cerium network it gets pretty crazy and now that people are actually excited about using blockchains and using a cerium the infrastructure has to catch up and that's why there are so many emerging scaling solutions on the horizon plasma is one of these scaling solutions what makes plasma so special is that you're able to make another blockchain which derives its security from a root chain so in the case of what we're building a Tomy sago the child chain will derive its security from aetherium which is super awesome because block chains currently derive their security from economic incentives so if you're just starting a side chain when it's just starting out it probably won't be worth that much so it'll have a relatively low cost of attack but with plasma you can get increased transaction throughput with a child chain wall basically building it off of the Economic Security of etherium which is quite it's well proven it's in production and it's worth billions of dollars so you get a lot more Economic Security from it so how does this all work scaling through compaction so this is a fairly simple example here we have a UT Exocet and that makes up the state of the child chain and then we use cryptography to basically take that state and then squish it down into a compact form I call it a restorable state and then we put that or a storable state on to aetherium and aetherium is kind of the final arbiter a theorem it keeps track of that state and but how do we recover this recoverable state well we use cryptography so we pre-compressed it using cryptography and then to get it back a user or anyone really could basically create a cryptographic proof that basically at a given time this state was a certain way in this example at a given time Alice owned a particular u TX o and then the user basically specifies Alice's u TX o puts in a proof and then aetherium processes that and checks that everything is valid and then boom you have Alice's UT EXO as the output without having to store it directly ooh cool projector still on so how does this actually work with in the case of a UT Exocet well right now we're using Merkel proofs you've some of you have probably heard about Merkel's they're super cool a lot of things blockchain related use them aetherium use this them yeah they're awesome and basically what they're best at is proofs of inclusion so basically proving that proving that at a given time something was part of a given set so in this example here we have a UT Exocet we hash it down so basically turning each UT Excel into a 32 byte hash because that's easier to work with and then we start hashing things together until we get a root of the UT Exocet and then we store that route on aetherium and that is basically the restorable state and through that we can prove that Alice had ownership of one of these UT exo's at a given time how do we do that well we basically create the path of hashes leading up to the root so Alice would submit a UT Excel but then she'd also submit the next the necessary hashes to recreate the root of the Merkle tree and then through that she basically has proof that she owned it at a given time which is super cool because it's significantly more easy to just store a root on a theorem then the entire UT Exocet boom now I'm going to talk about some stuff that's happening now with plasma boom so plasma MVP kind of the first pack written up by a Vitalik it's basically a UT EXO payments blockchain significantly similar in terms of functionality Bitcoin and that's kind of the first stage of pushing plasma from a white paper into something actually implementable and right now there are multiple teams kind of working off that and then iterating upon that further but how does it actually work well we have first UTX those unspent transaction outputs and basically they need to specify an owner and an amount so who has the money and how much money do they have but we kind of get an issue when we're using UTX OS to track who owns what one person can have multiple UT X's they could even have a thousand UT X OS and so in terms of kind of maneuvering these around it's quite difficult because the way plasma MVP works is if anything goes wrong everyone has to exit within a given amount of time and so if one user has a thousand UT X OS that means they would have to perform a thousand exit transactions on etherium and we don't want anyone to have to do that so we use a count simulation and what account simulation is is basically doing two UT EXO transactions to simulate accounts so in this example Alice has 100 Bob has 100 then Alice sends a transaction creates a transaction giving herself at ninety five and then giving Bob a UT EXO of five and then Bob still has the UT EXO of 100 so as you could imagine if we stopped at this stage Bob now has two ut EXO's this could basically he could basically accumulate more and more UT EXO's and eventually exiting would become very difficult and expensive so we have so to prevent this on the child chain where we have Bob do is we have Bob do one more transaction which basically just Nets his to UT EXO's into one and that basically makes it so that you for most of the time each user of the child chain will have all of their value in one UT Excel which for like before using it can be thought of as an account which is super cool but how does plasma MVP actually work so we start with basically a contract on aetherium that is securing the child chain and when users want to start using the child chain they deposit value from aetherium from like their token smart contractor ether they deposit that value into the plasma smart contract on aetherium and those funds are basically locked in to the plasma smart contract and will only be and they basically come out again on the plasma side of things and then you basically if when a user exits they regain access to their funds in the case of plasma MVP user deposits funds and for simplicity sake this actually creates a new block on the of the child chain on the plasma smart contract on aetherium and this is super cool because before we had to deal with kind of two types of it withdraws one where a deposit basically was made but it never showed up on on the child chain and then you had to basically prove that you made a deposit whereas now because the deposit shows up in a child chain block instantly on aetherium all users have to do is go through the normal withdraw process so for both deposit cancels and normal exits there's one process which just limits attack vectors and makes things significantly simpler boom so how do these transactions actually look so you have inputs which are basically referencing the positions of previously created u TX OS and these inputs they need to basically be referenced you reference the transaction position where the UT excel was created and you also need the signature from the owner of that input because we only want the owner of a given UT EXO to be able to spend it and then you have outputs which are the new UT EXO's and then you have the fee so this fee much like with aetherium gas basically pays the consensus mechanism for providing utility and also prevents d doses because even though we'll get a large amount of scaling without charging people fees they could basically over run the child chain with a bunch of spammy transactions and that would be basically make it useless but we can do more so basically with with child chains and with plasma MVP transactions we need confirmations because right now there's a situation where they and I'll get to why we need confirmations in a bit but basically there's a situation where someone can send a transaction the operator can withhold it and there's basically no way to prove whether someone has actually double spent it and it's been included in the child chain or or if the operator is just being bad but with plasma and child chain transactions we want to support more than Eve and this is really simple with kind of the UT EXO model we just add one more field and that's currencies and all of a sudden you can support efj and ERC 20s and eventually pretty much any currency down the road and the keys kind of security principle of plasma any MVP is that if anything goes wrong everyone has to exit so if you're validating the child chain and you see an invalid block or if the block basically the consensus mechanism block like the child chain operate suddenly starts withholding blocks you assume that something bad has happened and you have to basically call it and exit on aetherium to get your funds back within a given amount of time so what does this actually look like on aetherium we have a priority queue so that basically keeps track of the order of the order of exits so basically if you're watching the child chain and you notice something sketchy is going on or if there's block withholding you basically exit your UT excel and but if you do it within seven days you're basically guaranteed to have your UT exo's successfully exit before an invalid UT EXO which was create which has been created later so this works super well it's a little bit annoying because because exits are processed in the priority queue you have to pay a significant amount of attention to the child chain to constantly verify it but yeah it works but it's basically a fractional reserve on the etherium root chain which is not optimal in the sense that an operator if left unchecked can then withdraw and basically create money out of thin air awesome so here's where we're at now so right now with plasma MVP sand one deposits funds they get their UT EXO back out on the child chain they can kind of play around with ut EXO's juggle them around a bit and trade them to people do kind of swaps with them and then once they're ready or if anything goes wrong they go through a withdrawal now for a story so I just want to emphasize why confirmations are so important because when I first was kind of looking into plasma I I kind of basically because confirmations are a pain from a user experience perspective I kind of kept trying to wiggle my way them but at least for right now confirmations provide a super valuable valuable surface service and play an important role so in this story we have Alice Bob and Hades and Alice and Bob are just normal users and Hades is the child chain operator so everything's going normally Alice is on the child chain and she sends a transaction to Bob transferring Bob X amount of money but the Hades the operator is basically a bad actor so he's trying to steal steal everyone on the child chains money so what he does is he takes Alice's transaction to Bob and he withholds it so he doesn't include it in the child chain then what then he creates an invalid transaction includes it in the child chain then he exits that and then he includes Alice's transaction to Bob but he withholds that transaction withholds that block so Alice really has no way to even know if her transaction has ever been included in the child chain so here's what happens basically the operator is bad but because the operators withholding we can't prove it so Alice realizes something bad is going on tries to exit but if she went one she exits the operator can basically submit proof of a double spend because he did include Alice's transaction he just included it later and withheld the block so Alice has no way to exit and then if Bob sees the successful challenge and uses that information to try to exit himself because now he's the rightful owner of the given output that Alice created for him he can't exit either because his transaction was created after or was basically the transaction that created his unspent output was included after Hades invalid transaction so if you remember the priority queue what would happen is Haiti's invalid transaction would clear the plasma smart contract on a cerium before Bob's exit and basically what happens here is that Hades ends up getting away with everyone's money but neither party's exits who should who should have access to the money will get that basically occur successfully with confirmations what we're basically able to do is Alice only gives up custody of her funds once she has seized once she is able to see that her transaction has been safely included in the etherium plasma smart contract and once she's and when she has access to the different block where it was included so she can basically validate that everything up to that point is basically valid transactions no creating money out of thin air but P cash this is what everyone's talking about and this is there's basically significant progress in this area non fungible tokens blockchains are super cool because if you remember the problem I was talking about where where when we have a fractional reserve of basically a child chains consensus mechanism can create money out of thin air if the users aren't paying enough attention well we don't have this issue with non fungible block token block chains because every asset and its unique ID is stored on the plasma smart contract on aetherium so what this means is that an operator can't just create a new object and withdraw which is super cool but the operator can still basically try to steal an object by withdrawing something that doesn't currently belong to them in the most recent state of the plasma child chain so we still need to watch it but instead of checking the entire state of a child chain Alice's only has to check her piece of the child chain so she's checking her basically her basically Merkel proofs of exclusion that prove that she that her her unique objects that she owns haven't been accessed and she doesn't really need to care about everything else which is super awesome because as we start to get bigger child chains and more transactions per second if each user can remain safe by only checking a small piece of data basically what they care about it allows for a lot more scalability so yeah and when Hades comes in and tries to steal Alice's transaction even with the small amount of state she still has enough information and enough power to basically prove that no she is the most recent owner by submitting a later transaction that proves that hey know at one point Hades owned this but actually he basically did a transaction transferring ownership to me and Hades is not able to steal her money and this has been achieved with no confirmations which is awesome so how basically if Hades tried to create something that wasn't valid it'd be checked on aetherium and it wouldn't go through because we have a clear record of what's happening and the value of all the assets that are stored on the child chain and nothing can be created when Hades tries to submit a fraudulent value it stopped right away and we don't have to worry about a new kind of asset being created on aetherium so big picture the plasma white paper promise try multiple layers of child chains and them all talking to each other than verifying each other basically varying app specific child chains depending on the needs of an application and basically a bunch of cool things and that's currently being worked on there are people working on kind of how plasma can be used to do computation how we can use account models with plasma how we can eliminate confirmations how we can basically do other stuff besides payments and yeah that's going forward it's a progress it's a process eventually general state transitions will be possible with plasma and yeah when that day comes it'll really open the floodgates because then someone can basically take a solidity smart contract and without having to think about how to basically secure a specific plasma chain that has they're given functionality they'll just be able to deploy a solidity smart contract on a plasma chain and it'll be super smooth with little transaction fees so yeah plasma chains and how will this look though and the best example I've heard about how these plasma chains will kind of interact with one another and how security will be derived is through quartz and so we start with the courts of First Instance this is the lowest level court and so these child chains will basically have a really quick transaction throughput and the transaction fees will be the lowest because they're basically the farthest removed from aetherium where security is derived so if anything goes wrong it will take some more arbitration and there's less economic guarantees for the lower down chains and then we'll have the Court of Appeals where the courts of First Instance are secured by the court of appeals so if anything goes wrong on these it makes the most sense for a user to kind of say hey no submit a fraud proof this is what actually happened to the Court of Appeals because going one level above will be significantly cheaper than just jumping to aetherium and then finally we have the Supreme Court so in this case this would be a cerium and this is basically the law of the land if everything goes wrong on child chains you basically have to resort to using the root chain to settle all disputes and make sure everything kind of turns out the way it's supposed to the downside to this is as aetherium grows in popularity and the main that receives more and more uses gas prices gas costs will probably rise and with that it'll be more expensive to settle stuff on aetherium so the goal is for that to happen as in firm you can Lee as possible boom so as you see here we have the different layers of basically block chains that are talking to each other talking to the root chain and boom yeah so kind of going forward talk about what matters I'm the echo what Adrian said build the scaling solutions don't just wait for them to come to you yeah there's a bunch of cool projects who were actively searching for people like all of you to contribute to add value to use your creative and beautiful minds to contribute wonderful ideas do research so yeah once you have wonderful ideas kind of pick them apart talk to people who are smarter than you or who have more experience and then yeah kind of meld your creative ideas into solid specifications and yeah build them boom boom build your own plasma oh yeah sorry yeah build your own plasma chains a specific use cases plasma can change the world I have a quick question in your diagram you had a payment where you had two inputs to outputs of fee two confirmations and currency yeah is that fee just a third output yeah it would essentially be a third output yes and so I'm a little confused if that's a third output why I mean you sort of answered it and with saying that you account for every unit you know every atomic unit of account on the parent chain mm-hmm but what in the other example why couldn't you do that same thing all right why why could the operator create UTX oh that would that didn't that like how could an operator withdraw as a normal user a UTX oh that wasn't put in from but from a normal user right how could the operator withdraw a given UTX oh that wasn't that like an invalid UTX oh is that what you're asking yeah like how can they create value inside the chain as the operator if the value is only valid but you know if the parent chain is still the source of truth for currencies so basically the parent chain is only accepting route like the TX list roots from the consensus mechanism so the what and basically it doesn't do any validation when blocks are submitted so the operator can basically make a transaction saying whatever they want they could even basically pretend they that a deposit was received that was never received right okay I get it so the because the merkel route doesn't actually contain the full transaction log just the state of the UT exo's or it contains the full transaction log but basically the operator can withhold the like an invalid block that either has double spends where they're getting money twice or basically any situation where the operator has more money where they're supposed to whether that's the double spending them prison then pretending that a serum received a deposit to the child chained to them that never happened yeah basically a bunch of situations that cool yeah yeah that's awesome hello so my question is whether you're planning to include some kind of program ability into plasma at least to the extent that Bitcoin is programmable because for example one of the useful things that you can do with UT axle block chains is atomic swaps like you can swap things between different udx or chains and if you just use bitcoins script that would already allow for it so actually why are you reinventing the wheel why aren't you just using bitcoins you TXO format well so Bitcoin script is wonderful but Bitcoin are not wonderful but it does give you added functionality and base but it's it's significantly simpler with Bitcoin in the sense that Bitcoin is its own blockchain so it relies on its own consensus mechanism and there's not another chain that has to track each of those state transitions whereas with plasma you're basically tracking every state transition on aetherium so if something bad happens on the child chain you're basically able to settle that on etherium so I wouldn't say it's reinventing the wheel to not include it right away I would say that the majority of Bitcoin scripting functionality could be included right now on a plasma chain but it would look more as opposed specific functionality like say multi-sig functionality as opposed to having like the scripting opcodes that people can put together yeah so let's say like in this plasma cash example the the user only keeps or remember his own transactions when we have you know like a super big operator and so then the user was to exit mm-hmm and operator like blocks him and the user tries to you know do reconciliation on the on the main net he doesn't have them all the transactions yes because probably he depends on his input from other users and he doesn't have this this parts so how he can reconcile a when the operator doesn't agree or doesn't share that that part so user only should count in a given asset as received when they're able to exit with it so if I give you an asset but in between the operator starts withholding you never have custody of that asset you never would exit that I would be responsible for exiting that until you're able to basically until you see my transaction to you included in the child chain and then included in the route and then you would have enough information to exit does that what no you just need to remember so basically once my transaction to you is included in the child chain you basically will receive you basically only need to know the proofs that prove that you own a given asset you don't need to validate the inside entire child chain you just need to receive proofs of the transaction proof of the transaction where I'm transferring ownership of a given asset to you okay you want to do one more so the security assumption is that I have to watch the chain and exit right and then we already started talking about multisig and like advanced scripting and maybe we get general state computations going on but I would just like to get your opinion on how to handle like multi SIG's or Dowell like smart contracts or even the plasma bridges for the child child chain so if we always need to exit and my money is kind of in a flight because it's in a multi-sig mm-hmm how does that exit I would say the simplest way to kind of track more complex functionality and this is suboptimal but it's kind of a starting point would be basically to be able to prove the starting state and then to kind of go forward most likely through an interactive game to play back up to the kind of like current value state in the case of a multi-sig it's more challenging I would say basically what you'd want to do is like simplest is where all parties agree on the final state on aetherium because then you can just settle it that way but if they don't all agree then you have to kind of play an interactive game yeah and it gets fun and yeah that sounded a little like state channels in terms of like multi SIG's interactive games which is cool so there's some similarities there cool awesome I'm done thank you so much for listening [Applause]