Mina zkApps 🛠 Zero-Knowledge Programming with TypeScript - Jack Servia

[Applause] [Music] all right hi everybody uh i'm jack and uh i work at of one labs we're the company that incubated the mena protocol and uh in this presentation we'll kind of talk a little bit about what mina is what makes it special and how you can get started building zk apps using snarky js so our agenda for today is you know first we'll be looking at mina then we'll take a look at zk apps and run through some simple example code on stargates and then finally we can kind of talk about where you can learn more and go and open up questions and answers so amino works quite a bit differently than other layer 1 blockchains you're probably familiar with mina stays 22 kilobytes whereas other blockchains increase in size the current finalized state of mina and all of the information required in order to validate that stays a fixed 22 kilobytes um this is possible because we use these things called recursive zero knowledge snarks which are it's a type of zero knowledge proof where we can actually take the last state of the blockchain which is itself zero knowledge proof and we can uh take transactions which are also zero knowledge proofs and we can prove all of these zero knowledge proofs inside of another zero knowledge proof that's the same size as each of the constituent proofs so yeah this has been possible by our proof system called kimchi which is really just an implementation detail from the perspective of developers but it's something we've spent a lot of time making really really good and well suited to this use case and it has some properties that are yeah just really cool so it's succinct that means that the proofs stay the same size it's recursive that means that we can verify proofs inside of other proofs it's efficient and extensible so it can do the kind of math that you probably need to do in order to build applications things like hash functions work efficiently or i guess one hash function works particularly efficiently um yeah so the mean of blockchain stays 22 kilobytes but uh applications also work quite differently on on a blockchain like ethereum you you know are sending some sort of request basically to the ethereum nodes which store and run your code and then um you know they all have to do this at once in order to to be able to to kind of ensure that we're doing it correctly and and if you want to verify that the current state is true you take all of these signed transactions and sum up the effects of them uh with mina the smart contracts actually run off chain they live in the user's browser and and they're written in typescript and you can kind of think of it as the user just runs the smart contract uh or just runs the typescript code and proves that they've done it correctly and they actually send this proof to mina um this is useful for a couple of different reasons the most interesting i think is that you have privacy by default so anything that you do you're doing on your local machine it doesn't leave your local machine uh unless you deliberately send it away um and so this opens the door to a whole you know bunch of different kinds of applications that i don't think people have been able to think seriously about building on on blockchains like ethereum yet um it also opens the door to decentralization because the the blockchain can stay 22 kilobytes as we said or the current finalized state can stay 22 kilobytes so you can have wallets that verify the chain state themselves not in the way that like light clients work but uh in a sort of in a way that's as small as light clients and actually even smaller than light clients um but as secure as as a full node um and they also have this kind of interesting idea of interoperability because you can verify the entire mean of state in in a in a single proof if you can write a like let's say an ethereum contract that verifies this proof you can actually bridge the entire immune estate to ethereum in one single like non-interactive uh transaction you just send the proof to this smart contract on uh ethereum if the you know proof is valid that's a smart contract checks if the proof is valid and if it is valid then the whole state is bridged over to ethereum um and so ethereum foundation and mina foundation have actually funded a a project uh that's doing this right now uh no foundation is working on a bridge and there's a demo that works on one of the ethereum test nets so that's pretty cool too the other thing that you have is there's no gas model because the smart contracts execute on the user's machine and the mena blockchain is only verifying proofs you can do as little or as much computation as you want and it will always cost the same amount the proof is well it will always uh network demand will affect the you know the price you have to pay in order to get the transaction included but um no matter how much computation you do it'll it'll cost the same amount on on the you know a given day um and so yeah this opens the door to doing you know to building applications that require dramatically more computation than uh are possible on ethereum right now and there's kind of even this idea of uh being able to do a lot of execution off chain goes kind of even further you should actually build applications that fit a really different uh model than is possible on blockchains right now and like the the user flow is kind of different and so i'll actually talk about this at the very end um as kind of like a bonus um so yeah uh what is an example of this look like well if we want to prove that we have more than a thousand um pesos in our bank account uh but we don't want to reveal the exact amount or any identifiable information about ourselves and then we want to bridge this to to a chain like ethereum you know this is something that's possible with mina that it would be all of these bullet points would be hard to do uh with anything that came before amino um so proving that we have a thousand uh pesos in our bank account we're actually working on something called zk oracles right now which is a process where we prove a tls handshake inside of a zero knowledge proof so that we get the ability to basically take any information on any website and pull it onto the mena blockchain uh without having to worry about like uh a can you know a quorum of of like oracle operators cooperating or incentivizing them or paying them or anything like that it's we rely on cryptography instead of game theory and so it's pretty much if you go to the website the website proves to you that it's who it says it is and it proves to you that nobody is tampered with the information in transit and uh we create a zero knowledge proof of this so that this proof is non-interactive and you can just put it on chain uh so let's say yeah i want to prove that i have more than a thousand pesos in my bank account first i can prove that i went to my bank account's website and that it said that you know it sent me this page and so this page has all my information and so we don't want to reveal that because it would you know it would make it really easy to steal our identity um and so then what we can do is we can take this proof and we can prove about it that uh yeah just that our account balances is greater than a thousand pesos um and so now we've you know augmented the data so that it's uh still useful for what we want it for but it's not um uh you know gonna cause problems from a privacy standpoint and then uh you know that is attestation which lives on mean it can be bridged over to ethereum and so all of these properties come from just you know the fact that we're doing things a lot differently we've kind of rethought how blockchain should work in the context of you know efficient zero knowledge proofs um so zk app can consist of two parts we have the smart contract itself which is written in typescript using our library snarky.js and then we also have the ui which you can also write in typescript and you can pretty much write your smart contract as you know something in one repository put it on npm and import it into your ui uh and yeah it's a very straightforward workflow um so circuit.js contract yeah it's written in typescript and it eventually compiles into two things one of these is approver function which is what the users will actually run when they interact with your application this is what runs in their browser so it will do what you tell it to do but then it'll also generate a proof that it did what you told it to do correctly and that's what will get sent to meena it'll also generate a verification key which is the thing that actually gets stored on mina and commits to uh the like business logic that's in your smart contract and so this verification key is a small sort of random looking number that is computed by really complicated means um but ultimately can be used to verify that any interaction you have with your smart contract um is a valid interaction for for the code that you use to generate it so uh when we deploy a verification key uh to the amino blockchain we create something called a zk app account it's uh there's not as like well defined of a difference between like a i don't know like a an externally owned account and a contract account as there is on um on a blockchain like ethereum with mina zika app account is basically an account that has one of these verification keys associated with it and it will only accept transactions if they have a valid proof associated with that verification key and so this is how you can constrain these accounts to be usable uh only in you know some specific way that's defined by your uh your your smart contract logic um and so you know when we when we deploy one of these accounts then we can interact with this account you know doing whatever we want to as long as we are also as long as our transaction is also accompanied by a valid zero knowledge proof um but if it's not accompanied with by a valid zero knowledge proof then the transaction just fails the blockchain won't mine it um and so yeah this is how we can constrain you know you can constrain the functionality of this account in whatever way you want uh by this means uh so inside of a zk app we have a bunch of methods and these are the things that users can call um the methods taken so i guess yeah so we take in some sort of arguments that the user can generate we take in smart contract state so this is the state of the smart contract before our method runs and then we also take and take in you know uh state of the world which would be something like block height or i don't know verifiable randomness um what we spit out is uh zero knowledge proof that proves that what we did we did correctly and also updates to the state of the world and updates to the state of our smart contract and so as long as the zero knowledge group is valid then these updates are committed um so yeah we use snarky js to write these smart contracts uh snarky.js is a typescript library and we chose typescript for kind of a couple of different reasons but uh really the reason why is because the javascript ecosystem is really strong and we're really ecosystem focused we want to make something that people can use to build uh you know cryptographers can build some fancy cryptography library and then people who are not cryptographers can use this fancy cryptography library to build some really great idea um so yeah uh you can use vs code npm pretty or eslint whatever um the vs code support is great the intellisense really uh yeah it makes it pretty easy to figure out snarky jazz even if you don't ever look at the docs you can just kind of look at the intellisense and get started um but yeah we also have things like npm and eslint and so the idea is just that uh we have minimal developer tooling we didn't want to reinvent the wheel we wanted to let people use the things that they're familiar with and the things that are mature to that end the developer tooling that we do have is called the zk app cli and it's really easy to use and and really powerful despite being simple and elegant it's uh you know you can just yeah it's just a node package you can install it uh as it shows here uh and then if it can deploy your contracts to the amino blockchain it can scaffold these contracts so that you have um yeah like linters set up that will help you um yeah prettier and yeah it'll set up a project that uh has an ad contract by default and this is probably a good place if anybody's thinking about maybe building something just install the zk app cli look at the ad contract and see what you think of it i think it will be pretty intuitive just looking at it with no context even um so yeah moving on to starkey js z caps are written in typescript using snarky.js we use existing open technologies it runs in the browser and in node.

js you can use existing javascript and typescript libraries and tools excellent vs code support um yeah so okay what is uh why do we have to use snarky js like what is a zero knowledge proof is zero knowledge proof is basically a math problem um well a zero knowledge proof system is basically a math problem and zero knowledge proof is a solution to one of these math problems and so um you know this gets complicated because you have to be able to configure our math problem to represent some kind of smart contract logic that uh that yeah we want to allow people to prove that they're doing correctly and so um this is what snarky.js does it handles most of this hard work of turning a program into a math problem but at the end of the day the math problem is the thing that's used to check that people are executing code correctly and it's also well it's a math problem so it's it's defined over uh you know it's not defined over like strings or booleans it's defined over numbers and in fact a specific kind of number called an element of a finite field it's not really important to dive into what that means if you're curious you can just google it but from a developer perspective it really works very similarly to like a uint um 256 in solidity um you have you know natural numbers from zero to a number that's almost uh you know the same as the max for unit 256. um so this element is uh so sorry this type is represented as something called field in snarky.js and you can work with it directly there are some reasons why you might want to it's very efficient to work with it directly because ultimately this is what everything turns into in the math problem but uh you don't have to if that seems pretty confusing we've built types on top of the field type like bull and ui64 and other types so that if you want to use the things you're more familiar with you can and then this will do the work of figuring out how to turn these into field elements under the hood for you um the downside is that they're a little bit less efficient than working with field elements directly but you can start with something that's easy to implement and then optimize where you need um functions are just normal typescript functions and data are normal typescript classes um so if we look here we have you know a function add1 and double we pass in something called x which is a field and we return a field um and so what we're returning is x add one uh multiply two um and so yeah kind of a common question is why can't we use the javascript infix operator here why can't we do you know x space plus space one well the reason why is because javascript doesn't know how to make sense of field elements and it certainly doesn't know how to turn them into an equation and so um this is what snarky gs does it lets you define uh addition over these field elements and it figures out how to turn this edition into something that's a part of the math problem so that it's constrained by the proof um when we pass in a one here you can see so this is just a normal javascript one and it gets promoted into being a field element of value one um this looks a little bit weird and and uh in practice it actually ends up just being very elegant this kind of chaining api is something that lots of people have told us they like um and and i've also kind of grown to like it um so yeah here we've got another example we're taking a field passing in a number one it gets promoted into a field of value one and then we're adding to it a field of value three to get a field of value four so some here will equal a field element of value four um so yeah let's look at a hello world example uh we're gonna write a smart contract with a single state variable called x and it will have an update method that will let us replace x with its square and we can only update it if we control uh a secret admin private key so this is kind of the like um the requirements for our contract and now i'll get into how you build it um so okay so yeah here's what we have we have this idea of you know x is equal to three we want to be able to call update with nine and a secret key and as long as the secret key corresponds to um uh the you know secret admin admin key uh and as long as nine is the square of three then we'll be able to update and then we can call you know the same thing again with 81 and we'll be able to update again because 81 is a square nine but if we call um uh if when x is equal to nine we call update with 75 it will simply fail we won't be able to generate a valid proof because 75 is not this you know the the square of nine um so to write a snarky.js smart contract we just extend this smart contract class in snarky gs you just import it and you know extend so here we have a smart contract called hello world it's that simple um and then if we want to define state that's going to be stored on the amino blockchain we uh yeah we have like a variable here called x and uh we use this state decorator um in order to say we want to take this variable x we want to store it on the amino blockchain we want to make sure that any time it's updated it's being updated in a legal way and we also want it to have the type of field so we could change this field type to like public key or uint 64 any kind of type that's comprised of fields in order to make them easier to work with but in this case we're just using field um and so so yeah this is a part of on chain state now um the other thing that we're going to do here is we're going to look at this deploy method so this is sort of used as like the constructor this figures out how the contract should um be before users interact with it but at the time that it's deployed to the network uh so uh don't worry about these deploy args or these first two lines are are just here so that the zk app cli can like hook in and figure out how to put it on chain it's really straightforward from a user perspective this will get scaffolded in when you uh zk project but then we have this dot x set to three and so this is going to take our on chain state variable here x and it's going to set it to a value of three three is going to get promoted into a field element and the on chain state is going to be you know equal to a field element of value three and then we have this party.

set value this self update delegate admin private key uh don't worry too much about party either um party is basically something that uh well okay don't worry about this very much at all um what this is doing is it's basically taking a property of the zk app account and it's changing it to something different so in this case we're setting this property to the admin public key so that then we can verify that the private key corresponds to this public key and only allow people who possess the private key to um interact with this smart contract uh and so i should also say this uh party and this whole deploy method is something that will default to something that makes sense you will not have to think about this in the most cases you'll just sort of not touch deploy and work work forward however you want to or you'll just use deploy to set the initial values um but the idea is that this is here so that you can when you need to change things but you don't you don't have to worry about this kind of level of complexity straight away um so yeah then inside of the smart contract underneath our state declarations in our deploy method uh we have uh methods that users can call and so we we specify these using this method decorator and the method decorator basically says uh hey this is something that users are going to call and when they do call it you need to remember what you're doing and then you need to prove that you did it correctly and so this update method gets passed in uh a squared which is a field element and an admin which is a private key which is comprised of field elements but you can see you can work with the private key type here directly um and so we do is we have this constant x which we're going to set equal to this dot x dot you know get so we're going to get the value of x which is going to be a field element equal to 3 i think if we look at the last side yeah it's going to be equal to 3. um and so x is going to be you know equal to the on-chain state value of x and then we're going to assert that it's equal to x so this is kind of a confusing line what is this doing well um this assert equals it doesn't return like a true or a false it's just something that it has to be true otherwise the proof can't be generated you can't generate a valid proof unless x is equal to x um and so this seems kind of superfluous here it's just like a a best practice um but what it means is that if x doesn't equal x you can't generate a valid proof or i guess if this dot x which is you know the x from um uh um the s state variable uh isn't equal to you know the x in this scope it does it you know you can't generate a proof and so then uh we take x and we you know call the square method which is built into the field type um and then we assert that it's equal to squared and squared is the thing we pass in and so if we don't pass in the square of x the we just can't generate a proof and and you won't be able to send a transaction to mina and then what we do is we take x and we set it equal to squared so we set this state variable x equal to the squared value that we passed in and so again you don't have to worry about this code running um unless all of these assert equals are true the code will run on the user's computer but they just won't be able to generate a proof and so if they can't generate a proof none of this stuff can be committed to the blockchain so um yeah it's pretty straightforward in that way um so the state of the zika app is public unless it's stored as a commitment but that's pretty easy we have a hash function called poseidon which is really efficient and it uh yeah so you can just hash anything that you would want to store as um private state and then pass it in um and verify that the hash is is correct um in the middle of your method and then any arguments to a method are private unless uh they're stored as arguments you know directly and so what this means is that even though we're passing in a private key to admin it actually uh we're passing in a private key to update it actually does not matter because this private key never leaves the machine it's used to generate the zero knowledge proof and then it's not used again um so the update method in this case uh yeah calls git which fetches the state from the the uh mena blockchain and then we also assert that x uh let's see we assert that x oh yeah sorry um we assert that x is equal to its square and then we set that equal to the new value of exon chain um then we have sort of one more thing to do which is that we want to make sure that this can only be called by um the person who has the private key associated with admin um i'm sorry the yeah the person has the private key associated with admin so what we do is we can take in you know the admin public key and we uh i'm sorry we take in uh the admin private key which we pass in um oh okay i'm sorry we create a variable called admin public key and we set it equal to um this result of this two public key method on admin which is the private key that we pass in so you pass in a private key we compute the public key from it and then we set it to admin public key and then we ensure we assert that this is equal to the admin public key uh property in our zika app account and if it's not equal then we can't generate a proof and we just can't interact with the smart contract so um this way only somebody who has the private key for the admin account can use this method and uh when they do they won't be revealing their private key um so when we uh run update um nine with our our secret key um what we're proving is that we ran some code in the updates method with some arguments and the result was so this is all we're proving we're just proving that we ran some code with some arguments and the right thing happened um the result is that we'll set x equal to nine and um what we assume we know what we're proving with the zero knowledge proof in this is that x did or in order for zero knowledge proof to to work x has to be equal to three um admin secret key has to correspond to admin public key and then the delegate property on the account has to be equal to admin public key so yeah this is pretty much the anatomy of one of these smart contracts we have a field uh sorry we have state defined at the top we have a deploy method which sort of you know sets the contract up as we want and then we have methods that users can call and as a bonus really quickly one of the interesting things that you can do with me that you can't do with other blockchains that i kind of hinted at earlier is you can actually take some of this execution in a totally different direction so in the case of something like a game you might want to um yeah let users play a game without needing to submit a transaction to the chain every time that they make a move and pay gas fees and um you know wait for a block to be mined and so um this isn't possible on other blockchains because the smart contracts have to run synchronously or yeah so so on on mina you can actually build smart contracts that run asynchronously and this would look like uh i could you know make a move prove that i made the move correctly send it to another player they would verify that i made the move correctly prove that they made their move correctly and we would go back and forth until eventually we have one proof that represents the entire game that it was played correctly and everybody's move and then that proof could be submitted to mina at the end uh in order to settle the game and get like an nft for the winner or something so this is a you know a totally different approach the users wouldn't have to pay gas and they also wouldn't have to wait for for blocks um and this is just sort of one thing you can do you can do so many things so differently with mina and so if you're curious about it come talk to me after where you can get involved is we have uh yeah build zk apps make educational content and help mentor people uh you should join the zca app developers channel on discord it's cool it's full of people who are building ck apps and we have backward looking grants quarterly um so if you do good stuff we might just give you money um but not until you've done good stuff um you can learn more uh in the yeah the zika app developer discord is the best place and the docs these are the two places to go to but we also have twitter's for mena protocol and of one labs which you should definitely follow because there's cool stuff on them and that's it no time for questions and answers but we have a booth right in the middle come talk to me if you have any questions i would love to answer them all right bye guys thanks so much [Music]