EY 🛠 Meet Starlight - Write ZKP smart contracts without a PhD - Andrew Forman

foreign [Applause] [Music] Andrew Foreman I'm with uh Ernst young ey blockchain I'm here talking about Starlight um so basically yeah so I work at ey I work with a lot of our clients that are building smart contract applications any kind of web3 app um govern new governance features things like that uh what I'm not is I'm not a cryptographer I've never taken a cryptography class I don't really understand the math behind zero and entrepreneur circuits I know there's a couple of couple out there um so this this what starlight is is really just a huge leap forward in allowing any average slowly developer myself included to start to bring you and use privacy features in the construction of their adapt in their smart contract so this is very much like if I can do it you can do it to kind of talk uh we do have um some of the cryptographers that worked on building the the application on the phone and they'll talk through some of the technical parts of it uh but I definitely want to give you a feel for what this is what we're building here uh maybe just another important note too is that this is something that we're actively working on at Eddie why it's um pre-alpha release we very much experimental technology so like we're hoping to launch it soon but um and we went and the reason we're talking about it this weekend is so that you guys can see it you can start to use it give us feedback uh and then we can you know have a more robust um uh launch very shortly um so okay so what is Starlight so like I said the big headline here is that any solidity developer can now use the power of zero knowledge proofs in building private features for their dap on chain uh you don't need to understand kind of all the the sophisticated circuits the elliptical curves anything like that to go then build private features uh for it for your data so that's what that's what starlight uh was built to do it's really two things it's one it's a zero knowledge proof library for writing your solidity code and to a transpiler or we we call a company you know compiler but really it's a transpiler to then read that um that Library file and the the decorators are they're involved there uh so what you can do is then you take any of your these decorators do is they take any variables mappings arrays that you have in your contract and it allows you to put them into a private state and so then what we you know kind of some of the names you see up here are the kind of the names that we've been using I mean these are kind of like right now just internal names that we're trying that we're trying to experiment with but like when you take your adapt and you run it through this solidity uh this kind of construction that we have around decorators we're calling that a zap or a zero knowledge proof app uh the validity is a is the file type that we use in this zero Notch proof Library which is in the Starlight Library which I'll get to in a bit and um then zapify is really just the command to run the compiler so like once you understand kind of the some basic Basics around those decorators it's really just three steps write your solidity add these decorators run the compiler and as you can see like we've taken all of that you know trusted setup circuit construction trust assumptions logic off of you as a developer so all you have to do is add this to your solidity code and kind of understand what the logic is going to look like for your users uh and and with and how these State changes get updated okay uh so first first one we said two things right first is the compiler uh so I think I want to say like you know why did you even build a compiler that's kind of like a weird thing to even go and attack we don't see it that that often where where someone wants to go build a compiler uh and so for us this was really um just about scale and getting the more developers access to this this technology uh it was something that I ran into personally on a project so we like worked with a client they wanted to build this private donation platform and what it allowed you to do was take a bunch of different charities make private donations to them so now like a large donor who may not want Their donation to be public could do so privately on change so there's like a big step forward in like more sophisticated more um real world smart contract applications but I worked with like a team of advanced cryptographers we had to go through uh weeks of circuit construction uh they had to explain it to me so that our team could then write it into into solidity code all of that stuff is not scalable when you talk about hundreds and thousands of uh zero knowledge proof based and private privacy enabled applications so to to make that all work we started kind of at the compiler level so that you can keep writing your solidity code add these decorators and and run it through this construction so the three steps again we'll say take your your contract and in solidity.soul add decorators you mark what you want to be secret variables arrays mappings anything that can have a private state um then send it through a zapify into the into into our what we're calling this this compiler transpiler so then how does that look at runtime because it's kind of um this is like maybe just like also as like a developer education point you know understanding what what's happening to your code as you go in through and deploy it um so what we have here is um the compiler takes that solidity code and uh we have this zolt now this Zol file the solidity file type and what the um we're going to do is we're going to first kind of make sure that the syntax and the way your solidity code is written looks right that there's that um there's no there's no solidity errors first we're going to run it through the solidity compiler just like as as your code always would uh would be executed then we're going to add back into this this AST tree which we've broken out the decorators that you put into that file and then we're going to run it through our transpiler and so now you've we've done this gone through this compiler Loop a second time and what you have is a uh as a little you're a zap that's been compiled and so that's when we would then set up and create the circuits and the state changes that that um that you would need for for that application um so yeah that's kind of what it looks like at the back end you're gonna have one tree that has these three different parts which is The Shield contract there's orchestration code and uh then also just you know your basic uh your solidity file structure and I only call that out now because when we get into the more technical parts of the talk uh you're gonna see that breakout again of the orchestration the uh The Shield contract and and the salinity file Okay so like I said all that you need to know as developers how to use these decorators uh and how to run it through this transpiler and you've got your your solid Gap ready to so I want to now jump into the decorators because this is really kind of like the key thing for your anybody that wants to go and use Starlight to understand are these three decorators uh Miranda can you hear me or did you want you want me to take these ones I'm gonna try and test talking and see if we can hear you hello [Music] all right well I'll get i'll get started so uh the first one is is the secret the secret decorator so what secret is is um like think about um any kind of like variable whether you declare it at the global level or a function parameter that you want to remain in a secret or private state so like your basic example here and we can jump to um the code as well is um you know I've got variable a I don't want anybody else to be able to call and see what the what I what I have stored at variable a so I can put a secret in front of that that um that argument and now it can remain private on chain um known and unknown so this is getting a little bit more advanced so then think about this as like um a bank account right so a known would be where I know what's in my bank account I can now update the state of my bank account and and so I would use known for that if I want to add or decrease if I don't know the state of my bank account so let's say I want to change his bank account I don't know what's in his bank account I would use unknown and now I can add his bank account without knowing the state of it so that's how you would use known and unknown um it really I mean a lot of this comes down to kind of the language of of zkp and um and privacy and cryptography is just like who's creating the commitment who knows the the secret word at any point and who can update the state of that of that um whether it's a variable mapping or an array um and so to me this is just like a very nice um distillation of a lot of zero knowledge proof work happening in the background where for me all I have to understand is how to use these decorators um what they're what they're going to look like and once my code is represented on chain um and and now I can start to kind of bring these features of zero knowledge proof and privacy into my application who can change States who can who who knows things when and who can update them so let's look into an example of that Miranda if you can hear us you want to you can jump in on this one as well you start talking maybe maybe it's a little louder and try that again hello can you hear me yes we hear you fine perfect yes we do okay perfect so we're going from the example is that right correct I can't I can't see the slide sorry okay great so uh we have an example here I so if we want to zapify something and turn it into a zero knowledge application we start with a smart contract as Andrew talks through so let's do this super simple idea which hopefully some kind of use case we have a mapping of invoices from an address a person to the amount in the invoice we have the owner of the contract is the who this is the one who's going to be paying the invoices and we're focused and function to pay them so you see in red these are where the decorators are so we don't actually need to worry about known and unknown here because we're overwriting State and we're decrementing state so we know that essentially the only people who are going to call these functions are the people who know and own the state and the compiler is clever enough to work that out for you so we don't need no no unknown here but um yes this is an example of the kind of input you would be able to put into Starlight and zapify at the bottom is just a very high overview of the of the actual application by compiling this we would get a shield contract which would verify the information you put on chain in this example we are not revealing any owners or amounts of these invoices so very little information will go on chain apart from the proofs the proving you've done these computations correctly and the amounts based on whether you're adding a new amount or um whether you're decrementing some amount the orchestration is just the node code and a bunch of other types of uh sort of deployment type things so like Docker npm files that help you deploy and use and bring together um the journal knowledge on their own chain parts and the Socrates files the Socrates is the code that we use for our09 circuits all right so on the next slide there should be a sort of example flow of this yep yep so lovely so ideally here so the user wants to add an invoice using their xerne large application that they've made with Starlight so number one is the only step that the user has to do all the rest is done in the background and the users just waiting for the receipt back from the transaction so they want to privately add an invoice to this contract they still need to input an amount so if you remember in the previous slide day we we still need the user to input in a map but then the rest is done in the background so they're cool instead of calling their contract they will call a JavaScript node file and what that would do if you have an old invoice for for this exact owner for you then it would grab that old commitment um if not it would use a dummy commitment which is a bit of an advanced feature but we'll just continue um it would get all these inputs together and create all the things that we need um to keep the state private so in this case in number three uh we want to wrap the amount uh into a commitment so what we do is we we hash it with lots of other information as well to make sure that it's hidden but it's provably correct and we go through exactly the same computations that we did in the original input contract but instead we do it in the zone large circuit and we prove that we do that correctly rather than revealing the inputs that we've used and then once we've done all this in number four we send this proof the new commitments we have so the new commitment representing the new value and the nullifier of an old Commitment if it exists we send that one chain if the contract that we made if that verifies the proof it has a new equipment to a tree so you can prove that it exists later it basically tells the world but mostly our Merkel Tree application that a new commitment has been added and it adds a nullify so that you can't double spend any commitments so all these had to do was step one and the Starlight generated application has done all the rest so the user has added a completely secret invoice to this application uh yeah that goes through the example yeah great I'm interested if I could switch over to the to the actual repo itself I don't know if we can do that uh I mean here's another example just to bring it up again I mean I think that was a good example that Miranda walked through and um I think maybe just like some other examples to throw at you just to you know get you thinking about how you would use these decorators uh might be something like if I wanted to have a voting contract and I wanted to restrict the number of people that could vote in that contract but I and I wanted to keep uh that those 10 people private I could create a mapping that says here are my 10 voters they're private and uh and so you know you can go and check on chain you wouldn't be able to see who's allowed to vote on my contract and then maybe only I or some admin has special privileges to change the voters uh on on my um in my application um we've you know thought about some other ones like um uh issuing ious or different kinds of like uh uh Advanced commitments so um you know I think this one's like an invoice example um I think that like these are powerful tools and now we can start to think about what are the Privacy features of our users when do they want their their information to be private or some other part of the application be private and then this becomes a way that we that we actually instantiate that feature um I'll flip over to in a second but but we have a a GitHub repo that is public and anybody can can um go and access it I'll put up a slide after this and there'll be a link there to get to it uh there's a lot of good examples there a lot of good test files for you to go through so we definitely want people to go and try out the repos you know take a look at it see if if it makes sense if you have questions you know we're available to to talk through a lot uh any parts of it that you want um and then maybe just to hit on two two kind of learnings that we've had over the last few months working on this repo one uh building the compiler is really hard like it's a it's uh it's hard to find compiler developers to work on this there's a lot of different test cases that you need to be working for I like wouldn't advise it for your your health to go work on compiler code it's just it's a mess so um you know if anybody's a compiler Dev like come find me uh yeah recruiting dinner um and uh and then I think too like for me the the big the big opportunity and and the big thing that's changing in our space and as ethereum developers evm developers is um is is building privacy into our applications and I think as like these applications become more sophisticated as they start to have more real world applicability and use cases as um our governance systems get more sophisticated that we're going to want to have privacy in these the things that we put on chain for our users um and it's not feasible right now at this point just forever or just assume that everybody's going to go out and understand how a snark works at a very detailed level to to go build that up those applications uh so I really think we need you know tools like this to be able to make the Privacy features that that we want and that'll make the space better uh work and so I think something that'll be a big Focus for myself and our team going forward too is just like helping designers developers product managers think through what are the feature designs they want to build in and how do they start to think about privacy in a more robust way um that's pretty much all on the talk can I switch over to the GitHub I'll just show you guys where it's at here's a link if you want to uh scan and uh yeah you just heard from Miranda she she was one of the lead developers Michael Connor down there in the stands also worked on the uh Swati uh Royal is a part of our r d and cryptography team in London and Megan and I are kind of helping us uh develop a relation so to speak all right I don't think we're gonna get the GitHub but yeah come find me after the talk and and we can we can walk through the repo okay thanks everyone [Applause]