Building Web2-Style Privacy Into Web3 | Sarah Schwartz - ZKsync & Matter Labs

[Music] thank you um yeah so my name is Sarah Schwarz and today I'm going to talk about building Web Two style privacy into web 3 so just to start a little bit about me I'm a developer relations engineer and I started building in web 2 and I think probably like a lot of you when I started building in web 3 I started with smart contracts and with solidity and I sort of had to go through this like mental shift of like what how I thought about building um there I had a lot of ideas of like oh wow this could be you know a really cool idea for a smart contract but then finding out later like um oh there's you know different constraints and really hit with this like nothing is private on ethereum I had all these ideas of like wow you could you know make some games that have some privacy on chain and you know it's all decentralized but you know okay I had to take a break reprogram like how I thought about building and you know tackle some different ideas that were more un line with this reality here um and so yeah basically just sort of breakdown of like switching from web 2 to web 3 going from like everything can be private if I want it to be um but nothing is verifiable or trustworthy by external parties um to this like having to trade off if I want verifiable stuff it can't be private on chain uh and so like what is that sort of Stack look like visually um so like this web two Builder is super happy you can fully control every part of the application um but kind of sad no one can verify it and no one knows I didn't tamper with it on the other side um Now using web 3 like your basic web 3 stack um anyone can verify this St but it's 100% public there's a lot of parts of the stack that I don't control and I you know it's there's a lot of limitations there and so where does that leave Builders um you sort of have to choose at least one option uh from what it seemed like um you have to choose a privacy Focus chain that requires some TR level Trust In The Operators or you have to basically make everything private like fully encrypted even to the dev so you don't know what's going on um or you just end up using some web 2 solution right but what if you want something more like web 3 what if you're trying to build an application that's a little bit more like web2 but have that verifiability um something where you could make anything private you can still have full data access for the Developers for analytics um for compliance you can easily edit what's private without redeploying contracts and then it still settles on ethereum it's interoperable and use like standard solidity contracts so that's what ZK stack enables or that's one thing it enables um ZK stack is basically our stack for all chains uh in the elastic Network and we really think that Builders deserve the option to build anything um and there's a talk about this earlier but what is the elastic Network it's basically um a we're calling it a rollup cluster where it's like a bunch of l2s that have like a shared Bridge um they're all interoperable with each other they all use the ZK stack um but they all can be sort of customizable for each chain so if like one chain wanted it to be you know fully private they could or like ZK sync era is just you know a rollup where everything is public so this is yeah basically you can get the best of both worlds here with um a ZK app chain that uses a validium and custom RPC proxy U I'm going to get into that a bit later um yeah you can have private data and it's fully verifiable on chain composable with ethereum um and basically as a developer you can control the entire stack you have your own chain that is you can customize your contracts your own RPC proxy layer and authentication layer and it's all yours um so just to Define some of these terms uh what's a validium essentially it's like a a chain that doesn't Post Its data on chain uh what does that mean basically like all the data on chain doesn't get to other chains it doesn't get to ethereum it's private and then what is an RPC proxy it's essentially like a middleware server that sits between the client applications and the chain node and that's where the like authentication would happen just like in web 2 okay so what exactly stays private right like what's the catch um so with uh validium chains and ZK stack only the state root hashes are public so actually all of the state is and the balances can be fully private um the private balances only become known if they're bridged to a rollup chain but they can actually be bridged to another private chain and stay 100% private um okay so how do you actually build this I'm going to go through like a really quick you know Workshop of like here's how easy it is uh we have this CLI called ZK stack and it's really easy to install and it basically um is everything you need to like launch this local chain um so you can just run this ZK stack ecosystem create command it will create basically like a little elastic Network on your computer where you can create different chains and it will ask you some prompts when you're setting it up for this is where the customize part comes in where you can choose like okay here's the the chain is called my game chain I have the chain ID here I'm setting the data availab availability as a validium uh I can set the base token for different fees so I could actually make my own erc20 that I could use for fees on this chain um and yeah so and then at the end it asks you if you want to start the containers after creating and those are Docker containers so once you run this command you have like some Docker containers running um basically this is like your uh local L1 like ethereum node and then a database um for your train oh um and then one more uh command to run which essentially like initializes your chain and basically just start your server like local server so you imagine you have like your ethereum server and your validium chain server running right now and um next step is so like you have you know with this local ethereum node you have some rich water wallets that are already preconfigured on that Network so the next step would be to like Bridge some funds over to your chain um so this uh this is just using like the these uh local endpoints here so our Chain's running at Local Host 3050 and the L1 is at local hosta 8545 and another piece we need is a contract verifier so this is like another server running basically so you open up a new terminal and just run these commands and then you have like your contract verifier set up for your block Explorer and okay I know this is too small read but basically this is what the configuration looks like for when you're deciding like what is private um and this is all like not on chain this is basically your RPC layer right here and this is um you know a this is not part of ZK stack right here this is actually a custom implementation done by our friends at Moonson Labs they're um contributors to ZK sync and uh yeah they basically just made this um sort of config where you can like put in a function and here this function I have is like get player boards um this is an example for sort of like Battleship Style game that I made like onchain um so you're inputting like the player address and the game ID it's returning like information about like where the the ships are on the board um you have this sort of like constraints here where you're saying if you're reading this function it's a read function um then you have to check the argument at index zero which if you notice that's the address player and essentially it's just some custom you know authentication code here going on to check like okay whoever is calling this function is the player themselves and yeah you can basically make up whatever rules you want here and so for to make it public for everyone um just to be able to get like the game ID or yeah number of games someone's played you can just decide that's public so none of this is in the smart contract right this is all something you can change just in the RPC layer so if you wanted to you know for whatever reason make this private at some point that's totally doable without any like loss to your uh contract State and then this is sort of like what's happening in the back ground here is um just sort of like the RPC layer is just cycling through these uh config rules and you know like assigning different handlers to the the responses so if it's public it will create this public rule um if it's this check argument uh constraint which we had here then it will yeah check essentially parse that function signature um pull out that uh argument and check that the argument is equal to caller um okay so like what does it actually look like on a block Explorer like how is this private um so this is uh the example that moonsong Labs created they're called it D zero but essentially like a block Explorer where you there is this level of authentication um so you have to log in to see any transactions and here's what the login page looked like looks like so um it's kind of interesting it you can't just connect to the open RPC Network like that uh 3050 Port we have is fully open actually and you wouldn't want to share that because yeah um anyone can connect but we have like this other customized RPC URL that generates a token for each user um and then this like provides the authentication for that so to connect they get this custom RPC URL with like their token and then they can connect to metamask through that um and then what does it look like on the Block Explorer um so this is two showing like two different players playing the Battleship game like against each other um instead of ships I called them Bots whatever but you can see like you're starting the game placing the Bots and hacking them and you can see this contract has nine transactions total but each player can only see their own transaction um cuz that's what we chose in that privacy config that like the player has to match um you know the that first argument for those read functions um so yeah this player can see four of the transactions this one can see five and that's all the transactions for that contract um and the balance of the contract is also like restricted you'd have to configure like um some sort of admin owner or config figure access to that as well um all right so yeah what are some use cases for this um this is an example of like a private swapping application um that Moonson lobs built um so you can see like some things we can we do on chain already but maybe we would just like them to be private um and then this is the sort of like Battleship Style game I made is called Bots attack but you can see like there's these other use cases is where basically like the use case requires the Privacy right like you can't play this game if everyone knows what the opponent's board looks like um it just doesn't work um so yeah trading apps um games like poker and Battleship and other games that require privacy um I think are really good use cases for this personal data trackers um Banking and exchanges private subscriptions uh social and dating apps uh B2B payments you can imagine all these apps exist today in web 2 and they're just using like you know they're using yeah basic web 2 Tech they want to be able to keep um some of that privacy like for sometimes it's the use case sometimes it's just about like okay this is our data and we want to be able to do what we want with it um so this sort of yeah this option basically provides this like middle route where you're like okay not a full-on like you know web 3 D gen where it's like everything's going to be private like tornado cach style and like there's no no one can tber with it this is sort of like a middle of the road like what if you want a little bit of both and you want to just build something like you know whatever you want and it doesn't have to fit in these tight constraints of like Web Two or web three U so yeah ZK sync is the endgame um I have this QR code and a link tree link and this have like link to all the slides um a full tutorial for like how to build the private chain locally how to build the Bots attack game specifically um and yeah just more info about ZK stack thank you