J2 AG 7 Vitalik Buterin a quick intro to Plasma cash 1

why is this called plasma cash because plasma cash is plasma but it's way more scalable so this is not just my work thanks to watch 2 Dan Robinson ants - Carlos I mean a Karl Forsch from New York City New York so ok traditional traditional plasma and because this is a 15 minute presentation we'll be going through this fairly quickly basically the idea behind plasma is you have a main chain and this main chain on this main chain you have a plasma contract and into the plasma contracts the plasma operator publishes Merkle roots and the merkel root is the root of a tree of transactions in all these transactions together make up the plasma block now any individual user of the plasma set of any particular plasma system has to download and authenticate every plasma block so basically all of the data that exists inside of that plasma system so over here you have your workout tree you have your transactions and like all of that is stuff that must be downloaded by every single user now this is still a scalability improvements because users only needs to download plasma chains that they care about but it's still suboptimal right like with this kind of class but you can get the quadratic scaling but you can't really get anywhere I get anywhere above quadratic scaling you cannot do exponential so this is plasma cash each deposit instead of creating just an arbitrary unit of plasma either creates a coin with a specific unique ID right so I deposit 2.5 ether I have created a coin and this coin has a denomination of 2.5 ether and it has some you know agreeably assigned ID within some small range so you could assign ideas within the range I could say 0 to 2 to the 32 minus 1 coins cannot be split and coins cannot be merged so you just have coins of difference in nominations and if you want to pay someone you pay it on a bunch of coins if you don't have exact change then you ask them for change plasma cash is plasma plasma cash is cash so a transaction spending a coin needs to be included in not anywhere in the Merkel tree it needs to be included in the specific position in the Merkel tree corresponding to the coin ID right so if you have a coin that has ID is zero then the transaction spending the coin has to be included in the Merkel tree in the leftmost position going all the way to the left if you have a coin with it with an ID of 23 then you convert 23 into binary a bunch of zeros 1 0 1 1 1 and that described is a Merkel path that you have to walk down find the transaction for that transaction to count as valid what does this mean so this is what this is what it would look like so if you have a coin who is idea 6 then that would be the Merkel but that would be the only that miracle path will be the only place in the Merkel tree that a transaction spending a coin with ID number 6 can be included so what it right so what does this mean well the main benefit here right is that basically the amount of data that clients needs a process goes down by a lot so in plasma if your traditional a kind of minimal viable plasma if you have a plasma chain and this plasma chain in each block has a block size of N and the plasma chain continues 40 steps then every user of the plasma chain has to download and process every plasma block so the overhead is n times so here you might notice that a user actually only needs to verify this bit the the availability and correctness of the plasma chain only add the specific index that they want to spend so or or sorry over the specific index of the coin of any coins that they own in any coins that they care about so if I have 15 coins then I would only need to look at the plasma chain in AD 15 positions so what does this mean well if someone has si coins then the overhead goes down to roughly C multiplied by T multiplied by a log n over C so the C base how many coins do you have the tea means that while you have to keep track of a Merkel branch for every single block in the plasma chain and log in because there's ant because there's n different objects and them all right the plasma block has size n well again over C instead of log n basically because if you have multiple coins and the moral proofs have a tiny bit of redundancy to them so for every single block in the plasma chain you needs if in that block there was a transaction that spent the coin the transfer the owner then you want a proof of that that that coin is there and basically you need a proof that you know you have a history and that this history forms this chain that goes all the way back to whenever the coin was deposited and for every block in which the plasma that particular coin is not spent you just need a proof non-inclusion so basically just a merkel proof pointing to that scene index and the tree we are at that particular index and the miracle tree you just have empty data so log it basically log in go log n over per block and that's basically all that an individual user needs to care about so what does this mean in practice well let's say you are a crypto currency exchange and you are processing orders on you know you have an order matching engine you have an order book but you do not want to become the next bound Cox and so well maybe you wants to integrate plasma right maybe you wants to design in exchange in such a way that you do not actually have control over people's money instead you are just the order matching engine and it's the users that have the private key is and you have a plasma system that ensures that regardless of what happens through the exchange users can always run through the plasma exit procedure and get their money out so one problem well what's a your exchange is very high capacity and it is processing something like five hundred thousand transactions a second well even five hundred thousand transactions a second is is way too much for an individual user to download and process the entire chain also perhaps there are privacy reasons and inside of a plasma chain you do not want to give every user absolutely all of the data about the entire system well here comes plasma cash users do not no longer need to download all of the data even inside one particular osmosian instead you just send every user their merkel branch and you keep sending them the merkel they are Mirko branch it was every single block and that's all you need so sending someone a coin does now require sending them kind of proof data for its history right so if you have a coin and you have all of the Merkel proofs for that coin then you will if you send that coin to someone else well that person up until now wasn't keeping track of that particular part of the plasma chain and so you just have to send them all over East America branch that you've had for you have for the entire coins yes to me send them that entire data and they basically continue and start tracking that coin from there right so there is this you know a few hundred kilobytes possibly megabyte of proof data that you have to pass along with the transaction though that can be optimized the way there is a bunch of fancy Zeki snark bloom filter or whatever fancy crypto Bosworth trick so you can probably get it down to one to two kilobytes so the there is overhead that goes up and you can fix it using fancy crypto tricks and you can also fix it by basically taking every single coin and kind of checkpointing it on chain once a year so that basically means or just what's draw the coin and your en you redeposited and if you do that then the history that you have to keep track of goes back down to zero so also note one nice property of this construction is that only coins that have been deposited can be what's wrong right so in plasma an attacker can cheat in this really arbitrary way where they say oh I am going to just create a new you TXO out of nowhere I can have money I can have money I can have money but and the the victims of this theft are basically all users of the plasma systems right if you manage to somehow print plasma coins for yourself out of nowhere then you're basically turning the plasma chain into a fractional reserve here plasma coins are not fully fungible every single coin Ismet has a unique coin ID and coins with different coin ideas are different so any attempts to withdraw a fake coin any attempts to withdraw money without authorization actually means you're trying to steal money from a specific person and that specific person has the ability and then and the necessity to complain so because of this this is first of all this is the reason why you have this greater amount of scalability but also there's this really nice property that no can reckon ism is required right so you can just send someone a plasma transaction and and once that plasma transaction is put into a block they have the money you do not need this extra round of communication we're like analyst cents a transaction plasma operator creates a block Alice sends a confirm message to Bob Bob except sticking for a message eat for that dance basically it's just go just be in one step so exit challenge process so here is how exiting and challenging works in plasma cash so first of all just like plasma if you wants to exit from inside of a plasma chain then you have to provide a Merkel proof there's just a Merkel branch of the most recent UT Excel so basically if you have a coin and you received that coin in let's say block number 589 then what you need to do is you need to provide a Merkel branch and that Merkel branch basically proves oh look this transaction actually was included in the correct position of block number 589 so you profess know you provide this Merkel proof now then there are there are two ways to cheat and there's two kinds of challenging that you can do it a chance to challenge it invalid exit first of all if let's say I have plus a plasma coin and I received this plasma coin in block 589 then I sent you this plasma coin in block number 623 but then I'm going to try to double spend so even though I already sent you the coin I am going to still send but send the Merkel branch over and I am going to try to exit well you can challenge me and you challenge me by basically just providing a Merkel proof of your transaction so a Merkel proof of your transaction that was spending my transaction right so if I try to spend exit money that I no longer have then whoever actually does have the money now has a proof that of basically when I relinquished my claim so the money when I gave the money up and they could submit that proof and they can cancel my exit and if Lee wants to they can basically just substitute my exit with their own exit instead now another thing that you can do is you can challenge with in earlier UT Excel and if so the purpose of this kind of challenging is if the plasma operator is malicious and if the plasma operator tries to submit an exit we're with a coin for which there isn't actually a kind of proper history for if the Challenger exists with the normal URI TXO then the user has the challenge with basically some child of that uth so that was before or at the same position as the original exit so basically the original exeter has to prove no wait this thing that you challenged is actually an earlier part of the history and i actually know what the next step in the history is so let's go through some examples so first example there is a coin and this coin changes hands a few times right so let's say the second blast owner of the coin tries to exit then if that if the exit succeeds then well they they would manage to steal the next participant the next participants money right so the next participant so the last an actually current owner of the plasma chain has the ability to challenge right so i can exit with a merkel proof of this they can challenge with a merkel proof of that now so that so that's case one right so now you might notice it actually works all the way through the chain right so if let's say I try to exit with this then well you can challenge you can challenge by providing this right so if you have part of the definition of kind of owning a plasma coin does require you to have the inside the coins entire history and so if you have the coins entire history and if some then if someone provides any old spend of that coin then you can always challenge it so these two let's see let's say something like this happens right so here is the story let's say at some point in time I received a coin and then it's up weighted then very soon after I spend the coin but then immediately after I spend the coin the plasma chain operator starts going warranty right so immediately after I spend the coin and I send some transaction then right at that moment while the transaction is still in flight the plasma chain operator just basically starts attacking in the plasma chain operator creates a spend of the coin out of nowhere and then just start spending it a bunch of times and then the plasma chain operator tries to exit well here is how I challenge I take that exit and I am going to basically say oh well I only know last time I checked the I only saw I only saw this particular transaction right so if we assume the pause machine operator is an attacker then all of this data might be unavailable it might be the case that not only this data is available and so only this only this data was used to exit so I'm going to challenge with this now here is the problem the plasma chain operator is stuck now why is he stuck well he's stuck basically because there actually is nothing after that there is nothing after this particular transaction except you know this thing over here that got that ended up getting included much later right so that by itself basically proves that this particular exit is illegitimate and so because through the challenged procedure the attempted exiting what this fails now there let's say I try to exit with my own coin then the person I sent the coin to can challenge me and she can replace my exit with his own exit but that's okay right if I send someone money then well it's totally fair that you know that they are the ones that connects it with the money and I'm no longer the one who can edit it with the money so this this is also still kind of working as intended let's suppose that now the this guy tries to exit and the second guy tries to maliciously challenge and he maliciously challenges by providing this thing far off in the history both he provides this thing then well guess what I actually know what the response says and so I'll be able to respond if he challenges with this then I'll be able to respond with the transaction itself right so for any kind of any for any legitimate Exeter they will have a way of responding to any challenge for any illegitimate exeter there will be a challenge that they cannot respond to and it's always the legitimate owner of the coin who has the incentive to make the challenge right so this is kind of like the a that basically the same general principles by which plasma works but like in this case that's kind of adapted to the single coin model now you might notice one thing right and the one thing that you might notice is that if you create a story where oh well I sent you this point and then you end up spending that coin again and there is going to be a situation where there is a challenge that you will not be that you will not be able to answer right so the challenge the the challenge basically is that oh well what if you try to exit and then the Chan the challenger provides this right but then that basically is why like before you spend a coin why he needs to actually authenticate the coins Oh authenticate and have the coins entire history so that basically is an introduction to you know one simple way to make plasma more scalable and drastically reduce its usage requirements to regular users I hope that anyone interested in plasma and continue and anyone working on an exchange really seriously considers using some version of plasma technology in order to make their exchange much more hack resistant and hopefully you know whatever the neck whenever the next big multi billions over exchange I'm written by a totally incompetent developer gets hacked no one will loose any money thank you I knew one or two question so does it mean that all holders of coins need to constantly monitor the the plasma chain for fraud yes so in any plasma construction the the owner of a of any coins inside the plasma chain needs to constantly monitor and if they detect fraud as long as they become online within two weeks and within two weeks they got challenged any fraudulent exits then they will be able to get their coins out yep okay sure go ahead shout um basically if they figure it out and try to use some look there well realistically there is probably going to be as some like the digital equivalent of a Coinstar machine basically just like some decentralized exchange between well au denomination coins and high denomination coins another thing you could consider for very low denominations is just something like probabilistic payments now keep in mind by the way that this is still a very new very new research and this is literally from an ef-2 research post that we published four days ago so you know there there are plenty of optimizations still a lot of this stuff many of which we happen to discovered yet yes so plasma itself has something that can be used to kind of wrap existing centralized exchanges and basically turn them into exchanges that have centralized order matching but decentralized custody so that already removes like a huge portion of all of the security issues that exchanges have now of course there's also like other issues with centralized exchanges like the fact that there's a lot of shady backroom deals where they offer fifty fifteen million dollar listing fees to various crappy coins to get listed for pump and dumps but like if we want to solve that then okay maybe we need completely decentralized exchanges I don't know yes I wondering how's the coin history of your own coins house it's sent around to other people so if you wants to send a coin to someone then basically you would need to just send them the history through an offline channel so this could be done by whisper if it's in person payments it could just be done you know through an NFC connection or whatever okay thank you [Applause]