Sidechains Are Not Layer 2 by Georgios Konstantopoulos (Devcon5)

thank you very much for coming so today we're going to talk about side chains and layer two and the talk is about like how they're different yet very similar in some ways my name is georges i do consulting and research on off chain protocols and my main focus on interoperability and scalability so the big question is like why do we want to interoperate and this is the answer there's a lot of currencies like they all want to talk with each other and if the multi chain thesis is to like survive in the long term we have to figure something out why do we want to scale so I just learned that there is a talk by Joel Rubin happening right now like when 1 million mixed herbs who cares about the devs what about the users so and there is no way to get the users like without being able to scale with like quick confirmation and quick low fees so let's go back to where it all started so blocks released this paper and like I think it's the first time that science was mention of the term turns out I'm wrong like this never happened the first mention of side chains was by Satoshi in 2010 which he mentioned on becoming talk as usual like that side chains to do in the Ribera building however what she actually was talking about was merge mining which is a completely different technique three years later we have Greg Maxwell a very prominent Bitcoin core contributor who described the scheme called the coin witness which was very similar which is very similar to what people call today is EK roll-up and then we have this guy called killer storm who actually described the first like sidechain construction by utilizing certain types of proofs so the two-way peg as described in the blockchain paper and by killer storm describes a mechanism by which somebody looks some money in an escrow and then VI peg in transaction you create the same amount of money on another chain and that is a side chain and in that side chain you may have a different rule set like maybe the chain progresses faster maybe TouchSmart contracts and then when you want to get your money out like you provide the burn transaction and then the people love that side chain they allow you to withdraw your money back on the original ESCO and there's multiple ways that you can implement that so like let's dive into it the main problem that we're trying to solve it like how we can observe another change state and convince ourselves that this chain that we're being shown is legit in Bitcoin that's very easy work hashes are very easy to reason about their quantifiable you can do some math and can figure out exactly how hard it is to attack the trick here is that however if the proof-of-work algorithm is very expensive like you need to be able to verify it and doing it with any fancier like proof of work algorithm it's very hard and you cannot verify a script for example on EVM and the way that you do this is we are I think all the SPV proofs the way that most light clients work and there is a very close like a interaction between sightings and light clients that I will get to in there very soon so instead of providing like the full chain you provide the chain of headers along with Merkle proofs of your transactions and what you're trying to convince is that the chain that you're giving is actually the longest chain this is too expensive this is too long it's linear I need to provide you like so that you're guaranteed that I'm giving you the best chain like without ever having any trusted checkpoint I need to give you Genesis a bunch of miracle proofs and you should be convinced that's way too expensive so there's some techniques called nipple powers the one technique called super block nipple powers by the only seasoned Rose and fly client by Benedict bones who should be around this area so you should talk to them about that snarks which berry-like alluded to earlier and stateless experience so stateless movies are not technique by James Parrott who's also round and you should talk to him about it the problem here is that all work is not equal if I have the Bitcoin chain with a bunch of hash rate and a bunch of physics and the theorem chain with a GPUs and like a different hash rate having an asset on the one chain and on the other chain even if it represents the same like kind of like collateral it's not actually the same and I have developed this mental model where I want to think of cross chain acid this is alloys so similar to how in chemistry like you can combine one metal with another and get some different properties I think I'd like moving a Bitcoin from the Bitcoin chain to some other proof of world chain perhaps like tokenizing Bitcoin unlike for example for faster confirmation times is an option but however like due to the difference in the hash rate you're no longer as secure as you were before so you can call that BBC 30 and what about the BTC X where X can be T BBC WBC you pick it some derivative off of the Bitcoin which tries to peg like the price to it and it's going to be used in d5 space for example however the Assumption here changes from like the honest majority of the miners to the honest Federation for example if you're doing a federated peg or like to the whole mechanism around it working so you have technical risk arising so it's solution has a different like trade of space there's no free lunch but about perfect steak side chains so prospects items like don't exist what about well steak like clients which the argument is that it's equivalent this is a proof-of-work block main liberal world chains many per volt blocks and you accept a proof-of-work block only if the hash of the block header plus some knowns that you change is less than the number so let's take this and switch this in the proof of stake situation you replace the nonce with signatures and you accept like the block only if the blocks that you have received have signed like more than two-thirds of steak so how does this look like how am I going to do a proof of proof of steak I will pick some blokes like every some amount of time I will check that each time the validator said would have changed in this proof of steak sidechain I would verify that they signed on the latest block this means that also of course it's linear because I have to give you still linear to the size of the chain blocks and but also the side chain smart contract or the light client must always be aware of the latest stake distribution because how will I know that who is the two-thirds that I'm receiving the money from their signature from there's an attack here which I want to call the cross chain nothing at stake attack which basically says usually in proof of stake change you have the nothing at stake problem where validators like start building on two chains and basically if you can take the data from one chain and put it on the other you can slash them like for equivocating for double signing however what if I have a chain like imma validate or I have a chain I'm building on and then I'm just having a hidden chain that I'm also building on but I'm not sending in to anybody except like clients the light client must be able to take the signatures that I gave them off out-of-band and put them on the on the main chain I'm not aware of any change currently that has this mechanism implement tender mint right now has a few documentation and has some documentation exploring this they call this if I'm not mistaken the phantom validator because like you're a validator but not really because you're sending stuff or out-of-band and the issue also with this is a long-range attack because what if how like you need to do in order to incentive align this mechanism you need to slash how do you slash if the person that fed you with like with the signatures is now unbonded it's complicated so like the rule that you must say that like you will only accept proofs like signatures from people that are still bonded you reject from unbonded violators how do you know which what letters are unbonded I don't know like currently the dominant approach is having a trusted checkpoint we are like so that you always know what is the latest like bonded set the validators this is an open problem there is many solutions there is many other solutions we can take but they all again they all like 10 to some subjectivity which does not exist in proof-of-work everything so far we assume that each chain is individually secure if we're both like if both chains are secured I'm sure you can do you can make them communicate with each other security and the likely requires that you have something that is high cost something that is high cost is not scalable that has high cost is not scalable so I can concentrate on what if the side chain like mechanism if you try to use it for scalability and if you try to use it for scalability inherently it will be less secure does not want you to get out so what if the liquid side chain suddenly becomes devil and like they say no but your money's gone we're done so we don't want that the kind of taxonomy that we have for side chains then means that we have them at the federated side chain which is the multi-sig Allah liquid the proof-of-work side chain which is with nipple powers for logarithmic SPV proofs and some reorganization proofs because as we all know I hope when you have a proof of word chain that Forks like you want to be able to punish for that pork and you have proof of steak side chains well you have basically a multi-sig which gets rotated each time the mistake changes during elections all ooh and you also add this am equivocation and the thing is that you trade always security for scalability if you want to use it that way there is a great paper list like last week actually by alexei and friends on communication of course the civil ledger right now they're doing a workshop on it which was very unfortunate to convert because it conflicts with this talk so make sure you read this paper to like elaborate on to conclude on my point about side chains and they're a better bill dissolution it's not a scalable solution you need an independent security model and the moment that you have independent security model my argument is that you're not in the layer two domain space it's a layer one that talks to that array once it's like on the same level how do we scale and what's gonna happen off the chain so party McCurry's around here like the everything that's working on like off chain scalability requires that you have a layer one and layer two and some mechanism to make them communicate you need to put the minimum amount of data on chain because the chain has a finite amount of space and if you're going to support 1 million s debs you're not going to be able to hold all that capacity and maybe the theorem 2 is going to do it but what if it doesn't so what what's layer 2 so I call it a bit late settlement protocol with layer 1 guarantees so you have a protocol well you look some money on the layer one then you perform some of chain operations and then you have guarantees that are like equivalent to your layer one security model that you'll be able to get your money out and there's two like dominant approaches right now which is the commit chains approach which is like what plasma is roll-ups no cost and they have like some certain different trade-offs whether they can do smart conduction on various channels and the dominant channel approach is the lightning for Bitcoin and as far as I can tell there is some state channels initiative which like everything emerged and could this to them because it was a very hard task so and they have like different properties but we're not going to talk about channels in this talk so let's dive into they're comedians so firstly we had plasma like 2017 with Dalek Joseph they published this paper noting the paperwork and it describes basically a mechanism where you have an operator that takes hashes of the sidechain and it puts them on the layer 1 but and the security of the commit chain or the plasma like it comes under the assumption that you're able that anytime that like something bad happens you can take some fraud proof from the plasma change state put it on the layer 1 compare it to the hash that was committed earlier and you can get your money out like within some time and it has some synchrony assumption that like you you must be able like to get your money we did get the fraud profane within a week's time or two weeks time so this is like a single new assumption that very security oriented folks will argue against but again that's not the topic of the talk the problem with the plasma construction is that the operator it's at their sole discretion to give you the data so what if they don't like you have some state they create a metal tree of the state or of the latest you take so they committed but they don't give you the data you have a problem then because in certain they can come back they can create an invalid state transition and this invalid state transition will never be revealed and like you will never know that you no longer have your money so there have been like changes too lately to the plasma like protocols to fix that and it turns out that maybe yes maybe plasma was a premature optimization maybe like many people might have raised money on plasma on something that might be broken what can we do that's how the commodity will move forward so how are we going to solve the data availability problem we cannot so what we're gonna do instead of having obtained data a fraud proofs will put data on chain with fraud proofs and that's what we call optimistic roll-up and this is what they're currently equipped economics lab and the plasma group teams are working on which is basically that you take all the data that is off chain you create a smart like encoding of them and you dump it on the cold data of the layer and that's kind of cheap because the data is not part of the chain it's just part of the database like here and the other people that are working on this like another like independently like thought of construction was called meds consensus by Macario and john adler which basically says what i just said you have to commit like all the like the metal route and also you put an encoding of the transactions and you use basically the layer one as a data availability oracle and then if you plug out the flood proof and you put the validity proof as snark stark like whatever you want whatever they call it these days you have a sneaky roll-up like and i'm saying this like just so that we can get over the word salad and like understand like that the bits and pieces that make a mechanism Ziggy rollup means that you have the commit the numerical route of the latest state or the transaction that happened you take their knowledge proof which are tests that this state transition is valid and you put it on chain the smart contract verifies that the state an additional valid with movement the problem with this is that maybe you need a trusted set up as we saw in static September where like five new snarks were like released maybe we can remove the trusted set up but I wouldn't build all cryptography that was released on 2019 and they can be expensive like proving times are expensive verifiers all are so expensive and they can be slow so again no free lunch and and not only on training data availability because it has been like like pumped as an idea that like it's gonna solve all our problems I'm not a fan because the blockchain is supposed to be the verification layer the blockchain is not a file storage like and file core in another change that are going to do that do not exist yet so we know that like this is a hard problem and maybe one gets all the solutions all via data will abate the problem like will give us the ability to do like define all the other likely use cases that we're trying to figure out for this industry on the layer too cheap and fast but like the untainted availability reduces your scalability benefits like you cannot have like infinite throughput like with the other layer tools because again you're bound by the layer ones capacity so it's really a constant size improvement and also it's parasitic in my view by parasitic I mean that like the moment that you start utilizing the change so heavily what about the other apps that are not on your layer to your roll-up or whatever you call it em are they all going to come to your roll-up like I think that's - like ambitious and there is a post by vitalik recently where he like elaborates on this and he's a fan about this idea which yeah some takeaways from this I from this talk is that we know how to do both proof of work and proof of stake side chains it's hard to implement them and you need them to both be individually secure and having an honest majority assumption for more than one layer one is hard as we have seen for multiple layer 51% attacks on smaller light chains layer two inherits security from layer one and like I have a small taxonomy of like what goes where I'm a fan of the like direction this is like the current direction that we're going it seems but we should be like very skeptic about how much like we're just dumping on the layer one because nobody can sing in a three-room full node and this is not going to help with it the conclusion is side chains are for in their ability layer two is for scalability side chains are not layer two thank you very much and I'll be happy to take some questions for three minutes and also the I I should cap changes we can find a thought at scaling at side chains 2019 dot PDF there is a microphone if anybody wants to do a question we have hi thank you much for the talk so you gave I think very detailed criticisms of both layer two and side-chain solutions without highlighting too much of their positive aspects what solutions are you actually fund of I'm fond of the plasma construction for simple state transition for payments because this industry solves payments and I'm happy like if I can get a construction that can do multi-sig time looks like and that's it and plasma does that fine right now plasma for simple payments I I do not care much about smart contracts like smart contracts multi-sig time locks are sufficient okay thank you thanks for the breakdown one thing that you didn't talk about which I thought would be interesting to hear perspective on is hybrid approaches for roll-ups so where we use you know proofs of work from other chains to make the data availability there but do the fraud proofs on another chain right so with if the question but I have a rollup where I don't post all the data on chain were only for specific States so it's using availability from something other than the l1 that you know I do not think that's good because your security model change is wildly the security model that I want as I have a later on I know exactly how secure it is I know that I have the Bitcoin chain it has this much censorship resistance this much capacity I can dump all this data the moment I'm going to use Bitcoin cache as a data availability layer which is what you're like talking about means that like I have to trust between caches miners and do you know how is it is 2 percent or fifth cone cache very easy like 10 percent of bitcoins - wait so no like one chain for if you're gonna dump data somewhere dumb become launching in my view ok ok thank you so much [Applause] you