Scroll 🛠️ ZK Speedrun: 3 DSLs in 15 Minutes - Noir, Circom, Zokrates

[Music] hello everyone and welcome to the circuit breaker scroll Workshop ZK speedrun three dsls in 15 minutes Noir circom and Socrates joining us today is Amed Castro who will be taking us through this session and with that I'll pass over to Amed to get the session started thank you Rory yes uh we're going to cover different um dsls which is which are the the language needed to build circuits so if you want to follow it with me you can scan this QR code uh that will direct you to this page and yeah basically we're going to go H one by one and I will just show the same process for each one which you as a developer maybe you're AOL the developer that want to get into CK so what you need to do is first h create a circuit then generate a proof then generate a solidity verifier and then you can verify that from a smart contract and you can add some custom logic so you can connect it with your Dow or with your erc20 tokens or yeah everything that that we as a solity developer we are we are used to yeah and also uh last Workshop that we we did with um with global which should be also on the if you're watching on YouTube it should be like in this like um it Global YouTube channel I think it was really good ER the the circuit breaker attd like all of you guys were asking some really good questions so yeah if you have any more questions about this we can take a look at at the end so yeah let's get started with socres uh Socrates it's um uh going to put it here to open a terminal so um Socrates uh is okay here you go so uh let's let's start with Socrates which I think it has a really good developer experience here I I already installed call it so you can first run this command and then just put your username here if you want to uh load it into your environment variables so here I'm using Socrates 088 this is the installation part so let's start by creating a proof so let's create a circuit and last time we mentioned that circuits are like the Syntax for creating a circuit um it's very similar to a programming language but the difference is that you you write assertions instead of like you can compute stuff you can um yeah create variables uh Loops if statements and but difference that you make assertions and only if only if the all the assertions are like satisfied or complete uh you will be able to generate a proof so here what I did is I have a circuit that has a and b as input we're going to do very simple circuits for the sake of the example but I think all of the example are going to exemplify like and get you in the right mindset to what you need to do in order to to to yeah to write any type of circuits so this circuit is about two variables A and B and you're proving that a * a equals B and but a is a private variable so you have two numbers and you only reveal one number and the other one is private and in this case we're like revealing only b b is your public variable and a is your private variable and we're going to generate a proof by passing these two parameters a is three and B is 9 because 3 * degree equals 9 so we run these commands and now the proof was WR into the Json file you can grab from here from the QR um the link to this your to this uh yeah to to this page I will be right back yes can you can hear me Co yeah I can hear you now yeah okay yeah I okay switch my internet connection hope it's good now okay let's continue then so uh okay we ER so basically I generated so first I improving that three times 3 equals 9 but I'm going to keep three private and nine public in order to prove it I pass the three and the nine as as inputs and what I get back is the proof which is this one so the next step is to verify the proof so we're going to verify it on a solidity smart contract so I run this command and I get the solidity verifier once I have the solidier the verifier we can H deploy this contract and I'm going to deploy it on scroll test net but it should work on on H also on ethereum or or on all evm chains that supports all the pre-compiled needed H for this to work which are uh all the like layer ones all the optimistic clear tools and many just just just be aware that many um CK evm don't support this Jet and scroll does but with a caveat that you have to restrict the amount of easy pairings that you do so what you need to do as a developer what you need to know is that this is very hard for cvms to support like uh the cvms will continue to like improve this in the future for sure H but now you have to know about the limitations about it but yeah we're going to do this on scroll which is working fine and yeah let's do that now so first I'm going to have two contracts one is going to be the verifier contract which is the one that was generated by the DSL which in this case is Socrates so I compile it there's some warnings but don't have to worry about it so now I deploy the verifier contract and and then I'm going to this verifier contract is going to expose a verifier function and that verifying function is going to be called from another smart contract so let's take a look so this is the verify function from the from from my a * a equals B circuit so this is the verifier contract and what I'm going to do now is to deploy a second contract that's going to use this verify function let's take a look at this so this second contract uh we're going to call it like custom logic contract so the custom logic contract is going to do two things first it's going to verify the the proof we're going to send a proof as parameter and also we're going to send an input and by by the way something that I missed here is that the proof has to be true this is this is specifically for Socrates this is this is the way like the Socrates smart contracts work um incorrect proof put a message here so we're going to verify the transaction by sending the proof and you have to get a valid proof to continue the execution and what is the the next execution you can do whatever you want for example if you're doing like a I don't know private transactions on erc20 tokens then you send the transfer here if you're doing a dow with a voting here you vote for the proposal if you are doing uh social media uh like Anonymous social media here you create the the the post and here is the part like here you can put whatever you're already used to doing on solidity so yeah this is our contract and let's try it out so I'm going to compile it going to uh launch it to deploy it and as a parameter we're going to pass the verifier address that was generated from Socrates so uh we're going to deploy this and as you can see the we need to in order to to call the the send proof function we're going to need two things one is the proof and two is the public inputs so you can find those here on the proof so the proof is this one this a b c thing is the proof and the public input is this you remember that we're doing a a that we're doing like a time a equals B cirquit and B is the public input so we are not revealing a and in this case we are just passing b as parameter do remember that we did three times three equals 9 so we're going to only pass nine as parameter because that's the public input so yeah let's this is in a format that remix won't like that much so I'm just going to quickly H put this in a format that it would like the proof so yeah I think that's that should be it and also I'm going to pass this as a parameter to which is basically as a has an array of one and this should do it there you go and in this in this example I'm just doing one thing with the custom logic I'm just storing the public input because the public input is what will allow you to play around with your your CK logic and as you can see now the public input was stored and you can fake it you you can put just whatever number here because is going to revert right so yeah that's that's the cool thing about CK okay so this is Socrates okay this is a speed run so we're going to go to the next one you have any question about Socrates and if I can answer like I can we can do that like at at the end as I mentioned before let's go with Noir now we're going to do a very similar thing with Noir we're going to go to the same process we're going to get a circuit uh we're going to generate a proof and we're going to verified so let's do it and okay so I already have installed um nargo which is the no command I have version 22 which is the latest one and here you can this how you can install it on Linux on Mac and both Apple silicon and Intel and so let's create the hello word that Noir offers and now uh we are going to pass the you remember that we passed the three and the nine in the in the command line for Socrates in no we pass it on this tomal file so we're going to pass one and two and this is going to be run on this circuit that basically Pro that X and Y are different you B you pass to numbers parameter X and Y and you're proven that they're different but you all are only revealing y so X is private H so yeah you're going to pass parameters only raling one but you can know for sure that the the the private parameter is is another one it's a different one so now we're going to generate the proof just like we did before and our proof is going to be in the proof directory this is a very long proof here you go and now we're going to verif the proof Again by generating a solidity smart contract here you go here it is and we are going to the the same as we did before we're going to deploy this smart contract on chain move this okay this is the ultra verifier contract which I think is a very funny and silly name because uh it's using underlying technology of plunk about the version Ultra plun and they always keep keep putting this numbers like tbop PL Ultra plun I don't know what what's what's next okay so we have the verifier here it also has a verify function that we're going to call from a contract that I'm also prepared for today with custom logic and in this case we're going to do exactly the same we're going to verify the contract in this case we don't need to put this on the requir this is the way that the the the Noir uh contract verifier contract is done you just need to put this here to verify the proof that you pass parameter and you can see that we're passing the parameter in the same format first the proof and then the public inputs and finally you can uh you can add just custom logic which we're going to do the same you're just going to store the uh y the the the SEC the second parameter the public one okay so now the same as we did before we have to specify on the Constructor which uh which verifier address we're working on and we deploy it and then we will have to pass the proof right and we have to pass it in the in in a very similar way that we did before so first we pass the proof and also the public inputs so the proof is here this super huge number so just one recommendation for it to be compatible with remix you have to put the ZX at the beginning and that's it and then the public inputs you can find them on the verifier Theo file that was generated for you this is the only um public input so we are going to pass it in this format like a string on an array okay and we pass it on an array because usually you will want to pass many public inputs yeah that will help you to do the logic on on on uh on chain like on your smart contract so right now uh the public input is is is zero but when it gets confirmed it's just going to become uh two on this case okay here you go the is confirm and we store the number two uh okay so that's for Noir and and now let's go with circum which again is going to be something very similar let me see if I have installed correctly circum here uh um yes looks like so I'm not going to install but I already have it let me just check if I have snar KS also installed yeah looks like look it's installed okay so if you want to start it yourself you you will need you just run these commands and sorry that will get install for you so here this is a this is the circum syntax and we're going to do this circuit that is actually going to do some computation which I think is super cool going to check for some computation which we're going to check that the input a is going to be multiplied by the input B and it's going to output on C so yeah yeah we're going to check that a * bals C and yeah so uh the the only public in public input which is the output it's is going to be C so we're going to also create these files so you remember that this is a bit similar to to to Noir that we put the inputs on a Tomo file we're putting it on a Json file and then we're going to run all of this which is going to oops I need to save this okay we're going to run all of this which is going to take a while while because it's doing ER just just you would to have be prompted just a couple of times to put some entropy because we're doing the power of to and you know that we're using the kcg ceremony for Court 16 so basically means that maybe some of you may participated on the on the kcg ceremony by the T Foundation where everyone can cont rute to to the randomness and the more people that contribute the more safe get the protocol so yeah we're just going to do a couple of of uh of contributions here which just just some random stuff and just just to get to get it set up and H yeah it's it's worth to me that if you if you want to go if you're using use some dsls that use uh trusted setups like this this one and once you go live you may want to do it like in a very safe way or you may use some other snarks that don't use don't use this initial setup and in that case you you won't need to H to do this step so yeah it will be depend it will depend on what is you're using and each one has some pros and cons so before launching I would recommend you just go into the forums from that language from the TSL and just ask like what uh yeah what what recommendations are there so far as you can see the three of them have very similar characteristics and the the language may may look different you may have your your your favorite yourself and H but in general they're all the same they have inputs and they have public and private inputs and du do assertions you do checks and then if everything is correct then you will return appr proof and yeah that proof can be generated it can be verified multiple ways it can even be verified like offchain you don't have to two blockchain stuff in order to to to to to CK um but of course doing uh like verifying on ethereum is something very unique because it it allows you to to yeah have something that can be public and verified by multiple people so yeah ethereum is giving us this property that which is super cool okay so here the inputs of the proof uh so we basically pass during all of these okay we we are Computing that here the input that uh 3 * 11 equals 33 so 33 is going to be our public input which is exactly here this is the public input so basically this is the proof this is the proof and this is the public input say 21 but it's 21 on hex on hexadecimal which is 33 on decimal you can also say see the proof here this is the proof and yeah this is the proof and this is where is the public input uh I can find it here well anyways this is the public input and this is in the format that you will already expected from um solidity so again let's do the same process again of generating the verifier here you go and the verifier is here again we can go and put it on remix [Music] can uh deploy it and also we can um now uh create a custom logic circuit which is very similar to what we already did we pass the verifier as parameter and in this case the inputs are already format here so it's going to be very easy to pass them and of course you on your uh web app as we mentioned at the previous uh circuit breaker Workshop your you would usually want to build this on a web app and when you do it well you will have like each Socrates circum and Noir have some JavaScript way of doing everything JavaScript way of passing the parameters and a JavaScript way of generating the proof to you you will usually want to do it there unless you're doing some backend stuff some proving on a back end not not like a specifically a private privacy app but privacy apps are like very I think something that very new very unique something that was not possible before and now was by using our eum accounts which I think is super cool and it's something that you can use on layer to to sa so I think that it's a it's a good uh like doing privacy up on layer tools is something that we as developers uh there there is a lot of opportunities here because there's something something something very new and a lot of room for creativity for for us to think about new stuff so as you can see here I passed the parameters and I verifi the proof now it's on there just very simple custom logic but yeah this is my overview of the three of them each one has different characteristics if I can summarize what I think personally about each of them I think circum is uh like the one that's is has more adoption has more community and yeah I think it's super cool and I think that Noir the team is is working super actively on it I like a lot what the team is building and also I think they're very focused on developer experience and also Noir on top of being the language for creating a circuit for evm language there is also going to serve to create circuits in a non evm language that's going to be the declar too which I I think is super cool but this means that it is a project that is is is is being work on a lot so it's very active has very active development so I think that's super cool and about Socrates I think the the interface is really good and it's very easy to pick up the documentation is really really good and yeah probably I will recommend this as your first experience with CK either Socrates or Noir I think is more complex and yeah but yeah for developer experience I think it's it's very easy but H I think that um uh there is more activity on circom and on Noir but yeah each one has some features over over the other so when you want to like actually build a pro a project using either of these you will have to check if it has everything that you need for your specific app so yeah this is my speed probably it took me more than 1550 minutes that I was planned to well yeah happy that you guys Ted alone so yeah let me know if if if you have any questions yeah there was one towards uh the top um saying I I wish you would go back to the ways one can use the verifier do Soul they thought that you rushed that a little but maybe because it was in 15 minutes yeah like er about generating the the solidity file yeah so the the thing that you need to understand is that there are two contracts one contract is generated for you and the other contract is like your logic like what you usually write in solidity so let's pick uh for example I think this one is a good example uh so with this command you generate a contract and you deploy it and and yeah it's going to be sitting there and yeah it just has a function that you pass the proof it returns true or false if it's or it will revert if the proof is false if not it your program will continue that's one question you don't need to write it it's going to be generated for you and yeah it's going to have a lot of numbers that you don't need to understand the only thing that you need to know is that it will have a verifi function and the verify function is going to be called by the other contract that you H you you that's where you will be coding and what will you be C in here so you will have basically on one side you will need to verify so we have a verifier uh call to your other contract so the previous contract that was out to generated you're going to call the verify function from that contract and if it pass the proof because you send the proof and if it's not correct it's going to revert so if you pass a correct proof then you can add your custom logic and what things can you do on your custom logic so you have a couple of like uh tools that you can build here so one part is that you have the public inputs so when we pass stuff to the circuits you have the public and the private H inputs so the private no one can know about it especially just smart contract can it doesn't know about it why because it's it's private and everything on your smart contract is public right so the private stuff is going to stay off chain it's going to stay on the ciruit no one will be able to see it but the public stop is going to be here and uh you can play around with the with the public information on your here on SOL for example if you're doing a voting app the you can play around with stuff such as you can keep the voter Anonymous as a private input and you can keep the vote public as a public input so the the the public input is going you can you can play around with it you can do your solidity stuff with it you can do some computation whatever you want and yeah on the other hand for example you can have a um for example a def staking protocol for example that if you want to stake or on stake for example when you're on staking from a public H from a public perspective you will only be able to see the public params is the amount that you are on staking and where it's going to be sent but you the private input is the original owner you won't see it because that's the anonymous part so you it will depend on your app so you have some privacy stuff that will stay on the circuit and all the public stuff you can play around here in solidity so that's like your custom logic so that's what you will be able to uh to to do here so yeah so two things that you here first verify which is called the other contract and second just whatever you want to do your your custom like yeah nice and another question was um uh I would like to know if you can touch on converting arbitrary statements to math which what is fundamental to creating circuits that would create the proofs yeah I am not the right person for that but I I'm not I'm not very familiar with all the stuff but there is the CK the best resource that I found so far which is like the like a good like Middle Point for all the the math and also a little bit of programming stuff is the CK Muk on on uh by Berkeley on YouTube I think this is this is this will be my full recommendation here uh yeah I think it has both It Go like very very low level H it will go very low level on everything that that they need to tou on so yeah you can find this on this was done by yeah the the Berkeley University yeah this would be my my recommendation this is the most up toate and yeah but yeah I'm not the person for for for the M stuff yeah uh let's see and then uh uh should we check out the PTW or dot uh R1 CS files to get or is it better to ignore them oh the this one like the this so as a developer you don't need to touch on these files yeah other the P you you don't need H yeah you can just like ignore it and uh you will need them to uh to uh to uh to generate the proofs and to verify them and also to make the verifier contract but yeah as a developer you don't need to touch them uh you you just need to open up your your ceremony so many people can contribute to it and to make it more safe but after that you you don't need to touch it anymore and I think you may have mentioned this but uh which HDL among these is most user friendly for beginners yeah I think uh either Socrates or that would be my two recommendations but you just take into consideration that circum has more Community has a bigger community and also has a bigger um has a bigger uh like more projects have launched us using Circle so there are more like use cases and example products just take them into consideration but as you can see here like the it has the signals and these uh like this is the way of of checking constraints and yeah I think for developers if you if you're coming from maybe you're a web two developer or you're a solidity developer I would recommend either Noir or um or Socrates and also the Noir guys has been like putting a lot of effort lately on the on the documentation so so so so yeah probably probably Noir yeah I would say I would say Noir it will depend on the project okay uh in the Noir example upon submitting the proof in custom logic. soulle the public number was updated from zero to two how how does this prove that the numbers are not equal as was written in the Noir code yeah so um so we pass one and two right first was uh the X was one and Y was two so what we're proving here is that we passed a number that is is not two so uh but this particular example does it's not like practical like just this this is just an example but let's put this like into a practical context like an example uh with something practical is that okay you can H for example if like like I mentioned before like if x is your uh for example you have a list of Voters and like an array you can imagine array of an array of bers which is X your private input and why is your public input which is the vote like for or against maybe two means against one mean four so when you pass the when when you go to the contract it it is relevant at this point because you already know that only if you are part of the list you will be able to generate a proof so uh that's where like uh private keys public Keys com to play because you can only prove that you are you you you uh you are part of this list only if you have a a private list for example and usually this is done by using hashing so uh you can you can think about only if you have the key you can unlock the private part but the public part is just it's just public so you can't generate a proof if you don't have the key so H but the key is going to remain private so that that's the important part and so you can safely go and submit this on blockchain with a proof that you were only be able to do it if ER if if you have the key but if you if you have it you want expose it that's the the the cool part so and also you want know um proba if you if it was list for example you won't be able to know which one we you uh so yeah different different things that you can play around with here H this example as I mentioned is not like really um it's very straightforward it's just uh it doesn't doesn't uh it's not practical just to just to say like okay X and Y are different because you could have pick like one or three or four or five or six you don't know which one you the only thing that you know is that H you didn't pick two and the thing is that you can for this example you can generate an an infinite amount of proof uh or you can generate you can generate like the a different proof with the same number for for one and two you can generate the same number two times so as a developer you also have to think think in ways on how to restrict the proof generation maybe you can uh H you can um you can think of ways of of how to make people not to do the same thing two times like to double spent and here you will also need to be using like n and stuff I'm going like like talking about other stuff but in general you as a developer um what you will care about is the public inputs and how to not double spend and and and and nullify so yeah in this example the just passing one and two doesn't say too much but the the power of see and the thing that we were not able to do before is that this is going to be obscur h no one will be able to know ER what what was it I don't know if that if that answer answered the question okay and then last question what of Halo 2 yeah really good question um I thought about adding Halo 2 here but yeah it will definitely not be a speedrun at all um yeah Halo 2 actually Halo 2 is not a DSL but it's is it it's the it's is the it serves the same purpose that the three of them so how are whole Halo 2 is similar to uh Noir and Socrates so on Halo to can you write cits yes yes you can write circuits can you generate proof yes can you verify them yes can you uh generate a solid smart contract that is able to verify the proof yes you can do that too and how is um how is it different how is it different than than all of the three of this and as you may as you may you may have know uh scroll is written on Halo to because the the the Privacy the Privacy exploration from the PSC privacy and scale exploration a repository from the ckvm is WR on Halo 2 and why did they decide to do it on Halo 2 and not on this these others is because Halo 2 is more flexible it allows you to go like one step deeper and fine-tune uh like everything uh that that that like more like you can go like one step behind into the into the um into the more a little bit more cryptographic part and you can think about it as a you know you can write code in C in C++ for example but you can write the same code in C or even in assembly just going one step lower and yeah so Halo 2 allows you to go one step lower lower and just do more like um specific stuff that you won't be able to do in neither of this this this language uh but uh it's the problem is that it's it's very complex and you yeah you uh yeah you just need to to to fine tune because you have all this this different possibilities um you have to understand a lot of concept first and is also not a DSL because as you can see the DSL are Dynamic specific language so it's a language that works for that serves only one purpose so Socrates no and and ccum it serves only one purpose is making CK proofs but Halo 2 is not a TSL it's a library it's a rust Library so you write your rust program and you import the the the Halo to library and you can start writing your circuits that way and as you may have like if you may suspect at this point the the syntax is very very very very very very hard yeah it's very hard but it's it's also very cool and you can do a lot of cool things and that's why it's the prefer language for for the ckvm that's the language well the library it's not a language right it's a library that was a library that was big because it gives you a lot of flexibility and and it it expands the things that you can do but unfortunately and the reason why I didn't add it to to this like Speed Run is that uh you can't you you just just don't have this like Halo 2 export verifi you just don't have it you have to write the the Sol itself maybe in the future you will have like a a command that will allow you to do it but it's not there yet it's not it's not there yet and also it's not the the main reason of Halo 2ist because Halo 2 was developed I think by the ckash protocol and now it's used by scroll and other projects but yeah the thing is that the the objective is just going very deep and doing this uh low level stuff the objective not the developer experience but in the case of Socrates and a and and circum yes the objective is the the solidity verified that's why is the developer experience that's why you can have solidi and all that stuff yeah but yeah really really good question because um Hilo 2 like is part of this of this um uh of this group of of tools that allow you to to do the exact same thing nice awesome well cheers were a bit over time but uh yeah thanks again Ed for the great another great Workshop presentation and thank you all everybody else for uh asking these really thoughtful insightful questions as a reminder hacking has begun so you can begin hacking um yeah we've got one more Workshop this afternoon and then another team formation session so awesome if you everybody has a great rest of your Friday and have a great weekend yeah thank you Rory thank everyone for yeah all the for for for yeah participating and doing all these great questions yeah and yeah happy hacking and yeah can't wait to see what what you build on on on circuit breaker awesome cheers have a going everybody bye bye [Music]