L2’s Centralized or Censorship Resistant - Zachary Williamson

cool hi everyone um yeah i'm i'm zach uh i am the ceo of aztec um uh for those who don't know aztec is a um uh a privacy preserving layer two uh built on top of ethereum so we our goal is to both scale ethereum and make it uh private by default um enabling the uh awesome uh innovation that we're seeing in the in the current space but where we don't have to sacrifice um uh uh privacy or where we can all keep control of our identities and i want to talk a little bit about the state of latin specifically um uh zero knowledge relations ones that are secured by zika ziggy snarks against stock proofs and uh how like where we are currently with regards to like are these things decentralized or centralized and um how how do we decentralize this this like rather critical infrastructure um uh as we as we evolve the technology and basically um are we sleepwalking into some uh somewhat severe centralization issues that could threaten um uh the web free ecosystem and what to do about it uh so i guess i think a question that's on a lot of people's minds um uh who who are kind of are aware of the history of web 2 um and the kind of the the the the cypherpunk movement that that created web one is um how do we avoid repeating the failures of web 2 because webster started out with a very very similar narrative to web3 the idea is you have this permissionless decentralized network that anybody can access anybody can use and it was going to be an incredible liberating force um it was going to be the information super high it was going to educate and emancipate the human race but the reality of it is that whilst obviously it's been a transformational technology we live in a world where services are hyper centralized and the monetization model i would argue is predatory against individuals because instead of users paying for products instead of using the customers um users of the products themselves uh they're commoditized their data is being harvested by these centralized entities like facebook like google and being sold to the highest bidder and it's causing some rather uh some other severe problems in modern societies and so web 3 is very much like a reaction against that and but how do we avoid falling to the same mistakes as web 2 as well one and also how does this involve their twos and how can how are layouts use both a a solution and potentially a cause of um all of life's problems but before we're like talking about like what could go wrong i think i think maybe it's worth talking about well what what what we mean by things going right like what are the win conditions of web 3. obviously these are going to massively wildly vary um from person to person but i put i've put up some like some i think quite modest goals here you know i'm not talking about uh you know i'm stripping nation states of their ability to control their currencies uh um like at a very low level i think that the web 3 really should facilitate like alternative business models then um uh hoarding information basically enabling users uh creating business models for the web that allows individuals to actually take back control of their own data and become the customer not the product and as part of this um like effectively what we're talking about is massively massively lowering the barriers about the barriers to entry for providing um services based around um web 3 to individuals um you know like the typical stereotypical example is how d5 is much more decentralized than tread fire and it cuts out as a middleman and then it you know reduces costs um and i think this is just sent across the entire web free stack not just the applications running on top of um a network like smart contracts like d5 but also the actual um protocol itself this is one of the reasons why ethereum big games are successful because of its permissionless nature because of its censorship resistance and ultimately we should be i think creating networks creating architectures that are extraordinarily hostile to um entities that are attempting to like carve out data monopolies and effectively like become rent sinkers not really contributing value but um just like utilizing the fact that they've um you know they've control they have control over a large amount of user data which means switching services becomes very prohibitive so taking a bit of a segue um i would argue that if we live in that world you know i'm happy i don't know about you i think i think uh it will certainly be an improvement on where we are today and zero knowledge later twos are um a kind of a critical tech linchpin technology i would argue into it uh achieving this because effectively it it kind of solves or i would rather say bypasses the blockchain trilemma that you can either you know you can you have um for a for a distributed network you can have um throughput scalability or you can have security we can have decentralization you can pick two of those three basically it's a trade-off space uh and um but you have to sacrifice one uh one of those ethereum sacrifices scalability as we're all very aware with extremely high gas costs and so instead of the core architecture of ethereum resolving this um the i would argue the solution is for layer twos to solve the problem effectively uh latex will inherit the consensus of the layer one network like ethereum uh but um every individual transaction that's processed by the day one network represents you know the aggregated batch of thousands tens of thousands even millions of transactions um built on these layer twos where you can verify the the correctness of all these transactions through zero proofs you check the proof of the that somebody else has performed all the computations required to verify the block um it's you know it it's it's a it's a incredible technology i feel very lucky to be a part of um developing it uh and it almost seems too good to be true um so what's the catch and the catch is well the current let's just talk about the currency of layout to you right like we're in a world where last year a bunch of late 2's launched um you know we have the asset network private layer 2 there's you know there's there's zika sync there's polygon um uh you know there's there's an and stark net um there's there's a there's an absolute ton of them coming out almost like cambrian explosion and the dream is that these networks will be completely decentralized and permissionless and sensitive resistant but the reality right now is that they're all quite centralized and they're all and they're all highly permissioned and they're all vulnerable to censorship and part of this is just the the fact that this technology is still in a very early stage most of these um networks they're the the label smart contracts that verify the correctness of the networks they're controlled by multi-signature contracts that can modify states um to be fair you know hands up this is the case for aztec because we want the ability to rapidly fix cryptography bugs given the early stage of the technology and all these all these companies have uh plans to decentralize in the very near future uh but um i think we're going to see over the next year or two how hard this is going to be in practice and why is this well i'm going to talk specifically about zero knowledge later ziggy snucks um uh because this is really what my core competencies is what i've been um uh focusing on uh you know nothing nothing against optimistic roll ups optimistic letters uh you know i could argue that what i'm about to say is really actually um uh to their credits and to the dentures of zika layer twos uh because i said before you can you can you you know you can just bundle tons of transactions together and then verify their correctness by constructing a zero-node proof that somebody else has performed the effectively perform the work of a validator node but the problem is constructing these zero knowledge proofs is monstrously expensive in terms of computation um you know the difference between doing a computation and creating a zero knowledge proof of the of that computation it's about a factor of a million um it honestly depending on what you're doing like a scale to like a 100 million times slower you know we're talking insane numbers and so we're not going to really live in a world um well it's very it's very hard to see a world where we go where we're going to have like a massive decentralized network of these provers that are quite essential for the um functioning of these networks because you know you're talking about depending on the lab like the complexity of the protocol like if you're doing a zkvm you may need uh like to rent an entire data center of compute uh to construct these proofs in a timely manner uh and so you're not going to really ha it's it's difficult to see a world where you're going to have like a very like a massive number of these these effectively these these nodes um when the infrastructure required to run them is so high uh so how do we avoid consensualization how do we avoid like a very very small maybe even one entity kind of monopolizing proof construction um and uh basically holding being able to sense the transactions hold the network hostage all these bad actor problems and so one of the um solutions that that's come out which i is i think is quite elegant and it solves a lot of the problems here is um the idea of splitting up this concept of like a validator node approver node into two different actors you have a sequencer and approver where the sequencer um kind of acts a bit like a validator in a proof of stake layer one where the sequencer is the entity which doesn't need a lot of like horse computational horsepower they're probably um using proof of stake and what they're doing is effectively the sequence is determining um the the what the block is like what the next block is in the in the network so they're not really they're not constructing it the zero knowledge proof that proves it's correctness they're just stating what the block needs to contain and then it's up to the some other entity the approver to actually construct the proof of knowledge that proves its correctness and this is quite powerful because it means that the prover has no agency in selecting transactions the prover can't do front running approver can't sense the transactions that basically the approver is instructed what they have to compute and they have no alternative but to compute it or to you know do nothing um and so obviously this doesn't it doesn't remove things like front running and mev and blah blah blah it just means that that there those problems are part of the they're the sequences problems they're not the previous problems and that's a better world to live in because you can have a very large distributed set of sequences because they don't require very much very much resources and you can still have like a very small number of provers so this is um this is the model that pretty much all these zika layouts are going uh going the route of and um it solves most of the problems i've just mentioned in the previous slide but it doesn't solve all of them and i want to talk about that because i think no one's like i don't think a lot of thought has been put into this because everyone working in this industry and zk snarks and zk starks has been focusing so much on building out the underlying tech i think when it comes to like the network architectures decentralization there's not a lot of thought being put into it and we should talk about it because there are some problems that we need to resolve so what are some of the long term risks for that that are somewhat unique to zero knowledge latitudes uh and one of them here is is sequence the griefing attacks i i said in the previous slide that the sequencer basically fixes what the block is in the next uh um for for the next for the next block and all the privilege has to do is construct a proof of knowledge of its correctness well um this requires that your cost model is extreme extremely accurate effect like the equivalent of gas before layer 2 basically how much competition power is it going to require is is the prover going to require to make the proof of knowledge because that's going to define how much how expensive it is for the approver and therefore um how many uh the fees that users have to pay in order to get this this block on onto mainnet and so if your cost model is off say like there are there are opcos of instructions that cost that that cost more cpu power um then like they're the the gas metering would just wouldn't imply then um you've got a briefing attack because you basically you're forcing the approver to construct a um a block which is not economically viable for them to do so and so that kind of activity can hold the network it can it can mean that um like fewer or to no but nobody actually um takes on the role of approver because it's not economically profitable uh and you can get to like kind of worst-case scenarios where um like a malicious sequencer could in theory like in some circumstances produce uh required like demand approval to make blocks which you know take like you know um uh arbitrarily long amounts of time to compute um uh and that would hold the network you also have problems of proven liveness because um this kind of model um implies that you're going to end up with a very very small number of quite centralized provers with a lot of computational resources uh but when it comes to um selecting provers and rewarding them it can't be a zero-sum game the idea like for example like fastest fastest person to construct the crew for knowledge they get to put it on chain they get the fees uh because in that case the fastest people will always win and the second fastest trooper won't bother competing and then you end up with one prover and then you have a huge liveness problem because if that freebie goes down then your network goes down and for like critical base layer infrastructure that's that's really not acceptable you know if you have trillions of dollars um like flowing through these networks you can't just stop them for for an hour you also have an infrastructure centralization risk which isn't present um for proof of work blockchains uh and their mining networks because the the resources required to construct these proofs they're um you need enormous amounts of compute and you need enormous amounts of status storage you need enormous amounts of ram you know we're talking like terabytes of ram uh we're talking you know we're talking server farms of cpus uh or gpus or even sx and so right now everything i believe every single layer two zk layer two their proven nodes are run on aws or a similar cloud provider like aztecs we do this as well because it's convenient uh but um when you centralize infrastructure like that you have a huge problem because well the incentives aren't aligned uh because if let's say we're living in a world where all the layer 2's all the approvers are running on aws running on you know um digital ocean etc well these are supposed to be permissionless networks where people can get up to all sorts of junk and nonsense you know you can have people uh you know like trying to evade sanctions like in russia you know you could have um people like you know mixing on tornado cash and all this stuff which is going to be controversial contentious and like flat out borderline and like fill out about legal in the places where these cloud providers are located and so what if these cloud providers say well you're violating your terms of service we're going to shut down these proven nodes what do you do so i think this kind of infrastructure initialization isn't um we need to address this and deal with it and make sure that that the the the whatever architectures we end up building they can be they can be decentralized across the entire tech stack and the last one i want to talk about is proven data modes i'll get onto this later on but effectively um you can end up in a world where like certain privileged proverbs have enormous amounts of access to user data that isn't present on chain and then you're starting to and then there are some issues that come with that which i'll i'll go into later so i might have actually um spoiled a few of the slides uh future slides by uh spending so long on that one uh but here here's an example like uh of button five minutes cool so sequence of griefing attacks um this is basically what i was talking about earlier your sequencer can create like basically impossible blocks to compute uh it very much depends also like the the the the architecture of your network um affects us massively uh for example if you um uh if you take each program that you're running on your network you smart contract and then you compile it into one of these zero-nodes proofs then that compiler cannot apply optimization cannot apply um optimizations like a traditional compiler because then the compilation time um is uh uh like non-deterministic uh and you can end up with the um these concept of a compiler bomb where it takes like in it like uh where you can it takes an infinite amount of time not to construct the pivot knowledge but merely to compile the program into into a zika snake circuit this is what killed ewasm um for the record and so we need to and you can't we can't use models that like expose this problem uh in zika it's not very late either and so the solution is this universal simulator circuit where basically you have one vm where you where you emulate um like for example a zika evm where you have one zika snack seconds that will execute any program that you run through it but the problem with these is that they're extremely slow which exacerbates all the problems i was talking about before um similarly proven liveness i've talked about the problems some of the solutions are well you need to be able to have redundant previous publoc effectively um one solution is kind of sort of like a federated proven network for example instead of having one monolithic approver you have thousands of provers where you split your rollup block into um into tiny tiny sub-components so for example that you roll up two you have one you have one out because that rolls up two transactions and then you have another actor that rolls up uh two of those previous roll-ups and you keep going and going and going in a tree-like structure and this allows you to massively parallelize proof construction and you can actually decentralize the proven network uh the problem with this though is that it's really slow uh because you now have this kind of decentralized fair related network where you've got to you know transfer tons of data around and you've got to coordinate people and um you just don't have the kind of the economies of scale of a centralized cloud provider which means that you can't use this kind of architecture for something like a zkvm or something which has a huge amount of complexity in the in the circuits um you need to have something which is snap or stock friendly for example um like what aztec's doing i think uh cairo would also uh start starkville's curry would fall into this kind of could could use this kind of model and this solves the the centralization of the privilege because you no longer centralized it but it does limit the the functionality of your layer too um and similarly when i said about infrastructure centralization the centers aren't aligned uh if everybody's using cloud service providers uh and uh so that's that is that is the problem for this centralized proven model which we need to address uh it can be solved through a few means if you can have prover proving our approvers baked into hardware but like um bit like you have bit more bitcoin minus baked into like hardware you'd actually have the the approval algorithm as you know um is an asic chip uh then like the the act of making a proof is a lot more plug and play you know you can just buy some fancy hardware and then plug it in and away you go and you don't need the the the um the the cloud infrastructure anymore but that's still got some problems because uh you still need vast amounts of ram and storage and this zero proof tech that we're working with obsolete so quickly that um in my opinion it would be a rather foolish thing to today like to start creating burning uh asset chips that performs in our proofs because in two years they'll be completely useless uh and so another solution is these this federation of decentralized approvers but then they're slow so that's got that's got problems with that too um and the final thing i want to talk about is uh privacy um this is kind of this is aztec's thing we do privacy so i feel like i i should talk about it um and one of the reasons why we care about privacy um other than like the the the very basic thing of where we want to protect user data is that if you don't have strong strong privacy at the at the protocol level then you can end up with a rather dangerous situation where you can get pseudo privacy by giving your secret information to a trusted prover um the idea is imagine you you you know you you have something which you have some smart contract which wants to work on hidden data then well you make the data all public and available to the approver the approver will then construct this like as a stark or a snark of your of your smart contract transaction and send the proof to mainnet and in doing so they can um basically remove the that secret information that you gave them and so from the perspective of the network it looks like it's private but it's not private for the approver and uh this effectively enables producers as well but you have a centralized server approver you know where there's very few of them harvesting user data as part of a service they're building uh um and having having the ability to both monetize that data and it provides a kind of a data mode which prevents users from using alternative services and this is exactly the kind of web 2 model that we want to avoid the solution to this in my opinion is by baking in privacy at the actual critical level by having your smart contracts capable of using advanced urinal proofs themselves to obscure and hide data such that effectively you for all private transactions you store the encrypted data on some data availability solution uh and it can be decrypted by having by giving um and the user has the ability to decrypt them that data with their public private keys that way it's very easy to create competing services because that data can be accessed by anybody anyway that's basically everything i had to say uh thanks for listening and yes it's been a pleasure cheers thank you