NEAR Whiteboard Series with NEAR | Technical Deep Dive Sessions, 12 Feb 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Whiteboard Series with NEAR | Ep: 4 Georgios Konstantopoulos from Loom Network |

Description

In the fourth episode of our Whiteboard Series with NEAR, we had Georgios Konstantopoulos (https://twitter.com/gakonst) from Loom Network speaking with our Founders Alex Skidanov (https://twitter.com/AlexSkidanov) and Illia Polosukhin (https://twitter.com/ilblackdragon)

Learn more about Loom Network here: https://loomx.io/

Download the video here: https://near.ai/47e15

------- About Whiteboard Series ---------

The Whiteboard Series with NEAR is a set of video interviews with Founders who are building scalable solutions for Blockchain. We deep dive into their story, what they're developing and how it is helping the ecosystem.

Follow the latest from NEAR Protocol on,

Discord: https://near.ai/discord
Medium: https://near.ai/medium
Twitter: https://near.ai/twitter
GitHub: https://near.ai/github

#FutureIsNEAR #BlockchainProtocols #TechTalk

A

Alexson Illya here from near we're here with judges from plasma, we're gonna talk more in depth. How plasma works judges? Do you want to introduce yourself talk about what.

B

You're working on hi everyone, so I work on plasma, specifically the variant called plasma cash, which is a technique for creating more secure side chains and, let's get to it so the side chains they're used for basically, if a the original chain is very congested, you can offload computation to the side chain, do whatever you want there and then get your funds back so sure yeah. So normally you have like a chain which has some looks so I will use the arrow to the left to show that we pawned the produce. Look there.

A

Is a right direction? Yeah.

B

No to the left, because you point to the previous block, yeah and yeah, and so what would happen is that you have some transactions happening here. But let's say that you want to deposit your funds on a side chain, so you have another chain over here and let's say that this chain has like ten minute block time, like maybe bitcoin, and this has like one second block time, and so what you can do is that you can create a special transaction which it will actually lock up some tokens here. So you do.

B

You look look five with the C, let's say, and then this locked five BTC after a few blocks, which are used like to prevent like your organization from their original chain, they will appear on the side chain and now, let's say that you have now five and here now you have like five bpc twenty, for example. So.

A

When you say lock in I, mean is kind of bad example right, because you can.

B

Right, so let's consider that maybe you can call this, maybe if you're something else, so you have like you put your funds in an escrow. Will the escrow, which can be a smart contract. It can be some multi, some.

A

B

Take so script with time spending conditions, because we do not want this to be specific for a theorem, okay, and it will be very interesting like to see something which can be also applied to Bitcoin for this, and so you have your funds. Look here. You lock your funds here. The funds appear here, then you can start transacting so, like you get you spend from here to here and so on, and then, if you want to take your funds out, you make another special terms, action and you get them out like this.

B

So maybe this has because they have very different block times. Maybe this is like this has like five blocks, but this can be a million blocks in between and so this withdrawal it will burn. It will burn the five BTC 20 and it will unlock the five BTC here.

B

So this is like the very like overview of like how a sidechain works.

B

You look, you create new ones, you turns out, and then you burn and you unlock the original ones, but this has the assumption that, firstly, after you lock them, this will appear here and then that when you that the chain will allow you to burn them here, because if you- because what you will do is that you will go to this to the third chain and you can present proof of the burden of the origin of the on the side chain and it will allow you to unlock based on the spending conditions that you had originally, and you cannot always have this guarantee, because if you want to use this for to scale this chain, it will have like some inherent trade-offs with respect to its security.

B

So if it's not, for example, you cannot have a proof of work. If this is a proof of work chain, this can be used for interoperability. If both chains are very secure. Yeah.

A

B

They both have like honest majority assumption or the 51 percent like enough horsepower, but if you use, for example, some proof of stake, which is like much more limited with a limited value, dataset or just a one, guy yeah.

A

Or just one.

B

Guy, exactly or just one guy maintaining the chain, you cannot exactly like get these security guarantees, and so what the plasma technique does is that, along with this process, whenever all side-chain blocks they get committed to the original chain, and so when I say committed, I mean that the metal route of the blade, not the state, the transactions, so I will talk about UT, EXO based plasma, and so there are two variants like you can either have account based or you take so based where, in the account based you have accounts and in the YouTube which you have you take souls, but in the account based you commit state routes.

C

B

That you take so base you commit transaction routes, and the difference is that, with the account based, we currently do not have a good scheme like for maintaining safety. So this is like why we go with the UT exobase for now, and so every block gets committed to the original chain, and this shows that the plasma chain it must it must have like the same block time at least the same block time as the original chain. Why is that?

B

Because if you commit multiple blocks, let's say you do this, for example, if you commit multiple blocks in the same working in the same block, if there is an orphan block here, an attacker can simply orphan one block and.

A

B

While kicking multiple blocks out- and this could be used essentially in an attack where the size of a plasma chain database manager- essentially they collude with the miners and they choose to commit multiple blocks- they do a bunch of double spins in the chain and then they orphan one block then commit.

A

In different yeah, exactly okay, but it also means the finality for the sidechain is.

B

Yes, exactly so the finality.

D

Question, yes, why is it different from like? Let's say, let's say it's the same right? Yes, they still can collude and revert one block.

B

Yes, they can collude one to revert one block, which means that, alternatively, if you want to make this more say, you can commit less often. So the goal of plasma is not to improve finality to improve capacity, because you still have the same all words finality, but you, instead of having you commit, if you essentially finalize a bunch of transactions with 32 bytes, because you just commit like one.

C

B

Cash one metal root, while this block it can have like in any number of transactions. So you have this separation of the state where the state of this I train, just like a very small commitment of it gets put, but.

D

In practice, it could have been 100 blocks yeah in 32 bytes. It's just that I, as a user of plasma, will still wait for for 10 more blocks on.

B

The up of the okay alternately, you could do that. You could just wait as a user for the finality.

A

Smaller blocks, but the finality, though, still depends on the time of the parent.

B

You know exactly exactly and obviously the more secure the parent chain, the less likely you can stretch this on. Okay. So that's the basic approach and the difference with the sidechain egg. The sidechain withdrawal is that, instead of burning, we call this process and exit which essentially the exit. It's a bit different. So let me just erase this to make this more clear in the exit.

B

You make an attestation about the validity of your state and you have a dispute period so that if somebody wants to say that this is not the current state you you're you're at the station gets cancelled. So what you do is that, for example, I'll do another chain and I will show you how they exit would be.

B

So let's say that you want to you you claim, but you want to exit and you take so which was which happened at this block. So you make the exit request here with whatever information I required. So it's exact.

A

Request and you check so model you just span you you check so into some specific address- know.

B

So you claim ownership that you did so and then so what you do is that essentially you go to the parent chain. So this is the parent chain and you go to the parent chain, smart contract- and you you say: I- have some funds from the plasma chain and this is the latest state that I own the Met and you make that the station here and then you wait some dispute period.

B

So this is the dispute period, which is some number of blocks, which is a security parameter and then, after this time has passed, you can finalize the exit and withdraw your funds. But so, if you do the finalize, then you can take your funds out of the escrow.

B

But in the alternative case that somebody comes here and challenges can use them blue moon. Somebody can come in between, like maybe at this block and they can challenge.

B

And what the challenge does is. It simply is a contradictory statement which says that you exited here and they present proof which shows that your exit request is invalid, and so this is like, and basically what you do is that when you exit you need to enforce somehow this good behavior. And how do you do this, because what's the cost essentially of an attack, it's basically?

B

Firstly, the transaction costs, but what you do is that you also have some fidelity bond like some security deposit, so that when you do the the the initial request, if nobody challenges you, you also get the bond back mm-hmm. But if somebody challenges you, firstly, your exit gets cancelled and the Challenger gets the bond. So it has like this very nice property that you're both disincentivized from doing the trip and also people are incentivized to look at you, and this is pretty standard.

B

This is used also in proof of stake, withheld a deposit in payment channels for disputes. This is the typical trade you.

A

Challenge it also post a bond right to a cap. The challenge excuse me: challenger, also posts a bond, no.

B

So, okay, so they're very few. There are different types of challenges, so if the challenge is non-interactive, so if it's like I see something I challenge, it done. Here's the proof. Yes,.

C

B

Challenger doesn't need okay, a bond in the cases which I will explain in a bit. There are sometimes there is a type of challenge which can be interactive, and this means that somebody exits somebody challenges and somebody can also respond- can solve a interactive challenge. It needs to be bonded because they respond. Essentially, they responded, cancel the challenge yeah, all right, so in plasma cash.

B

Now, specifically, what happens is that it is a UT EXO based last matching, so we have shown like how you can how the high-level overview is wave for, depositing and withdrawing and how you can use exits and challenges to basically enforce the good behavior. So now we will check the protocol specifically how it is, and so in plasma cash. What happens is that let's say you have five I'll use. If now, and what do you do? Is that you deposit them?

B

You deposit them in a smart contract. So this is the contract. Okay, the contract then emits some event to notify the.

A

B

Side chain here and meet deposit, and then this is the plasma chain and the plasma chain then creates a new block which gives you the funds so in plasma cars. Specifically when you deposit a coin, you get a unique ID. So it's almost like it's almost.

A

B

It's almost like cash in a sense that this is like a five with bill, so if I deposit another bill, if I deposited two, if I would get a twist build and much like cash I cannot like very.

C

B

It in half because the moment you think they have like it, has no value in plasma. You cannot, you simply cannot tear it in half, and so this means that you have a utakome model which has one input, and so after this you get the coin get this, and so you have a you TXO model, which is one input and one output.

C

B

Output, and so there yeah thank you, and so, if you have a UT EXO model, which is with one input and one output, you cannot make arbitrary payments which, at the end of the recession, will show how you can do it through some interesting techniques. And so how does this look like in the chain? How does travel so now? We will show like how to one how to transact to how to exit three, how to challenge this is the process we will follow now so.

D

I have a quick question here. Yes,.

B

D

Happens if I deposit five, if to the contract and.

B

Okay, so what you can do is that you can initiate at an exit of a deposit, so essentially, if this part doesn't happen. So if this thing doesn't happen, you can directly go to the contract and exit the deposit, and somebody can then show proof of a spend of the deposit. So you deposit your coins, you get, but you don't get anything here. If you exit the deposit, this will only be charged by showing a spend.

A

On plasma yeah, yes, they have to.

B

Show you take solve it on plasma, but because you never signed a utx own plasma because you never got the funds in the first place. There is no such challenge.

A

So it's deposit generating a unique ID for this, like.

B

This in this moment, right in the smart contract to be perfectly accurate, you get some coin, ID, okay, whatever unique identifier. So it's like the serial number in cash. This would be like 0 X, 1, 2 3, so it has the dollar bill that you get when you deposit the funds. It has some additional metadata, so it has the block at which you deposit it there.

B

It has a very owner like it has like some necessary metadata or to do this if you are depositing some merci 20 token, for example, it would also need to have the contract address, because when you want to withdraw, you would need to have that story from.

D

Before exactly so, so if so, if I just deposited but never ever transacted there.

B

D

For me to exit I can exit the deposit and I. Can yes.

B

D

Way, yes, okay, I see.

B

Yeah, which, in the code it is like one function, it's one function, you just like specify where you want. I'll show this right now so now we'll do like a graph when we show that you deposit the coin you transact and how you can exit so we'll take the usual suspect like Alice and Bob.

B

So let's say it like this arrow. It indicates that you deposit. So this is all this is the plasma chain, and this is block 1 block 2 loop, 3 block 4. So in this block you get it like. This is Alice Alice right here she can choose to exit. So this is essentially the state here. What we just said like it doesn't matter. If you got it on plasma or not, you can just say I exited this block that I just deposited and some for somebody to challenge they would need to reveal a spangly. Oh.

C

B

So let's say that this doesn't happen right now and let's say that alice indeed got your fans on their plasma chain and she wants to spend them to somebody. So in order to spend a coin, you do this. Obviously, so you have the coin, and what you do is that, essentially you create a transaction which refers to a parent block, so essentially the transaction. It is the slot, the parent block by and block, then you own, a new owner and some signature. The parent block on plasma.

A

B

So in this case we're signing- let's say it's 0x a so in this case it would be 0x a it's, not the pint block would be block 1, the new owner would be Bob and the signature is.

A

B

It's the signature on this data yeah.

A

B

Do we do this? Why do we need the parent block, because analyst should also do this, and if Alice does this, she gets another transaction included to let's say a prime, which is also Alice. Her background.

A

B

The other accounts you want to double spend. We want some way for Bob the actual owner to challenge, and essentially this is a challenge of a double spend by which you show that you have a transaction in between, and how do you know that it's in between? Because you reveal a transaction which has the same parent block with a later transaction, but it happened before the other transaction, and this is like, by definition, a double spend.

B

It have the same place which gets spent into play in two other places: okay, but let's take the honest games like so how does Bob know.

A

Just so what if I was includes another transaction in this block, this.

B

Cannot happen by definition because yeah I didn't say so we use a structure called sparse metal tree. So this part is marking tree. It has it's an ordered tree where they I think I'm. So they're.

B

Like the index here, it's like 0 1, 2 3 their coins. If its index they rather its index, is actually the value of the coin. So the 0 X a let's, say it's 0, X 1. It would get. It will appear like in this index here. So you have like some if here, which means that if you try to include two transactions like it, you cannot do it simply one either one or the other will get included mm-hm for the same transaction route because otherwise like this is already full. It is okay, yeah.

A

So there's like yep once yeah.

B

So there is that you could say that Alice could overwrite and say like I, give it to Bob, and then she overrides it and then does to a prime but Bob needs to wait and check that this block yeah exactly and when that block is positive, like he checks that oh I don't have the transaction so I do not give I will not give you the product or you just paid for it, mm-hm all right. So let's take the honest case and see how like this evolves,.

B

So is it clear so far, okay.

C

B

Maybe I can have the blue yeah yeah, so now that bob has the coin. Let's say that in this block nothing happens like some other coin gets spent, but this coin doesn't happen. So right now we're looking at the sequence of blocks, which are only specific to this coin like, and this is like the how plasma cash gives with security yeah.

A

B

It's going is unique and you have like this separation for it's going, and so nothing happens here now, bloke so and now she wants to spend it like this, so this is Charlie, let's say so. When Bob receives the coin, he needs to check that it was included in block 1 and in block 2, and if the metal proofs are valid, he will say. Okay, the coin is good. I will give you the product that you paid for now that Bob sends it going to Charlie. He must give.

B

He must thank him, inclusion, proof, inclusion, proof and exclusion proof. So every time you make a transaction, you need to pass the full you take so history of that specific coin and the bad thing about this is that it grows linearly with the history, because what happens is that let's say that you had like a million no interest right exactly, but no. The thing is that you don't need to have a million transactions you you have no spends here so.

A

Let's say 1 million blocks without without.

B

Transaction I still need to send you all the 1 million blocks, even though I didn't touch the coin right, which doesn't exactly make sense. So- and this is like one like the main pain point of the plasma cash. But when I send you so, let's say that Bob wants to send to Charlie like they would lead to send him 1 million proofs of exclusion where a proof of exclusion in the sparse Merkle tree. It simply proves the a path but the path that nothing exists.

D

B

No from like it would be like.

A

This yeah just to pass that this is zero, pretty much yeah.

B

You prove inclusion of zero instead of proving inclusion of some element. That's.

D

A good question, so so let's say my coin is 1 belongs to L is when L is sends up the book. Is it still one or that creates in you? It still wants to fill.

B

One so what happens that the owner of a coin per block gets updated, or rather you have a transaction which has the inside yeah. So you always have like. A coin only cares about its specific index. It's totally separate from all other coins and.

D

In the sorry, I assume every block contains the transaction route and what is the value that is stored in the leaves? Is it the owner or is it just it's the hash of the transaction? If the transaction for that he takes off happened in the yes.

B

A

Yeah yeah: that's why you need to send all of it because there's no like state yeah in the blocks. It's it's actually like you.

B

Need I need to prove to you that in the ten blocks that passed, this was indeed zero and nothing else happened, because if it wasn't like, you would have the previous attack that we showed so in this case, for example, if there was like another transaction- let's say so pretty much it it's. If there was a transaction here, Charlie would check that there was at spend in between until they reject the coin and by reject the coin like the up the chain.

B

It could show that charlie owned the coin, but Charlie wouldn't use it, and they wouldn't give you the product because they cannot exit the coin. Why? Because this guy would be able to challenge it yeah. So.

A

It's not like a straightforward at least the way I think of it a check, so it's more of like an account model of this Queens. Thank you happy pretty much you have like you can have a mapping yeah.

B

You have one X owner, yeah yeah, that's.

A

Just state, and then you judge.

B

The state this state yeah yeah, what's the depth of the state yeah, essentially the the full node it maintains that yeah right like if you have, if you run like a full node yeah, exactly what.

D

What breaks if the, if the Merkel root, is actually Merkel's root of the of the owners so.

B

If you, if you the root of the state, you mean yeah, so you cannot have a tax where you cannot know like who is the valid owner you, you need to prove like somehow that no, the making root is still the owner.

D

Because because the plasma owner can fabricate yes fabricate the change.

B

You need because, when I'm doing this, like, when I'm taking the history, I'm also taking signatures mhm you're taking that for.

C

History essentially.

A

B

Here hits X is a signature of the transaction valid for this one, and you do that for all right and for the empty ones. You just take the metal path, because there is no transaction and.

D

Are you are you about to review some magic way to avoid, including you land blocks, yeah.

B

Yeah, we will do that like the world.

C

B

Exactly so, this is how transactions happen if I want to exit. If I want to withdraw, you need to addition. You need to provide essentially the block that you got the transaction and the parent block, so an exit. It looks like this, so it's like you give their the transaction here and the Palin transaction here, and you do you need to do this in order to do the challenges properly which we're getting to now. So you start an exit. You wait seven days or some amount of time.

B

If nobody challenges you get the you get, you can withdraw the funds from the original contract yeah. If some of the challenges, you cannot withdraw the funds and you lost your deposit, your deposit right. So now we'll show the three types of challenges that exist on the plasma. So this one yeah okay, so this is good. So, instead of exiting here, what? If Bob sends the coin to Charlie and Bob decides to exit here? It is a valid. The smart contact doesn't know that this transaction has happened it.

B

It has a make reroute yeah, but it doesn't know that per se. The transaction has happened, and so Bob exits here he waits some time, but Charlie reveals a spend of it and has to be a direct spend. So it has to be exactly a transaction which spends from this block because otherwise you could have an attack, for example, where how to say maybe like Charlie gives it to Bob again.

B

Yeah Bob gives it again, and you know you can have like this case, where Bob exits Bombyx it's here, but Charlie challenges with this, and you don't want to have this, so it has to be, but.

D

B

Book is lower right. Sorry, the slot would be lower. No, no. The slope is always the same, like it's always about the same coin. Oh a slot is.

D

Not the the slot of the block.

B

No, no so when yeah right so.

D

B

Use it as coin idea, yeah yeah I think like slot in the American clue. So it's index coin index yeah right. So this is the challenge of a spent coin right. So this is like. There are three types of challenges so.

A

But it's possible that, like this happened, yes and then so.

B

What you still.

A

Challenge with this, but like it's not his coin, why would he care right? This.

B

Guy, when this guy does the coin is senses.

A

B

Got all the precautionary.

A

B

He uses this proof: okay, okay right, so in the other case, you can have a double spend so the double spend. It would look like this in general.

A

Anybody can anybody.

B

Can Challa know anybody can chattering yeah so you're, not that fine.

A

With any of this.

B

Yeah, but the party who is most incentivized to challenge is the owner of the coin: yeah yeah yeah yeah. Exactly so. Let me just clean this up a little bit from the millions of arrows.

B

Right so now, let's say that Alice has the coin here. She sends it here and she also sends it here. Let's say like to Charlie Bob receives the coin. Everything is good, but Charlie.

B

Now he exits by referencing, the coin and a parent, and this again it looks like a valid exit to the smart contract, because you reveal the transaction and its parent, but this guy doesn't like it because it's his coin because he got it first, and so you challenge by providing a transaction which has the same parent, but it hasn't happened before this one.

C

B

So this is like fairly straightforward, so so far we have shown like- and these are both like these two challenges- they are instant. How.

D

Do you find before, like.

B

How do you prove that it is before by showing that the coin you're revealing has been included after the parent block before the X block and that it has the same parent block as this transaction? How.

D

Do you actually.

A

D

That your block was earlier.

A

B

In exchange agenda, because because of the on the plasma contract you have like block, 1 has 0 X 1 2 3 block to some others. It.

D

B

Of all the blocks, yes,.

D

B

Plasma contract every every yeah right, so every block route it gets committed to the plasma change. So essentially you say you reveal amazing proof that this coin was included and like when he exits. He reveals a medical proof here when you exit, you reveal America. Here we.

D

Have a notion of time so it happens, is Bob receives transaction receives money from Alice. Bob knows that until that and kill the block where the transaction was included, it.

B

Was not bent? Yes, then,.

D

Bob observes that the block is included in the plasma chain that all the previous blocks are consistent with the proof he waits for 10 blocks, I, say and so Carol or Charlie has no way.

B

God Charlie receives it and he knows that she cannot exited this.

D

Book is always greater than yes.

B

Yes, yes, and to be clear, like Charlie here, they know that this is invalid, because.

D

They know they're yeah exactly.

B

They know they're cheating, so if this guy accepts the coin, it's only because they're trying to cheat like there is no way for them to spend it or exit it, because if.

D

They send it because.

B

If they send it to somebody else, they.

A

Can run body else they will.

B

See this transaction and they will say I detector, yeah,.

C

B

They will reject right, it always like yeah. So there is this thing: you need to always validate the UT EXO history right and, if you're a full client. This is easy because you have all the nodes already, but if you're a late client, this is also like this is better than there are other alternatives, because you always only implicate just about the coins that you own, because if you own, like three coins like this, isn't that much data to verify the main problem is the bandwidth like when you need.

D

To send a million yeah, but at the beginning we sort of concluded that the plasma network doesn't have any incentive to generate blocks faster than yeah.

B

Exactly so, it's not all sorry.

D

Well, faster than the than the parent network right yeah. So if it's Bitcoin it's once every two.

A

B

Quite a few yeah, if so, they're they're multiple I, will approach to this towards then like. How can we make the history smaller? There are multiple approaches, so this is the challenge between. So you you can imagine them like the first one is their challenge. After will you challenge with a spend yeah? The one is the challenge between, because you give a challenge in.

C

B

The final one is the challenge of an invalid history and the challenge with an invalid history. It's an interactive challenge. What do I mean by that? That's when the plasma that requires collusion with.

A

Plasma, oh yeah, yeah yeah, so runners, yeah.

B

So I'll leave cows. Has you seen the coin and somehow the operator in.

C

His trade that.

B

You showed there they allow this transaction to happen like from Bob to charlie, somehow because they are the database manager and they say in their state that this guy owns the coin and now Bob makes atoms AK from Charlie. Charlie obviously sees that there is no spend from here to here. So he shouldn't accept the coin. But let's say that they're all like together and they're, trying to steal this coin, because that is they attack effectively, and they do that again.

B

Let's say Dylan and Dylan again, they're all trying to cheat. So what what they do is that they try to exit here. All you could try to exit here. This also work, so you exit here and what happens is that this one? They do this like challenge with invalid history, so they they reveal essentially a metal proof which shows that they own the coin. Before the pylons look and this it is an interactive challenge. So this one is exit + bond, and this is also challenge. +, borned.

A

Yes, yeah because this guy's need to know if it's true, they need to provide this link exactly.

B

Because this can be true, okay, but this may also have happened. So if this has happened, you do respond.

B

You do respond to challenge and the idea is that you can have multiple of the challenges in the whole history and in order to finalize an exit, it must have zero pending challenges which haven't been responded to, and this happens like if you have a long chain- and you have an operator who starts like to do.

A

B

But still, this shows that the attack, as long as there is somebody watching it, still maintain safety, because you try to exit here some of the challenges in the past and you can either you can try to reveal spend if you have one or you cannot and if you notice it like. This is essentially almost like that. The first challenge of a spend where you try to makes it here and somebody responds with a spend yeah.

D

So the challenge trade is pretty long right. It's like few days. Yes, so so what so effective? What could happen is so these look from Ellis here and she sends it like. Let's say, let's say the coin was actually traveling quite a bit right. Then it went to Carol, maybe back to alias, like there was like every ten seconds. Let's say it was moving right, yeah and that that has been happening for like quite a while.

D

So let's say these 100 transactions here and then it stopped and then at some point later Bob who does not possess the coin anymore, sends it to Dave.

D

What happens now is that Dave tries to exit. He says I'm exiting yeah and Ellis.

A

Challenges of type so Ellis says.

D

A

The challenge it was whatever oh yeah, oh, they always will use the.

C

A

Yeah it still I mean it could have been like. This is an engineering problem. Oh.

D

No, no, what that actually I was not.

D

Let's say: Dave tries to exit here and he legitimately possesses the coin, and then Ellis doesn't want him to to exit, and she says you know I actually own it here for Dave to prove that Ellis is lying. Yes, he will send a challenge saying that now look like you sent it together.

B

They will spend of the of the challenge yeah, which.

D

To which Ellis says, oh.

B

You know it no more, there's no more there's no more! Oh.

D

That's it. You.

B

Do one round there's one? No, it's.

D

C

D

Steps makes it don't mix, don't search because.

B

The moment you reveal spend that's it. Alternatively, Alice could challenge again with.

D

But if you challenge the the exit challenge period does not extend right.

B

No, no, no! So there, there is a trick here that you do, because when you allow multiple challenges, what an attacker could do. So, let's make an so these are the three challenges: it's clear how they work. Let's say some timing, like attacks like how the when you challenge how the challenge period became and there anything that we talk about challenges, responses, bonds and all that it's all are generalizable to any type of crypto economic protocol. You want to build.

B

But how you manage basically the safety of the protocol by adding like challenges and disputes, but all.

A

This does require pretty sophisticated, like smart contract platform right. You can yes,.

B

I Bitcoin, this is unlikely to be possible. It's may be possible in Bitcoin cash with the addition of a few op codes which are being discussed right now as far as I know, but I haven't looked into it in depth. It would be very exciting if it's possible, though so.

A

That coin cash.

B

Exactly yeah, oh well, nothing works.

B

Okay, so this is the this: is the dispute period, let's say so at t 0. This is the exit exit time and we have like some t, 0 plus T capital T, which is the end of the challenge period. And if nothing happens you can finalize here.

B

So you call finalize here and T is a security parameter like the longer the T the more time there is for somebody to do challenge so the less the liveness requirements for the network, but the user experience drops because you need to wait longer for your to get your coins out and after I describe. This I will also show a way with how you can basically avoid this delay.

B

So you do exit here and what you do is that you split the challenge period in half, so this is 0 plus T over 2 R. You basically split it in like some parts, some partition that you want, and only during this period can you do an interactive challenge, because you want to give enough time for people to respond, because otherwise, if you allowed somebody to make an interactive challenge here,.

A

B

Would be able to respond right, so what you do is essentially you. You allow instant challenges during the whole period, but you won't allow interactive challenges only during the first half or like okay, so.

A

Maybe yeah whatever security parameter.

B

Exactly exactly so, essentially the closer this is to here, the more the more dangerous it is for the responders and the closer it is to here. The last time there used to actually challenge. So essentially, you want this somewhere, like it's a heuristic like pick whatever you want, um okay, so this is how they we split the challenge period and essentially, you can think of a coin as a state machine which it basically goes from like a few states from the pole, so it so, let's see first.

A

Deposit on on a smart car.

B

The moment you deposit it it's at state, let's call it like q0 when you exit it goes to Q 1. When somebody challenges it goes back with a non-interactive challenge. It goes back to the default state. It cancels the exit yeah when, when nobody challenges after a week, you can finalize the exit which goes.

A

To q2, do you need to send a transaction to finalize.

B

Yes, you need to send the transaction, and what you can do is that you can create a batch finalize, the transaction which just takes all the coins and finalize them or like you, can give it a list of coins. But this is an engineering like how you want to do it and somebody's to pay for it. Buddy.

A

B

Exactly and you can, additionally, if you want, you can add a q3 which is like the state from which you withdrawn yeah.

A

That's like 4 years to 20 yeah.

B

But these two they can be combined. This is literally because, if you want now from an engineering perspective, if you do finalize and withdrawing in one step- and you want to do- maybe many and you want to finalize many coins- they withdraw. It cost much more than just setting the state to finalize and then each user on their own, taking with the other coin. So it's useful because you can do this to finalize many coins together, so the plasma.

A

Oh, like runner, can be like when they checkpoint.

D

A

I can also find a.

B

Lot everything exactly.

A

D

Why not Auto finalize if it's been 500 blocks? Oh.

B

This is literally like how you you can add a cron job which.

D

Literally, just.

B

Keeps calling finalized.

D

Every blow, my question is: why not like in the smart contact? Why not to consider? There is no out.

A

Of its much contact you.

D

There's no like, if you, when they call for withdraw. Why don't we drop just check how many blocks it's been since.

B

Okay, so you can make it directly to do withdraw sure. So, as a user, you can essentially call the.

A

Rizal that.

B

Withdraw called finalize first.

A

B

But we want essentially a way to safely instantly finalize everything and then people can withdraw whenever they want so.

D

Do you mind if I quickly jump back to the challenges? Sure so scenario, imagine that so this is a block in which a coin belongs to Alice and Alice is the only honest person in this okay.

C

In this scenario,.

B

D

Some point eldest decides to send money to Bob, and so she submits a transaction that is like from Alice to Bob, and this is the parent right. So actually this is the block she sends it to Bob. Bob doesn't have to be malicious at some point later.

D

Carol, who is malicious, initiate transaction to Dave, with, with the same coin, Dave tries to exit exit, with the caveat that, starting from this moment in time, this plasma owner, who is also malicious,.

A

Withhold checkpoint stop completely.

D

Revealing blocks huh so it would snapshot to the main chain to the parent chain. It will snapshot all the hashes all the header all day, but.

B

The data about the blocks are not away, but the date is not available. So now, when.

D

Dave exits Ellis is like all I want to challenge, but the last state that.

B

Must be Alice to challenge it will be Bob. Let's.

D

Say Bob is malicious. Well,.

B

If Bob is malicious, that's right.

D

C

B

Owns the coin, yeah Bob is the latest valid owner of the Bob.

D

Is the latest valid owner, but Bob also cannot challenge right well, yeah. He cannot, but so the thing is that, like a mitten, Ellis is sending money to Bob, as the transaction goes to the plasma owner, plasma owner completely stops showing blocks to Angela so between Alice and Bob. Then this.

B

Is always not know if you see the coin or not, what happened? I I get I got you. So what will happen here? This is an inflight transaction. Essentially right so Bob is honest or in our case Alice and Bob are honest. They want to do they're going to make a transaction, and really this doesn't matter. What happens? We want to check like I agree that like then again attacking happen, and you want to reveal a parent and how do we challenge this? How do we get this through? So?

B

Firstly, let's see how you can do like this inflight transaction, how you can settle it. There are two approaches to this there. One is that this we name it a griffon attack where you just say that essentially the operator by withholding data, they forces you they force you to exit mad.

D

Bad chicken or because Alice can attempt to eggs. That's right. Yes,.

B

So what you can do, the steps are Alice exits. So that very scenario is the following step: one always wants to buy a product from Bob like let's like a real-world scenario, so Alice to Bob transaction with held.

C

B

C

B

All they see that a new block is committed, but they do not know if the transaction was always not. They need to force the operator to give them the information. Somehow, so what alex can do is alice? Does an exit, Alice exit, a exit they exit here and the operator they reveal a spend? They reveal the spend, so they challenge the exit so Alice, so exit plus bond.

C

B

Operator challenge challenges, so Alex loses a bond, which is a constant griefing factor, confirm Griffin vector which is like so four. So the means that alice.

B

Bond but the transaction was revealed and the operator as a business. They made it clear that they're against their customers, if you want so in a sense that if this is a payment processor- and they do this process- indeed, Alice does have a Griffin vector of like one bond, but the transaction settles because you now have all the information about the transaction and you have like you're, essentially lose all your customer base.

B

So, on the one hand, like you, you call this a Griffin attack where you, which means that you lose some funds, but the safety of your funds is still not close. That's a.

A

Little weak, but it's also, but it's also like if, if I went to a store right I did this. This cut was held I exit right away because we didn't see it. You know was in ten.

C

A

This happened in seven days. Just so, Bob got the money. I didn't get the product right. Okay,.

D

A

Not just born it's born, plus, whatever the coins.

D

But they are. The thing like seven days is a like that sounding your except when you use plasma, you accept that you're you waiting for seven days for security, so no.

B

You don't wait for the final transaction finality.

C

B

You consider the transaction has happened when you see the main route and you get their witness there now.

A

B

Of the paragraph.

D

C

D

In my scenario, who will be so one day if is saying or given I guess we agreed when given says I want to exit Google challenging yeah.

B

Yeah so let's see cool challenging Alice will challenge.

D

Him and given just sends and then and then Bob.

B

Denzel Pareto reveals so let's say that this all is withheld right.

D

But not quite because so let's say you and challenges illustrates also the timeline right. So this is this is this is when Gilliam says I want to exit this and the the non-interactive challenge. I can send them till the last moments right right, so so operators, and so the very last moment, operations.

A

D

Wait so yeah, so I try to exit who you.

A

Are Ilana? Thank you. Okay, Alice.

D

Is initiating interactive proof somewhere.

A

Here, like, let's say, let's say: Ellison Ellison, you.

D

Shades your interactive probe here, yes,.

A

Operator here provides.

D

Books, transaction like one second before before, before NGO and exits, and then and then like what happens. No.

B

It doesn't happen because.

D

But he challenged Alice sister Anne Ellis's exit, yeah, Alice's challenge yeah. So.

B

There wait so right, I, see, I, see, I, see, I, see, okay, yeah. This is a good attack, so what you can do- and you want to somehow have Bob then.

D

Not challenge it right so the moment they.

B

D

This video now Bob can.

B

Show about the time.

D

But the time is very little for him.

B

Right right, so what you can do is that you can make it so that when it somebody responds you.

D

May extend the time to extend.

B

D

Then we're getting back to example, where these 100 yeah.

B

And then you get yeah, but every time you challenge and respond like there is a. What do you call it? There is a there's, a bond, but.

D

Let's say: keep attacking I have a lot of money, but they don't want someone.

B

To exit yeah, but this is like a Griffin vector where you have like infinite funds like you're, losing there's no like from a perspective of gaining profits. You're not gaining anything I agree.

D

It's my competitor, who tries to get.

B

Their money- this is a valid concern like this- is why I didn't describe the extension of time.

A

B

Period of time earlier, but yeah, this is a valid attack that can happen, but wait a second so like. How can we prevent this in the first place? So there is a way that you can do what we call an in-flight and essentially exit of a fund where you add like when you exit, you also reveal the transaction that we held and somebody so essentially you're, saying I exit, but the exit is not just block plus PI and block.

B

You also reveal a transaction and for somebody to challenge you they would have to reveal either another transaction at this block or spend of this transaction right. So by doing this, you essentially skip away over the whole, with building by attesting that you know this data also.

D

You're exiting for Popov that.

A

Yeah you're exiting here into Bob's, pretty much account.

B

Yeah exactly exactly the exit it settles to Bob. Oh you.

D

Say bye, and that would be something that Bob will do. No.

B

Neither Bob no not necessary, like Bob.

D

Do it, or else can.

B

Do it anybody can do it? The whole point is that Bob will get the funds and.

D

The NHL and the challenge will be the church that will be saying you know there was another transaction which wasn't live there. It.

B

Wasn't Bob either it's somebody else or there is this.

D

A

You proven Mirko route here that goes to zero, for example, or goes yeah.

D

Everybody else in.

A

This block, or so.

D

So for Alice that would be a dangerous and.

B

What you do schedule, because.

D

No I'm saying that in flight exit, for else will be dangerous because Ellis will say: I want to exit for Bob and Bob concurrently will send money to someone else right.

B

So it won't be Alice yeah. It would be.

A

So can Bob do this right.

B

Yeah, okay, and to be clear, like to do this type of limbo exit, you need to add an additional parameter like because you need to show that the terms actually revealing where it was included. You need to show that it was included in this block, but.

D

You cannot, you never saw the block yeah.

B

Yeah, that's what I'm saying that you you claim that it was included in this block, but.

C

A

Transactions when you make this happened.

B

Whatever this happen,.

D

Yeah, rather the question is Ellie said she doesn't know if the transaction to Bob was included, because the block was never revealed.

C

D

Doesn't know- maybe maybe maybe plasma curator decided not to that's.

B

What I'm saying that, when you this to do this type of a exit and challenge, you need to add an additional parameter in the actual transaction which we call target which block to include enter? And you say that I considered this transaction valid only if it gets included in this block right.

B

So if so, if this is block one and like I, don't know if this will happen or yet I say included in block two. If it's not included in block 2, then it doesn't doesn't.

A

So yeah, in this case the like, if the operator was held and and I mean not results, it's not the Malaysia separated just slow operate like.

C

Yeah yeah slow.

A

Right they didn't include it into Alice's. Like wait, nothing's happy I should have received it into yeah. Let me let me push the money.

C

A

Operator, like it yeah I, mean it's here, just I didn't included yeah.

B

A

This is just like it's not, it was malicious. It's just slow, yeah.

B

D

B

Approach it has this thing that if it doesn't get included in the block, you essentially gets dropped and you need to resubmit it with a target block yeah. But it's the current way to mitigate this. All you can added data availability challenge, which is not exactly like the best approach. In my opinion, because you essentially essentially you say that you do a blind challenge. You say operator, do it's holding here and the operator has to reveal some data that does that prove that there is no more data being withheld.

B

But this doesn't really scale because you can, you can keep challenging the operator and you can do what you said. You can you out your competitor and you start like Griffing them and how you do is if they don't respond. You slash a massive deposit that they have, but this also imposed like capital lookup requirements for the operator which this design doesn't help yeah, but.

D

B

To be clear, these are all one-off attacks, because if the operator does such an attack, they can at most attack like one or like a few coins. They cannot attack the whole chain and if they do it, like everybody, like I, agree that it's kind of a weak assumption like from a security perspective. But this is all you already paid. You said that somebody will come watch and challenge, and if people are already watching, they notice this problem. This becomes likely. It has some social percentage. If this type of happened so.

D

For the slaughter, so let's say transactions do not include this. The the target block if.

B

They write this attack is possible. My.

D

Question is rather, the transaction also includes all the proofs for all the blocks in the past right, you say not. No,.

B

No, but when you exit so the all the past transactions, they do that's the chain, it's only unhooked like so when I send you some funds, I give you out-of-band all the trans, all the proofs, but when you exit you just show two proofs and.

D

Certain extent when I'm sending money to Ilya there is sort of a a target block because I'm sending him the proof up to some block right. Oh yeah, that's true!.

C

A

It's not inside the transaction so so.

B

You're convinced that things up to here, I'm good.

A

D

Guess the protocol will be I'm, sending money to you. Yeah I mean isn't in the transaction I'm waiting from transaction to get into the blue. Yes and.

A

B

D

The proof of all day, yes,.

B

Yeah yeah yeah, of course, of course, the transaction, the the foolproof key story that you're sending is that you make the transaction the transaction gets included. You get the witness data about the transaction, and then you send the whole thing. I'm.

A

Very happy to wait. You wait for checkpoint on parent chain, yes, and for whatever six blocks or power of blocks before chain organization can happen in the parent chain, and then you can actually send it thanks right, because.

D

Otherwise yeah, but do I need to send some all the proofs can. Can he get all.

B

They can get them directly from the open.

D

C

B

It or you need to send them ad hoc only if the operator is malicious if the operator is complicit like they can get them directly from the operator so there. This is like you need to have like the word case, but.

D

If operator is malicious, I will not have the proc side there right.

B

Because we receive them from the previous guy, but.

D

I, don't know the proofs of exclusion from from from the block where I received it until the moment where I'm sending it yeah wait.

B

A sec so so.

D

So the example so like this is the block where I received money, so I'm Alex, Ellis I, received them work from somewhere in the past. I have the proofs of exclusion or inclusion into the past, but then you know something later: I want to send it to Ilya I need to include proof of.

C

A

B

D

Not have those I need to request.

B

Yeah but it's a.

D

Small request right in essence, yep from from the operator yeah.

B

That's true yeah you need to have like your client means to well.

A

I mean if it's you're talking, you know it's not there, but.

D

They need to send the proofs of and yeah.

B

Yeah yeah, so this is kind of like unfortunate that, like you need to do this whole process, so you said: there's a way to yeah, so assuming that you already have them I'm, assuming that you already have the proofs, you can either create a snart proof like where you just take like a bunch of blocks, and you put them together.

B

So this has happened already like there is a proof of concept for this already all there is a technique called the I'll, just say accumulator, which can be used for this, which I'll show you now how but.

A

For the snart proof, I don't just have a snot proof, but.

B

It's a similar snark. It's simply it's not for a negative proof. Well, if you want like for the whole thing, oh that's what you said for the whole kiss forger.

A

Yeah yeah yeah, if you.

B

Do it's not if you do the whole history yeah yeah, so you take like the whole history. Yeah.

A

Take the previous part in all the transitions for.

D

The for the error say accumulator doing you, the semiprime. Yes,.

B

You do it cause, it doesn't set up such a snark, so it's not yeah.

D

So it's like semiprime is slightly worse, I guess no.

B

You you will generate the trait NPC, so it's still like the same assumption right right. So how would they all say, emulator work, currently the operator when you have like to change this? Is the panting this beside the plasma train, the operator they commit like 32 bytes, the medical route, which is like the you should take the tree. You make a micro route with the RSA accumulator that they, the operator they additionally commit one more thing: the accumulator, which is 2048 bits like 256 bytes, not 256, 256 yeah, so they need to commit something.

B

Additionally, how does this work so that human later, like long story short, you start with a value G when you want to accumulate an element to it, you raise it to that power, so you have like there LM very slot 3 the coin. Id 3, you raise it! The third! When you want to add another element, you raise it to the let's say: the coin might be five. You raised the fifth you can do.

B

You can include multiple elements that you move later by including their product, so you do directly due to the fifteen right to prove inclusion to the accumulator. You reveal a cofactor so if I have G to the fifteen, I need to reveal three and five like three is the element I'm proving five is the cofactor. If this is like, maybe G to the 105 like three five, seven yeah, that's it three! Oh three, five! Seven! You would reveal three and thirty five, like I'm, improving the inclusion of three with that without thirty five.

B

So how does this apply for the plasma in the exclusion proofs? What you can do is that if you have multiple blobs and you have the accumulator at block one and block n, you can create one proof for from just the accumulated one proof of an exclusion. So let's say you have one block two blocks and then you have like a huge like gap, and here so you have an accumulator look n and block n plus K. Do we have accumulator per Queen one? No, no! No, that you later it's like one! It's.

C

Yeah one yeah: this coin is the.

B

Coin ID is the value of being accumulated, so you have both the metal three and the accumulator is essentially per block which coins moved and which cones did not write the code, rather the values. What which were in it are the ones which were included.

B

So at this block, let's say the value of the accumulator is G to the three three five seven at this block, and at this block it is G to the three square. Five seven. This essentially means that in this block, the only coin that was spent was three right because it was only accumulated and whatever transaction route was committed before. So what you can do is that you go to like a bunch of blocks later and you have like some other accumulate, some like whatever elements, and you still have seven.

B

So if you have this, you can be sure that by revealing this and this, the coin was not span in between, but.

D

How they approved I mean if it was proved, then by now it will be seven squared right. No.

B

No, it wasn't spent that's what I'm saying that's.

A

Panin, if it was granted.

D

Most squared would be so they still seven as a as a as a multiple here, no.

A

No you're, just proving deaf, find improving options of seven squared. How.

D

Do you prove absence of I can prove that there is some factor. I cannot prove the absence of a factor right. You can. You can prove absence of a factor yeah.

B

Because then, you can reveal the next state, but you may think you can reveal the next state and you can show that it's not there can you can take the current state in the latest state.

A

Well, you mean like if there is a seven square somewhere like where it's spent, you.

B

Only accumulate elements you do not remove elements, so you cannot go from seven squared back to seven so.

D

Formulas, and so so, if I have three five and seven so so each each particular coin has a prime number associated with it right only only because otherwise it's not safe.

A

D

Three five seven means that coin T was spent once coin five was spent once and coin seven was spent once and then, when coin seven is spent, it.

C

D

Three: five: seven squared right: okay, so when I send so, let's say n is the block when I receive the coin, and this is the block where I'm sending the coin to you right, mm-hm or, like rather I'll, say this is where I sending so I want to prove that here up to here, it was not. It was not expelled, I'm not proving.

B

You need to prove inclusion of seven and exclusion of any higher power. The.

A

One before you just show that it's set and.

D

How they prove the exclusion over power is, it is actually I, don't know. Maybe it's possible.

B

Like because this is like this is, this is all work in progress to be clear like that stuff would have shown so far it's except what this is working produce, so how to prove it like the accumulator. Is this one? You reveal the three five seven and you want to prove exclusion.

D

Of seven yes, so I'm going to show you t x, 5 bit x, seven right.

D

I'm revealing to Yugi today, but.

A

D

Think that's the entire point of the yeah.

B

That there is no element twice because all.

D

Right now saying: that's the entire point that you cannot prove that that it is divisible by by G to the seventh, like the entire point of their say, accumulator right.

B

There's a good point.

D

Or it is not the case actually don't know my.

B

Mind is a bit rusty. This mate I, don't have something right now, like of the dolls, my head.

D

Because? Because if you can prove that it is divisible by due to the seventh and the problem is solved, you like yeah,.

C

B

D

You will say: look it's divisible by two to the seventh you clearly trying to do you.

B

D

B

Yeah, so the question is the question is: if we have like three five, seven squared, how can I prove that seven squared is not in the accumulator right, because currently, the only thing you can prove is that seven only well.

D

It's not a fact if it was possible to prove to easily show you if it's divisible by.

B

D

You wouldn't you would not need to show the cofactor, because people would just like that.

C

D

You cannot right.

B

Yeah, that's a good thought and.

A

By the way for Ziggy's snarfy, already using snarks, wouldn't be easier to just have like an account model. Yeah.

B

That's why I do not like if you get, if you assume you can use snarks plasma, soft yeah.

A

Everything easier yeah starting us off today.

B

So yeah, that's why, yes, they can do it right generally like this is like the history compaction. It is that the biggest problem of the plasma, because they fungibility like do you want to like so okay. We agree that this is like a bit shaky yeah, but.

A

Yeah yeah, it's.

B

It's an improvement on the kind of thing to make it like very feasible and note that you can avoid having to do this like this is another alternative that you can exit and redeposit. If you want, because you exit the coin that you have and you deposit it and sang all your history.

A

Color all your history gets.

B

Lost so you could even do this if you want like this would be an alternative, so yeah, like all you have to like, maintain the history, which is a history it grows large after, like it becomes a gigabyte after two years of not have of not moving the coin. Maybe so. This is not exactly the best solution for cold storage, because you still like me to watch and everything, but if you have like I know, like maybe a tournament of a game or something or you're doing some gambling on a side chain.

B

This is like good, because you do not have like too long history right, and this happens only when you commit this happens when you commit very often right. So another approach would be that you also reduce the finality by committing less often and like. Naturally, if you commit less often you have like smaller history will.

D

The following work: so let's say that when I, when I say when I send the coin to a theorem, there's this prime I I know the prime and I and I do not reveal the prime, so I will need in some way to prove that so, let's first go through it. So let's say I'm sending G, and so my prime is seven okay.

B

D

Sending G to the power of seven to the hundred or so seven multiply by 100 and I, because I know seven I know all the G's from from G to the seven to G to the 7.5, a 100 I know all hundred of them, but I only review this one.

B

So you multiply 7 by a hundred.

D

Yes and and I can erase G to that power and then.

B

I will tell you now: 100 can be moved to any of the other numbers if there are more accumulated. Yes,.

D

I mean 7 to the power of 100. Oh ok,.

B

D

I revealed that number I need to prove somehow that this is actually I, don't even need to like I.

B

Mean I need to.

D

Prove that this is a prime number to some power. I think that is yeah.

B

D

So then, what what I do is that, if I want to send money to someone, then.

D

I privately send them all the all the powers in between, and then we replace G to the seventh one today, so we really use the we'll use the power instead of increasing it. How.

A

Much you get so now to.

D

Prove that that something wasn't spent I can just provide the cofactor to this number right.

C

D

And if it was spent, the power goes down, so I will.

C

D

Able to do that now and when I sent to the person, all the all.

C

A

All the powers- and so they.

D

Will be able to decrease it in the future, but nobody else will.

A

That's kind of reversed history and result. Like you say this is my maximum length of history and every time you send.

D

A

It's also like you, it's up fronting the history instead of history growing, but yeah yeah.

D

Okay, let's move to fringe ability this.

B

Is like one of the I'm sold, so the fungibility how you can solve it? There's two approaches again.

B

You can either consider that a coin from like country we'll consider that the coin is like one solid value. You can think that a coin is, let's say, I like this and out with a liquid like. So this is one coin. This is another coin, and the coin has like some: they wear ball has some maximum capacity. This is the plasma debit, which was proposed like a few months ago by Dan Robinson, and so like the the maximum size of the coin is like what you deposited initially.

B

So if you deposit five with you, get like maximum capacity five, and if this is another coin, that has like three like the its much capacity is three and what you can do is that, essentially, if a coin and if a coin has any- and we consider that any coin can have a value in between mm-hmm, so the coin can be like, like.

A

B

Yeah, it can be hopeful, so maybe so here it's like a tail to five and what you can do is that essentially can create kind of fungible payments by atomically, like in the same moment like reducing one coin and increasing another. So going like from three to five like you can essentially do go back to five to five and take this down to one out of three in that sense. But this requires that two transactions get included in one block at the same time, and you cannot assume this so currently.

B

There is no like clear atomic swap protocol like because you need to essentially force the operator to somehow include transaction both to this one end to this one, all with sound buffer like within the next five or six blocks. So, but if you do this, so let's say you have the atomic swap like you can have like the fungible payments and the exit game. It gets modified slightly because you can consider essentially that it's it's time you change this. It's like it's like.

B

You almost have a channel a payment channel with the operator, because the five out of five, which means that you own the five and the operator on zero when you reduce it, like you, get three out of five. The operator owns two, but in addition the operator like like this goes down so the operator like, so you got three out of five, so the operator owns two. You increase it by two, so now the operator on two less, but you also decrease this one by two, so the operator is still always at zero.

B

So there is almost like this liquidity, like.

A

A pretty pretty much takes two here and put.

B

It exactly exactly exactly which starts to look like an account model, eventually, where each coin is its own account Yeah.

A

B

And essentially, when you're doing this payments, this gives you instant finality between blocks, because you can essentially you sign. You have messages with the operator that you sign and so I can be at 3 out of 5.

B

Then we have announced, for example, but you keep increasing so you go 302 5 out of 5 out of 5, then 5 then 4 to 5, then 3 out of 5, and essentially when you exit, you also provide the notes and you will add an additional challenge which says, provide them late at Norm's to stop my exit right and and yeah, and they and then you need also another challenge too.

B

If you include the transaction of an Tomek drop, this can be challenged by revealing that there wasn't the corresponding transaction in the same block, because if there wasn't like, we essentially got some money for free, while the other party did not yeah I cooperated took it exactly.

A

B

Exactly and there's no code for this like to be perfectly clear, like the history compaction and the end, this there's no code for.

C

B

Purely because they because the protocol is still not like completely defining yeah and yeah, so there's this approach, which is like. Essentially you do this, so you can consider almost that each coin becomes a channel with the operator and the operator becomes a hub and essentially like you, do this up and down like rebalancing of coins, which is nice, and it also has the addition that when you make you can either do this type of transaction or you can transfer your going to somebody else.

B

So this gives the notion of transferable payment channels, which Cantley does not exist like in anything else, because if I have a payment channel with you, we cannot somehow I cannot give give you the the channel somehow without giving you my private key. So while I'm not sure about the use cases of this, it's interesting like to Superman yeah.

A

Exactly so, why why I mean if this is like already kind of moving into account model right? Why not just make this an account model like what why you have this limit pretty much right.

B

Because if there is no limit, you cannot enforce like how much can be exited, because otherwise I.

A

Just reveal that you know there is no yeah.

B

But gotta change like that, like I, haven't gone into this like very much in depth, but the operator, basically, they can just like create an invalid state transition and if they withhold they can exit that mm-hm like it's always about the withholding attack. That can happen so that they withhold when they try to exit the coin like it super large value, and you cannot prove that it doesn't have this super large value. You enforce this limit so that like they cannot play create any withdrawals, but.

D

They like, if it's at one third right now operator in principle, can still no.

B

They cannot, because you can reveal a challenge. You will challenge, because we have like a note, goes back and forward. So you if the operator tries to exit the coin or, if you're, if you allow it in the protocol rule in the first place, to allow an operator to exit the coin, because currently you can make it that I exit and simply one-third goes to me and 2/3 go to the operator.

B

But if you allow the operator to exit the coin, what will happen is that from three other three, it would go back to one out of one I see that make sense yeah or you can additionally have the operator inject liquidity on the coin. So from three out of three from one out of three. They would make it one out of five, for example, but this already starts comes on very high key yeah.

A

B

A sense because you have something- and you start like making bigger smaller and depending on what you want so actually I have like an open pull request on the code base like that implements this, but it doesn't implement the atomic swap and if you don't have the atomic swap like you, cannot it's it's useful because you can do like one-way payment with the operator. So with the operator is Netflix, for example, you do stuff with that. But then it's just the payments, a one-way payments I mean with another party mm-hmm like not interesting, wait.

A

A centralized party with.

B

A sound alert idea but feel like it's another party like what I'm saying that it's just payments on.

A

B

Right and we have time like for one more construction or if you're, if the limit is there, it's fine I.

A

Think, let's wrap it up here. Oh cool.

D

Yeah yeah I think I think we've covered quite a bit over both material yeah.

C

D

Cool: okay, thanks thanks a lot.

A

For stopping by yeah, thanks for stopping by check.

D

A

Videos upstairs Downstairs, like, etc, yeah.