►
From YouTube: Whiteboard Series with NEAR | Ep: 49 Kostas Chalkias, Co-Founder & Chief Cryptographer, Mysten Labs
Description
This episode of the Whiteboard Series dives into Sui, a blockchain built by Mysten Labs using the Move programming language. Illia Polosukhin, co-founder of NEAR, hosts Kostas Chalkias, Co-Founder & Chief Cryptographer at Mysten Labs. Kostas was previously a cryptographer at Facebook, working on Libra, encryption of WhatsApp, and more.
Mysten Labs was founded in 2021 by a team of ex-Facebook engineers. They are building Sui, a decentralized, delegated Proof-of-Stake blockchain with high throughput, low latency, and an asset-oriented programming model. Mysten are also working to accelerate adoption of Move, an open-source programming language for building smart contracts originally developed as part of the Libra project.
To learn more about Mysten Labs and Sui, check out:
Website: https://mystenlabs.com
Twitter: https://twitter.com/mysten_labs
Blog: https://tech.mystenlabs.com/
Github: https://github.com/MystenLabs/sui
Docs: https://docs.sui.io/build
Sui Website: https://sui.io
Sui Twitter: https://twitter.com/SuiNetwork
To join NEAR’s community, visit:
Website: https://near.org/
Reddit: https://www.reddit.com/r/nearprotocol/
Discord: https://near.chat/
Blog: https://near.org/blog/
Twitter: https://twitter.com/NEARProtocol
GitHub: https://github.com/near https://github.com/nearprotocol
Docs: https://docs.near.org/
B
Thank
you
Leah,
so,
by
the
way,
yeah
I'm,
also
coming
from
Facebook
as
the
whole
Founders
team.
Five
of
us
we
used
to
be
leaders
there.
I
was
leading
the
cryptography
part.
Obviously,
while
Libra
was
collapsing,
I
was
actually
dealing
with
other
staff,
including
WhatsApp
security
and
cryptography.
It
eventually
well
left
and
we
built
actually
and
after
a
year
now,
almost
a
year,
we
recently
launched
testnet.
We
had
devnet
for
a
while
we're
doing
really
well
on
testnet.
B
B
And
then
these
transactions,
via
some
housing
and
obviously
someone
will
pick
the
transaction
that
will
go
into
this
block
either
by
mining
or
by
some
proof
of
stake
or
any
other
method.
You
will
create
a
different
blog
with
different
transactions
as
they
come
here
and
then
we
said:
okay
cool.
This
was
pretty
much
the
the
model
that
we
used
to
have
at
Libra
and
most
of
the
blockchains
are
built
under
this
like
pretty
much
the
same
construction.
But
we
said
there
are
a
few
opportunities
where
we
don't
need
to
wait
for
blocks.
B
We
don't
need
consensus.
You
go
through
the
validator
set.
We
are
delegated
proof
of
stake,
which
means
that
people
can
actually
give
their
with
some
weight.
They'll
take
to
someone
else
who
will
vote
on
behalf
of
them
like
a
regular
democracy,
and
these
transactions
will
go
on
Parallel
into
you.
Well,.
A
B
Broad
definition,
but
yeah
off
topic
from
this
yeah
I
get
it
I
get
it.
Let's
assume
there
is
a
set
of
validators.
There
are
epochs,
of
course,
like
every
few
moments.
At
the
moment
we
have
a
day
for
the
nipple
katsui.
This
can
be
rotated
based
on
the
stake
and,
let's
assume
now
that
we
are
in
an
ebook
and
we
have
all
of
these
transactions
happening
on
Parallel
and
what
will
happen
in
this
particular
case.
I
will
assume
like
four
or
five
situation.
B
You
just
go
on
this
transaction
to
the
validators,
and
you
ask
a
signal
to
your
own
parallel
from
all
of
the
four
out
of
five:
let's
assume
it
literally
five
and
you
need
four
out
of
five
for
for
bft,
you
get
the
signature
back
and
then
this
might
be
enough.
If
you
can
construct
now
the
user.
The
difference
between
the
other
chains
and
three,
the
user
here
is
actually
getting
the
transaction
of
the
getting
the
signatures
for
this
transaction.
They
are
forming
a
certificate
and
they're
sending
it
back
to
the
validators.
A
B
Want
exactly
so,
there
is
a
benefit
here
in
the
sense
that
these
validators
do
not
need
to
interact
between
them,
which
usually
introduces
and
then
square
or
depending
on
the
protocol.
It
might
be
n-cube,
like
communication
cost.
Now
what
we
did
is
we
have
the
user
and
the
user
is
actually
the
driver
of
yeah
I'm,
sending
a
transaction
I'm
going
into
the
validators
getting
only
signatures.
They
don't
communicate
between
them.
Then
I
receive
all
of
the
signatures
back.
B
We
are
using
BLS
and
BLS
in
this
particular
case
can
actually
aggregate
the
signature,
the
signature,
the
signature
is
aggregated
on
the
usage
side
and
I,
send
it
back
to
the
validators,
so
the
validators,
they
see
a
signature
of
like
n
to
f
plus
one
of
them,
and
they
say
okay,
if
other
people
also
sign
and
I
also
sign.
We
have
to
have
plus
one
I
can
accept
this
transaction
without
communicating
with
them
it's
in.
B
Instead
of
having
the
validators
actually
communicating,
you
have
the
user
being
the
aggregator
and
in
this
two-step
process,
which
can
happen
on
Parallel,
of
course,
you
can
actually
have
the
same
thing
as
a
consensus
mechanism.
These
is
is
taken
from
a
protocol
that
Jordan
Isis
and
some
other
people
in
our
company
Alberto
as
well,
have
created
back
at
Facebook.
It
was
called
Fast
pay.
B
So
this
is
a
method
for
fast
payments.
Without
food
consensus
there
is
no
full
consensus
here.
Yeah
and
you
can
have
parallel
transactions.
Obviously
there
is
a
caveat
here.
Right
I
mean
you
cannot
do
it
forward
when
you
don't
have
order.
Yes,
exactly
now,
you
don't
care
about
the
order.
What
are
some
like
examples
that
this
works?
Can
you
give
me
a
few
applications
where
you
don't
need
ordering.
B
You're
right,
okay,
so
you
go
to
Starbucks
and
by
the
time
you
go
there,
you
buy
a
coffee
and
then
obviously
they
they're
ready
to
prepare
your
coffee
to
to
serve
you.
They
don't
need
to
wait
for
the
block.
You
just
send
the
signatures.
I
mean
the
request
signature
for
to
the
validators.
You
don't
need
to
wait
three
five
ten
seconds
until
the
block
is
formed
and
you
are
getting
these
signatures
by
yourself
and
you're,
giving
them
directly
to
to
Starbucks
and
Starbucks.
B
B
Well,
it's
your
object.
Right
I
will
explain
how
the
object
models
work,
but
at
this
time
I
mean
you
can
get
the
certificate.
Starbucks
will
check
the
signatures,
but
the
validators
when
they
send
the
transaction.
They
check
that
you
had
the
balance
to
actually
pay
for
this
element
and
because
the
or
the
in
order
to
shine,
obviously
they
take
the
correctness
of
the
transaction.
But
this
is
what
they
do.
They
didn't
communicate
with
other
validators
as
the
trick.
B
A
B
Yes,
exactly
there
is,
there
is
a
state
change,
but
the
small
difference
between
other
account
based
systems
and
our
system,
yeah
we're
somewhere
between
account
based
and
utxo
based,
yeah,
so
sui
is
not
utxo
based
like
completely
it's
not
even
an
account
based.
Well,
you
have
an
account,
so
we
can
let's
finish
with
this
stuff,
and
then
I
can
explain
why
the
object
model
in
our
case
is
very
useful
for
fast
paid.
Fast
pay
wouldn't
work
in
a
purely
account
based
system
of
ethereum,
for
example.
The
idea
is
that
you
have
like
imagine.
B
This
transaction
is
using
only
one
utxo.
This
might
be
the
object
that
I'm
sending
you.
It
might
be
five
dollars
right,
it's
these
five
dollars
that
will
change
state,
of
course,
and
what
what's
the
change
of
the
state
I'm
changing
the
owner,
I'm
just
sending
you
a
particular
object,
so
imagine
all
of
them
as
being
like
nfts.
Yes,
but
it's
fungible
right,
it
can
be
fungible,
it
can
be
mutated,
but
it
doesn't
matter
it
has
an
owner,
so
the
balances
are
not
under
accounts
anymore
and
they're,
not
under
contract
like
internal
data
structures.
B
They
live
independently.
So
I'm
sending
you
this,
and
this
is
why
I
can
make
the
state
change
without
affecting
anything
else
on
the
network
I'm
only
affecting
the
state
of
this
particular
object,
and
this
is
how
you
are
getting
all
of
this
benefit
on
payments.
Some
other
examples
that
are
very
interesting.
Okay,
let's
go
and
listen
right
payments.
B
Obviously
you
can
have
confidential
payments
because
there
is
no.
There
is
no
huge
difference
between
sending
real
like
visible
integers
or
sending
competitions.
Yeah
I
mean
you
can
do
whatever
you
want.
This
can
also
be
objects.
What
you
can
do
is
you
can
even
build
like
your
personal
webpage,
it's
something
that
you
own
every
single
time,
you're
mutating
your
page.
Nobody
else
is
affected.
If
you
know
how
to
do
your
ordering
by
yourself,
it
can
be
unparalleled,
you
don't
need
blocks
anymore.
The
same
thing
is
for
Twitter
We
call.
B
We
have
this
example
on
three.
We
call
it
sweeter.
What
is
a
tweet?
It's
an
nft,
so
in
practice,
when
I'm
sending
something
to
you
I'm,
creating
an
nft
and
I'm,
sending
you
to
the
network
I'm
the
owner,
then
in
this
nft
I
might
even
have
a
reference
if
it's
ready
to
eat.
If
it's
a
like
or
it's
something
else
and
in
practice
everything
lives
as
an
nft.
In
in
theory,
you
can
imagine
surya's.
B
B
B
Exactly
and
anything
that
you
can
imagine
that
it's
objects
that
you
control,
nobody
else
can
touch,
it's
only
you
that
actually
can
Define
the
order
can
be
built
with
this
fast
pay
model.
Some
other
examples
are
even
things
that
you
cannot
imagine.
It
is
possible
to
do
with
single
owner.
We
call
them
single
owner
objects.
A
B
B
There
is
an
issue
here,
however,
in
some
applications
it
might
be
tolerable
that
the
other
player
might
at
the
same
time
send
the
same
object
that
they
locked
in
the
same
transaction
somewhere
else,
and
it
might
be
an
equivocation
yeah.
So
there
is
a
race,
will
they
succeed
or
the
other
transaction
will
succeed
and
there
is
another
race.
Maybe
this
transaction
will
succeed
on
50
of
the
validators
yeah
and
the
other
on
the
other
50,
and
then
you,
you
have
a
problem.
A
B
B
So
what
we
can
do
is
we're
resolving
this
at
depot
level,
debug
level
you
can
do
it
and
there
is
because
the
book
level,
you
can
actually
say
if
you
didn't
receive
the
transactions,
can
actually
Define
the
ebook
that
they
want
to
be
executed.
If
you
didn't
receive
it
on
time,
just
throw
it
and
then
you
can
start
the
game.
What
share
ebook
Links
at
the
moment
it's
one
day!
Well!
This
is
something
that
we
will
play
with
that.
B
B
There
is,
there
is
a
fast
and
freeze,
but
it's
not
only
those
examples
that
I
explained
here.
There
are
more
examples.
Well
defy,
as
you
said,
uni
swap
is
more
complicated.
You
can
do
it
with
this
way,
however,
with
a
multi-agent
transaction
while
working
on
the
multi-agent,
it's
not
there
yet,
but
there
is
also
a
lot
there
is
imagine
if
we
have
a
giveaway
where,
in
this
giveaway,
you
have
a
car
right,
you're
giving
away
a
car,
people
are
participating
and
obviously,
if
you
imagine
a
lottery
in
your
head,
you
will
say
no.
B
No.
This
requires
a
certain
object.
I
mean
we
cannot
participate
in
the
same
Lottery
where
people
are
locking
money.
This
money
should
go
to
some
counter
to
some
balance
that
it
always
goes
up
and
up
and
up.
There
is
a
way
to
avoid
it
and
the
way
to
avoid
it
is
I
can
buy
tickets
independently
on
Parallel
I
pay
five
dollars
in
this
payment.
I
pay
the
owner
of
the
giveaway.
Let's
say
it's
an
organization,
so
I
pay
five
dollars
to
buy
a
ticket.
It
dependently,
we
all
pay
five
dollars.
B
C
B
Win
a
car
which
means
that
you
buy
tickets
independently
and
in
this
particular
case
you
can
have
the
fast
pay
approach.
I
just
buy
tickets.
But
how
is
the
winner
defined
now?
I
have
the
problem.
You
need
to
define
a
winner,
so
the
winner
can
be
defined
by
the
fact
that
you
can
use
fraud
proofs.
We
can
use
the
do.
You
know
algorithms,
certification
algorithm
where
they
do
the
leader
election
thing
yeah,
so
very
quickly.
B
B
We
have
nfts,
which
are
the
tickets
one
ticket,
two
blah
blah
ticket
and
eventually
on
some,
we
Define
when
this
ticket
issuing
will
finish.
Let's
assume,
Epoch
seven
ebook
seven,
you
start
from
Epoch
one
until
epic,
seven,
you
can
buy
tickets,
that's
fine,
and
then
eventually
you
have
a
list
of
tickets
and,
let's
assume
MoneyPak
8.
We
have
the
big
one.
B
The
Bitcoin
is
defined
on
duplicate.
How
do
we
Define
the
I
mean?
All
of
them
are
independent
right,
you
don't
know
you
cannot
even
sort
them.
You
cannot
do
anything,
however.
The
users
can
have
access
on
these
tickets
because
it's
a
blockchain
they
can
go
offline.
They
can,
let's
assume,
that
it's
a
very
basic
function
of
hash
of
a
Bitcoin
comma
ticket.
B
Everyone
is
producing
The
House
of
the
big
comma
ticket
and
the
smallest
one
wins
like
the
house.
That
starts
with
many
zero's
wins,
so
only
the
winner
is
the
one
that
will
go
and
have
a
second
object.
Now
all
of
the
tickets
99.99
of
the
transactions
are
fast
paid
and
only
the
winner
will
use
a
certain
object,
something
for
which
you
need
consensus
and
what
the
winner
will
do
will
say:
I
won,
you
will
wait
if
nobody
complains
you
want.
If
someone
comes
to
you,
it's
like
arbit
room
yeah,
then
you
keep.
You
keep
going.
B
Is
only
one
winner,
nobody
complains
and
then
you're.
Definitely
the
winner
or
the
winner
didn't
report
it,
but
everyone
can
report
it
right.
Even
if
you
are
not
the
winner,
you
know
how
to
provide
the
ticket
as
evidence
as
a
fraud
proof-
and
this
is
very
similar.
Actually
it's
a
good
way
to
have
fraudproof
some
sweet,
not
necessarily
A
fraudible
by
executing
the
whole
state.
It's
a
special
case,
fraud.
Proof
there
are
more.
There
are
more
applications.
A
B
Yes,
let's
assume
we're
using
d-round
right
or
any
any
Bitcoin
yeah
and
we
say
on
Epoch
a
there
will
be
some
random
because
you
don't
know
it
by
the
time
you
register,
because
you
registered
until
seven.
So
when
this
Bitcoin
is
published.
Now
we're
going
to
do
all
of
the
classes
offline
and
the
winner
will
just
report
it,
but.
A
B
Define
the
third
object:
this
is
a
object.
Now
that
is
not
single
owned.
Yeah.
It's
like
a
data
structure
or
it's
something
that
the
organizer
actually
has
sent.
One
car
nft
here
yeah
and
obviously
there
was
like
on
Epoch
eight.
We
have
to
get
the
beacon
and
if
someone
executes
a
transaction,
we
have
to
wait.
I
don't
know
for
for
two
epochs
for
the
fraud
proof.
A
A
C
B
B
X
and
this
one
might
be
your
your
ticket,
so
you
will
provide
the
ticket
the
ticket
with
this
ticket
type
can
only
be
created
by
this
marketer.
You
cannot
create
it
by
another
smart
contract,
so
the
winner
will
just
send
to
this
faction
that
lives
under
the
third
object,
an
object
that
has
been
created
somewhere
else.
I
mean:
where
are
your
bank
tickets,
and
it
can?
It
can
understand
that
this
is
object,
Type
X,
and
it
knows
oh,
it's
definitely
a
ticket
that
I
issued.
It
was
issued
by
my
particular
smart
contract,
so.
B
A
B
B
B
Not
this
buy
ticket
could
even
live
outside
this
object.
Okay,
in
this
module,
it
can
accept
any
module
type.
Here,
that's
why
we
have
the
composability
and
show
you
that
you
cannot
easily
get
on
ethereum
on
The
Theory
of
Everything
is
a?
U
256..
How
do
you
know
it
has?
How
do
you
know
it's
a
number,
how
other
contracts
know
the
type
that
you
represent
internally
in
your
in
your
own
contract?
Well,
in
our
case,
they
are
like
strictly
typed.
B
You
know
exactly
what
this
is
like
of
this
type,
and
we,
if
you
also
need
to
use
some
like
genetics,
we
also
have
this
object.
Type
T.
You
know
it's
a
from
this
Lottery
and
this
is
why
we
allow
this
composibility
and
I.
Guess
one
example
that
you
will
see
with
three
is
people
who
are
running
independent
contracts.
Then
I
can
go
and
create
a
new
contract
that
they
can
input.
B
Some
object
that
you
created
on
your
own
contract,
and
maybe
you
can
Define
like
many
complex
structures
here
of
different
contracts,
communicating
with
other
contracts
and
different
types
of
objects
and
evolution.
We
can
even
evolve
now.
If
you
don't
like
your
contract
anymore,
you
can
just
create
another
contract
that
takes
as
inputs
types
of
your
previous
contract,
and
you
know
exactly
the
type
of
of
the
expected
like
inputs
of
the
function.
So
that's
a
benefit
or
I.
Think
it's
is
it
clear
at
least
yeah
sorry
at
the
high.
A
Level,
yeah
I
think
probably
worse
same
pretty
much
that
the
the
object
that's
stored
on
kind
of
on
chain
right,
which,
which
are
you
know,
there's
owner
kind
of
and
some
let's
just.
This
is
some
Global
idea:
I'm
assuming
right,
yeah
that's
used
and
then
the
code
is
living
separately.
Yes
and
the
code
yeah
can
refer
to
any
of
the
object
types
exactly
right,
and
so
through
that
only.
B
A
B
B
Object,
of
course,
yeah
right
and
it's
actually
helped
us
like
some
data
structure
internally
to
the
smart
contract.
Yes,
if
it
belongs
to
the
smart
contract
with
high
probability,
it
will
be
a
shared
object,
but
now
you
can
even
have
objects
that
do
not
live.
As
I
said,
like
data
structure,
it's
it's
like
a
single
thing.
B
You
have
an
nft
that
has,
as
ownership
a
user,
it's
still
coded
inside
this
module,
but
it's
not
part
of
some
data
structure,
and
this
is
where
you're
getting
all
of
this
single
owner
and
those
that
are
not
single
owner.
So
everything
that
you
see
in
in
ethereum
Sparkle
drug,
where
it's
usually
a
map
of
things,
everyone
can
go
there
and
write
places,
are
the
set
objects
and.
A
B
A
B
C
B
B
B
B
C
B
Can
do
whatever
they
want
with
the
sizes,
but
in
our
cases,
because
you
can
actually
remove
things
from
this
object,
you
can
you
can.
You
can
create
like
a
very
interesting
data
structures?
Maybe
you
can
even
have
a
map
and
this
map
gets
up
to
an
element
and
if
you
need
more
you're,
just
creating
an
extra
attention
object
on
this
that
can
can
move
on
or
you
can
even
have
a
tree
structure.
So
you
have
pointers
and
you're
creating
multiple
objects
that
are
owned
by
this
object.
B
A
C
B
Yeah,
okay,
there
is
a
way.
Actually
it
was
a
good
question.
There
is
a
way
to
provide
the
parent
object
now
and
actually
it
can
resolve
all
of
the
children
of
the
or
the
children
that
you
want
internally
to
the
execution.
Maybe
you
say
that's
expensive
now
it
can
be
a
bit
well,
it
depends.
Maybe
you
can
find
good
good
ways
to
do
it
like
some
prefixes
or
some
references
internally.
You
just
need
a
byte,
and
you
know
that
if
you
see
this
byte,
it's
this
object,
ID
don't
provide
the
whole
object.
B
Id
and
yeah.
This
concept
actually
exists.
It's
very
useful.
Actually,
I
can
explain
why
it's
useful.
Imagine
you
have
an
account
now
in
ethereum
and
and
this
account
owns
nfts
in
multiple
smart
contracts,
you're
a
company
and
eventually
you
want
to
sell
your
company
to
another
bigger
company.
What
do
you
do.
B
B
I
agree,
but
you
have
this
account.
Logically,
you
need
to
split
your
account.
Logically,
you
cannot
now
because
you
can
change
it.
You
cannot
have
the
fast-pay
model.
Obviously,
because
imagine
in
one
transaction,
you
are
changing
the
account
and
in
the
other
you
are
doing
a
transfer.
You
need
to
have
the
order
on
who
is
the
who
is
the
owner
at
the
time
of
transaction.
You
need
to
synchronize
online,
exactly
we
don't
have
this
ability
because
of
parallelization.
A
B
Right
because
we
only
mentioned
one
type
of
the
consensus:
it's
not
full
consensus,
but
a
way
of
like
it's
like
a
broadcasting
exactly
so
what
is
the
life
cycle
of
a
transaction
right?
I
only
explained
like
part
of
it,
so
we
have
a
transaction,
and
this
transaction
will
go
fast,
like
let's
assume
in
the
fast
pay
world
where
the
validators
will
give
you
to
f,
plus
one
signatures,
and
this
is
like
for
locking
the
the
objects,
because
here
you
will
have
object.
Inputs
object,
one
blah
blah
blah
so
you're.
B
B
B
If
it's
not
fast
pay,
then
after
the
locking
mechanism
after
this
one
round
trip,
you
can
actually
send
it
to
narwhal
and
Bulls
Ark,
and
this
is
literally
one
of
the
fastest.
This
one
doesn't
even
require
a
leader
election.
So
previously,
if
you
see
all
of
our
documents,
we
had
tasks
and
then
it's
pretty
much
the
same
team
that
actually
created
both
tasks
in
Bulls
Arc,
but
task
requires
some
random
Beacon
for
fairness
and
other
things
and
bullshark.
B
It
can
help
if
you
have
around
the
big
one,
but
it's
not
a
huge
requirement
here
and
now:
you're
not
going
through
fast
pay.
Now
you're
going
through
this,
and
here
you
have
to
wait
for
a
block
and
after
you
have
these
blocks.
Obviously
you
have
okay,
some
are
with
effect
certificates.
Some
are
with
narwool.
What
do
you
do?
We
have
another
model
where
these
fast
pay
executed
transaction.
They
can
also
go
through
a
number
eventually
and
all
of
these
snorkels.
B
B
Evidences,
for,
like
I,
don't
know
if
you
have
a
delivery
versus
payment,
you
you
see
the
payment
and
you
deliver
the
object.
How
frequently
are
the
checkpoints
so
we're
working
on
the
checkpoints?
It
might
be
seconds
I
think
we
had
an
example
with
six
to
ten
seconds.
If
I
remember
correctly,
I,
don't
know
what
the
number
will
be
on
mainnet,
because
now
we're
working
on
like
synchronizing
this
part
of
synchronizing
to
to
checkpoint
and.
A
B
B
C
B
A
B
All
of
them
they
are
forming
different
different,
let's
say
blocks
small
blocks,
yeah,
and
it
is
possible
that
one
block
is
having
I
mean
this
blog
is
having
tx1.
This
also
has
the
X1.
They
have
different
blocks,
yeah
and
then
they're
starting
proposing
this
yeah,
and
if
you
see
a
transaction
that
was
already
included
in
a
different
block,
I
mean
it
was
already
included.
There
is
some
duplication
here
yeah,
but
this
is
what
gives
you
the
the
speed
right
I
mean.
Some
transactions
are
indeed
in
different
blocks.
B
However,
it
doesn't
really
matter
right,
you
just
need
one
of
them
to
include
it
and
it's
a
dug.
You
get
a
duck
in
bull
shark,
and
eventually
you
have.
You
know
multiple,
like
objects,
multiple
blocks
being
proposed.
Some
of
them
might
be
overlapped,
not
fully
overlapped,
and
then
you
go
back
to
check
if,
like
a
transaction
was
already
included,
you
don't
include
it.
We
have
some
hashmobs
internally
and
all
of
this
so.
B
Yes,
you
need
to
have
plus
one
signatures
right
if
you
receive
12,
even
if
you
didn't
receive
something,
but
you
receive
an
Evidence,
the
12
plus
one
has
signed.
If
you
accept
it
yeah,
that's
the
idea.
Well,
you
will
see
a
few
systems
that
actually
are
down
and
only
two
f
plus
one
are
live.
Yeah.
Eventually,
you
need
to
sync
up
yeah.
You
have
to
have
plus
one
signals.
You
assume
that
the
system
is
running
correctly
holds,
but
all
of
them
can
propose.
A
How
you
do
attacks?
You
know,
you
know
right,
it's
more
complicated,
yeah,
let's
not
go,
and
maybe
it
is
whole
separate,
I'm,
just
like
just
so
for
clarity
right
so
let's
say
I
am
as
a
user
right
in
this
case
like
because
I
already
have
the
certificate
that
they
saw,
the
transaction.
If
you
go
through
yes,
yes,.
A
A
B
It
exactly
in
theory,
you
can
even
send
it
to
one,
but
you
have
the
risk
that
this
one
will
not
for
yeah.
So
you
can
actually
pick
a
bit
more
like
this
number
I.
Don't
remember
if
George
has
a
real
number,
we
were
testing
this
number,
but
it
will
be.
Obviously
if
you
send
it
to
f,
plus
one
yeah.
It's.
A
Enough
that
someone
will
will
propose
it
yeah,
okay,
so
then,
then
everybody
proposes
a
Blog,
they
probably
and
then
they
start
sending
their
blocks
to
the
other
violators
right
and
so
so.
I'm
from
my
from
a
single
validity
point
right,
I
have
my
blog
that
I
proposed
and
then
I
received
some
other
there's
no
time
stamping
right,
so
they.
B
A
A
B
A
A
B
B
We
can
have
here,
which
is
more
like
fine
grain.
There
is
sequence
of
blocks
well
here
in
the
dark,
it's
very
difficult
to
have
a
good
time
yeah,
but
yeah.
That's
the
whole
idea
of
like
the
the
basic
protocol.
What
people
can
understand
on
on
this?
One
is
definitely
you
need
one
round
trip
to
get
a
locking
on
the
objects,
yeah,
some
certificate
objects
and.
B
B
It
looks
the
same.
The
user
I
mean
it's
as
easy
as
possible
for
the
user.
They
don't
even
need
to
know
where
they're
sending
data
section.
This
is
happening
everything
on
the
background.
So
that's
a
general
way
of
of
how
sui
works
right
and
we
explain
a
few
examples.
There
is
also
a
move
in
the
game
yep
and
in
move.
Some
of
the
hints
that
we
gave
already
is
everything
is
object.
Yep,
like
it's
it's
strictly
typed.
There
is
also
some
capabilities
like
the
object
can
have
capabilities
like
drop.
B
B
C
B
B
B
A
B
It's
also,
it's
also
abilities
that
they
have
so.
Some
is
working
on
some
very
interesting,
like
even
extra.
Some
is
our
CTO
extra
things
that
we
might
have
here
and
Todd
novaki
who's,
leading
like
the
move
team,
and
there
is
another
thing
that
we
have
to
know
about
three.
So
we
explained
all
of
this.
What
we
didn't
explain
is
transaction
costs,
storage
and
this
kind
of
stuff.
Auto
economics
is
very
interesting
right.
What
is
usually
the
the
cost
for
a
transaction?
Why
do
you
pay
the
validators?
B
B
Yes,
execution
starts
you
pay
for
this,
and
also
this
is
the
cost
of
the
validators
pay
right.
I
mean
a
validator
has
to
execute
transaction,
but
at
the
same
time
they
need
hard
disks.
They
need
all
of
this
stuff
to
maintain
the
network
and
the
state.
What
we
do
is
we
split
the
gas
between
these
two
and
we
have
a
storage
fund.
B
Part
of
this
well,
there
is
there
is
there
are
some
functions
from
Alonso,
our
like
economist,
go
to
a
storage
fund
and
this
storage
fund
is
actually
giving
the
opportunity
for
the
users.
If,
in
the
future,
you
want
to
delete
this
nft,
the
storage
that
takes
you
will
get
some
rebuttal,
you
get
the
return
yeah,
yes,
you
get
some
return
and
it
also
gives
an
advantage
to
the
validators.
Are
we
good
with
the
time
are.
B
B
Exactly
but
you
need
to
store
all
this,
you
have
the
students
funded.
We
can
pay
you.
Obviously
you
are
not
going
to
get
as
a
user.
All
of
this
I
mean
if
you
you
deleted,
you're,
not
getting
everything
back.
Yeah
like
the
battle
is
sorter,
but
at
least
you're
getting
something
some
people
might
use
it
to
have
like
I'm,
storing
objects
and
then,
if
the
market
goes
up
in
practice,
I
I
can
even
make
money
in
theory.
But
let's
assume
that
this
is
not
the
the
reason.
B
A
A
A
B
B
B
B
It's
there
and
there
are
some
functions,
giving
money
to
the
Valdez
and
to
the
users
for
the
battles
I
see,
because
then
we
might
not
be
solving.
If
we
didn't
right,
you
can
invest
it
in
theory.
You
can,
you
can
do
a
lot
of
things,
but
this
is
something
that
will
be
defined
in
the
smart
contract
level,
not
outside
the
the
smart
contract.
Right
I
mean
everything
will
be
transparent.
B
B
The
other
thing
that
is
interesting
with
us
is
crypto
agility,
I'm
going
into
my
territory
now.
So
what
do
we
have
right?
We
do
have
API
internally
from
the
from
the
STD
API
on
growth.
16,
like
we
have
zero
knowledge
proofs,
yeah
I
mean
some.
The
smart
contracts
can
literally
execute
zero
knowledge
proofs
by
just
calling
the.
B
B
We
also
have.
Obviously
we
have
the
BLS
verification
even
internally
to
the
contracts
we
do
have
I
mean
the
regular
cdsa.
Did
you
did
you
speed
up
BLS
because
you
say
we're
using
the
plst
but
we're
working.
You
will
see
in
a
couple
of
weeks
another
optimization
of
the
aggregation
on
top
of
the
dampone
paper.
B
We
we
managed
to
make
a
way
where,
because
it's
a
validators
keys,
if
you're
using
BLS,
mostly
you
need
it
for
validator
signatures.
What
you
can
do
is
you
can
have
different
ways
of
aggregating
by
even
avoiding
proof
of
possession
of
the
case.
You
don't
you
might
not
need
proof
of
possession
anymore.
B
Usually
you
need
to
to
prove
because
you're
doing
aggregation
that
hey
it's
my
key
to
avoid
the
kind
of
attack
called
wrong
key
attack
so
I,
because
you're
aggregating,
somehow
I
know
some
other
validators
keys
and
I
create
my
key
in
a
way
that
I
take
advantage
of
your
keys
and
then
I
can
omit
your
signature
and
somehow
the
people
who
believe
you
signed
yeah.
We
found
some
ways
to
make
it
a
bit
faster,
so
we
call
it.
B
So
there
is
a
version
of
BLS,
let's
see
if
we
are
going
to
to
have
it
already,
because
the
bill
is
the
implementation
and
the
aggregation
is
really
fast.
Now
I
think
we're
the
first
company
that
we
have.
We
have
a
library
called
Fast
crypto
foreign,
so
this
is
popular
enough
now
I
mean
even
fans
are
using
it
that
have
the
fastest
implementation
we
find
just
we
make
all
of
the
adjustments.
Obviously
we
use
them
on
Suey,
but
this
one
is
like
published
independently
and
everyone
can
use
it.
C
B
C
B
There
was
even
treasure
and
some
other
wallets,
that
they
had
an
exposed
API
where
someone,
if
they
were
not
careful,
they
could
expose
a
private
key
treasure
was
lucky
and
he
didn't
have
the
like
this
vulnerability
being
exploited
yeah,
but
someone
could
do
it
accidentally
now
they
fixed
it.
I
mean
they
were
super
fast
to
fix
these
things,
and
it's
in.
B
B
This
is
for
like
confidential
transactions
and
other
things
that
you
can
do
yep
generally,
you
will
see
a
very
rich
API
on
cryptography.
We
even
have
dran
support
native
drill
and
support.
So
literally
you
can
you
can
you
can
use
their
Durant
committee
internally
to
show
it
today?
We
also
have
some
other
protocols
that
we
implemented,
like
some
optimistic
Satoshi
dies
for
for
lotteries
even
multi-party,
so
you
can
even
avoid
vrfs
we're
working.
B
B
A
B
Does
it
means
yeah,
yes,
mobile
enclaves,
so
we're
having
this
and
obviously
we're
making
because
they're
not
good
implementation
of
R1?
Unfortunately,
you
will
realize
it
as
well.
This
is
faster.
This
is
faster
because
the
Bitcoin
World
actually
made
it
faster
yeah,
and
this
one
is
faster
because
we
also
contributed
on
this.
No.
B
It
is
it
is,
but
but
even
our
team
actually
contributed
a
lot
to
making
this
a
lot
faster,
even
on
battery
verification.
If
you
go,
we
even
have
half
aggregation
here.
You
can
literally
aggregate
without
an
interaction
in
the
DSA
signatures
to
have
half
of
the
size.
We
publish
this
on
RSA
conference
like
two
years
ago,
while
at
Facebook,
but
yes
R1,
and
we're
going
to
even
have
BLS
in
the
user
side,
because
in
BLS
you
can
have
very
like
efficient
threshold
schemes
without.
B
B
B
C
B
Size
also
plays
a
role
yeah
and
the
execution
cost,
and
you
can
do
some
other
batching
and
parallelization.
We
also
did
some
parallelization
here,
so
this
is
one.
This
is
the
other
part
on
on
cryptography
and
and
a
very
interesting
like
signature
scheme
is
coming.
I
cannot,
unfortunately,
cannot
we
really
because
we
didn't
have.
We
don't
have
yet
the
security
proof,
but
this
one
will
be
I.
Think
one
of
the
best
ideas
in
the
space
on
how
you
can
authorize
users
without
Smart
contracts.
B
B
So
today
is
the
day
that
you
know
that
I
publish
something
it's
very
interesting
right,
I
mean
I
was
going
to
be
published
a
bit
later
right,
so
yeah
yeah,
you
will
publish
it
later,
but
the
idea
is
I
played
like
a
big
role
in
the
past.
Personally,
like
as
my
personal
goal,
you
know,
while
working
at
Libra,
we
had
to
work
with
Regulators,
so
I
was
involved
in
this
meeting,
sometimes
and
I
had
all
of
the
input
from
Auditors
Regulators
like
regular
Auditors,
not
only
governmental,
Auditors
and
Libra.
B
Literally,
it
wasn't
technical,
the
issue
that
didn't
work
right.
It
was
other
things
outside
our
territory
that
didn't
allow
it
to
to
to
be
able
to
be
a
product.
However,
we
did
a
lot
of
work
on
solvency.
We
had
very
good
economies,
even
Dalia
from
chain
link
now
and
Christian
catalini,
like
the
economies
that
we
have
now
in
Syria
Alonso
de
cortari
myself
as
a
cryptographer
who
is
now
on
a16z
and
some
other
cryptographers
like
around
the
world
in
Visa
research
in
Cornell,
University,
Panos
and
Yan.
B
We
worked
a
lot
on
finding
okay,
even
if
we
want
to
have
solvents.
It's
not
easy,
it's
very,
very
difficult
how
you
have
a
centralized
exchange,
or
even
in
decentralized
exchange.
If
it
uses
some
of
the
assets
outside
the
blockchain,
how
do
you
even
verify
that
what
they
are
liable
for?
They
have
the
exact
same
assets
or
even
more
srps,
and
then
some
companies
after
FTX
started
to
offer
like.
B
B
But
even
in
the
regular
there
is
no
other
solution
and
I
can
explain
to
you
why
there
is
no
other
solution.
This
is
for
sex
right
sex
of
the
centralized
exchange,
not
the
other
sex.
No,
no.
You
remember
vitalik's
recent
post
how
to
have
a
safe
sex.
This
was
the
the
title
literally,
but
obviously
we
mean
about
like
centralized
exchanges.
The
problem
is
first,
they
have
issues
with
privacy
yeah
and
the
other
thing.
B
B
This
is
one
of
the
things
that
we
mentioned
in
like
binance
now,
but
some
other
exchanges
that
they're
also
using
the
same
algorithm
like
Kraken
and
others,
and
something
that
they
always
do
I,
don't
know
why
people
are
doing
it
is
so
instead
of
using
32
bytes
they're
only
using,
for
example,
eight
bytes
for
leaves-
and
this
is
very
dangerous-
why
it's
dangerous,
because
someone
cannot
find
collisions
of
chain
here,
you're
using
also
some
salt
per
user.
You
can
just
play
with
the
salt
until
you
find
two
balances.
B
You
report
the
lower
balance
to
the
auditor.
You
report
the
real
balance
to
the
user,
and
the
auditor
will
do
the
sum
and
we'll
see
some
very
small
value,
even
zero
in
theory
and
the
user
will
say
no,
no,
my
balance
was
there,
but
this
is
completely
wrong
and
this
is
I.
Don't
know.
I
feel
the
mistake
is
based
on
the
fact
that
traditional
Auditors
have
implemented
the
original
Maxwell
approach.
B
C
B
Like
and
we
identified
this
issue,
we
identified
other
issues
regarding
the
summation
vitalik
Stakes,
now
a
leading
corollon
trying
to
propose
even
a
standard,
and
there
is
the
communities
at
Cape
roof
and
many
cryptographers
that
we
literally
want
all
of
this.
Yes
to
be
zero
knowledge
proof,
so
you
don't
need
to
provide
the
pairs
yeah.
B
We
do
have
a
paper,
it's
called
Depot
Plus
and
actually
this
year
was
in
the
top
10
Innovations
of
2021
in
one
of
the
biggest
I
think
Innovation
contests
in
the
world
see
so,
and
this
one
works
really
well
with
proven
security,
and
all
of
this
vitalik
now
is
proposing
another
scheme
where,
instead
of
using
this,
let's
like
snark
everything
and
by
snarking
everything,
probably
we
can
have
a
faster
verification,
proofs
and
other
things.
However,
this
works
in
my
opinion.
We
should
start
with
this,
at
least
to
ensure
that
it's
better
than
the.
B
B
It
gets
very
close
yeah,
while
this
one
is
using
bulletproof,
it
doesn't
require
a
trusted
setup.
Okay,
so
we
say:
let's
start
with
this
thing:
we
have
proof
of
liabilities.
How
do
you
solve
proof
of
assets
there?
It's
difficult
right
with
centralized
exchanges
that
might
have
liquid
semi-liquid
illiquid
assets
yeah.
What
do
you
do?
You
need
both
Auditors
and
oracles.
A
B
Yes,
and-
and
this
is
where
the
problem
starts-
sometimes
I
don't
know
about
the
FTX
situation.
Right
I
mean
nobody
knows
the
the
correct
number,
but
the
idea
is
even
if
they
were
and
something
was
in
liquid
in
practice.
You're
not
solving
I
mean
if
someone
tries
to
withdraw
the
money,
you're
not
solvent
and
it's
very
tricky
how
to
define
so.
B
Something
that
I
realized
in
the
past.
This
was
Deloitte.
In
this
particular
case.
We
found
attacks
on
on
the
Lloyd
as
well
two
years
ago,
right
very
similar
attacks
that
we
found
now
on
binance
Banos,
by
the
way
super
transparent,
at
least
on
me,
and
they
told
me
that
they
will
check
everything.
They're,
they're,
open
and
I
give
them
yeah.
B
Auditor
offering
something-
and
if
you
don't
have
I,
don't
know
crazy
cryptographers
in
your
team.
You
just
accept
what
the
auditor
is
giving
you
yeah
and
they
said
they
will
fix
it.
So
I
feel
confident
they
will
do
it,
but
even
back
then
one
of
the
issues
that
we
have
is
sometimes
synchronicity.
How
do
you
synchronize
the
input
you
get
from
the
proof
of
assets
with
the
proof
of
solvency
in
the
millisecond
level?
Because
because
you
know
what
can
happen,
you
know
there
is
an
audit
yeah
like.
B
Point
yes,
but
let's
assume
at
the
time,
like
one
millisecond
before
the
like
the
deadline,
I'm
sending
money,
but
you
will
see
the
transaction
on
your
report
when,
whenever
the
sex
decides
yeah-
and
there
is
a
thing
right-
they
can
play
in
this
late
moment
transactions
they
can
play,
and
Deloitte
told
me
that
we
give
a
five
percent.
You
know
threshold
yeah
because
of
all
of
these
things
that
can
happen,
but
we
realized
that
most
of
them
had
the
one
to
three
percent
Surplus
if
they
were
like
secure.
B
So
all
of
this
is
happening
now
we
are
trying
to
even
us,
miss
them
and
I
guess
all
of
the
other
companies
will
help
with
their
cryptographers.
We
need
the
standard
yeah,
because
something
that
can
happen
is
bitmex
if
I
remember
correctly,
published
something
literally
today,
just
hours
before
my
announcement
on
the
binance
vulnerabilities
with
a
different
scheme
and
then
balance
is
going
to
propose
a
different
scheme
and
then
vitalik
is
proposing
another
one.
I
say:
let's
start
with
this,
and.