Solidity Dev to ZK Dev: Why and How You Should Start ZK Dev Now

foreign [Music] we're here to talk today about our journey from solidity depth to ZK Dev I talk about how we went from uh salinity developers it got introduced to zero knowledge cryptography and went on to implementing battleships so uh my name is Ian and I am Jack and yeah like we said we're gonna walk you through our journey and uh how we got to where we are today um but first off I want to start by uh thinking the ethereum foundation um just over a year ago today battleships was just an idea and to go from presenting at Denver uh receiving a grant from the ethereum foundation up here uh presenting at Devcon today you know it's a pretty surreal experience so um none of us expected this so thank you so uh before jumping into what uh our journey in ZK first let's start off with a question what is web3 shout it out yeah please raise your hands uh I think decentralized all right answers uh I think to really get an appreciation for what the definition of what three is so uh it'd be helpful to look at what some of the tight ends of the industry have said so Satoshi oh wait that's not Satoshi I guess okay you know we'll go with that Satoshi and I just want to preface real quick uh blockchain predated what three by about five years uh so this is defined in satoshi's terms of uh what Bitcoin was uh but he basically said Bitcoin is a purely peer-to-peer version of electronic cash which would allow online payments to be sent directly from one party to another without going through a financial uh financial institution uh next someone we probably all recognize here as well uh vitalik buterin uh in the context of ethereum his definition of what three was what ethereum intends to provide is a blockchain with a built-in fully fledged terrain complete programming language that could be used to create contracts that then can be used to encode arbitrary State transition functions but none of this would be possible if it weren't for the work of Nick Sabo who I coined the term smart contract and came up with idea in 1994 and his uh his idea of what this eco ecosystem representative was the obscurity of a large random number so vast that a lucky guess is unlikely if the in if desired the lifetime of the universe and that's the foundation on what uh cryptographic Protocols are in an intern smart contracts are built and then finally appropriately ending at the uh founder of the or the corner of the term what three Gavin wood his definition was in short we engineer the system to mathematically enforce our prior assumptions since no government or organization can be uh be trusted so that leaves us with our own definition what three is sovereignty and cyberspace and following from that cryptography is the authority uh the enforcer of the laws in this news uh and set space so now that we have a definition a little bit of the etymology of web3 uh let's talk about the actual state of this industry um and specifically some of the issues that are plaguing it um personally we see the biggest issue as being the um almost zealous conviction in tokenization of all assets and uh perhaps this might be a little america-centric but um you know you could just take a look at the housing market as an example of an asset class that maybe you don't want to hyper financialize and what we essentially are seeing is that as time has gone on protocols focused more and more on financial prosperity rather than the actual core tenets of what web3 is supposed to be as as we just went over um and beyond that uh I'm sure a lot of you here have heard a lot of talk about privacy and scalability over the past few hours um again from an individual perspective and from an Enterprise perspective uh it's unusable a lot of the time so I mean if you try to make a swap when ether was at forty eight hundred dollars you probably paid 50 for a swap that's hurts um and while some of us have gone ahead with web 3 despite privacy concerns there are a lot of ways that private information can be leaked and then on the front of Enterprises they've just full-blown written it off for these reasons a 50 transaction fee is a non-starter and the fact that certain information is public on a public blockchain again is a non-starter so we saw the rise of private blockchains and those were also ruled out as uh well they are private and scalable to the outside you are still sharing critical business information with the other validators who happen to be competitors in the industry so what we've seen is essentially uh at least until uh recently the solutions were just not there so uh really we think that uh we can summarize this issue uh in a single way that that web3 which is mostly become synonymous with D5 uh defy decentralized Finance has lost the plot of web 3. uh cryptocurrency has become this mechanism for profit generation whereas that's not really what Bitcoin was supposed to be Bitcoin well it has appreciated considerably from being worthless back in uh 2000 2009 um it appreciated because of its Financial agency and stability relative to Fiat currencies it was designed to be not censorable or manipulatable you can print more than 21 million and the fact that it appreciated in this economic condition is a consequence it wasn't explicitly engineered to go up and then we have protocols like Luna where uh you know there wasn't too much Innovation on the side of the decentralization or peer-to-peer networks or cryptography but they did present uh you know a novel algorithmic stable coin which turned out to be a financial weapon of mass destruction a lot of capital was destroyed both for retail investors and institutional investors lost a lot of money and not only is this bad for the industry just because they're resources that um are suddenly uh taken away it actually causes a recession in uh decentralization in this industry and this is I think something even vitalik has brought up uh as we uh create these insane volatile uh liquidity events uh governments notice and they decide their mandate is to exert force or exert power over um these industries so as we create more of these opportunities for them to notice uh we lose decentralization so uh essentially what we want to say uh or we want to see to have web3 grow uh to where I think we all see it being in the future is for web3 to break out of decentralized finance and become something more than just a monetary tool and we kind of see that with like decentralized science decentralized uh social media some governance tools are definitely more focused on information rather than the financial aspect but what we really believe is that zero knowledge cryptography is going to cause an explosion in these tools so um specifically you might if if you're um a little unfamiliar with zero knowledge uh you might think of tornado cash and uh how zero knowledge can be used as a tool of anonymity or potentially even subversion of central Authority or surveillance however it's actually important to note that um at pretty much its Inception uh one of the thought experiments for um justifying the need for zero knowledge was denuclearization between bitter enemies United States and the Soviet Union they needed to prove to each other that that they were actually denuclearizing but they didn't want to send uh or they didn't want to allow inspectors from each other's countries into their nuclear bases so to have uh disjointed or adversarial parties that are able to coordinate and prove things to each other is incredibly valuable both in the decentralized context uh where you know parties are just disinterested and perhaps in more centralized contexts like the relationship that individuals often have with Central authorities where incentives are very much misaligned we can start to build solutions that kind of bridge that Gap so going into the specifics again we can uh on one end we have tornado cash coin mixers which are alternate tools of anonymity and on the exact opposite end of the spectrum with very similar code uh we have uh tools of of compliance know your customer anti-money laundering um and uh moving on uh there's also uh and I'm sure a lot of you have seen uh like the temporary Anonymous Zone all the semaphore stuff um there's the ability to create an anonymous social media uh programs that again allow coordination without any sort of central Authority and uh on a completely unrelated vertical we can construct iff signals which many of you probably know you don't know what those are but essentially identification Friend or Foe signals go on combat aircraft and uh when they're flying through an airspace you can basically with a zero knowledge iff you would prove that you're allowed to be flying in that airspace without actually revealing the details of that mission and we can um start to fortify uh trustless Computing even bulletproof hosting and again on the other side of things we can be fortifying uh centralized processes specific Ally let's take IRS there's a little bit of entropy that goes into the audit lottery so we want to make sure that that is uh that entropy is sampled correctly as well all of the parameters that are used to choose how someone is audited we want to make sure that those are all correctly chosen uh improved and then finally um something that is not so new chain link has been working on proof of reserves for a while but facility takes the uh unbanking of Pop again on the other hand we can have a centralized Supply chains so uh take the distribution let's say of alcohol when you go to a bar you need to prove that you are of age and the bartender needs to prove that they are only um Distributing uh alcohol to people who are of age and this takes the form of uh literal cops sending in uh minors to actually test these places and that is a reactive solution that uses resources whereas if we were able to have a system where you can't even get in the door if you can't prove you're 21. we create a lot more we free up resources for obviously the people who are checking uh the cops and then as well it makes the lives of both really the distributor a lot easier given the compliance is is managed in a programmatic way and a proof a provably correct way so just to summarize it uh we have uh semaphore again um which is uh something that could be used for anonymous coordination or uh kyc ammo so what you should really be thinking is that zero knowledge is an incredibly versatile tool and how it is actually molded into whatever product uh that's up to you so specifically uh if you are kind of intrigued by semaphore and you think that you have some way to contribute there's actually a grant round going on right now um I it said uh 14th on an earlier thing but I'm pretty sure that this link says uh the 28th so I would uh highly encourage you again if uh this is remotely uh interesting uh to look into that Grant uh because there's a huge community of like-minded people so awesome yeah with the background of uh some of the applications of zero knowledge let's jump into uh the actual history and how this came into being so uh no doubt uh zero knowledge has very much been much uh somewhat of a Zeitgeist this past year everyone's talking about it how it could be used for privacy purposes scalability but uh what not many people might know is actually uh you can trace this Genesis back to 1985 uh two years after the founding of tcpip and six years prior to the first website on the world wide web uh it was first published in obscure paper by goldwasser Macaulay and rakoff and uh really what this paper at first introduced the whole entire concept of zero knowledge cryptography but it'd be about three decades until we actually saw uh some continue or some additional work on this uh in 2013 we saw the first CK snark implemented through something called Pinocchio um we saw the first example of a ZK VM through a tinyrem uh these weren't blockchain uh specific per se but three more years we would begin to realize the uh you know the opportunity that zero knowledge cryptography really could provide in terms of scaling uh and providing privacy to ethereum and this happened through uh the proving mechanism called growth 16 which was really the first practical CK snark you know something that could uh handle almost any arbitrary computational uh problem and uh encrypt it um two years later we would see a golden year and zero knowledge cryptography uh Barry White Hat implemented the first throw up as far as we were able to uh to uh ascertain uh circum a language made specifically for writing CK circuits uh were released by an organization called iden3 uh the foundation of the zk's historic which is a different um type of zero knowledge proof apart from Starks that stands for zero or sorry uh scalable transparent argument of knowledge and uh what it really provides um that snark stone is it's Quantum resistant and it also removed moves the need for a trusted setup which up until this point has been a major complaint of implementing zero knowledge proofs fast forward to 2019 and Aztec released a new proving scheme for Stark's called Planck this didn't totally get rid of the proof uh The Trusted setup but what it did allow is a universal trusted setup so instead of needing to provide uh perform a lengthy trusted setup for every single snark you implement you only have to do one that can then be applied to many um a year after that uh starknet released their own ZK VM called Stark x with its native language called Cairo importantly to us uh Z cash started work on the Halo 2 proving scheme which is foundational for battleships V2 what we want to accomplish here and uh we'll talk about that a bit later uh in our presentation a year after that Mina came along with the idea of snaps zero knowledge applications or zero knowledge steps as well as circum released uh or item three release circum 2.0 uh which really with that that's what made it possible to uh release Battleship speed one and present at East Denver uh back earlier in 2022 then fast forward to a modern day A year later 2022 uh plonky two the successor to plunk uh allows proving speeds that are 100 times 100 times faster uh zke EVMS are beginning to enter the mix uh in the experimental stage uh that include polygon Hermes scroll which actually implements Halo 2 and then uh ZK sync as well and then finally uh an interesting uh application that exists now is zprize which is a zero knowledge analog of xprize what it basically aims to do is uh provide a list of bounties so that um those interested in improving the uh efficiency which with um zero knowledge algorithms compute uh can go and claim these prizes um but yeah no now that we've gone through the lengthy history let's talk about how you can actually apply ZK to uh the evm and to do this you really have two options uh you have the option of applying a domain-specific language or utilizing a ZK virtual machine um and both both uh methods have their own pros and cons their own trade-offs and ultimately when it comes down to is you know what are you trying to achieve with your application what's the scope of it um but we'll uh go through the pros and cons right here you know this Pointer's tricky um so when it comes to a DSL scaling requires expertise um but whether it's EK evm the entire purpose of this uh other network is really to allow scalability of your applications um uh with dsl's computation is verified directly on layer one uh but with GK VMS technically they are a layer two so all computations take place on uh set Layer Two and then consensus for dsls comes from the root ethereum network of your choice and then again uh touching on the point just before uh a layer two or a ckvm being a layer two you know you're relying on an entirely separate set of security and uh validators that you trust will uh put your um eventually reached consensus on layer one but ultimately it's up to this external network and then uh when it comes to dsls uh the software development kits that exist right now do their best to abstract away complexity but really what ends up happening is uh you kind of have to put on another thinking cap um you know for those of us who are used to uh developing in standard languages you really when writing to your knowledge produce can't get away without learning some of the cryptographic principles uh underlying elliptic curves uh finite Fields constructing arithmetic circuits so there's definitely a lot of overhead and a lot of investment you have to put in before you can actually get to writing your own program um whereas in a VM uh it's specifically abstracting a lot of the ZK uh overhead away so you can get in with knowledge as a developer and get ahead and running your apps like that um and then finally talking about portability uh between dsls and VMS uh what a DSL basically allows you to do is it's a way of constructing your uh files for proving and verifying 0 your knowledge proofs then it's up to you where you want to deploy them to be it a solidity smart contract on uh be root ethereum chain it's really up to you where you deploy to but when it comes to ZK VMS you face vendor lock and risk you know you might have a specific idea of what chain you want your application to end up on but down the road uh if you're you know if the scope of your project changes you can end up being locked in and um you know I lose some flexibility that way but we're out we ended up going on is uh the DSL route and for that we chose cercom uh circom was an obvious choice because it intuitively uh provides a language that closely mirrors the cryptography you have to learn um so after going through that headache learning the ins and outs of the underlying cryptography you can pretty much write out everything you've been working on the past weeks or months however long it takes you uh but anyways uh as much as we love story com we found it difficult to actually go from beginner's EK developer to releasing battle Zips we actually have crafted our own good book called uh awesome circum and uh you can reach it there by scanning the QR code or go to battleships.com resources but I just want to preface that it's not quite done yet but come this Friday it should be complete um but yeah check it out for sure we're gonna get that that finish but uh basically uh taking the topics that we think are important from uh you know someone who's absolute newbie uh uh to basically be introduced to borderline spoon fed um and there are some that are really well documented um the proving systems Roth 16 and Planck and oh ceremony that is trusted setup for grass 16.

we don't really need to do a lot for that we are really just aggregating existing documentation and putting it in an easy to access format on the other hand we have multiplexing in circom this is a little hidden tidbit that took us a while to figure out if you read the circum documentation you will be misled into thinking that you can use if statements you you try to use an if statement to compute a condition to select a conditional statement in circum you will get an error called non-quadratic constraints not allowed very dreaded and to circumvent it essentially you need to do something called signal multiplexing which is where in zero knowledge you cute both cases or let's say you have n different branches of logic you compute all n branches and only once you've computed every single branch in zero knowledge then can you select which branch you want and this is uh this is an analogy from electrical signal processing I believe this is how uh TV channels and cable even works but um the point is if you aren't familiar with this I know I wasn't when I was looking through various code bases and looking at multiplexing and while you see an if statement in the documentation it can be very confusing but um so that's an example of something we go more in depth on um for the sake of time I'm going to speed through a little bit of this um but uh we have some stuff that's again more documented uh which is the arithmetic friendly implementations of uh different hashing algorithms which then uh underlie the signing algorithms so sha3 and um uh ecdsa out the window uh we're now using Poseidon or MIM C at the very least and uh eddsa which are far more efficient um we have Merkle trees which I'm sure a lot of you are aware of but they are one of the most powerful tools both for privacy and scalability we can take a massive massive data set and compress it into a tiny hash and not only is this clearly a method for scaling but we're also taking that data set and obscuring the data within it while still being able to operate on it so this gives us both privacy and scalability so you will definitely be working with Merkle trees and then there is first and third party devtooling the first party devtooling you literally just have to use circum uh relies on snark.js to actually put proofs in the evm and then there's also circum tester which unless you want to spend two hours running tests every single time uh you're going to want to use something that simulates the logic rather than actually running the entire overhead and then there's also third-party tooling which is maybe not as required but still is very important for having a good time developing so there is The Shield CLI which was just released I believe two weeks ago they released their first non-beta version and you can think of shield as hard hat or maybe truffle for circon essentially it um takes you'll see in the battle Zips code base there are a couple of bash files that handle the generation of circuits and this is something that requires an understanding of what you're doing whereas The Shield CLI will just do this for you so whether you're already experienced with the circums and arc.js and solidity stack or you uh are brand new especially it's going to be very helpful for kickstart starting a new repository and then there's also the circumspect static analyzer and this is another thing in circum the debugging and error messages leave a little bit to be desired so having a tool like uh circumspect to analyze your code point out areas where perhaps your miscon training misconstraining something or you're just not correctly writing code is is very valuable so again circumspect and shield CLI very important and then finally implementations we've done a couple of videos and we've got stuff on there so I'm not really going to go into it but um the actual specifics of using zircon so now that we've kind of gone through uh all of uh what that is uh again I think there's like one more minute so I'll be quick but um we built uh our original version of battle Zips as a purely a privacy preservation tool and uh this is mostly what we've been speaking to you about today uh circum so this essentially allowed us to prove uh an adversarial uh interaction between two parties where they could still trust each other uh without revealing all this information so it was a great proof of concept for us to demonstrate um private information on a public blockchain but it fell short in a lot of ways the scalability is pretty trash to be honest and um the intermediate state so you're still hiding the ship positions but um hits and misses all the different turns in a game all that's public so moving on what we're now working on with the assistance of the ethereum foundation through the grant is Battle Zips V2 and this is a little more uh exciting and novel we think essentially we want to demonstrate using battleships the generation of State in a state Channel off chain and then we summarize the entire State channel in a single transaction using zero knowledge and what this allows us to do is produce these interesting truths so you get this uh almost immutable or indivisible object a battleship game valid Battleship game occurred between Alice and Bob where Alice was lost we'll talk about that in a second but um essentially this benefits both privacy in that you have the intermediate state shield and scalability in that um you're batching all these transactions and um we intend to demonstrate how that can be used to drive qualitative insights without revealing a ton of like personal information using ELO scores so I think we'll just skip to the next slide but because it's kind of the same thing um again uh battle Zips and and Zips is a kind of data structure is uh basically State Channel summary um where we're rolling up all of the state that we generate in like a ephemeral Layer Two we collapse it back onto layer one as soon as the state generation is done and um we already talked about the battleship Battleship proof but uh there are a couple of more real world examples that um are exciting to us take proof of a valid delivery you know there's a bunch of different parts that go into it perhaps there's iot temperature controls or perhaps there's an inertial sensor on something that's fragile and can't be moving in transit chain of custody whatever you decide is necessary for your supply chain you can then package that into a single proof of delivery and what that uh the consequence of that is that the participants in this say the delivery drivers who have no interest in being doxed on chain uh don't have to be docked on chain you you can start to involve them in these economies without them being exposed to all these negative externalities that web3 currently exposes us to and again just another example which is a little less novel obviously there's you know snapshot which is somewhat centralized but um essentially we can uh you know take this entire um uh voting process off chain I assume it probably looks a lot like Macy too actually in in um premise but instead of it occurring all of the state accumulating on chain um where uh in in Malik style uh it's it's all even public uh we are accumulating uh the vote off chain and then rolling up uh a proof that a vote occurred on this proposal where 65 percent of stakeholders approved it or 65 of Governors or whatever so uh it creates these kind of indivisible proofs that uh can be used for various things so yeah um so if you guys have uh any [Applause] thank you [Applause] sure yeah um really quick any desire to be working on this and you're struggling to get started um we have I think in uh the battle Zips resources we have a link to our Discord um you can go in there and drop literally any question we'll do our best to answer it with the QR yes sir um and then are there any questions maybe have time for like one or two okay if not another huge round of applause for Jack and Ian thank you [Applause]