EthCC 2: Georgios Konstantopoulos

okay thank you all for coming Albus extinct because it looks like we're a bit late for whatever reason so I'm gonna talk about plasma scalability solution and what's up with it so we have a bear market for about a year nobody cares about scalability everybody's talking about like good UX and everything but when we get the next crippled kitties things are gonna change and so we gotta prepare for that new scalability winter so a year ago we had vitalik actually introduced the plasma cash technique in this not this amphitheater by this conference and when he introduced it there was no code the spec was underwritten so let's see where we have come since then basically plasma is an extension on side chains and so I'll do like a brief introduction the side chains so you have the pine chain and the other chain so the initial on the other one and so what you do is that you take some funds you lock them in a smart contract then the other chain it listens for some event it creates you funds then you do whatever you want in the side chain and then in order to get your funds out of the side chain you need to burn these funds and then you take this proof of burn receipt you show it to the other chain and you say okay please unlock my eath that I unlocked initially but the thing is that if you want to do scalability usually you cannot have a proof-of-work side chain well you can but it's gonna be good for interoperability but not scalability so if you have a more scalable blockchain I will claim that it will be less secure in this example so an example of an attack is that basically the side chain will never let you withdraw your funds why because it will never let you burn your friends so that you will take it to the other chain so this means that citing like custodial so the fans are secured are as secure as the side chain consensus and if you don't have like a secure enough consensus such as proof of work well don't judge me for the proof of stake well you're not you're not always guaranteed to give your fans out so what will you do with plasma the solution is that instead of having like always to do a burn transaction every block gets submitted every block gets from the plasma chain it gets committed to the parent chain and this is done by somebody who is an untrusted basically the database manager of the plasma chain which is called usually linked in our lingo like the operator and so the operator takes every block like they produce blocks and they submit all your transactions and they take them in they commit the medical route of the block to the parent chain so plasma is non-custodial the funds are secured by the parent chain so if you have AB if you have a proof-of-work chain your fans are is secure I will claim as the proof-of-work security but you also need to have like some extra responsibilities which is called we use something called an exit game so what is this game so whenever you want to withdraw your funds you actually need to wait some time you start an attestation you say I want to withdraw my fans at this block then you need to wait T which is some sort of security parameter and then after T passes and nobody makes some sort of dispute you can finalize your exit and get your fans out but again there is a problem that because the database manager cannot be trusted at any time like there may be some sort of invalid state transition or your exit request may not be valid so what you do is that your all challenges disputes as the previous speakers said so what you do is that during this time T if anybody sets a dispute your exit is cancelled and usually you introduce some sort of security deposit so I make a deposit I would say I start the exit and I put the bounty I say I pay I have like a speck of one ether on this exit and if some of the challenge is my exit I lose that ether i forfeit the other so I'm directly incentivized let's say it worked honestly otherwise I lose money and not good so in plasma cash what happens is that in order to like contrary to other plasma construction basically there is a requirement that you do not have a vulnerability called the mass exit we're basically a lot of users need to rush to get out of the sidechain if something goes wrong and you won't like clients because you want the actual to be able to fully validate the found your funds in your phone because otherwise you can have like gigabytes of data on you which is not desired so what you do is that you have you TXO based model so we're telling some lessons from Bitcoin here we have one input one output UT exo's so the transactions they're non fungible if I have five Witter just like cash I can only pass around five either I cannot break it in half I cannot tell the Builder part we utilize a data structure called the sparse miracle tree which has inclusion proofs but because it's an ordered medical tree it allows you to also do exclusion proofs which will say why it's important and basically the process is that whenever you deposit your coins you get some funds with a serial number which is like the coin ID that you own and whenever it turns out you reference some PI interns action and when you exit you also like reference to blocks so let's see how this actually works so I initially will go through a simple example we have Alice the usual suspect Alice deposits let's say five if they're in the plasma chain it appears out of nowhere in a sense and she transfer it to Bob so Bob must always always verify the transaction history so it's a you take so based model so whenever you receive a transaction need to verify that the you take so you're getting is valid so what Bob does is that he verifies the Myrtle inclusion proof in the last block and he checks that it's okay so he accepts the coin when it block three like some other constants right but like our coin does not move so we do not care with not do anything maybe we download the exclusion proof actually we must download the exclusion proof because when Bob wants to send the coin to another party not only must he sent the inclusion proof said block one and two but it must also show that it wasn't spent at block three because in this example it's pretty clear that if Bob would spend it at block three and then spend it again at block four it's a double spend so Charlie it is his responsibility to always verified that there was no double spend or invalid state transition in the consistory and then if Charlie wants to exit human reference to blocks you wait a week or whatever the security parameter we set and after that period passes he can withdraw your funds and he can get wherever the he he wants to go let's take the procedure for this like we model it's going as a state machine so in the happy case I have a coin that I have just deposited I exited it's in this state I wait seven days I can find the eggs and then I can take the coin out so this is like the happiest scenario which if we have designed our construction properly it should always happen in the non interactive challenge case so we have two types of challenges they interactive and their non interactive and non interactive challenge is one that takes an exit and it instantly cancels it so you do the state transition to exiting and then you go back to the original one and gets directly canceled in the interactive challenge case what happens that we have a counter well coin so whenever interactive challenge happens you increment that counter so now this coin has a one counter for example of the pending challenges and whenever somebody responds to the challenge that counter is decremented but what happens is that if nobody responds within some time period which is also security parameter the coins again it's going back to the original state but again if somebody responds to the challenges that you made the coin continues resumes its withdrawal as before so this is the state transition function essentially and because this is like a very simple state machine it allows us to model essentially all the security properties very easily I'm going to go now through the three types of challenges that we see in plasma cash so basically the very first challenge they in the non interactive one where I have a coin I X I spend it to somebody and then I directly try to exit it so I'm trying to exit a spent coin and what the very simple challenge is that you reveal the spending transaction so it block - I try to exit and somebody can challenge by revealing spend from block - that's pretty straightforward in the double spend case what happens is that we consider that Charlie does not validate the coins history so it block one he checks the he's colluding with Alice to steal the coin so what happens that Allison's account Bob and then Alice directly sons are going to Charlie or essentially charlie is Alice and what happens that if Charlie wants to exit the coin Bob can at any time like challenge say no like I got the coin before you like get out and the final type of challenge wins the interactive challenge is like actually more involved because in order to have this type of situation so in order to know to have an arrow going from one block to another but after that block you have some state transition the operator must be malicious and this is the type of attack that for example when it happens in the other plasma variants when the operator shows that thermal issues you need to everybody need to get out of the chain which is a dangerous situation so in plasma cash we get this very nice property that you have like him peeing to watch only your coins so in this case what happens is that Alex Castle coin and after like let's say number of locks Bob suddenly has the coin why whatever because the operator is an untrusted party he owns the con she can do whatever he wants with his centralized database and what happens is that maybe they transact a bit with it they're all colluding parties they're all friends and they want to steal the money from Alice and basically the London tries to exit the coin so they challenge to this is that you do an invalid history challenge and basically you I attest that there is a missing link in the history of the coin and if there is no missing link such as in this case if there is a missing link such as in this case there is no way for Bob or any other party to prove that Alice spent the coin which is good because I'll keep skip going in the other case though where if Alice actually did spend the coin but she still wanted to challenge because whatever because she wants to grieve the other party from exiting you can still reveal spend from the invalid history challenge and cancel them the challenge so this is like how we have the three challenge types so in order to keep this secure there are some very like specific requirements we want some of the most challenge basically because like if nobody watches who will challenge and this is like a security property for any layer to solution not sidechains but for state channel for payment sunland's will payments on a network for plasma you name it so somebody must be there to challenge and this it's a reasonable assumption I will say but some people may argue with me and also we want to design it so that the expected reward of the attacker is less than zero because if an attacker can basically keep trying to exit the coin and the coin is worth I don't know like a thousand ether and the cost to attack is one dollar and maybe after a hundred tries they succeed the expected reward is positive so we want to keep the cost to attack always higher than the profit basically and all they layer to game to implement them as deferred optimists we call it so that you need to wait some time before like the game ends which is for the liveness and so what happens is that let's say we have a malicious exit at some time zero and then at time one somebody broadcasts the challenge so what must be happened in order to keep this secure is that the challenge must be included the transaction must be verified before t 0 plus T however what happens that this D that I show here it's a security parameter also which means that if they pan and chain quality is not good so if there is a censorship going on or if the congestion going if you have crypto key this being played basically this can be delayed more and if it's delayed a lot well you lose your money so that's what I mean by saying that your your funds are secure as the parent chain so it is a requirement that you use a secure parent chain so you usually you will want to use like maybe a proof-of-work chain or something similar or something with finality and basically we have this safety condition and doesn't attack your thing they try to make an exit if somebody challenges them they the attack fails if nobody's journalism they get back the bond that they put up they want if they or whatever amount they get back they they steal the coins or they earn whatever monetary value is in the coin and they lose like whatever gas fee they paid however what an attacker can actually do is that they can do a front running attack were basically attacker exits Challenger challenges and attacking challenges themselves and they managed to get the challenge lands action in before the other guy which means that they're able to get back the bond that they paid which reduces drastically the cost to attack so a very simple fix to Lisp is that you simply instead of giving the whole bond to the attacker so I exit I put up one ether if some of the challenge me they get one ether you the attacker will get I don't of it you pick it so this way we can keep it the game incentive compatible and basically we have like a sort of modeling we can do in order to keep things like legit so so far we talked about plasma cash like fixed denominations how can we get forward to this so all credits for this implementation so what I've talked about so far and for the rest of the talk everything has been implemented and being deployed and been tested it's nothing is theoretical so like these very smart fellows have developed an application which actually can do more than what I just described how does it do it I have a euro 1 euro coin with some serial number in the plasma cash model II this one coin so in the plasma cash flow model the naming joke everybody hates it you break it down in ten fragments of ten cents each and instead it it's literally just exchange your mental model instead of having one coin you have a coin line and essentially what you can do is that you can transfer an uninterrupted range in one transaction and you can also exit and on interrupted range in one transaction and an uninterrupted range can have any granularity so instead of in this case for example I have a 0 to 75 coin which can be whatever they do nominate the minimum denomination is but I could as easily exit 0 to 12.5 for example and obviously if there is if I don't own the whole range and if I have a gap and I try to exit the whole range it's valid challenge is just like one coin so this gives us still light client properties because you still do not need to download like a lot of data in order to make valid challenges yeah so another thing that you can do which is a very nice construction is that if you have like two ranges with a gap in between you can coordinate with the parties who have we can fill your gaps basically and defragment your ranges so from this where you have two ranges and one in between you basically do an atomic swap between the coins in between and the coins in the side and you now own one range the other party still owns one range you maybe want to pay them a fee to incentivize them to do this act or well it's beneficial to everyone and this way you can keep like you can essentially consolidate their ranges that you own which is a very nice property because again you can exit more funds in less transactions every since again and how do we do this like the construction that being used it's a metal industry because they difference with the metal spot this part's metal tree is that it also supports ranges so this is a one-hour discussion on this so there's no time like to actually describe this but I suggest you watch this video with this very nice interview with Ben and yeah so let's do a quick summary over what I talked about so we have non-custodial side chains which work by notarizing blocks which is what I've been calling a commit chain so you have a side chain which commits blocks commit chain yeah it doesn't have a mass exit reliability which is there it's not there Adam you have all chain gasless payments which do not have any cost and the on any cost to unboard yourself which is a big advantage over payments journals because in payments animals you need to do a funding transaction wait some time it said you can think of it like the easiest way to think about it like if you're designing applications on theorem and not on the site you know a plasmid change that it literally the compression mechanism so anybody who says that layer 2 is like if layer 1 scales like layer 2 is irrelevant don't listen to them you always need layer 2 for efficiency reasons the big advantage of plasma is that of this plasma variant is that you can audit the main chain contract and note the side chain contract which is like very very like if you need to hold it literally much much less data and what's in the future so the arbitrary denomination payments like a few weeks earlier it was not crossed away but like it looks like it's solved um we want to do even lighter like clients so plasma cash cash flow they're very good but like we want to try better a very prominent proposal was the RSA accumulator which was proposed by the Stanford kataka fee group a few months ago it was it got a lot of time but we got to the result that basically there is a computational bottleneck because it involves exponentiating people times and basically if you want to exponentiate a million coins because you have accumulated like a million coins literally the operation to do this it takes too long the RAC accumulators in my opinion will be reconsidered one we have hardware that can do exponentiation very fast and it happens to be that the theorem 2.0 is working on this with what they're calling a vdf isaac which is basically hardware which will be able to do exponentiation very hard for their own reasons but we can review and we can use that the current approach towards compacting the history is going to be some sort of a disease or knowledge proofs as a snark or the static or some other black magic and the way that we want to do smart contracts on plasma because currently it's just payments you want to use either state channels on plasma which is my preference or a recent construction which was thought of a little earlier than if denver and was implemented as a POC only then were called predicates and i have a link like if you want to read more about it and that's about it thank you very much and i'm pretty confident I can answer all of your questions just [Applause] wondering what kind of user interface you're imagining for the people issuing and managing the challenges are these gonna be kind of professionals maintaining a plasma sidechain or people receiving notifications on an app and checking on things I'm just curious like in this future world what is it look like regular people so the question is that how will user challenge to keep the fan safe so firstly I expect very very with a very high probability that there will be services like that will basically do challenges for you if you will same semi trust less watchtowers so trusted losers are a good thing but like it will it will for sure happen that we have will have some sort of trust same I tested Watchtower on the other hand if you design it like if the light client requirements are good enough you can actually put a plasma wallet or some sort in the browser in your opera wallet which is already being worked on and basically the moment that you open your wallet because the client is very light and it runs a full node on your mobile phone you can just have a service like an application like you open Facebook every day or something like that right which will basically issue all the challenges directly and that's it and you will parameterize the security parameter so that you will for yourself so that you come online every whatever amount of period but the way the world is going like I don't think I do not know many people who can manage to stay offline for 15 days yeah yeah so should I go over this or do you want to take a picture okay yeah thank you very much [Applause]