►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/zkevm-vs-evm-full-equivalence/
At Polygon-Hermez we have bet for the zero-knowledge EVM to solve Ethereum scalability.
We will talk about what is the ZK-EVM and how are we dealing with it at Polygon.
We will explain the differences between zkEVM and EVM,
Also the main challenges, tricks, tech decisions and differences we had to apply to achieve EVM compatibility will be explained.
Speaker(s): Ignasi Ramos
Skill level: Advanced
Track: Layer 2s
Keywords: zkEVM,zkrollup,EVM
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
A
It's
been
a
year
a
year
and
a
half
that
we've
been
working
very
hard
to
release
the
the
ckvm
and
I
am
very
happy
I'm,
very
proud
to
announce
that
on
Monday
it
was
announced
the
release
of
the
ckvm
on
public.net,
so
I
would
ask
you
to
do
an
Applause
for
the
polygon
team
that
they
did,
that
effort
that
it's
it's
enormous.
So
thank
you.
A
A
After
that,
we
will
go
like
to
the
topic
of
the
talk,
which
is
the
the
difference
between
the
ckvm,
the
polygons
GK
VM
and
the
evm.
So
what
is
AC
KVM,
there's
a
well.
There
are
like
the
three
statements
that
I
think
that
they
Define
the
minimum
of
RC
KVM,
which
is
that
it
is
a
virtual
machine
that
executes
smart
contracts
in
a
way
that
is
compatible
with
zero,
no
less
proof
computation.
And
why
will
we
like
to
do
this
because
we
already
scale
ethereum?
A
We
want
to
increase
like
the
throughput
of
ethereum,
the
transactions
per
second,
at
the
same
time,
at
the
same
time
that
we
lower
the
fees.
So
how
can
we
do
it?
We
use
gksr
technology
to
make
cryptographic
proof
of
execution
of
ethereum-like
transactions.
In
a
summary,
and
now,
when
you
process
like
about
with
a
lot
of
transactions,
you
get
a
result,
you
get
an
output,
you
get
an
estate,
so
how
can
other
people?
A
Who
can
other
ones
to
trust
you
that
this
process,
this
process
of
the
batch
has
been
done
with
with
correctness,
has
been
done
correctly,
following
like
the
evm
constraints,
they
have
to
process
also
those
transactions
and
see
that
the
output
is
the
same
with
zero
knowledge
and
proofs.
We
can
like
do
it
easily
because
we
can,
after
processing
all
those
transaction,
create
acid
or
knowledge
proof,
and
if
someone
wants
to
validate
that,
this
transactions
have
been
processed
correctly
like
following
the
constraints
of
the
ABM,
the
only
of
the
ckvm.
A
In
this
case
they
only
have
two
verify
that
proof,
and
this
is
faster,
also
the
verification
of
a
proof,
it's
always
constant,
which
is
very
interesting.
Actually,
this
is
like
a
game
center
in
the
in
the
ecosystem.
I
remember:
it
was
around
the
SCC
that
a
lot
of
companies
were
doing
like
release
announcements
of
releases
of
gkvms
and
it
created
like
a
lot
of
noise,
especially
in
social
media
and
in
many
places
a
lot
of
people
was
very
confused
because
a
lot
of
new
words
appeared
there
like
compatibility
equivalence.
A
What
is
the
approver
I
don't
know,
but
luckily
we
have
like
beta
League
that
he
did
a
very
interesting
blog
I,
actually
I
strongly
recommend
it
to
to
read
it
when
he
classified
the
ckvms
in
five
times
he
created
what
I
like
to
say.
Like
the
cqm
Dilemma
like.
If
you
have
more
performance,
you
have
less
compatibility,
and
if
you
try
to
have
more
compatibility,
you
will
have
less
performance
actually
at
polygon
ckvm.
We
aim
to
be
from
type
2.
A
A
So
the
advantage
of
of
these
of
this
type
2
is
that
it
has
a
lot
of
compatibility.
It
has
as
much
compatibility
that
we
can
talk
about
equivalence.
The
disadvantage
is
the
performance
and
the
village
in
vitalik
course.
He
said
that
it
takes
like
a
lot
of
time
to
generate
the
proof.
Well,
this
is
habit.
Relative
I
mean
what
is
a
lot
of
time
now.
A
We
are
generating
proof
in
around
five
minutes,
but
we
still
know
how
to
do
it,
and
we
have
a
lot
of
ideas
in
mind
and
how
to
reduce
these
two
up
to
five
minutes,
and
also
it's
not
that
that
a
big
problem,
because
you
also
can
like
parallelize
the
proofs
first
of
all,
I,
would
like
to
explain
like
very
simply
when
we
talk
about
equivalence.
What
are
we
talking
about
we're
talking
about
that?
A
Putting
the
batch
of
transactions
in
the
evm
and
putting
exactly
the
same
batch
of
transaction
or
the
same
block
or
whatever
to
the
ckvm
and
get
the
same
state
and
when
I
say
State,
it's
like
the
same
state
route
and
when
they
have
like
the
same
state
route.
It
means
that
the
storage,
the
the
state
of
the
blockchain
is
exactly
the
same.
A
It
means
that
all
the
accounts
have
the
same
balance
with
the
same
nodes
with
the
same
value
code
with
the
same
storage
with
whatever
they
are
exactly
the
same,
so
are
different
black
boxes
because
internally
they
work
differently.
But
the
equivalence
means
that
for
the
same
input,
The
Hive,
they
have
the
same
map
output.
It
could
be
like
a
lot
of
time
explaining
how
we've
done
it
and
there's
people
here
sitting
that
could
explain
it
by
far
better
than
me.
So
I
just
do
like
some
some
sentences
just
to
put
some
context.
A
Also,
it's
not
not
the
topic
of
the
of
the
talk,
but
we
can
discuss
about
it
later,
but
at
the
end,
what
we're
doing
is
a
processor,
okay
and
a
processor
has
clocks,
so
each
clock,
it's
like
a
new
test,
a
new
state
and
we
are
playing
with
these
newer
States
as
steps.
So
as
all
and
processors,
you
can
build
a
an
assembly
at
the
top
of
them.
A
You
can
build
an
assembly
language
to
Define
these
steps,
and
this
is
what
we've
done
with
a
language
called
GK
assembly
with
Decay
assembly,
without
try
to
replicate
the
behavior
of
the
evm
in
an
assembly
language.
When
this
Assembly
Language
is
completed,
it
creates
like
a
build,
which
is
a
a
big
trace
of
all
the
steps
that
and
well
Define
the
the
processor.
A
On
the
other
hand,
we
have
the
build
the
polynomial
identity
language
with
its
like
one
step.
More
of
silicon.
2.0
is
also
a
language
done
by
or
take
lead
or
develina,
and
what
the
executor
does
is
that
he
gets
the
ROM,
which
is
the
build
of
the
cksm
language
that
I've
just
explained
it.
He
also
uses
the
pill
where
there
are
the
state
Machines
of
the
ethereum.
They
find
it
there
and
he
like
verifies
the
correctness
of
each
one
of
the
steps
of
the
ram
while
it
process
the
transactions
so
more
or
less.
A
This
is
this
is
how
it
works,
like
I'm,
just
scrapping
the
surface.
This
is
how
it
was
the
the
ckvm
and,
of
course,
as
all
other
processors.
We
also
have
a
ram
and
install
it
now.
Let's
talk
about
the
variances
between
both
of
the
of
the
avms
and,
as
you
may
know,
the
ABM,
which
uses
a
particular
tree.
While
we
are
using
a
sparse
medical
tree
where
the
leaves
are
indexed
in
each
Leaf
of
the
ebm,
we
store
well
the
storage,
the
registered
all
the
information
of
the
account.
A
They
have
denounced
the
balance,
the
storage
route
and
they
got
the
hash,
but
we
are
doing
it
differently.
We
are
doing
it
differently
on
each
Leaf.
We
only
store
one
property
of
the
account.
So
this
brings
me
to
the
second
difference,
which
is
the
hash
for
the
evm.
It's
used
the
Decay
tag,
but
we
are
using
the
Poseidon
with
the
goldilock
prime
number
as
definite
field.
A
This
is
for
performance
reasons,
so
when
on
ethereum
you
want
to
get
the
you
want
to
get
the
key
of
a
leaf,
you
have
to
Hash
the
address,
but
as
we
all,
we
only
count
retrieve
like
one
property
of
the
account
for
each
Leaf.
We
have
to
Hash
the
the
address
with
a
property
key,
for
example,
if
we
have
the
ethereum
address
with
the
property
key
of
balance,
we
will
get
the
Leaf
where
it
should
start
at
the
balance.
A
Another
difference
is
that
ethereum
uses
more
than
one
tree
to
Define
all
the
system,
as
you
can
see
here
in
one
of
the
leaves
there's
the
storage
root,
the
steriletruth
points
to
a
different
state,
three,
where
the
storage
is
restored,
we
are
doing
it
differently.
We
only
have
one
tree
that
defines
the
whole
system.
A
The
ABM
uses
for
detached
load
of
memory,
8
Bits,
one
byte,
and
we
are
using
256
bit,
let's
like
32
bytes,
so
we
are
working
with
a
we
get
a
memory
slot.
These
makes
that
when
you
are
according
to
the
memory,
the
what
the
information
that
you
get
is
the
same,
but
the
way
that
you
obtain
the
information
it's
a
bit
different
I
mean
the
internal
logic
of
sum
of
codes
had
to
be
changed.
A
bit.
A
I
will
show
you
an
example
now,
for
example,
for
the
code,
M
load
with
them
load.
You
load
32
bytes
from
the
memory
so
well,
there
are
different
cases.
Some
are
more
tricky
than
the
other
ones.
This
is
the
easiest
one.
When
you
want
to
get
just
52,
bytes
users
are
scored
it
and
you
have
to
return.
The
full
slot
in
our
case
is
the
Fuller
slot,
because
we
have
a
slot
of
52
bytes.
A
The
fullest
load
of
the
of
the
memory
in
case
of
the
offset
is
different
from
very
well
when
I
say
different
from
zero
I'm
talking
about
mod
52..
It
means
that
at
the
beginning
of
the
slot,
it's
not
the
beginning
of
the
memory
that
you
want
to
retrieve.
Maybe
you
will
have
to
get
like
half
of
the
memory
from
one
slot
and
half
open
Memory
of
the
next
slot,
and
it
gets
a
bit
more
tricky.
A
In
the
first
case,
for
example,
we
are
only
retrieving
some
bytes
of
one
slot
in
the
second
case,
just
the
byte
in
the
middle
of
the
slot,
and
in
the
third
case
it's
like,
if
you
want
to
do
it
with
an
offset
different
from
zero
and
also
more
than
32
watts,
then
maybe
you
have
to
get
some
bytes
from
one
slot
then
get
the
whole
bite
of
the
following
three
four
five
slot.
Whatever
the
length
is,
and
some
byte
from
the
last
slot,
yes,
another
another
difference.
A
A
So
when
you
are
processing
about
you,
can
you
have
a
limited
number
of
steps
and
also
you
have
a
limited
number
of
State
machines
that
you
can
consume
while
doing
a
kind
of
code
or
an
operation,
so
in
our
implementation
of
the
GK
VM
I
will
show
an
example.
Just
after
this
slide,
we
have
to
check
that
we
have
enough
counters
to
process
that
of
code.
A
If
we
go
out
of
context,
for
example,
the
evm,
the
ckvm
throws
an
error
which
is
out
of
Counter.
This
error
is
not
user
fault
actually,
and
it's
like
a
folder
of
the
executor,
but
it
can
be
solved
easily
like
processing
this
bad,
but
with
less
transaction,
because
it
means
that
the
counter
the
number
of
counters
to
process
that
that
batch
has
been
exceed.
A
Here
we
have
the
different
the
name
of
the
fan
and
stain
machines,
for
example
the
binary
one
it
just
consumed
when
you
compute
a
binary
operation
or
the
key
tag.
When
you
do
a
architect,
hash
I
will
show
you
an
example
of
an
up
goat.
Well,
it's
a
widely
used
of
code.
It's
the
equal
one,
the
equal
of
code.
He
compares
the
two
last
to
last
values
in
the
in
the
stack
and
exit.
They
are
equal.
A
A
As
you
can
see,
the
binary
I'm
taking
I
have
at
least
one
binary
counter
for
the
state
machine
of
the
account
for
one
one
binary
counter
to
process
this
this
of
code.
It's
because
here
I
use
the
equal
and
the
equal
consumes.
One
binary
also
I
check
the
steps.
Each
one
of
the
lines
of
the
CK
assembly
is
a
step
of
the
processor
here,
I
put
120.
A
We
don't
use
the
self-destruct.
Actually,
this
is
a
difference
now,
but
we
have-
and
we
guess
that
it
won't
be
a
difference
in
the
near
future,
because
probably
ethereum
will
accept
the
EIP
4758,
where
it
replaces
the
cell
the
cell,
distract
by
send
all
so
we
are
not
using
self-destruct
from
the
very
beginning.
We
are
using,
send
all
and
I'm
happy
for
it
because
of
the
stack
creates
a
lot
of
a
lot
of
problems.
A
What
does
the
essential
does,
instead
of
removing
the
bytecode
and
the
storage
of
the
of
the
account
when
you
call
this
the
track?
What
it
does
is
to
empty
the
account
and
send
all
the
balance
of
the
account
to
the
account
caller
at
the
end,
we're
just
following
the
this
EIP.
This
is
also
a
difference
that
will
disappear
in
the
next
month,
because
we
are
really
working
hard
to
to
finish
this
and
it's.
A
This
is
the
way
we
are
not
still
type
2,
but,
as
I
said
before
it
will,
this
will
be
over
in
a
few
months.
Actually,
we
only
support
three
pre-compiles
from
the
ABM.
We
support
DC,
recover
the
identity
and
the
model
X,
and
this
is
one
of
our
priorities.
We
are
working
to
finish
them
all.
Actually,
the
S8
2.56.
It
won't
be
that
hard,
because
we've
only
done
the
easy
recover.
Maybe
they
see
biting
it's
it's
a
bit
more
tricky,
but
but
we're
working,
it's
working
progress.
A
A
A
A
It
is
different
from
the
ebm,
because
DB
game
is
unlimited,
The
Limited
is
set
by
the
gas
and
you
can
put
like
50
million
gas
in
one
one
block.
Actually,
this
limitation
makes
that
in
a
batch
you
can
put
8.5
million
for
its
transaction,
that
this
is
the
the
cost
of
the
memory
expansion
and
we
won't
have
any
more
memory.
But
I
have
to
say
that
a
transaction
with
8.5
million
cars
it
will
be
enough
to
do
whatever
you
want.
It's
also
very
easy
like
to
do
different
transactions.
A
A
A
It's
we
are
fully
VM
equivalent
and
I
also
would
like
to
to
send
a
message
like
this
in
the
second
point,
which
is
that
the
difference
that
I've
been
explained
now
most
of
them
are
for
this
for
n
to
be
more
equivalent
and
with
a
better
performance,
I
mean
we've
been
building
the
ckvm
with
a
different
toolkit
that
what
was
done
with
the
evm.
So
we
have
to
take
like
some
technical
decisions
with
different
tools,
but
to
reach
the
equivalence
also
taking
in
account
the
performance.
A
It
was
better
and
finally,
to
finish,
just
tell
you
that
what
I
said
at
the
at
the
beginning,
we
are
on
public
investment,
so
we
really
encourage
everybody
to
try
to
crush
it.
Try
to
test
it
play
with
it.
I
mean
it
will
be
very
good
for
us
if
you
crush
it,
so
we
can
find
a
work
and
we
can
iterate
and
deploy
again
fix
the
back
and
and
all
this
so
just
to
to
finish.
Thank
you
very
much
for
thank
you
very
much
for
for
being
here
hope
you
enjoyed
the
talk
and
thank
you.