ZK in Rollups: Full Validity Proving on the OP Stack by Uma Roy | Devcon SEA

[Music] hello uh my name is Zuma I'm one of the co-founders of cinct and today I'm going to be telling you guys about introducing full ZK validity proving into the op stack so let's start off with kind of motivating the problem which is why are ZK rollups interesting and important to the ethereum endgame so today the ethereum rollup Centric road map is how ethereum is going to scale and within that I think it's common commonly acknowledged that ZK rollups are the only way that a lot of the problems we're facing today as an ecosystem will get solved for example we'll get fast finality we'll get interoperability across all the rollups uh unified liquidity for users and overall it'll help improve ux greatly inherently we can kind of think of why ZK helps solve all these problems because decentralization with all the different ethereum nodes rerunning and re-executing transactions inherently has some overhead and ZK by giving us verifiability fixes this so ZK Roll-Ups have been around for a long time historically we've known that ZK has been very important but until recently ZK rollups have been really challenging uh you'd have to write in specialized languages sdks and dsls to actually encode an ethereum evm State transition function in a ZK circuit to be able to prove it and then in general there were a lot of compromises you had type one type two type three uh where you can't use the native ethereum storage format or sometimes even be B code compatible due to the limitations of ZK so how are we solving this well it's a synct we're building a ZK VM not a ZK evm a ZK virtual machine where you can just write rust and then use ZK so what does that mean uh as a developer you can just take arbitrary rust code behind the scenes it gets compiled to risk 5 which is say standard instruction set and then we prove the execution of risk 5 code and get out a ZK proof and sp1 is really really fast and I'll talk about this a bit later um and that's kind of one of its big Innovations uh that Ena the future of ZK rollups so if you use sp1 and you take it in the context of ZK rollups let's kind of examine the before and after before sp1 it was very difficult to make a ZK rollup right uh you had to have a lot of specialized expertise A specialized cryptography team now with sp1 you can just write your evm state transition function in normal code and then get ZK proofs of that before sp1 to actually make a ZK rollup it took a lot of customization ation it was hard to maintain add pre-compiled and customized it in any way and then when the evm upgraded you'd have to write all your custom circuits and upgrade them to which was a huge developer burden with sp1 I like to joke it's as simple as cargo update ref or cargo update revm and you get all the latest changes uh to the evm additionally with sp1 the security surface area is a lot smaller because you're able to reuse existing libraries and components like WTH and them in the rust ethereum ecosystem you get evm compatibility by default so it's just type one and then it's also pretty cheap as I'll discuss in a little bit which is also awesome so with sp1 uh and this idea of a general purpose ZK VM that can be used to execute rust code to write in evm state transition function ZK Roll-Ups are now pretty awesome so that's kind of the high level of why SPN so great um and now let's actually kind of go through building a ZK rollup with sp1 so step one is actually proving the block execution of an ethereum block using sp1 so how do we actually do this behind the scenes will we take ref which is a rust implementation of an ethereum client and then you actually take a w program you execute a block so you verify all the signers of a transaction you process those transactions um in Rust code and then you use sp1 to to generate a ZK proof of that so in more detail what does this mean first we get all relevant Merkel proofs and storage slots and accounts and state needed to execute the block then we construct an input with all these relevant Witnesses so that includes the entire state that we need to execute the block and it requires all Merkel proofs to actually check this State against the parent block hash to make sure it's verified and then we actually execute that block within a program that we run within sp1 and that's actually a pretty simple program because again we can just use ref and uh execute the block itself and then finally we generate the proof and we actually did this using sp1 and wrote all these programs that I'm describing in the above steps and it was around a thousand lines of code so it's pretty simple kind of a weekend project level thing of actually proving ethereum block execution with sp1 and this is something that used to take teams of people years and years and now P1 metor weekend project kind of illustrating in practice why it's so awesome uh one thing that people always like to ask is you know how much does this actually all cost it sounds so simple um but is it actually practical and the answer is yes so from benchmarking on SP sp1 on a cloud prover you can see that the costs are actually in the range of T of Cent per transaction and these are actually some numbers that are kind of out older uh in the more recent months we've improved these numbers even further and so it's actually very practical to prove transactions in ethereum blocks using sp1 today uh I also want to discuss why sp1 uh intuitively is so good at these types of workloads so in normally executing an ethereum block uh even on a normal computer you spend a lot of time in these cryptographic operations like kjack and sep 256 K1 and sp1 has this system where you can have custom circuits for those operations interconnected with a nor our normal risk 5 CPU circuit and that really accelerates the proving of those computations by an order of magnitude we also implemented an optimized GPU prover and we have a bunch of other algorithmic and cryptographic optimizations uh that make sp1 very performant and kind of give the costs that I had on the previous slide so the main takeaways from kind of this exercise are that the costs are really cheap you know tents of a cent to prove each transaction uh it's easily customizable the lines of code is really small it's upgradeable it kind of satisfies all the awesome properties we'd want of making a ZK rollup so now I want to cover kind of now that we've been able to prove the execution of ethereum block and transactions what's the next step of fitting it into an actual rollup and I kind of like to say that executing an ethereum block and generating a proof of that is one of the easiest parts of making the rollup there's actually a lot more steps involved now thankfully we can take sp1 and we can insert it into an existing open- Source rollup stack op stack to make a full-fledged ZK rollup so what is op stack at a high level it's a as I mentioned this open source rollup stack and it has a bunch of different components um like a sequencer for taking user transactions and posting it to ethereum a bridge contract optimism portal where users deposit funds and withdraw funds and finally it has this L2 output Oracle that today um you have a proposer that proposes the state route and then there's a fault prooof game uh that we know as the optimistic fall proof system that kind of is responsible for making sure that the posted State Route is correct and that has the 7-Day withdrawal window and all that other fun stuff associated with optimistic fault proofs now how we turn P stack into a full ZK rollup is we just swap out one simple component which is that L2 output Oracle that has the state and instead of having the fault proof game we just take that component and now we verify a ZK proof uh of the op stack rollup State transition function uh using sp1 and using our sp1 verifier onchain and so the upgrade process is actually really simple to take an existing op stack rollup and turn it into a full ZK roll up uh we first upgrade the contract to take in this proof uh of the state route and then we have our proposer basically generate proofs um using sp1 uh behind an API call and then posting those proofs to that smart contract and behind the scenes it's actually a bit more complicated uh for the sake of time I won't go super into detail but actually for we generate proofs of ranges of blocks at a time and then once every hour we aggregate all those proofs together to post to ethereum and kind of the architecture of how we actually do this proof generation so finally I want to talk about what one hour of finality with ZK validity actually enables um I think the best thing is that it enables users to feel comfortable with actually putting money into a chain and knowing in the worst case scenario that they can withdraw their money within an hour it's also adds Capital efficiency because Bridges don't have to rebalance and what's really great also is that it helps more rollups become stage one today and so I think having 1 hour finality is very very important uh for the future of ZK rollups and my final slide is I want to highlight that all of this is actually practical today so we have this working it's running it's integrated with a bunch of rollup as a service providers the costs are really cheap as I mentioned previously um and yeah we're excited to kind of see uh the future of all rollups on ethereum bzk roll follows with the ZK VM approach thank you thank you Uma uh we have a bunch of questions for you so let's start with those um how does OPN verify that witness matches data committed on chain um so when we verified the proof uh on chain uh some the thing that's passed in as one of the public inputs to the proof is the L1 block cash from the L1 block op code and against that L1 block hash you can kind of open uh all parent headers and you can also open what blobs were posted to the chain and you can walk back from that block block hash you know arbitrarily and open all the blobs that are relevant for deriving what the L2 blocks are uh what makes sp1 different from risk zero Z yeah so there's a bunch of uh ZK VM projects um um so risk zero also proves the execution of the risk 5 Isa I would say that what's most different about us versus their approach is our pre-compile where we can have specialized circuits for certain operations like hash functions like catak and uh signature elliptic curve verif operations and verification uh that make it particularly fast for all these rollup workloads um so I think our costs are very very cheap on all these blockchain workloads today um zisk I I don't know a lot about I think it was actually only recently announced I believe they're doing risk five but they're doing the 64bit variant whereas we do the 32-bit variant um but I think they're relatively newer and then there's some other interesting projects like jolt um which is developed by andreon uh they don't use the hash based schemes that we do um and then there's another approach um or there's many approaches some there's one I believe called valita where they prove an Isa that's not quite risk 5 but inspired by risk 5 um yeah okay um so is op suin production ready what's missing before rollups like Bas can become a ZK rollup um yeah so OB synct is production ready we have a few test Nets working today um and some chains that are excited to take it to production soon um what's missing before Bas can become a ZK rollup well I think you know the technology is still relatively new I think ZK base only recently added ZK fault uh sorry fault proofs in general so um and many of the other op stack chains still do not have fault proofs um so it's just this is all like relatively new tech even though P stack so it just takes time to like adopt technology especially when there's billions of dollars blocked in these contracts okay uh given that as sp1 proof generation is slower than risk zeros why should I choose sp1 seems like there's a uh interested party in the audience um I think today sp1 is the only Z VM that can actually run these Ops synct rollups and we're actually running them um so I think the premise of this question is just false and kind of a troll question um so yeah you can choose sp1 cuz it's like working today with all these op stock rollups okay um can we use sp1 to prove a small part of the execution Trace instead of proving the whole block Trace um yeah so you can prove any risk five program with sp1 so you can prove you know individual transactions at a time you can prove parts of a block um whatever you want you just have to manually split up yourself and then perhaps Stitch the proofs together later okay let's squeeze one more question there are five more in the line but we don't have so much time is client side proving possible with sp1 um yeah you can run sp1 um on your phone or on your web browser it'll just be very very slow so it probably will not be as fast as you want um but you can do that today um and that's kind of an active area that we're excited about to work on over like the next few months is make that experience better okay that's it thank you