Mina zkApps 🛠 Zero-Knowledge Programming with TypeScript - Jack Servia

foreign [Applause] [Music] hi everybody and welcome to our presentation on starkeyjs and the media protocol uh thank you for being here and uh I'm Jack servia I'm a developer relations engineer at Overland Labs which is the company that incubated the Mina protocol so you can kind of think of a one as like consensus to ethereum or as Mina Foundation is ethereum foundation to ethereum um I'm based in Denver and here's kind of what we're going to go over today so first we're going to talk about snarky JS which is the Smart contract language for the Mina protocol and kind of unique for a bunch of thing reasons we'll get into and then we're going to go through an example where we build a simple smart contract that you know uh verifies that the number you pass in as an argument is the correct uh next number in the Fibonacci sequence then we're going to make this recursive which is something we'll kind of explain why that's cool later but it basically allows you to do a lot of stuff off chain without any additional security assumptions then we'll talk about the Mina protocol which is sort of like a meta version of this it's like a settlement layer for these uh zero knowledge applications and then we can talk about where to learn more and open up to questions and answers um so snarky JS it's a typescript library for defining zero knowledge proofs and it's also the smart contract language for the Mina protocol uh it looks like this but don't worry too much about the code right now we'll get into it more in a minute everything is in typescript so you can keep using the tools you're familiar with uh like prettier npm vs code uh eslint Etc and it's really easy to learn it's actually so easy to learn that you can probably figure a lot of stuff out just with intellisense if you look here we have you know an example of uh kind of a funky looking decorator and then a really good explanation of what this is so you can just dive straight into it and it's also extremely powerful so uh this is for two reasons one is our proof system which is something that we've built in-house it's called kimchi and and uh it has a number of features that make it really well really well suited to a kind of application like this uh it's fully trustless setup so there's no ceremonies uh we have custom constraints for Poseidon uh which is a hash function that's particularly efficient in zero knowledge proofs um elliptic curves and and encryption uh we also have constant proof size uh that's why ovon Labs is called ovon Labs um and it's recursive which means that we can generate a zero knowledge proof of something and then we can actually verify that zero knowledge proof inside of another zero knowledge proof and so this opens the door to a whole bunch of new architectures for things that can increase scalability user experience and and of course also provide privacy um finally it's plonkish which means that we can add new features like Dynamic array access which is something we're working on um so kimchi is you know mostly we should kind of not be something you have to worry about too much but just sort of know that we've put as much horsepower as we can into into snarky JS um and so the other side of what makes snarky Jazz so powerful is that is actually the language itself um typescript method chaining allows developers to think through their programs in a very linear way especially compared to to other zero knowledge proof sort of paradigms and so we can sort of see what this looks like here we have this pool is correct color we can just call and on it and pass in you know the thing that we want to end it with and what we get out is is another bull is white Peg uh and if we want to do something more complicated we just chain these methods together and so this makes it very straightforward think about this is my data this is what's going to happen to it and then this is sort of uh what's going to come out and it makes it easier to make sure that everything that you're doing is is being sort of proved correctly which is a it makes it easier to write code that's secure basically uh we also have custom circuit values and and these have actually been uh we're in the process of possibly changing this to something called struct you can go look at the GitHub and read the RFC for this and and uh leave comments if you want but for now I'll explain how circuit value works struct is largely the same thing just better but even circuit values are very cool and so these provide a layer of abstraction that makes data much easier to think about than it might be um otherwise what this looks like is uh we can take um in zero and all truths everything fundamentally because of the cryptography has to be represented as something called a field element which is just a it's sort of like a un256 with some special properties um but it's required by the underlying cryptography and so trying to represent a more complicated data types in other zero knowledge roof languages can be quite hard snarky.js makes it fairly easy with this circuit value maybe soon to be struck which allows you to basically describe a way to turn normal JavaScript values you know normal JavaScript variables numbers strings whatever into fields and then take them back from Fields um into into something you can work with and so this in this case we have defined one called pegs and this represents Four Pegs in a board game and we can work with the sort of just the same as as uh as you'd expect finally plenty of the stuff that you need is already implemented in Starkey JS um what we have today is support for a bunch of different uh types that are built on top of this field type so the field type can be a little complicated to work with sometimes but what we can do is we can actually compose field types into other things that are more familiar and so we have types for un64 U and 32 and 64 group pool scalar public key private key signature and more coming soon including hopefully string pretty quickly we also have efficient Poseidon hash function which means that we can do hash evaluations very efficiently in Starkey Jess and this opens the door to things like big Merkle trees and other kind of stuff like that we have efficient encryption and decryption so you can do things like take data um well actually we'll jump back to this in a second uh we have signatures uh Merkle trees are supported in the experimental API right now which is just a namespace in the API that has stuff that's bleeding edge and we have the recursion API which is something we'll talk more about later in this presentation um signatures and encryption and decryption are unique and I'll just sort of call them out now because what you can actually do with this is like take a value from a trusted Source they can sign it and then you can pass this value into a zero knowledge proof verify that it was signed by the you know the trusted party and then you can augment it in some way so you could do something like prove I am not a citizen of the United States I'm over the age of 21 and I'm not ofax sanctioned or you could prove the opposite it's up to you um so why did we choose typescript this is kind of a common question and the answer is because we're ecosystem focused so the idea is that people who want to work on tough cryptography can do this and they can put their stuff in you know npm libraries very easily and and then people who want to build user facing products can import this and and have access to a whole lot of power really quickly we want to kind of get both of these two groups of people working together in order to you know sort of uh really push forward a new class of applications um we're looking for code reuse that's as high as it is in the JavaScript ecosystem um thing uh that I think is worth calling out is that if typescript sounds a little bit like a what would you say like um some people have maybe a problem with typescript if you're writing your front end um writing a snarky Jazz smart contract is is only nominally more work uh so how actually the smart contract works is uh actually I'm sorry we'll dive into this a little bit more later I keep getting ahead of myself for now I'll just stick to this so this is snarky Jess uh we've been through all this um how does it work well here it is in five sentences it's a typescript library all the information is represented in one of the starkeyjs compatible types so these are all composed of the field type ultimately but like you went you know we know how to turn that into field so everything is under the hood fields or an easier way to work with Fields one of the circuit values that's composed of them starkeyjs provides classes and functions that are compatible with the field type or these circuit values that are composed of them so we can do things like add two numbers together um but not only can we add the numbers together we can prove that we add the numbers together correctly without revealing what they were um and and this is sort of this next thing so Starkey Jess after we've written our program it can represent any operations on the field type as what's called a kimchi arithmetization which is basically a math problem that represents the um the program that we wrote and this is important because the zero knowledge proof system is itself kind of a math problem and so we need to turn everything into math in order to be able to prove that we're doing what we say we are um and then finally a user that interacts with the snarkyjs program can generate a zero knowledge truth that their interaction was legal and this opens the door to a lot of cool things one of them is snarky Jazz smart contracts on Mena protocol which we'll dive more into in a little bit so uh in this Paradigm developers write smart contracts in typescript and they deploy the verification key to a ZK app account which is just a specific kind of account on the Mina protocol what this looks like is you know we write our application we send a transaction with the verification key which is just an artifact that's generated um it's you can think of it as sort of like a commitment to our code with extra features what is it which is that we can use this key to verify zero knowledge groups that we generate for this code and only this verification key lives on Mina so then the user will run the smart contract in their browser and they'll generate a zero truth of their interaction you know proving that it was allowed and then they'll send this proof to Mina and and if Mina will check it against the verification key that's stored on chain and if it passes then the transaction goes through and if it doesn't then it fails um if the transaction does go through then it commits any of the relevant State updates that were associated with the proof so when we do something uh with a mean a smart contract uh the smart contract is sort of getting in as arguments the arguments that the user passes in some smart contracts State you know this is the state of the smart contract prior to the user interacting with it and the you know some values from this state of the world this could be like block height um and so the smart contract would actually run in the user's browser the user will get all this information themselves they'll pass it in and they get a proof out as well as the new state of you know whatever value they were interacting with so if I want to send you money I can literally just say I'm going to basically write to your token balance and here's the proof that I'm allowed to and that's all that's needed um that's a rehash of that so how do the ZK apps work well you install your smart contract in your UI um and then you deploy it and that's all and so yeah you can just publish your uh smart contract on npm or GitHub or wherever you can just npm install it import it like you would anything else and and it's a part of your UI it's very straightforward um so now we'll kind of get into an example and uh this is uh hopefully everybody is familiar with like the Fibonacci sequence if you're not um it's the last two numbers in the sequence added together equals the next number in the sequence so one and one two two and one three so on and so on um you know three and two five uh so we'll write a smart contract that calculates the next number in the Fibonacci sequence and also don't worry if this goes a little bit uh will be at the booth we're upstairs on the second floor in the corner and uh if this is sort of uh obfuscated at some point come talk to us and we'll make it clear um but the point is now just kind of broad Strokes so we'll have two pieces of state that we store in the smart contract this is going to be n minus two and N minus 1. um these represent the last two numbers in the sequence if we have a method so we'll also add a method update which will let us update n minus one and N minus two if we pass in you know the correct number the next number in the sequence uh so in order to do this all that we do is we extend this smart contract class into something called Fibonacci Sequence and now we have a smart contract called Fibonacci sequence then we add some State and we call it n minus 1 and N minus 2. we set it to the field type and we use the state decorator which if you're not familiar with typescript decorators again come get us they're not too hard to get your head around um but what this basically tells snarky jazz is hey when a user Alters this value uh figure out how to store it on chain and prove that we're updating it correctly and so these numbers will be stored on chain yeah the next thing that we have is this deploy method this is a method that gets called at the time that the smart contract is getting actually deployed to the chain which is at the time we're calculating this verification key and bundling it up into a transaction and sending it off to the chain um you usually don't have to worry too much about this uh the defaults work nicely in most cases but in this case we're going to use um the this deploy space uh to initialize the values of our of our state variables um and you can do other things here too like set permissions uh again we won't dive into it too much but all that we do is we call you know this n minus two uh and then we call the set method on it and we pass in a value and in this case we're passing in field.0 don't worry about this dot 0.

1 you can also pass in You Know Field open parentheses one close parentheses it does the same thing this is a confusing um uh kind of artifact that exists right now um so uh next thing that we do is we Define a method that users can use to you know interact with the smart contract and we just call it method I'm sorry we call it update and we add the method decorator and the method decorator basically says hey um this is a thing that users are going to call when they do prove that they're doing it correctly we can pass in an argument and that will be the next number in the sequence and what we do is we grab n minus 1 and N minus 2 for mod chain State we store them in local variables then we add n minus 2 to n minus 1 and we check that the value that we passed in as an argument is is equal to this edition of these last two numbers in the sequence and so this assert equals uh it actually means that like you will simply not be able to generate a valid zero knowledge proof if if new state does not equal n um and so there's no way for a user to call this unless they're passing in the correct argument now what's really cool and I don't know if this was sort of clear by now or not but the value of the argument that the user passes in and all the computation they do is private they don't ever send it out of their browser unless they want to so uh the only thing that that is public is the you know the on-chain state and and you can build a lot of private applications very easily by storing a commitment to something private in the form of uh like I don't know hashing some private value and storing the hash on chain um so yeah we can uh I guess it's not useful in this case we can prove that we know the next number in the Fibonacci sequence without well in this case I guess we do reveal what it is um because it becomes n minus one but you get the picture there's a lot of cool stuff you can do with this um now uh the final thing that we do is we set these on-chain states to uh you know we move n minus one to n minus two and and we move the the new state to n minus one um this is pretty much the basic structure of the smart contract we have you know a we extend the smart contract method we add our state definitions uh deploy method and then we add the the user callable methods and add the method decorator to them so what's really cool about this architecture is that we can actually make this uh recursive and what this means is that right now the current Fibonacci uh program that we just built um this every time a user wants to interact with it they they or every time a user wants to do something they basically have to create a transaction send it to Mina pay the fee and wait for it to be mined um this is what's really cool about recursive zero knowledge groups they allow you to move away from this in really interesting ways so um we had smart contract but we also have ZK program and ZK program is what it sounds like it's it's just a zero knowledge proof program as opposed to sort of a zero knowledge proof program that's also a smart contract and so we can do is we can write a ZK program that actually takes proofs as inputs um so the ZK program we run it and we get a proof out and that proves that we ran the ZK program correctly as well as the outputs um but we can actually also pass these proofs so we can pass proof that we ran a ZK program correctly into a ZK program and this lets you uh scale in really cool ways and so I won't dive too much into what this is now because I think we'll be a little bit short on time and I want to get to mina which is really the sort of important part of this um but uh to give you an idea of uh why this is useful we can basically uh uh yeah so we can uh would you say we can prove that we have a number of the Fibonacci sequence and we can take that proof and pass it into um uh an another proof that verifies it and so this can be useful for something like let's say we wanted to make take a moving average of uh values over like 20 years we could do is we could take the moving average for the last 10 minutes prove it and then take the moving average for the next 10 minutes prove that but in that proof we can also include the computation that verifies that the first proof is correct and we can do this over and over and over again and we can just keep one proof that attest to the fact that we've had been keeping a correct moving average for you know 20 years or something and it stays you know it stays very small the other thing you can do is you can create uh like well we'll get into it in a second um so uh how does this work well you write your uh ZK program or sorry you wrap your CK program inside of a proof class and then you pass the proof as an input parameter to your ZK app to verify that it's correct um again this was kind of fast we went over this really quickly but if you have any questions seriously come by the booth and stop us we'll help you get started building something or uh you know just answer any any questions you have so this kind of brings us to the you know the the climax of the presentation which is you know what is Mina um and actually wait I'm sorry I'm going to go back I know this is very non-linear um but another thing that we can do with recursion um uh is we can build uh smart contracts that execute largely off chain and so an example of this is like let's say that we built a game um and I don't know if anybody has heard of the game Mastermind but this is a tutorial that uh we did a while ago we have uh um or sorry not a tutorial a workshop that we did a while ago and we have it recorded and so at the end of this presentation there'll be a QR code that will take you to a bunch of relevant links and and also that um and so this is a game where it's limited information so I can't know what my opponent is doing but I have to know that they're making legal moves um and so this is a game that would be very hard to build on a normal blockchain it's very easy to build on Mina but it goes a step further uh if you build it in the naive way you have a game that you have to you know send a transaction to mina every time a user wants to make a move but using recursion we can take this and we can set the game up in such a way that I will make my move I'll prove to you that it was correct and then you'll make your move which will also verify the correctness of my move by verifying the proof and send your move to me proving that it was correct without revealing what it was and we can do this back and forth so on and so on without ever having to pay ease or wait for a block to get mined so the user experience is literally like it would be in web 2. and at the end we have a proof that it tests to the correct computation of all of our whole game and then that can get you know settled on chain um so this is obviously really good for user experience um and also really cool uh so okay now we're to the you know back to where we were with what is Mina protocol um well it's a layer one blockchain that proves its entire finalized State using recursive zero knowledge proofs and because of that it stays small you only need 22 kilobytes in order to verify basically uh that the current finalized chain state for an account is correct and and uh this is cool but it's also really useful um for quite a few reasons one is privacy as we said ethereum spot contracts found on every node so all the information is public uh here's what ethereum looks like Mina smart contracts run in the browser and so arguments and intermediary values are private by default um again managing you know keeping the state private if you want to can in many cases be as simple as just hashing it uh so what does this look like we do the stuff we want to do in our browser then we just send State updates and approve that's it Mina verifies the proof and updates the onstain on chain state if it's correct next scalability there's no gas model zika apps run off chain which means that the amount of computation does not affect the transaction cost you can do in theory an unlimited amount of computation in a single Amina transaction you can also do them asynchronously watch this presentation isn't about but is another pretty cool feature uh so yeah you can run smart contracts asynchronously on me now um again come to the booth and ask if you're curious about that uh so developers can use recursion to build application specific Roll-Ups what are these um oh well uh they're what we talked about earlier I think I kind of forgot the order of some of this um yeah these These are applications where only the parts that need to be verified on chain are verified on chain in many cases you'd actually don't need the chain to sort of verify what you're doing like if you're just interacting with one other user in a game or something really you only need to prove to the other person you're playing against that what you're doing is correct as long as you can eventually prove it to the chain and so this is uh a door to some really interesting stuff um decentralization uh it's possible to validate the entire finalized mean estate using only a small zero knowledge proof uh and and so um what that means is that there's no need to rely on trusted third-party node operators like inferior um right now chainsafe is working on an implementation of a wallet that will basically be uh of a full meaning node um you know no additional security sort of concessions um and how it works is that it just uses the zero the zero knowledge proof to verify the transaction history right with Mina we do some stuff we prove that it was correct so all the transactions are zero knowledge proofs and then we take these your knowledge proofs and we verify them inside of another zero knowledge proof and inside of that zero knowledge roof we also verify a zero knowledge proof that uh represents the last batch of transaction and and that one verifies a zero knowledge truth that uh is also verifying the batch of transactions before that and so on and so on and so what we're left with is one zero and all proof that represents the entire chain history and uh and and proves that uh it was legal for us to get to the place that we got to basically and so then a wallet um can just with this 22 kilobyte stub verify that the proof is correct and and no um you know that things are right it doesn't have to grab all the previous data and sum it all together like an ethereum node does uh this is really cool also because of bridging uh so smart contracts on other chains can Bridge the entire mean estate just by verifying the most recent proof to get into what this means a little bit more um you can write a smart contract on another chain and as long as that smart contract can do the math to verify uh the mean of zero knowledge proof then you can be sure from within that chain that uh whatever State Route is associated with that zero null truth is the legal mean estate route um for a given block height and uh and so the nil Foundation is working on one of these Bridges right now they have a demo working on one of the ethereum test Nets um but it really does work it's it's uh you can go play with it here um and the result of this is that there's no you know like Quorum of there's no multi-cigs there's none of the really confusing stuff there's none of the really hackable stuff there's just um uh basically a smart contract anybody can interact with it anybody can go grab the mean estate anybody can send the mean estate to the smart contract pay the gas fees and in one block uh you have got the whole most recent State bridged over uh finally oracles um we're working on a product called ZK oracles right now and these will allow users to create TLS uh proofs that bridge data from any website onto the mean of blockchain and so when you go to websites now you get a little lock inside of your browser this means that we did this thing called a TLS handshake it's like a a thing that allows you to know that you're talking to Amazon and Amazon is talking to you and that nobody's in the middle listening to what you're saying and uh the problem is that it's interactive and so it's only the the protocol only really proves anything to you and to Amazon you couldn't send it to ethereum because it's interactive ethereum would have to sort of interact with Amazon for it to work that way and so is your knowledge proofs we can use this interactive sort of uh protocol and make it non-interactive um and the result is that I can prove that I went to my bank accounts website or my bank's website and uh basically I can prove that like the person at usbank.org sent whatever they sent to me um and that nothing has been tampered with and this is really cool because then we can take this information and we can do something like then augment it so I could get all this really personal information prove that it really did come from U.S bank and then just have a Boolean that says does Jack have more than one dollar um and uh and get a proof that just says Jack has more than one dollar or Jack doesn't and so you can make the information uh you know sort of as private as you need it to be and no more um what else well we actually don't really know everything that's possible yet and this is what we're hoping that you guys here will help us figure out um there are so many new ways that we've found that we can do things uh that we would not have thought of you know even six months ago and uh yeah that's uh what we're hoping to get out of hackathons like this we hope that you guys try new things and uh and and yeah find new ways of of uh of doing things that leverage all of this sort of new uh flexibility so what makes me in a protocol unique all this stuff um where to learn more um how do I get started uh okay yeah so yeah how do I get started uh well all you do is mpm install the zcap CLI and ZK project it'll start up a repository with a scaffold code a simple contract that will add two numbers together and that's all that you need uh the zcap CLI is our only piece of developer tooling it's very simple it's very straightforward to use and it's very powerful uh it uh um yeah so if you want to get started just do this there's nothing more really uh it should take one minute and you can even uh deploy to uh Berkeley test net which is our uh test net uh I think we have cards at our booth that we'll explain how to do that again should take no more than 15 minutes to get started uh where do you get involved well we have a well Mina Foundation has a quarterly grants program uh so uh you can get grants by uh building CK apps creating educational content or mentoring and so these are backward looking grants so just do Google stuff and then maybe you'll get a bunch of money um or some money um so here's a QR code if you scan it we've got a links to a bunch of the relevant stuff from this presentation um we also have our docs website which we just revamped like maybe a week ago it's a lot better now we have search and and some other stuff that we've been kind of putting off for a little bit um we have the zcap developers Channel and Discord this is a really great place to to meet other people who are building stuff um here's our twitters all right well thank you so much guys foreign