Ethereum Foundation DevCon 6 - Layer 2s Track, 18 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Technical Details of the Opcode Compatible zkEVM by Jordi Baylina | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/technical-details-of-the-opcode-compatible-zkevm/

I will explain some technical details on how we, at PolygonHermez, built the opcode compatible zkEVM. This will include some design details of specific pieces like the storage, the arithmetic state machine, the keccak circuit, among others. I will also go thru some snippets of the zkASM code that emulates the Ethereum VM.
I will include in the talk some performance measures and I will do a live demo of the testnet.

Speaker(s): Jordi Baylina
Skill level: Advanced
Track: Layer 2s
Keywords: zkEVM,Zero Knowledge,rollup

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

And today, I'm going to present mainly the public test net that we publish it last last Monday, first of all, I'm going to explain a little bit how the ckvm works, and then we are going to proceed to a demo works from the user perspective.

A

Well, a user should not see any much any any difference like working with any other network. What we will do is first, we will send uh transactions to a sequencer, a sequencer. We're already give a a state. That means that the state will be final as far as you try as a sequencer sequencer. The first version is going to be a centralized sequencer with the centralized later on. But if you trust a sequencer, this transaction is final and you have the warranty by the sequencer that this transaction is going to be mine.

A

It's going to be process it. The sequencer will collect transactions and, at some point, we'll send these transactions to the blockchain, okay and- and then at this point the state is final and safe. Here we don't have any proof. Yet it's just the transactions are set and you have the warranty that those transactions are going to be processed uh in that order and because they are on chain you could they cannot. They are not going to be changed, so they you know that they are final and you don't need to trust the sequencer anymore.

A

You know that these transactions are final and in background. In parallel, it's going to be the proverb. Actually that's going to take all these transactions and it's going to compute it's going to prove that this implicit state. So this is a state, that's everybody can compute, but it's not. It's not Unchained, because you know Chinese are only the transactions, the data availability, if you want the transactions are going to be processed, but it's going to be converted to a rare to a real State, and this is proved by the approver.

A

This is the big difference with the optimistic rollups in optimistic relapse. You need to write for somebody to to challenge this state in the in you know, in in a zero app this estate, it's become the prover just set this state, and you know for sure that this that that this is valid. It's at this point where the user can withdraw with router funds. So here the most important piece or the differential pipe is of a CK Roll Up is the proverb. The proverb is a zero knowledge proof If.

A

You want a validity proof that uh validates the transactions which transactions ethereum transactions is taking. A state, is taking a set of infinity transactions and is Computing in your state and validating that this state is valid, so how how the program is built. So what's what's inside the approver? Well, the approver is a set of Technologies, but the way we build this, we have a circuit with a traditional circuit, written in in pill, specific language we built for the ckvm. That's mainly a processor, it's a generic processor. It's generic!

A

It's with some specifies that, but it's a processor that's built with this zero knowledge uh technology and on top of this processor, we are running a program. We call it a ROM okay that actually is an ethereum. It emulates ethereum it actually, this program just is the is this problem is the one that is actually taking the transactions uh analyzing, the transactions, checking that the signatory is valid, discounting the balances, checking the fees deploying the smart contracts executing the smart contracts and doing exactly the same. That does gaffer.

A

That doesn't mean ethereum, node, just processing this processing these transactions- all this goes to approver, and it's and this Brewery is the one that's verified on chain. If you zoom in in the processor. Well, we have a mainly a processor. Is this ZK processor? It's a all. These processor is very tailor made for uh the ckbm, so it's not like a very generic processor. It's this part, that's generic, but there are specific pieces that are made explicitly to be optimal for running the evm program. The ckvm program.

A

Okay, this processor has a ram, has a ROM which contains this program. That's executed contains the storage, because the ABM you should be able to store values and and and get the values it have also uh kind of a suit processor that handles all the binaries operations here includes addition subtraction and torque xores, and so on has a model. That's for identic. This is you know in the in the in the IBM.

A

It works in 256 bits, so this arithmetic circuit actually does all these operations in the 256 56 bits, okay and then has uh the hashing for ketchups and other hashes that are also inside the inside the process inside this processor. On top of this processor, there is this ROM okay, this ROM is written in assembly. It's a specific assembly for this processor, and here is what contains that this here contains all the logic.

A

Actually, what contains all the all the sodium logic that when we are processing here here, I want to show you just a snippet of code of how this looks like this is just, for example, the the one and two, but here we have all the opcodes. We have implemented all the ethereum of codes uh at this point and then once we run this, then we need, like the cryptographic prover the cryptographic proverb. uh What we do is mainly we are using Starks with a a very optimal way to compute proving systems.

A

We are using Goldilocks, it's a technology for from people from for our colleagues in polygon 0. That makes to build these proofs really fast and it's again for recursion, so it's approver can aggregate many proofs and at the end this is a stark and at the end, what's doing is we are are converting. We are very fine, is a stark with a snark. So at the end we just in ethereum we are just verifying a normal growth, 16 or block uh proof. It's just a circle.

A

It's a circum circuit in the last in the bottom of that piece. So this is the stack. The cryptographic stack for verifying that okay. So let's cross fingers and let's try to see the demo, let's see if it works. If it doesn't work, you can try it. Okay, you can go to public.c, kvm.test.net and fantastic. You will see. That's very simple. The demo that I'm gonna do is first of all I'm gonna Bridge it.

A

Let me just uh switch okay, so the first thing that I'm going to do is I'm gonna, I'm, gonna Bridge, uh so I mean go early. uh I'm going to early Network I have an account here. That's uh has three go early already and it's just a strike new account that I just created before this. So the first thing that I'm going to do is I'm gonna transfer, I'm, gonna Bridge, three ethers, uh three uh well 0.25. First.

A

This is the maximum that we allow here in this test now just to protect some Daniel of service attacks here uh and we are just to transfer to the uh to the layer to the layers too. So I mean go early right now, so I'm just uh like, let's see if ethereum works, okay here we are, uh let's Bridge it okay! So let's sign! Let me just uh let me just let me just modify the gas fee so that it takes.

A

uh It goes faster, let's go early, so you never know, save okay and then just send this transaction. Okay. Okay! Now that that no that so we just deposit the transaction, this transaction is mining inwardly. We need to White also a little bit so that this transaction is kind of a final, so that this transaction is included. Okay right now, it's this is already so it's. This is already done.

A

What we have done is we just put this transaction in America tree and then the root of this migratory of all deposits is passed uh is passed as the as the state of the of the Roll Up the sequencer.

A

Actually, there has not been any trans any special transaction on chain, because the sequencer already takes in account that okay, so now, let's uh finalize this okay- and this finalize- what is doing is collecting is doing an L2 transaction to collect these uh for these phones, this ethereum in the in the layer two so here when I push here.

A

The first thing that I'll ask me is ask me: is just to switch the network, so I'm just switch the network and now I'm just signing the transaction in in and just on just signing the transaction in Layer Two, okay, because I just signed into transaction.

A

Let's see if it works there we go shoot. Yeah here is okay. So now, if I check the account I'm in the layer, two now I have the 0.25 ether in the layer in the layer, two okay. So now, let's now, let's go to do something with this account: okay, let's create a smart contract and deploy it in this layer too. So let's go to remix just gonna use uh an example. Very simple, smart contract looks like remix is gone, so let's meet this little work. Yes, it's just a very example: smart contract.

A

So let me compile. Let me compile this smart contract. There is and now I'm going to deploy it to the layer. Two so I'm going to connect this to a metamask, okay, I'm. Just using this account and then I'm just uh well. This is I, don't know if I'm connected to the last one well just connect here yeah. This is the one that I just did. I have the 25 feature here so and let's deploy this okay, so just deploy this Mark on track.

A

It asked me to sign I just confirm this transaction see if it goes.

A

Its internet is not like the fastest thing here, but here is okay. So now here we have the smart contract. If we do a get a it's, we get a zero, but if we, for example, we set a 22, so this will generate a transaction to set this state variable to 22. We sign it confirm.

A

Save there is and just get the value.

A

And I see here, 22 right here: okay, so I just deployed that in layer 2 like any other network here- okay, so uh what's going on in here, so let's, let's see, let's see the let's go to the let's go to the uh to the. uh This is the roll up the smart contract in the layer, one okay and here we see two kind of transactions. One are the sequence uh batches like here where here you can see in the data that this is here, all the all the transactions that we are setting?

A

Okay, but in parallel, but in parallel to this we have the the batch. The batches is the proverb: that's generating batches, that's actually validating these transactions, and here is where all the magic happens. Okay, here in the blockchain, you cannot see much, but here is the proof. Actually, this is the grow. 16 proof in this case that validates all the transactions that we have been processing. Processing.

A

Ok, so until here is well I can maybe I can give you a bonus bonus track here, so we can go, for example, to UNI swap okay. This unit is obviously is already deployed. Assist without compelling and recompiling anything, it's just a normal unit, swap it's deployed in Layer Two, and here we can do, for example, a transfer. Let me just just change the account to the first one so that I have some some tokens to to exchange.

A

Okay and here I want to compare from Full to Bar, just a normal swap.

A

It's fetching the price and just doing the swap The Firm swap I should sign the transaction. So here we have uh deploy it. So we here we have already deployed the full uni swap but version 3 in the layer.

A

Two and all this is verified in the program just confirm that okay, now this is confirmed now here, the the unit swap interface has some uh it's iterating takes maybe some 10 seconds or so to to realize that the transaction has been moved, but that's mainly the thing okay, so let me go well just let me see if it finished this.

A

Okay, so I already do the swap so I can just checking in swap just like normal, like any other uh ethernet transaction. So let me switch back to the presentation.

A

A

Nothing fancy right, that's the cool thing, and that's like strange things, even for me explaining for me here I'm just feeling that I did a demo of ethereum, but this is the interesting thing. It's that the all this is running all this is validated in the Brewer, all these transactions that are really complex or all the unit swap transactions and everything. This is validated uh inside the broker, and this is what this zkbm and the main importance of this design. You don't have to recompile anything. You just take the code exactly the same code.

A

You don't have to reality. Anything you don't have to learn anything. You can use exactly the same tooling. You can use the same, the same language, the same gas model. It's no difference for developers. They should not notice any difference in deploying in working with ethereum or in uh or in the KVM. The only difference should be the gas price and the quantity of transactions that you should be able to deploy.

A

This is a test net. Please test it. We have been running for this week. Already we have more than 1 000 accounts. We have, most of them are just deploying uh transactions, some of the projects already tested uh already tested without any big issue. We have some reports of some bugs that we haven't fixed also, and we will continue work. It's this testnet is a little bit like a baby. It was worn last Monday, but uh it's gonna get stronger, and this is the the previous stage just to the to the to the main net.

A

Okay, here is uh okay, and what's the limit of the scaling list, we don't know yet. What's clear is not gonna? It's not gonna, be in the proverb it's going to be, maybe not that availability, it's going to be in the maybe in the sequencer in the other pieces, but because why? Because the proverb can be parallelized and here the important part. Actually, for example, we are running uh seven Brewers at this point, because this week you know there is main transactions.

A

Some of the products have been stopped, so we are just just trying to catch up with the trend with some of these transactions. But this is the cool thing we can run as many Proverbs as we want. So if there is a lot of demand, we're just running more Brewers and the only thing you need to take in account is what's a cost per transaction because running these servers are not free.

A

So what's it what's this cost well, the cost right now is less than one cent per transaction, and there is this is in AWS cost, which is probably the the most expensive cloud service in the in the in the in the world, and there is also a lot of optimizations that are coming here in GPU. We can. We believe that we can improve one order of magnitude and there is other improvements that we are working on. That, but proverb is not the is not the the bottleneck anymore.

A

What's missing? Well, not much so we are fully compatible. We are running all the all the all the off codes. Everything works as as ethereum is. There are some things that we are already implementing. They are not implemented yet and I'm just listening here, but everything is there. What is missing is that AIP is the original ethereum transactions. This is mainly to deploy mainly not safe, but it's uh just for for distance.

A

These smart contracts that have the same address in many in in in in many chains they use they are using these primitive transactions that they don't include the chain AV we are implementing those and then the we are not supporting yet the shadow 56, the Blake and the paintings pre-compile to Smart contracts. But this is a work in progress.

A

All of them are doable and we will we will work in the upcoming on those on in the upcoming in the coming months, there is the Audi Title One to enter an entertaining the Audi, but this is probably the the most challenging part that we're facing right now. There is a full plan for running this outage. If anyone interested in that, please contact me. What else are we working on?

A

We are working also in aggregating of the proof right now, the aggregators right now we are running one one proof per batch okay, but we have to uh run one. So we need to aggregate all these proofs in a single transaction and and with this in a single proof, actually we're working in this proof. This is not that much because we have all the recursion already done and it's just putting them together. That's a piece that we need to put there and we're also working with AAP 4844 for line shelving.

A

This is uh clearly the future for the scalability, and uh we already uh working uh on that. We're very excited on that. I I have to recognize that when I read this EIP I was very skeptical at the beginning, but uh it's really the way to go. We we can Implement insight and it really go will go even faster and it's even better that what I would what I would do? It's just that you. The only thing is that you need to go a little bit deep to understand this VIP. That's really interesting!

A

I'm very excited for this gaming testing, we're running the the ethereum test. Suites right now we are at 97.7 97 of uh passing all these tests. There are edge cases that we're still uh working on that, but I'm sure that uh very soon uh we will be covering the will be in 100 of the of the ethereum of ethereum test roadmap. Of course, we just launched the public test net. uh We need to audit and we will launch when it's ready here is uh we want. We want to be enough safe.

A

We want enough sure that so 100 uh safe is going to be impossible, but we want. We want to be responsible and we want to update this very well and when we feel comfortable, then we will we will. We will launch a reminder. Everything is open source. You can take a look. You can see you can you can review. Everything is uh in the GitHub repositories and yeah gkbm is no longer a myth.

A

B

Thank you so much. uh We have a couple of minutes for uh questions. So if you have a question, please raise your hand.

C

Hello, thank you for the presentation. uh The AVM is not a frozen object, it's leaving and it's evolving with new eips, and we are going to see possibly big change like the eof or other things like that, and they will be way easier to implement for core devs and for you. So are you worried that some possible evm change will be hard to translate into circuits in the future.

A

We need to see which are those changes and once I see the changes. I will tell you, but there is one thing that, because this is this is some of the the questions that I received. Now it is sometimes it's more about the upgradability of uh this. What happened if the ckvm upgrade and then what happened with the roll up it will upgrade, and if you want to decentralized system- and but here is uh we need to understand as a community that uh the ABM at this point is evolving because it's work in progress.

A

But at some point this will this. This will need to be frozen.

A

uh I don't know when and how but and I'm not talking about the ckvm I'm talking about the AVM, so the ABM, if you want uh I, believe I, I, I, I, believe I hope and if talking with people with the effort, they already think very much on that time. Is that at some point, maybe in two years, three years, five years, once the ethereum is finish it then the IBM will be Frozen and then it will be also the time to for to freeze the the roll-ups.

D

Thank you for the presentation. Great talk, I would like I mean, could you detail a little bit? What are the edge cases that you are meeting regarding the failing tests.

A

uh Here we have uh Carlos in the room, that's responsible for testing, you can ask them, but they are very very they are very, very uh complex one. It's a Carl of a static call and then do a surface truck and and do whatever you know. This is our very, very edge cases uh very, very edge cases testing, but you have to take. You have to look at it because you never know one and it's important. That's why those tests are are there but are really really edge cases at this point and complex ones, hi.

E

Thank you for the presentation uh when you were showing the uh on ethoscan the contents of the badge you showed like that there was like you know uh the code like encoded set of transactions. Is there any way to decode them uh to to see what exactly is in the batch yeah.

A

It's mainly many other transactions, uh one after the other. uh um We have some internal tooling just to to take a look on that. Well, actually, they are open source. You can check the repositories, but we are building it and in any case, it would not be difficult to interpret at the end. It's just a format with with the array of transactions.

B

I think we have time for one more question. So if you can lend the microphone to our speaker ah cool go ahead.

F

Hey thank you. Can you hear me yep? Okay, um first of all, congratulations! This is amazing um when you launched, let's suppose it's early next year. Obviously it's a very complicated system. If you find some bug or something that needs to be addressed, what can you do in that situation?.

A

With the strapping decentralized systems is not uh is not an easy topic uh here we have the experience of Hermes 1.0 in our team, and here you do, some I would say nasty tricks.

A

uh Here is, maybe you do an upgradability things that you we can you can do is an upgrade, so you can upgrade the smart contracts with maybe with a time lock, and you can do, for example, is limit the the withdrawal, the the withdrawal flow, that's leaving the smart contract so that it's like, if you are working with less as a certain amount, you are purely decentralized.

A

But if you want to run fast and run bigger numbers, then you can you have the option to go Central lights or just or or white until you you, there are some tricks for Buddha strapping, but this is our just temporary uh Solutions until we feel comfortable at some point, the roll up should go along. We are building on the centralized system and- and it should be safe enough here is. uh We are managing that in the in the in the in the beginning.

B

Thank you so much Jersey valina. Please give him any thoughts.