20240322 ETHTaipei Workshop_ZKBankai @G Part 3

okay see it was not in my plan to relas but yeah this is three and this is the I mean this is in the CVM we are applying proportion this is so we main what we are doing is we're working with the starx star the cool thing of starx is that the recursion is very natural you don't need to work with uh cyclic uh uh cor cycle cor corpse different Corps in the cycling and uh I mean you just work with a single Prime field and just dotion uh EAS uh the only thing you need to do is you need to use the hash function that actually U is in the same Prime but here for POS or any arithmetic function works well for for this okay but Starks are very good for recursion uh it comes out of the box okay that's the first thing so you can do with a snarks but it's I would say at least it's more difficult then is you you and you end up doing foldings instead of H recursions and but the is the same but uh with theoric is uh much much easier okay so this is I mean this is we have a the basic proof is what we call a badge proof this mainly is so badge can contain many blocks and this is about more or less about 10 million gas uh eum blocks more or less okay depending on what you do there and does that directly impa the T generat proof is it dominated by gas civilization or this this batch is constant I mean it's monol proof and it's constant time the only thing is that you cannot do everything I mean if you're doing a loop of KS you you are going to be of I see I mean you can prove that you are out of cont so would say normal user will not affect unless you are doing some crazy some crazy stuff is is a or something like that behind that actually creat these batches what is any or something behind that actually creat these batches well yeah there is a well actually there is a sequencer the sequencer is generating uh blocks okay and U and if you want they they they already packed them in in batches they see that they fits and okay this is this is going to be a batch this is going to be another batch this is going to be another batch and then of course you need to generate the proofs the cool thing is that the proof you can generate them in parallel I mean you can have like uh 10 servers one generating the proof for B one there for B two there for B three and you you pipeline them okay so uh proofs is not is not so the pro proving is not bottleneck for a ZK roll up okay that's that's my Mantra it's of course it has a cost so if you have a very crowed uh uh so if you have a very loaded uh chain you will need to generate more proof so you will need to put more servers in B but there is no no limit I mean you can scale um you just put servers and that's it okay what happens if you Pro say B what that what happens in a Flor a bad fails impr no B me bad are designed for never F okay and let me I mean and this is important because this is for example uh when we have four transactions so you can so a user can put any transaction that they want there and then maybe they put a loop of cets there uh on there okay and the trick that we are using here is that we in the proof we have the counters so before doing a katup I'm just counting how many cats I already did if I don't have enough ketchups I just don't execute the catch I'm just saying okay I don't have enough ketchups the proof is valid maybe the transaction is going to be a no operation transaction okay but the proof is Val and the important thing is no matter so you can have a um a data and it can be a random data you will be able you always will be able to generate a proof okay so we guarantee that we generate a proof in the smart contract we do we do some checks for example we limit the quantity of data that you you can put in a proof okay so but you so so that you will be able to Hash it inside okay so we warantee that um by smart contract but if a smart contract accepts a b a sequence then this will you will be able to prove that by definition maybe there is a back but if there is no bu this is how the system should uh the system should work okay but does the does the sequence attest to the new state or you just say just the sequence turns out so the sequencer the sequencer does not pro any I mean uh it just computes it's like a normal client um they just uh create blocks here I mean this is more an internal thing is we are check so when we are sequencing before giving a Blog for for correct we do a kind of a double check and we check that it's going to be provable as sequence because we want to detect that at the beginning and and this works I mean this warant that we are not going to stop the network okay but it's more a protection that a need I guess what I was wondering question so the the design is the design is so the specification is that the you will be always able to generate a batch always so you can I mean you can put random data you can put malicious data you can put whatever transaction uh so whatever thing you do the the the the code me the this is a kind of a processor and a code that's is needs to take all the all the I mean all the edge cases that I mean invalid rlp or non-canonical rlp uh I mean here there is a lot of logic you need to take in account but that's part of the specification when you need to think all the all the possible uh cases uh here yeah the only guar yeah okay so here going to rec so here we have different badges this is a mon this is just a proof okay I mean it's a it's a I mean it's a it's a big proof I mean it's a proof that uh it takes a couple of minutes in a 128 course uh machine uh with a half terabyte of memory okay so it's a huge machine the biggest machine that you can let's say Buy in the market okay but it's a huge machine a huge standard machine say that way and uh it's a machine that in spot instances uh it cost about 212 per hour okay and it takes less than 2 minutes to generate one of these much move just to and depending on these counter but more or less it can do about 500 ethereum transfers about uh I think was something like 80 or 90 token transfer of 30 or 40 swaps more or less and that's something between 5 and 10 minut class okay depending on the sections okay so we have many batches first we have a we do we do um this is our this step is very much a kind of a compression so here is a huge roof okay so the idea here is in the Stark we generate a a uh the first proof that we generate is a huge proof so it's it's a proof that uh verifying that proof is relatively costly that's already a proof but it's it's big so here what we do is a set of um steps I mean it's say we verify a proof with another proof until the size of the proof is more or less the same that means that you need to do a couple of steps okay but that's just for compressing the compression uh compression steps why because the recursion part I want to work with a relatively small proof a proof that's easy to to generate okay and here um okay so this is very much the so then we have a a recursive part a recursive part I mean here we have a recursive tool this is a proof that actually uh includes two proofs so includes two verifiers so it's a proof that includes two verifiers okay so it's a proof that verifies to that verifies to verifi and it's joining one proof in Mo and and and then you can do this as many times as you want we will see now how we do okay and of course in the last in the last step we convert this a star to a snar to send it to the blockchain just because verifying a Stark in on chain is very expensive uh so you can do it uh so we we just have um a normal snark uh that we're using F FL uh to verify the last uh the final the final stop okay so and then this cost like 200k around 200k gas in the in the but it's a proof that Pro as many bues you want okay if the proof the pro F can you exactly point out which of the U exact fa you have like you have to guess which like if the AG Pro fails like all pro no no no cannot fail I mean it fails to verify what means fails the verifier does not you that means that the proof was not correct yes so no you all the proofs I mean no all the proof they cannot fail by Design so the the first one is the less obvious thing okay because here is this is controlled by but this is very fine so if this is Bid here you what you're doing here is veryify to prove if this is valid and this is valid uh then you are able to prove that those things are M can f if the two proof that you are verifying are M maybe you are maybe you're doing something wrong okay but uh it cannot fail okay so if it fails is that there is a back in the system okay Act of God maybe Act of God bit I mean if I tell you that never a proof fail I would lie to you but but that's when the proof fail is because there is something wrong we need to fix okay yeah okay let's see how we do this let's work let's see how we create a proof that generates two proofs okay so here is actually we have a cc imagine that this is a a imagine that this is um so just take just take this one so this is well this is imag that you have you have a proof that just see is better here yeah this is the this is the the basic circuit okay uh the basic circuit that Aggregates to proof let's first try to aggregate two batch proofs so two basic GRS okay so actually if you see imagine that this this is a circum IM that is circum circuit okay circum circuit has like uh two templates okay one template that verifies uh a proof of a bunch another that verifies a pro of a v okay here of course the the input state so inside the circuit is connected so the input state is connected to the beginning of the state the input the output state of the first part is connected directly to the uh input state of the previous one and then you go to the and then this is the the the state okay so this would be and this is a uh well this is a recurs the basic recursive the basic recursive Sy got this in serial uh because you mean it goes one after the other okay so you improve one bch and then you have this this C point this would be par I've always wondered why the number of the number of inputs to like a node in the recursive circuit tree right is two instead of like more than two there are designed for like this me well you can have so I mean in the case of G we have many inputs but but the main input is you have an Old State and new state okay so you have an Old State you have a set of transactions that you want that in general are uh private inputs and then new state of course we have um some so some way we have other inputs just to validate that the transactions that we processing are the ones that are committed in the state okay but the the the basic I mean the basic the basic the basic public inputs of the circuit is the AL State at the new state okay yeah so this is the input State and the output State okay yeah so first thing that we do is okay so we have a proof that verifies a buch a proof for buch okay so here um imagine that we have a template in circum that actually verifies a b okay so we just create another circuit with this template that verifies the BGE proof here the circuit of course the the basic proof that generated is part of the it's like a private input so we have a private input and here the only thing of course this state has an input State and the outut state and here we just add um we call it root C this would be at this point with this cut is used it's just a public input that we just add here but some uh in this case here is like a fake input but an input as you can put any value here okay so it's just an input that it's oh well I need well I don't know I need like 10 minutes I don't know if you want I can stop it's Daniel session after that I give up my S every learn more from this I mean I don't care I already know that but yeah so okay so with this I generate the proof and here so I built another uh well this is I built so this is the the same thing yeah so it's a the circuit that have root C that uh well here I I I do the same so here is the this is the adapter circuit okay so to verify um so I I do this again another another time okay so I generate another circum circuit in this case here I have the the verifier is not the gener verifier is the adapter Circuit of course the the root C needs to be ined directly here again this is in the adapter CC this is uh useless okay input a state and okay so I have okay okay but so here we are not going to use the ciruit but important that we have this adapter this is a template it's a circuit template that actually verifies the this so this this adapter cqu this actually verifies the the verifies the the previous C okay so we have this circuit and and and and and and and this template this is in yellow this is what we are going to use okay so this is a template that actually verifies the previous C okay and now what I'm doing is very much this okay so I'm just taking this template that verifies adapter circuit and I create a circuit where actually I have two verifiers inside the CC okay and well the root c i connect them to both sides okay the input State I connected this Areo and as a public input I have a P1 and P2 adap okay so this circuit actually would verify two basic two basic uh two basic uh uh so two badges okay actually it's uh badge needs to be you need to with the with the proof of the batch you need to generate the proof of the adapter okay but it's a single proof and then you can verify this this adapter uh with these two parts okay this is if you want this is the recursive one is the Adaptive C okay so and the only thing that does this adaptive circuit is add a public input the only thing that it does it just adds this uh this special public inut okay here the next thing that I do is okay um yeah important here one thing that's important um this circuit so this circuit for the verifier here we have the verification key so the verification key is an input so I I abstract the verification key and I put it but in this case it's hared okay so here there is an input in this case of the circuit would be hardcoded to the verification key of the basic verifier C okay okay here of course I'm not using this but here I would ad up here what I'm using here I would here I would adap the verification okay but what I can do here is okay I have another public input that I'm saying if it's a basic proof so a batch proof or is another aggregated proof if it's a BGE proof I hard code with the the Adaptive proof so in order to have the same that I had here with a hardc adap here but if I'm setting here a one if I'm sitting here one and saying No this is an Adaptive this would be an adaptative circuit then I'm just selecting the one that comes from root six from this special input that I put here okay and okay I have this okay have the CID but just selecting here I'm just here I'm just multiplexor that either select the root C or the hard one and I can put a zero or one okay now I'm generating again another another so another circum circuit where here I'm just putting a verifier of this circuit okay so here is a half temp plate okay here is going to have this is going to have a uh um it's going to have a here it's going to have a verification key that's going to be different because a circuit is different okay I just remove I mean I just this verification key and I have this template okay so this is a circum circum template of course this is green because it's a different circuit it's a different verification okay but the cool thing is that they have exactly the same um they have exactly the same uh so this template has exactly the same uh public so the same inputs and outputs and I can make it to have the same structure actually I can make it to be exactly the same I mean if you see the circum code of the green circuit and the uh the green the green circuit and the and the yellow circuit is exactly the same the only difference is the verification key which is a number and I'm just extracting I mean I'm just taking out this verification key and putting putting it as an input okay so here so actually the circuit is is green or room I mean this this circuit is so this template is exactly the same okay so let's put it here because it's exactly the same so here if I'm putting a zero or a one so if I'm putting a zero the verification key is going to be the verification key of the basic CID if the if it's a one it's going to be the verification key that I'm putting here but here I have a a chicken and egg problem okay so that's why I take it from this root C so I that's why I'm taking this special input here so here I put her code so here I put her code for the green one but I mean the green one is the the is the verification key of this so like I cannot generate verification key of a circuit that is myself so what I'm doing is okay I'm just taking the one so this circuit verifies the thing as far as a public input I'm setting the I'm as public input I'm setting the the in root C that is the is the verification key of the same C okay this is the main trick so is the verification key of itself is fast as a public input of the C and I need this adapative circuit in order to have exactly the same inputs so that the verification key is exactly the verification template is exactly the same okay so that means that okay the circuit of course can be if root C is is is the so the circuit is verify verifies itself uh or or either itself or in either so either aggregated proof or either a basic proof and two aggregated proof can be aggregated and you can put as far as this root C is the verification key of this okay so at the end at the final so I can have another circuit which I just taking exactly the same the same the same key but here already this is a final C here already I hard Cod I hard code the this uh the verification here with the verification of the aggregated Circuit of the two circuits I put it here and then here I have a circuit that has exactly so here as an input I can put either an A A A type one so a batch proof or or an aggregated proof okay 0 one and it has exactly the same structure that I had in the beginning okay but this can include the segment can include just one uh just one uh proof If this is a zero or can be a uh aggregated proof okay this a one here I can put an aggregated proof the the verification key here already is going to be the aggregated proof so this this this this verifier verifies something that's uh uh correct in there okay so we go back main trick the main trick is is here so the verification key of the same ccit needs to be passed as a public input because I I I will I don't know know I will know later on and then I have a circuit that takes this public input and verifies depending if it's the I mean the first Cc or the aggregate itself y of course this allows me to do aggregations in in cial like this it allows me to do same technique but aggregations in in parallel I do some sort ofation and yeah should work for trees as well right yeah yeah you can work with trees parallel way so you can you can AG but the cool thing is that you don't even you don't even need a structure so you can have a balance tree or a non balance Tre so when we are aggregating maybe it's a question before uh uh we are aggregating as they can so I have a two proof then I just launch a a worker to aggregate these two proofs that canel other proof well if I have to proof to agregate I I I just send worker uh okay and and I'm just trying to aggregate as much as I can but as they can first come first ser and depending on the workers that they have meting on the provs well I'm going to try them to be working as as much time as as as they can and they are doing the the best work that they can do at each moment so I'm aggregating aggregating aggregating once every half an hour I just uh okay I just get okay was not I'm going through here I finish toate whatever it's finished okay and I send it to I send it to I worker do me a machine for a we have a I mean the IDE is we have a we call the aggregator aggregator is a single machine that some H coordinates and it's kind of a mining so we have a agregator that's just uh giving right now this is is going to be different but right now it's just a kind of a mining pool I mean there is one aggregator which a simple machine very small machine that the only thing that says is and and and here many many um many validators many provs uh can connect to them and depending on the pro that connect you just give uh okay you do this you do this you do this and when they receive