{"id":"JIlLAxFUcwA","title":"Whiteboard Series with NEAR | Ep: 37  with Michael Riabzev from StarkWare","description":"StarkWare Co-founder and Chief Architect, Michael Riabzev (  / @starkwareltd  ) and NEAR Co-Founder & CTO, Alex Skidanov (  / alexskidanov  ) discuss StarkEx, STARKs vs. SNARKs, and do a deep dive into Stark's algebra.\n\nStarkWare solves the inherent problems of blockchains – scalability and privacy. They develop a full proof stack, using STARK technology to generate and verify proofs of computational integrity. StarkWare’s cryptographic proofs are zero-knowledge, succinct, transparent and post-quantum secure.\n\n------ About Whiteboard Series --------\n\nThe Whiteboard Series with NEAR is a set of video interviews with Founders who are building scalable solutions for Blockchain.  We deep dive into their story, what they're developing and how it is helping the ecosystem. \n\nFollow the latest from NEAR Protocol on, \n\nWebsite: https://near.org/\nDiscord: https://near.chat\nTwitter:   / nearprotocol  \nGitHub: https://near.ai/github\n\n#WhiteboardSeries #Blockchain #FutureIsNEAR","channel_name":"NEAR Protocol","published_at":"2020-07-22T00:00:00.000Z","thumbnail_url":"https://img.youtube.com/vi/JIlLAxFUcwA/hqdefault.jpg","transcript_text":"okay hi everyone this is alex from near and with me today is michael one of the co-authors of this dark paper and the co-founder and chief architect of star queer hi michael hey alex thank you for having me here i'm really excited to be here today yeah absolutely uh so we will talk today about uh starcx and starks in general and michael would you like to introduce yourself and uh give us uh an overview of the technology yes sure thank you alex yeah so as alex said i'm a co-founder of startware and chief architect instructor the plan for today is uh to dive into one of our products the start exchange a south custodial exchange engine we will see some comparison to other exchange engines and other models and ideas and analyze things like scalability and data availability we will have some taste of starts versus snarks and other proof systems and hopefully some deeper dive into starts algebraic we'll have some time for this how does it sound sounds great let's dive in okay that's what i mean so first of all i start with describing what a blockchain is i guess all everybody in the audience know what the blockchain is i just want to do a quick intro because the blockchain the way that they fit is a very complex and multi-dimensional technology i just want to make it something shallow to project it on only on a few dimensions and just to have something concrete and similar to talk about so a blockchain in high level is blocks of transactions going one after the other this system is very interesting because it allows two very important features that for example regular central systems don't have one of them is the fact that there is a sound state transition what does it mean it means the following in a bank in a regular bank uh that we have today there is a centralized database in this bank and the one who decides how to change the database is actually the bank i don't know i.t department they can do any change they want in a blockchain it is not the case in the blockchain everybody see the transactions and they know exactly how to deduce from these transactions what are the balances of each and every one in the system additionally and this allows them to make sure there is no uh no malicious behavior for example nobody just prints out money out of thin air something which is technically possible in a central system and no money is being stolen somehow because every transaction in a blockchain requires a signature of the one who owned the funds before another important property in blockchain is anti-censorship this mechanism is insured in the decentralization nature of blockchain because when i want to send a transaction in a blockchain and if for example somebody doesn't want me to do this transaction i can believe that the fact that there are many miners in the network if i'll just provide enough fee for this transaction it will be mined by somebody and this is so those are two very important features of blockchains and we will focus on them today unfortunately those features don't come for free and they're pretty expensive we have a big network of validators and miners that in order to keep track on the network and verify that everything is indeed sound all the state transitions are indeed sound it requires everybody to verify all the transactions which is something that grows linearly with the number of transactions in the network okay so we have actually thousands or millions of nodes doing a work which is linear in the number of transactions now we can do something better let's look at a more scalable solution immerse scalable solution says the following actually those validators of the network eventually between each and every block don't really need to know what were the exact transactions all they care about is the balances let's call it b balances so what they want to know is the difference of the snapshots of those balances what would help them to verify uh things verify all the new state transitions but if you see only the balances how can you know what are the state transitions or whether they are valid so if you trust some a third party for example you can ask them to check a block of transactions a batch of transactions and to report to you what are the balances if you don't want to trust somebody we can use a cryptographic utility called proof systems a proof system is a or a proof of knowledge actually is something that can take knowledge of transactions it can take the statement of let's write it here explicitly balance zero given a set of transactions leads to balance one okay so a proof of system can take this deduction part and compress it compress the knowledge and so you won't have to pass all the transactions explicitly but only send a small succinct proof that can be verified by anybody in the network that shows that this balance transmission this state transition is indeed a sound uh transition so in this case each uh block in not only include the balances but include a proof showing that the transition from the previous balances was indeed sound this technology has a name and let's just name the previous one the previous one is blockchain this technology is called zk roll up which vk comes from zero knowledge proof but actually you don't really need zero knowledge for this we just need a proof of knowledge and in this technology it scales much better than blockchain so what is the work each node in the network need to do in such a case in such a case the work each node has to do is the if of the order of the amount of the balances that changed right so this is what we call the zika rollout now we can scale even better we can think of the following why do we really need the balance actually there is a good reason why those balances are needed but if the only thing that we want to do is to focus on scalability and we want uh to be able to have as many balance changes as we want we can scale by providing only the hash of the balances not explicitly sending the balances so it's just a hash of this database and in this case we can use proof systems as well but those proof systems show the following it's a transition from hash of balance state 0 given knowledge of the pre-image the set of transactions and a new balance set goes to a hash of balance one okay that's just a and and in this case what we have is scalability which can be which is not bounded anymore by the blockchain because any state transition requires verification which is a story poly logarithmic in the number of transactions which is effectively a constant number for any practical usage and this kind of systems called validium so why is it poly log why is it not constant uh it is polylog because the verification the proof size is actually a log square the number of transactions uh but it grows logarithmic log grows very very slowly so when you multiply something for example by a factor of two you just add a small constant to its log it's it's uh it just grows very slowly uh i can give even the actual numbers because uh here in the start where the stark exchange is currently based on validium so for example when we do batches of 100 transactions or batches of 64 000 transactions all of them take roughly a bit less than 5 million gas it doesn't change much so so we don't we're not really bounded uh by the blockchain does it make sense yes it does okay great if we want to do another leap we are getting two centralized systems like centralized exchanges or bugs or bands then and this is of course requires of one work of the network no special work i'll just add some colors to make it a a bit clearer what belongs to what so this is the discussion about validium and this is the discussion about ck roll up and this is bitcoin okay are the differences between the different uh the different models here it's clear yeah so far everything makes sense okay great now here is a question why would anyone want to do a dk a roll-up why would you want to keep the balances on chain so there is a very good reason for this assume all we have is only a validium what would be a possible attack in a validity we can be sure that and let's do it this way in a valyrian we can be sure that any state transition is sound because the proof system doesn't allow the operator the exchange to move to a non-sound state it would be impossible for example if alex deposited to such an exchange money it would be impossible for the exchange to move to a new state where alex does not have this money anymore but there is a a challenge with anti-censorship because it could be the case that alex deposited a hundred ether into the exchange and now alex asks to withdraw this hundred ether the exchange cannot just move to a state where alex does not have android editor or something removed but the exchange can decide and not uh to serve alex's your request um and in such a case this is this is correct for any system this is correct for ck roll up the exchange can decide not to serve and in validium and what happens in i think most of the system in start exchange this is the way that we do it if somebody is not satisfied they want to withdraw in the exchange does not serve them then they can call the smart contract and request to force a withdrawal it is we can think of an analogy of going to court and they go to court they tell the smart contract that they are they want to withdraw their funds and the exchange does not serve them then there is a time lock that if after this time lock the funds for example alex's funds are not withdrawn to unchain and the smart console does not see that alex's request was indeed served alex can contact the exchange again for example in the case of the current stock exchange implementation with diversify after a week and and and show the contract that there was a request a week ago and it was not served and in this case alex can just freeze the exchange freeze the exchange meaning the exchange cannot serve anybody anymore okay it means that it it is a threat on the exchange that if the exchange decide to censor somebody then they have to send or they then they cannot operate anymore they have to stop work at all completely but it's still not it's still not a good enough solution even in this case although it's a big threat on the exchange alex is still missing his android ether that he deposited into the exchange um not a a way to continue and to provide alexis funds would be for alex to get them directly from the exchange but in a thicker road for example it's easy to do it in seeker roll up the smart contract can know for example what what are the balances in some cases or any way if for example the balances are kept what is usually done in the merkle tree and only provided on chain sanded in the transmission alex has all the data needed he can reconstruct the merkle tree and can provide the smart contract with an authentication path convincing smart contract he really did a owned hundred ether in the exchange and the smart contract can uh give them access and send him this hundred ether in a validium it becomes a bit more difficult because the because alex in this case only sees what all the networks is the hashes of the balances in such a case um and the hash is actually a miracle root of the balances in such a case alex can again convince the smart contract by showing it a miracle authentication path uh showing he indeed owns a 100 ether in the exchange but how would alex be able to get this authentication path in such a case because alex might know that he has android ether but it doesn't know how much the neighbor in the merkle tree have or anybody else and in order to reconstruct the authentication path you actually need to know what are all the balances of everybody so in such a case uh the way that we solve this issue in the start exchange is using that availability committee that availability committee is like a small permission blockchain that whenever there is a state transition uh the data availability committee which is which includes uh several uh uh companies well known with high reputation uh consensus infiora cephalopod iq illusion and diversify and start where have to sign on the new route on the new hash of balances attesting to knowledge of this information of the balances of the exclusive balances allowing reconstruction of the tree and the smart contract verifies that every state transition comes with a signature showing this attestation which is of course based on a trust in this way and in such a case where the exchange freezes and the user need to escape their funds using authentication paths those committee member members are required to provide all the users their data of course even for such a committee there are several possible models it could be the case for example when all the balances can be public like in decentralized exchanges where everything is on chain anyway that the data can be available to everybody all the time all the snapshots all the exclusive balances are published in some websites for example and the only some selected committee you need to find on them and this is what the contract verifies and the in diversifying for example one of the things that is very important to traders is their privacy the and in such a case the committee member keep this balance of information to themselves but they are required to publish them to anybody in case the exchange freezes in order to allow an exit does it make sense yes that makes sense okay great so now i would this was a this is scalability i'll change the color so so it is worth uh very quickly discussing right that uh some other roll-up solutions uh to provide data availability they just submit all the transactions in the call date as you mentioned they think uh and uh but they don't store them in the storage yeah right so so you also mentioned that very verification of the stark is 50 million gas right so not 50. uh a bit less than 5 million oh sorry yeah yes sorry that's what they meant yes a little less than 5 million gas right so a little less than 5 million gas allows you to send in the cool data on the order of uh 300 kilobytes of data right so if transaction depending on the size of the transaction that allows you to send on the order of 1000 transactions for the same for the same amount of gas right so i guess this is not very viable uh how many transactions so so i think well my my calculation could be a little off but if we assume the transaction is on the order of 300 bytes it will allow you to send approximately 1 000 transactions for the same price if transactions are smaller that will be more transactions but that's additional right so if you if verification costs 5 million gas 100 yes makes sense and in this case this gas price for the start proof can be a proof of knowledge for actually unbounded number of transactions but how many is usually sent in practice it depends on the throughput of of each exchange so when there is a load throughput then each batch contains a a small number of transactions when the when the throughput goes higher then you have bigger batches so this is something about scalability i would like to continue by analyzing uh the trade-offs related to trust in the system so let's go here trust okay and before i start the discussion about uh trust i want to say a few things about the blockchain properties and to dive on a bit deeper discussion about proof systems to analyze it a bit better so there is here and something which is arguably an opinion but let's look at this this way opinion my personal opinion maybe somebody else can think so opinion yes okay so it seems to me that if in a system there is no one one is not something that is promised then 2 would be kind of worthless what do i mean by this if for example uh i have a system when i cannot censor but i can do state transition to any state that i want and alex deposited 100 ether and then alex asked me to withdraw his funds i will just do a state transition where alex does not have this money anymore and i have this money instead and then they'll tell him okay here i withdraw everything that you have you have nothing so it seems that one one one is is more basic in the importance and two is an important addition but does not stand by its own okay so also by anti-censorship do you specifically mean uh censoring exit transactions or or are we also considering censoring uh like let's say i'm trying to send a limit order to the exchange and exchange is not including it do we consider it as a censorship yes this is a great question alex yeah i mean anti-sensorship in regarding uh withdrawals regarding the self custody the self has to be property of the exchange um preventing the exchange from censoring things like orders or things like that is not directly related to self-custody which is the first uh the first goal we are trying to solve uh scalable self-custody and i think it might have some regulatory or additional issues for example it could be the case that you really don't want or should not serve a trader for example somebody doing a money laundering tarot or something like that i'm not sure it is a property that it is very important to have or it might be even problematic uh for the traders to force the exchange to execute their orders but this is this is not a technical question i think this is a more a question about regulations and things related to law okay so i would like to go a bit down here and talk about a proof but also i i think it's it's it's worth comparing uh quickly the the zika roll up in an optimistic roll up right so it's in the model above uh the difference uh between optimistic roll up and ezekiel roll up right that in ezekiel roll up uh when we when we're submitting a new set of transactions for other new balances we submit a uh a proof right that uh they're correct we're submitting a i was called validity proof right yeah while i'm optimistic instead of just submitting your balances and we're saying those balances are correct trust me and then anyone in the future can submit a fraud proof right providing a prove that they are not valid in fact right so what is the uh what are the advantages of of the zika rollover optimistic rule yes as you're absolutely correct uh it's another dimension that i just put aside for the scheme and did not focus on it so as you said optimistic proof and optimistic systems based on fraud proof are a bit harder to analyze because they require a liveness of uh of the users of the system uh in in contrast to the systems described here where you have a safe state transition in some way in optimism optimistic roll ups are something completely different the operator can try to do any state transitions and even try by opportunity to cheat but all the users have some window some time period they can claim the operator is trying to cheat here and to show it with some kind of a proof that something invalid happened in the system but in contrast to all to the systems here it requires everybody to be alive and monitor it is very sick it is in the way uh similar to blockchains in a way if we here we somehow took the blockchain the consensus mechanism as a perfect mechanism but in a way it is kind of an you can think of it as an optimistic mechanism i'm not sure if it is a very correct way to say it because you have all the validators of the network that need to validate it but if i was for example only a single miner or a small conservation of miners that want to be malicious i could try to mine something which is invalid by the protocol it's not exactly correct because the protocol would not allow it while in optimistic roll-ups for example the protocol does allow to put something invalid as long as nobody showed the from proof against it but i think in some way the difference between the blockchain consensus mechanism and the optimistic rollups is something about the amount of validators in the the blockchain for example the bitcoin blockchain the ethereum blockchain i believe there are many validators and i believe i don't have to run a validator node by myself and i can use safely etherscan for example or other actually trusted applications and to trust uh what's going there because there are many many validators uh in sikhiro if there would be some very very big uh energy sorry optimistic relatives there would be a very big optimistic application in the scale of bitcoin and ethereum it might be the case that i will feel safe about it similarly but if there is a small application where there are a few dozen of validators and it could be the case that there is some window in the time that none of them is operating i don't know some kind of an issue they're on vacation there is i don't know they're all in some area where there is a issue with electricity right now i don't know what i would be afraid that the system would get to some invalid state and so i think the analysis of a fraud proof based systems is a bit harder and there have their uh they have their uh advantages of scalability because in the optimistic systems there is no need for the operator to prove every time and generating proofs is a costly process to prove every time they transition they just do the same transition and only when somebody wants to show that there is an issue only then additional work has to be done so in a way they can provide more scale but the the trust model there or the security is something which is a bit harder to analyze the way that i see it right so so i think one of the starquer uh engineers had a very good blog post where they analyzed a very particular attack on the optimistic rolex which is not possible in the ziki rollups in which they were bribing because if there is an optimistic roll-up which is very active right which is very popular so so let's say optimism actually takes off and a large number of uh like let's see maker darwin compound move to optimism right and suddenly there's a huge number of assets locked then stealing those assets becomes a very desirable attack and so what what an attacker can do they can bribe 51 percent of miners uh and miners daily reward is actually not that large right uh and uh and so and so the uh the attacker can bring 51 of miners and just ask them not to build on any block which includes the challenge in which case it doesn't matter how many validators optimistic roll up has right if the challenge cannot go through uh and all you need is just to wait for a week right so so you need to to cover uh one week you worth of 51 of validators but if you have all the compound and maker assets locked right yes but also i think to your point uh you mentioned that you can trust etherscan because of number of validators arguably etherscan can provide you invalid data even if even in the case of many validities right but if you're on a light client i think then then then i think your your point becomes uh correct because if i run a light client i only validate the the hash the hash complexity of the chain right then i trust that more than 51 of block producers are honest and so the longest chain is the valid chain but if it was a smaller chain on the blockchain uh then uh then they obviously can attack me and provide an invalid chain which has higher hash power so i think that then optimized to crawl up on the blockchain become very comparable absolutely yeah i think it's a great example yes alex absolutely um okay so i'll continue to talk a bit about uh proof systems not diving very much into them but just a high level comparison okay so a crash course in complexity of proof systems uh so there are several proof models in computer sense complexity uh the simplest one is a proof model where approver provides a proof to a verifier and the verifier reads the entire proof and checks if it satisfies the claim the statement this model is a very known model it's a class of problems called mp and nondeterministic polynomial time solvable problems and if you think about it anybody who learned the basic complexity classes it's familiar that with the definition that np is the set the languages in np the problems that belong to the np class is the set of problems that there is a polynomial lens uh weakness polynomial in the length of the problem description that a verifier can verify it deterministically and check if the witness satisfies the statement so this is the the smallest class of such a proof system something which is a a bit more a class which is a bit bigger is interactive proof system interactive proof is just like i don't want the approver to provide me all the information i interact with the prover it's just it's like a it's like questioning somebody in the court and asking them where did they been what did they do checking their allerby and things like that this is a an interactive proof class uh it it it has some more languages that we know in it and even a bigger model is called a pcp which is probabilistically checkable proofs which is actually the base of a all the computational integrity proof uh it is based on ideas from the late 80s and and based on pcp there was the idea of having any program and that approver can generate a proof showing that there is no uh some some input to the program that would satisfy for example the program ends with return true or con false and a verification of such a proof would take a poly logarithmic time in the length of the execution trace so this the set of languages in this this complexity class is languages that can be determined with a non-deterministic exponential time it's a very big class and just to get some intuition or what does it mean to be in this model of proofs the publicity checkable proof so in probabilistic regional proof uh the prover in order to generate a proof to prove something to the verifier they write something very long very very long this is called the proof and then the approver can disappear the approver can go away and no need to interact with the prover anymore what the verifier does the verifier chooses a few random places to query from this proof and then checks consistency between all those places between all those values that the very fair read from those places uh and with the initial uh problem that the approver wants to prove and only given this information the verifier should decide whether the proof is valid or invalid okay so that would not work right if the proof can have like let's say a proof is such that a single a single line can make the entire proofing correct then sampling several lines would not would not work right so there they need to be some property that the proof is either entirely correct or or has a large number of of incorrect statements right yes you're absolutely correct alex so the proof in such a case has to be decoded in something called a locally testable codes in some way and actually you can't really check the fact that the proof is correct it could always be the case that if you read the proof deterministically you'll see that there is some issue there but there is still high probability that the verifier given the query is the very first row uh would be satisfied by the proof but what it says in such a case is not that the proof is correct but the proof is closed uh as a code word to a correct proof so it means that there exists a correct proof and if there exists a correct proof it means that the statement is correct and actually if the proof is close to a correct proof then the approver could have generated the correct proof actually because the proof is proof of knowledge making something close to a correct proof shows knowledge and knowledge shows that you general can generate a correct proof okay just to give some intuition it's not an algebraic intuition but something because this concept of why would you give somebody to do a lot of work and it would be sound uh to read only a few places from their work i would like to ask you alex alex how is your hebrew how's my what hebrew hebrew how is your review do you speak hebrew i don't speak it at all no at all okay if you would like to convince me you actually speak hebrew you know hebrew how would you do that i would ask you to provide me five very complex words that most of the people don't know and i will i will give you the translations or couple sentences i guess would be enough maybe if if i'll give you a word and i ask you to translate it it might work it might be a case that you actually speak hebrew but if the word is very complex you don't really know it for example i speak russian but there are several words that i don't really remember in russian i would it wouldn't be easy for me to remember them a possible test so so just asking you to give me a word or to translate a single word it might be not the perfect thing and the sentence is a bit a bit better but it still could be the case that you somehow know how uh to translate a sentence i ask you to translate but a test that let me really be convinced that you know hebrew if you really know hebrew is if i could give you for example an article or a book a short book or an article in english and i would ask you to translate it to hebrew in such a case you would do actually a lot of work but i'm being busy i wouldn't really read all your translation of the article or the book i would choose a few random paragraphs or a few random areas and i would verify the translation is good meaning the syntax the hebrew syntax that you used is indeed a good syntax showing that you know how to write something that makes sense in hebrew and i would check consistency with the origin with the article for example to check that it is indeed in line with the original article and it would be very easy for me i think that something that would take you about maybe a few hours to write i could verify it with a few seconds and actually as more work that you would invest in writing it for example if it if you would write it in five minutes probably it would require me a bit more than a few seconds to check it because the domain of what i can query is very small but if it would require me to translate something very boo very big and i would choose randomly a place there and it would be okay i would be actually very convinced very quickly that you really do know hebrew does it sound right yes that's that's that makes sense so this is the pcp model in some way but the verification in this case the example that they gave requires some natural language processing which is very easy for humans and not so much for machines in in the proof systems in the pcps there is some algebraic the proof is not worse but some algebraic field elements that should have some relation some consistencies and when the verifier draws the queries decides what exactly they want to query they they generate a circuit let's say x1 2 3. they generate a circuit they can put the answers into x1 x2 x3 and decide if they accept or reject okay so this is what the verifier would do the verifier would randomly decide what are the queries and based on this queries based on the indices the verifier is squaring the verifier generates some circuit that would allow it to verify the correctness of the answer okay so but now we have an issue here uh the proof size is pretty long for example uh as we said when we talk about computational integrity computational integrity is defined in the following way given a program both the approver and the verifier agree on the approver proves that they know an input to the program that eventually the program accepts for example the program ends with a return true statement and and it could be a very long run time of the program right the the program the time that it would take the prover for example to run the program could be exponential in the length of the program for example if there is a very long for loop or a while loop in this program the proof size here is very long it is a quasi-linear in the length of the trace of the program you can think about this way this is when we talk about programs if we talk about circuits then it is a it was a linear in the number of uh circuit gates but yeah because you can always think of a circuit as a restricted program and that the time to execute it is as the number of gates so the proof is very very long for example you can think about a case of a proof of knowledge of million transactions moving you from one hash of state to another hash of state such a proof because its length is at least as a verification of millions of transactions you cannot send it on chain it's a very long proof and as we said the verifier only need to query a few uh indices from the proof so what we what we actually send is not the proof what called hill the proof but what we send is the transcript of the communication between the prover and the verifier and this allows everybody to simulate the verifier and to verify uh that everything is okay for example if you see the randomness is okay there are the very fair choice then you can know what are the queries you know what are what is the circuit and anybody can actually verify the response right and the verifier used to use some unbiasable unpredictable randomness right yeah which is also deterministic okay yes so this is exactly something that i'm about to to go into uh if you if you somehow magically trust the verify randomness then you can verify this transcript and now we have a question how can you trust this verify randomness and another thing how can you trust that the approver that the the values the approval returned the answers are indeed a related to this specific proof that this proof was generated before notice that the prover just seeing what are the questions can understand what was the randomness leading to it or at least what would be what could be the circuit to verify uh those questions and can just return them you don't have something fixed in such a protocol we have to make the prover non-adaptive we have to force the approver to first generate this very long proof and only after this long proof is generated only then we can query the prover proofer the proof and to check the results this transit by the way is called an argument the argument this is in the academy it is called an argument of knowledge but in in the space of blockchains this is what we call a proof both when we say that we send proofs on chain and both when you have snark proofs on chain none of them are actually proofs they're all arguments for something much much bigger uh so does the term argument specifically refer to these transcripts or in general to something that is not uh uh a proof but rather probabilistic statement yeah so our argument the difference between a proof and an argument uh which i did not explain exactly what an argument is and we will see in a moment but a proof is something that you have a mathematical proof that you cannot cheat for example if we have a pcp protocol even an almighty entity would not be able to generate a proof for an invalid statement that would make a verifier to accept it with high probability an argument on the other way is uh based on the com on cryptographic assumptions and we will see in a moment uh two such arguments one used for start systems and the other used for start systems we will see exactly why it's waterproof and why there are the where there are those assumptions of those complexity assumptions so by this terminology is merkel proof an argument yes exactly miracle proof is an argument because an almighty entity knows the collision okay so let's uh see how does it work for starts so in start in starks what we have is the following we have the proof and we have a miracle tree and we have a root a root is a commitment to this proof this root is sent to the verifier and now the verifier knows that when they ask for queries they can get authentication paths showing that those queries are indeed consistent with what the approver committed to before they knew what the queries would be right and now the verifier uh given this commitment can i can draw some queries and uh and send it to the prover and test it but as you said before alex uh if we want to send it to somebody else not only the the verifier to check it but for the verifier to send it for example to the blockchain and so in order for the verifier uh to be to provide the terministic randomness but something that the prover cannot predict uh what is used is uh is a technique called the theatrical heuristic the verifier has a prng a known photorandom number generator which he initialized with the vertical route assuming the approver could not predict this vertical route and this prng provides the queries and the queries are sent to the proverb this way notice that the approver doesn't really need to interact with the verifier because the approver knows already what would be the query so the approver can commit on the proof and then to simulate the verifier putting the merkle root in the prng and then to answer the queries and eventually to send everything on chain for example to change the mercury root and the query's results and the authentication path to the results and then everybody would be able to verify verify this correctness so something they can do is they can grind right they can grind proofs until they get one yeah but the probability of of the success is so low presumably that's impossible right yeah so you're absolutely right alex absolutely correct and this is a real issue in a way so in a proof system something that i did not get into is a soundness the what is the soundness for example if we go back to the analogy of translating something when i ask you to translate a word or a sentence or an article or a book we have come to the conclusion that as you do more work for example uh then it it would be easier for me to check it this is one thing another thing it would be more sound if i'll check more places right if i have more queries i can i can have better sounds so if we have an interactive protocol when the approver cannot predict what would be the fair uh randomness just as before not using the feature heuristics and i just want to convince you something now online i just give you the commitment and then you give me randomness and i have to answer your queries i think that if i have probability one to ten to cheat you in such a protocol you will feel pretty safe and if you want to feel very safe probability one two hundred if i'm able to cheat or really sure about it one two thousand i think in such an interactive protocol you don't really need what is called a high sound when the protocol is non-interactive you actually need much higher soundness because of writing exactly as you set up in such a case the proverb can try for example to choose some index here and to grind on it to try there many many different options to this index until they get a route that would would generate queries that would make a transcript that would satisfy a verifier but if the probability of approver to cheat is much lower for example uh one to a milliard 2 to the minus 80 to the to the minus 100 cryptographical probability of cheating then the approval would have to try many different many infeasible number of options until they are able to cheat in such a proof so in such a case and the way to increase the soundness is just by having more queries so a proof which is non-interactive is by nature not a proof in this case an argument which is non-interactive is by nature bigger than an interactive argument and because it requires it includes more queries and more vertical authentication paths in the case of stars does it make sense yes okay great in the case of snarks it is a a bit different snarks provide non-adaptivity using something called homomorphic encryption so decay dk snarks so in a way snark works the following the prover has a proof and the verifier so proverb verifier the verifier drove encryption encryption key proof encryption and the queries encryption maybe this will be the writing queries encryption and a circuit to verify it to verify the answers okay what the verifier does it sends to the approver the prover encryption key encrypted the queries okay the prover encrypts the proof using the prover encryption key this is an encryption it's not a regular encryption it somehow messes up all the structure of the proof in a way that when you read something from the proof it's harder for you if the proverb cannot know what was the original data that needed that that that caused the values the encrypted values this is something that mixes everything up and the queries are something that read this mixed up information and the idea here is the following with this homomorphic encryption when the prover sees what are the queries the prover doesn't know what exactly those queries represent they're in an encryption form sent into an encryption proof and the prover doesn't know how exactly to generate uh something that would satisfy those queries unless the approval really generated a real proof so we get here a non-adductivity of the prover in the previous case of snarks of starks we had non-activity for commitment with vertical trees here we get non-adaptivity of prover to queries simply by blinding the approver the prover doesn't understand what are the queries that the approver cannot generate answers that would just satisfy them and that's the best strategy for the prover is to generate a real proof and to answer to those queries and the answers are and the answers are in encrypted forms form as well and what the verifier does it just puts the answers into the circuit and verify if it accepts or reject or reject it accept or reject okay uh does it make sense right now uh to an extent so um is it also the case that you can use some heuristic to generate those keys in a non-interactive way again alex what's the question uh so so this uh this scheme is interactive right right and not not only interactive uh this scheme is actually a verifier designated okay in this scheme because the soundness of this scheme requires the prover not to understand what are the queries there is no commitment actually to the proof there is only a request for the approver to encrypt the proof with some key and to answer to some queries the prover doesn't have to send to the verifier anything before and and actually the approver can generate the proof only after it they see what is the encryption key and what are the queries and the cryptography says that the approver would still be unable to generate a proof that would satisfy the verifier to an invalid statement but the assumption here is that the prover doesn't know what is the randomness what is the encryption key the verifier generated because those queries here the diver sends the encrypted queries are deduced from from plain queries the verifier knows in the process if the prover would know what those queries are then just as before the approver would know what are the queried indexes and how they would be checked so the prover can generate a proof which is a complete rubbish and only to put a values that would satisfy those specific proofs and those specific queries in the relevant indices and encrypt it and do everything in the protocol and then the mover actually can generate a proof that satisfies the verifier for any statement even invalid statement right yeah that makes sense okay so this is so this is a very fair designated proof and in a way uh in contrast for example to the starts where what the way that we call such a protocol is the public coin protocol or a transparent protocol because the randomness doesn't have to be secret as long as the randomness is known to the prover only after the proof generation it doesn't have to be secret here the randomness have to be secret until the answers to the queries are provided and for example i would not be able to for example interact with a some prover in this protocol and then try to convince somebody else that they generated a valid proof unless unless i am as the verifier who generated this encryption set of in particular queries entrusted by others not to reveal to the prover what those queries are right another thing that we can see here that in snarks first of all another difference is that is that the statement is not about a program it is about the circuit and the encryption key here is as long as the circuit as the circuit so it is actually it's not some synth work to generate those keys it is a an expensive work requiring complexity what is usually done is taking those parts of generating all those parameters and delegating them to a trusted party this is what is called the trusted setup and what the trusted party does they just publish this set of encryption key encrypted queries and the circuit to verify approve verifier only execute this very small circuit on the answer and the approver has to generate a proof encrypt it with the encryption key and answer the predefined queries in the trusted setup this makes the verification very succinct but as you as the name says and as you understand from this process this setup has to be trusted in particular it is very important for these queries not to be linked because if those queries are leaked somehow in this phase and then proofs can be furnished for any statement even for incorrect statement and so in certain use cases right so so it doesn't matter in the case of uh so as you mentioned zero knowledge doesn't matter in the case of uh validium or rollups but in the cases where zero zero knowledge does matter uh even if q leaks right uh that will allow someone to get an invalid proof but will will it allow someone to uh to break zero knowledge component of the proof um i i never thought about this question but my intuition says no i don't think it's really related here to breaking neuro knowledge you know okay no it should not break zero knowledge because for example the zk snarks the very very designated protocol as i described before is a zero knowledge protocol it protects the youth the approver and the verifier knows what are the the plane queries the verifying the designated verifier protocol the verifier knows everything here all the information that can be leaked so and it is still a zero knowledge protocol so no it does not leak information from the prover this randomness is only protecting the very fire from malicious cougars makes sense uh and so i guess a natural question arises uh so given snarks do have a trusted setup and and many people are very unhappy with the with the existence of trusted setup right and and starks do not what are the disadvantages of storks so so one of them i guess is a complexity right so snark is appears to be constant or rather the size of the of the number of queries right uh while stork is uh logarithmic in the size of the proof yeah so yes starks are the proof in starks is uh bigger the the main difference the main disadvantage is the is this miracle authentication path that you need to send to the verifier and end up being part of the argument that for example goes on change and this is of course uh something which is expensive for example if we have a very big proof and we usually have we can have proofs that proofs that are of size of gigabytes or even more and then the authentication path is although logarithmic in the size of the proof but but you can think about it for every single query you have to add all this authentication path so it's a pro it blows up the proof by a constant something very close to a constant because uh this logarithmic length of the authentication path does not grow very quickly but it is much more than what you have to send in a snark which is uh only the answers to the queries and and so uh what is the uh order of magnitude of number of queries which are usually answered uh so it depends on many parameters um for and and it depends on the parts of the protocol that i did not uh dive into but there are those magnificent is around 30 something of this order of magnitude right and so so let's say that the proof size is a gigabyte what would be could it be cheaper to prove that you have a valid uh proof than actually proving the proof itself proving that we had what do you mean so uh so so so so consider i have a large proof of the of the transactions like on the exchange right so on the verifier side i will uh to the verifier i will provide the miracle witnesses uh of for the for the queries that uh that were submitted right using randomness and so on the verifier side i will then execute the proof right uh and and executing the proofs successfully if i can prove that there's a proof that i can execute successfully it is equivalent to an extent you mean to instead of when you're saying the proof here you mean the numerical authentication path you you're saying you are suggesting instead of sending the explicit individual authentication pass sending a proof of knowledge of this authentication path yes done in the same way so so if if if proving the knowledge of those authentication pass is shorter than the original proof yeah so that would be beneficial right it is indeed an interesting idea it has trade-offs but it could be the case that i guess for very long proofs uh it might be beneficial right now when we have a authentication path of length i don't know of the order of 30 for example then replacing them with the proof might seem not really beneficial make sense i would like to wrap with a with the trust analysis which we can do now given the discussion before so i'll just remind what we said we said that in the blockchain we have two properties one a sound state transition and two anti-censorship anti-censorship and we said that one seems to be more important than two so in this case i would just write that we have here one which is based on trust and here lower two which is based on trust so one uh sorry not one voice of trust two based on trust is a is is a bit better it requires less trust and here it is actually one based on trust so two based on trust meaning the anti-censorship is based on trust so if you remember the discussion that we had before regarding um regarding the stark exchange so in stark exchange we have a validium and the anti-steroid ship ends up being based on trust it is just like trust is not always a very very bad thing for example we trust banks and things like that but it is not as good as being based on cryptography and here we trust eventually committee members that in case the exchange freezes would allow the users to escape by providing them the data so here we have the stark exchange when one is based on trust it is actually given the discussion that we just had uh when we have state transition uh based on zk snarks then the fact that the proof cannot be forged for example you cannot just move to a new state that you want and it is sound it is based on the trusted setup because if somehow information from this trusted that leaked to the operator then the operator can forge any state transition so in this case we have a vk snark based so this placement also depends on the on the data availability scheme right if it uses the same data availability scheme as star x it will be uh yes is this yes it's not about the data availability it's about the trust model if this would give the same data availability as starts oh i see it does not it does not imply that the two is based on trust here your effect was saying if one is based on trust it doesn't matter what two is based on yeah because one i see exactly if one is based on trust and you cannot be censored and you ask to withdraw i can just move to a state when you don't have any money and the something that we just posted a blog about a few days ago is that we it is not something that is mutually exclusive we are thinking about a system uh of stark exchange in the in the newer versions that we call a model we call evolution and that would allow both data on chain and a data off check so you can have a funds in the same exchange and you can choose if you want your balances uh to appear on chain when they're changed and in this case it is it should be of course more expensive because just as the price tag shows here uh it would require all the verifiers of the network to read these balances and to verify them and things like that so it is more expensive but it requires better less trust in the system or you can choose to do the cheaper and more scalable uh of putting balances off chain and this way you would have to trust the committee members and the exchange not to decide to attack you or in case the exchange freezes uh you will get your debt and you you will be able to escape does it make sense yes that makes sense okay uh so that will effectively change stark a little bit right so now you will be saying that uh given some unknown balances and also some known balances which are in chain uh this transition is correct right yes exactly the program in this case uh would be something of the following uh form it would have two different of uh when it when the knowledge or the public input to the program would include a set of uh balances or a range of balances actually uh that should appear on chain and the proof would attest that if a balance in this set changed then here is the new value of this balance and the smart contract in this case which has access uh to to those balances would verify that indeed all the balances that should appear on chain are indeed on chain or part of this public input alex you're muted if you're saying something yes i was thank you so there was something on the lines of given public balances right uh and hash of private balances i know some transactions uh that give new public balances right yeah uh and the new hash of private balances yes but you don't even need it it would be even cheaper not to put the previous public balances before because you don't really need it i think you only because the the only reason you would need this data availability to know those the balances is in the case there's the exchange freezes and you want to use the escape patch so you don't really need to verify what was the values before you only need to keep track of the most updated values of those balances right but but if we have on the left uh hash of all the balances right and on the right we have public and private then the contract will have to compute the hash of all the balances right yeah i think i think it could be this way it could be the hash of all the balances as well as long as you have the public balances explicit it is okay i see yeah yeah that makes sense yeah but yeah this is exactly yeah it shows that that it is clear awesome okay uh is there anything major we haven't discussed yet well i think we discussed a lot of things uh we did not actually dive into the structure of the start protocol but i think it is something long enough for uh for much more than the time left awesome great uh then uh then thanks a lot for uh for presenting us with the with the design that was that was very interesting and yeah thank you thank you very much alex you","transcript_synced_at":"2026-11-04T04:25:05.231Z","segments":[{"start_seconds":4,"text":"okay hi everyone this is alex from near and with me today is michael one of the co-authors of this dark paper","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4s"},{"start_seconds":11,"text":"and the co-founder and chief architect of star queer hi michael hey alex thank you for having me here i'm","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=11s"},{"start_seconds":18,"text":"really excited to be here today yeah absolutely uh so we will talk today about uh starcx and starks in general","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=18s"},{"start_seconds":27,"text":"and michael would you like to introduce yourself and uh give us uh an overview of the technology yes","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=27s"},{"start_seconds":34,"text":"sure thank you alex yeah so as alex said i'm a co-founder of startware and chief architect instructor","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=34s"},{"start_seconds":42,"text":"the plan for today is uh to dive into one of our products the start exchange a south","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=42s"},{"start_seconds":51,"text":"custodial exchange engine we will see some comparison to other exchange engines and other models","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=51s"},{"start_seconds":60,"text":"and ideas and analyze things like scalability and data availability we","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=60s"},{"start_seconds":67,"text":"will have some taste of starts versus snarks and other proof systems","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=67s"},{"start_seconds":73,"text":"and hopefully some deeper dive into starts algebraic we'll have some time for this","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=73s"},{"start_seconds":81,"text":"how does it sound sounds great let's dive in okay that's what i mean so first of all","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=81s"},{"start_seconds":88,"text":"i start with describing what a blockchain is i guess all everybody in the audience know what the blockchain is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=88s"},{"start_seconds":95,"text":"i just want to do a quick intro because the blockchain the way that they fit is a very","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=95s"},{"start_seconds":101,"text":"complex and multi-dimensional technology i just want to make it something shallow to project it on only on a few","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=101s"},{"start_seconds":110,"text":"dimensions and just to have something concrete and similar to talk about so a blockchain","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=110s"},{"start_seconds":118,"text":"in high level is blocks of transactions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=118s"},{"start_seconds":124,"text":"going one after the other this system is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=124s"},{"start_seconds":132,"text":"very interesting because it allows two very important features that for example","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=132s"},{"start_seconds":141,"text":"regular central systems don't have one of them","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=141s"},{"start_seconds":148,"text":"is the fact that there is a sound","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=148s"},{"start_seconds":156,"text":"state transition what does it mean it means the following","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=156s"},{"start_seconds":168,"text":"in a bank in a regular bank uh that we have today there is a centralized database in this","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=168s"},{"start_seconds":176,"text":"bank and the one who decides how to change the database is actually the bank i don't know i.t","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=176s"},{"start_seconds":184,"text":"department they can do any change they want in a blockchain it is not the case in the blockchain everybody see the transactions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=184s"},{"start_seconds":193,"text":"and they know exactly how to deduce from these transactions what are the balances of each and every one in the system","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=193s"},{"start_seconds":201,"text":"additionally and this allows them to make sure there is no","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=201s"},{"start_seconds":210,"text":"uh no malicious behavior for example nobody just prints out money out of thin air something which is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=210s"},{"start_seconds":218,"text":"technically possible in a central system and no money is being stolen somehow because every transaction in a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=218s"},{"start_seconds":227,"text":"blockchain requires a signature of the one who owned the funds before another","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=227s"},{"start_seconds":236,"text":"important property in blockchain is anti-censorship","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=236s"},{"start_seconds":250,"text":"this mechanism is insured in the decentralization nature of blockchain because when","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=250s"},{"start_seconds":257,"text":"i want to send a transaction in a blockchain and if for example somebody doesn't want me to do this transaction","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=257s"},{"start_seconds":264,"text":"i can believe that the fact that there are many miners in the network if i'll just provide enough","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=264s"},{"start_seconds":272,"text":"fee for this transaction it will be mined by somebody and this is so those are two very important features","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=272s"},{"start_seconds":280,"text":"of blockchains and we will focus on them today unfortunately those features don't come for free","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=280s"},{"start_seconds":287,"text":"and they're pretty expensive we have a big network of validators and miners that in order to keep track","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=287s"},{"start_seconds":296,"text":"on the network and verify that everything is indeed sound all the state transitions are indeed sound it requires everybody to verify","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=296s"},{"start_seconds":304,"text":"all the transactions which is something that grows linearly with the number of transactions in the network","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=304s"},{"start_seconds":311,"text":"okay so we have actually thousands or millions of nodes doing a work which is linear in the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=311s"},{"start_seconds":321,"text":"number of transactions now we can do something better","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=321s"},{"start_seconds":327,"text":"let's look at a more scalable solution immerse scalable solution says the following actually those validators of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=327s"},{"start_seconds":336,"text":"the network eventually between each and every block don't really need to know what were the exact transactions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=336s"},{"start_seconds":343,"text":"all they care about is the balances let's call it b balances so what they want to know","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=343s"},{"start_seconds":352,"text":"is the difference of the snapshots of those balances what would help them to verify","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=352s"},{"start_seconds":359,"text":"uh things verify all the new state transitions but","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=359s"},{"start_seconds":367,"text":"if you see only the balances how can you know what are the state transitions or whether they are valid so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=367s"},{"start_seconds":377,"text":"if you trust some a third party for example you can ask them to check a block of transactions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=377s"},{"start_seconds":385,"text":"a batch of transactions and to report to you what are the balances if you don't want to trust somebody","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=385s"},{"start_seconds":392,"text":"we can use a cryptographic utility called proof systems a proof system","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=392s"},{"start_seconds":400,"text":"is a or a proof of knowledge actually is something that can take knowledge of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=400s"},{"start_seconds":406,"text":"transactions it can take the statement of let's write it here explicitly balance","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=406s"},{"start_seconds":413,"text":"zero given a set of transactions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=413s"},{"start_seconds":421,"text":"leads to balance one okay so a proof of system can take","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=421s"},{"start_seconds":428,"text":"this deduction part and compress it compress the knowledge and so you","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=428s"},{"start_seconds":436,"text":"won't have to pass all the transactions explicitly but only send a small succinct proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=436s"},{"start_seconds":444,"text":"that can be verified by anybody in the network that shows that this balance transmission this state transition","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=444s"},{"start_seconds":452,"text":"is indeed a sound uh transition so in this case each uh block","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=452s"},{"start_seconds":459,"text":"in not only include the balances but include a proof showing that the transition from the previous","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=459s"},{"start_seconds":467,"text":"balances was indeed sound this technology has a name and let's just name the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=467s"},{"start_seconds":477,"text":"previous one the previous one is blockchain","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=477s"},{"start_seconds":485,"text":"this technology is called zk roll up","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=485s"},{"start_seconds":492,"text":"which vk comes from zero knowledge proof but actually you don't really need zero knowledge for this we just need a proof of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=492s"},{"start_seconds":500,"text":"knowledge and in this technology it scales much better than blockchain so what is the work each node in the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=500s"},{"start_seconds":508,"text":"network need to do in such a case in such a case the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=508s"},{"start_seconds":514,"text":"work each node has to do is the if of the order of the amount of the balances that changed","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=514s"},{"start_seconds":524,"text":"right so this is what we call the zika rollout","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=524s"},{"start_seconds":530,"text":"now we can scale even better we can think of the following why","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=530s"},{"start_seconds":541,"text":"do we really need the balance actually there is a good reason why those balances are needed but if the only thing that we want to do","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=541s"},{"start_seconds":550,"text":"is to focus on scalability and we want uh to be able","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=550s"},{"start_seconds":556,"text":"to have as many balance changes as we want we can","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=556s"},{"start_seconds":563,"text":"scale by providing only the hash of the balances not explicitly","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=563s"},{"start_seconds":573,"text":"sending the balances","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=573s"},{"start_seconds":585,"text":"so it's just a hash of this database and in this case we can use","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=585s"},{"start_seconds":592,"text":"proof systems as well but those proof systems show the following it's a transition from hash","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=592s"},{"start_seconds":600,"text":"of balance state 0 given knowledge of the pre-image","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=600s"},{"start_seconds":607,"text":"the set of transactions and a new balance set","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=607s"},{"start_seconds":615,"text":"goes to a hash of balance one","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=615s"},{"start_seconds":622,"text":"okay that's just a and and in this case what we have is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=622s"},{"start_seconds":629,"text":"scalability which can be which is not bounded anymore by the blockchain because any state transition requires","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=629s"},{"start_seconds":637,"text":"verification which is a story poly logarithmic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=637s"},{"start_seconds":645,"text":"in the number of transactions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=645s"},{"start_seconds":657,"text":"which is effectively a constant number for any practical usage and this kind of systems","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=657s"},{"start_seconds":664,"text":"called validium so why is it poly log why is it not constant","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=664s"},{"start_seconds":673,"text":"uh it is polylog because the verification the proof size is actually a log square","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=673s"},{"start_seconds":681,"text":"the number of transactions uh but it grows logarithmic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=681s"},{"start_seconds":688,"text":"log grows very very slowly so when you multiply something for example by a factor of two","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=688s"},{"start_seconds":696,"text":"you just add a small constant to its log it's it's uh it just grows very slowly","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=696s"},{"start_seconds":704,"text":"uh i can give even the actual numbers because uh here in the start where the stark exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=704s"},{"start_seconds":712,"text":"is currently based on validium so for example when we do batches","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=712s"},{"start_seconds":719,"text":"of 100 transactions or batches of 64 000 transactions all of them","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=719s"},{"start_seconds":726,"text":"take roughly a bit less than 5 million gas it doesn't change much so so we don't","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=726s"},{"start_seconds":735,"text":"we're not really bounded uh by the blockchain does it make sense yes it does okay","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=735s"},{"start_seconds":744,"text":"great if we want to do another leap we are getting two centralized systems","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=744s"},{"start_seconds":752,"text":"like centralized exchanges or bugs or bands then","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=752s"},{"start_seconds":760,"text":"and this is of course requires of one work of the network no special work i'll just add some colors to make it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=760s"},{"start_seconds":768,"text":"a a bit clearer what belongs to what so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=768s"},{"start_seconds":776,"text":"this is the discussion about validium and this is the discussion about","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=776s"},{"start_seconds":784,"text":"ck roll up and this is bitcoin","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=784s"},{"start_seconds":796,"text":"okay are the differences between the different uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=796s"},{"start_seconds":803,"text":"the different models here it's clear yeah so far everything makes sense","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=803s"},{"start_seconds":810,"text":"okay great now here is a question why would anyone want to do a dk","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=810s"},{"start_seconds":818,"text":"a roll-up why would you want to keep the balances on chain so there is a very good reason for this","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=818s"},{"start_seconds":827,"text":"assume all we have is only a validium what would be a possible attack in a validity","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=827s"},{"start_seconds":835,"text":"we can be sure that and let's do it this way in a valyrian we can be","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=835s"},{"start_seconds":843,"text":"sure that any state transition is sound because the proof system doesn't","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=843s"},{"start_seconds":850,"text":"allow the operator the exchange to move to a non-sound state","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=850s"},{"start_seconds":858,"text":"it would be impossible for example if alex deposited to such an exchange money it would be impossible","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=858s"},{"start_seconds":868,"text":"for the exchange to move to a new state where alex does not have this money anymore","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=868s"},{"start_seconds":875,"text":"but there is a a challenge with anti-censorship because it could be","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=875s"},{"start_seconds":882,"text":"the case that alex deposited a hundred ether into the exchange and now alex asks to withdraw this hundred ether","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=882s"},{"start_seconds":893,"text":"the exchange cannot just move to a state where alex does not have android editor or something removed but the exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=893s"},{"start_seconds":901,"text":"can decide and not uh to serve alex's your request","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=901s"},{"start_seconds":909,"text":"um and in such a case this is this is correct for any system this is correct for ck roll up the exchange can decide not to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=909s"},{"start_seconds":917,"text":"serve and in validium and what happens in i think most of the system in start exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=917s"},{"start_seconds":926,"text":"this is the way that we do it if somebody is not satisfied they want to withdraw in the exchange does not serve them","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=926s"},{"start_seconds":933,"text":"then they can call the smart contract and request to force a withdrawal it is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=933s"},{"start_seconds":942,"text":"we can think of an analogy of going to court and they go to court they tell the smart contract that they","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=942s"},{"start_seconds":949,"text":"are they want to withdraw their funds and the exchange does not serve them then there is a time lock that if after this time lock the funds","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=949s"},{"start_seconds":958,"text":"for example alex's funds are not withdrawn to unchain and the smart console does not see that alex's request was indeed served","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=958s"},{"start_seconds":968,"text":"alex can contact the exchange again for example in the case of the current stock exchange implementation with diversify","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=968s"},{"start_seconds":976,"text":"after a week and and","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=976s"},{"start_seconds":980,"text":"and show the contract that there was a request a week ago and it was not served and in this case alex can just freeze the exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=980s"},{"start_seconds":988,"text":"freeze the exchange meaning the exchange cannot serve anybody anymore okay it means that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=988s"},{"start_seconds":995,"text":"it it is a threat on the exchange that if the exchange decide to censor","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=995s"},{"start_seconds":1002,"text":"somebody then they have to send or they then they cannot operate anymore they have to stop","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1002s"},{"start_seconds":1009,"text":"work at all completely but it's still not it's still not a good enough solution even in this case","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1009s"},{"start_seconds":1016,"text":"although it's a big threat on the exchange alex is still missing his android ether that he","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1016s"},{"start_seconds":1023,"text":"deposited into the exchange um not a a way to continue","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1023s"},{"start_seconds":1030,"text":"and to provide alexis funds would be for alex to get them directly from the exchange but","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1030s"},{"start_seconds":1038,"text":"in a thicker road for example it's easy to do it in seeker roll up","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1038s"},{"start_seconds":1045,"text":"the smart contract can know for example what what are the balances in some cases","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1045s"},{"start_seconds":1053,"text":"or any way if for example the balances are kept what is usually done","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1053s"},{"start_seconds":1060,"text":"in the merkle tree and only provided on chain sanded in the transmission alex has all the data needed he can","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1060s"},{"start_seconds":1068,"text":"reconstruct the merkle tree and can provide the smart contract with an authentication path convincing smart contract he really did","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1068s"},{"start_seconds":1078,"text":"a owned hundred ether in the exchange and the smart contract can uh give them access and send him this","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1078s"},{"start_seconds":1086,"text":"hundred ether in a validium it becomes a bit more difficult because the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1086s"},{"start_seconds":1092,"text":"because alex in this case only sees what all the networks is the hashes of the balances","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1092s"},{"start_seconds":1099,"text":"in such a case um and the hash is actually a miracle root","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1099s"},{"start_seconds":1106,"text":"of the balances in such a case alex can again convince the smart contract by showing it a miracle authentication path","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1106s"},{"start_seconds":1116,"text":"uh showing he indeed owns a 100 ether in the exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1116s"},{"start_seconds":1123,"text":"but how would alex be able to get this authentication path in such a case because alex","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1123s"},{"start_seconds":1132,"text":"might know that he has android ether but it doesn't know how much the neighbor in the merkle tree","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1132s"},{"start_seconds":1140,"text":"have or anybody else and in order to reconstruct the authentication path you actually need to know what are all","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1140s"},{"start_seconds":1147,"text":"the balances of everybody so in such a case uh the way that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1147s"},{"start_seconds":1154,"text":"we solve this issue in the start exchange is using that availability committee that availability committee","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1154s"},{"start_seconds":1161,"text":"is like a small permission blockchain that whenever there is a state transition","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1161s"},{"start_seconds":1169,"text":"uh the data availability committee which is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1169s"},{"start_seconds":1176,"text":"which includes uh several uh uh companies well known with high reputation","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1176s"},{"start_seconds":1183,"text":"uh consensus infiora cephalopod iq illusion and diversify and start where","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1183s"},{"start_seconds":1191,"text":"have to sign on the new route on the new hash of balances attesting to knowledge","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1191s"},{"start_seconds":1199,"text":"of this information of the balances of the exclusive balances allowing reconstruction of the tree and the smart contract","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1199s"},{"start_seconds":1208,"text":"verifies that every state transition comes with a signature showing this attestation","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1208s"},{"start_seconds":1216,"text":"which is of course based on a trust in this way and in such a case where","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1216s"},{"start_seconds":1224,"text":"the exchange freezes and the user need to escape their funds using authentication paths those committee","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1224s"},{"start_seconds":1233,"text":"member members are required to provide all the users their data of course even for such a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1233s"},{"start_seconds":1243,"text":"committee there are several possible models it could be the case for example when all the balances can be public like","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1243s"},{"start_seconds":1251,"text":"in decentralized exchanges where everything is on chain anyway that the data can be available to everybody all the time","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1251s"},{"start_seconds":1259,"text":"all the snapshots all the exclusive balances are published in some websites for example and the only some selected committee you","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1259s"},{"start_seconds":1267,"text":"need to find on them and this is what the contract verifies and the in diversifying for example","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1267s"},{"start_seconds":1276,"text":"one of the things that is very important to traders is their privacy the and in such a case","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1276s"},{"start_seconds":1283,"text":"the committee member keep this balance of information to themselves","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1283s"},{"start_seconds":1290,"text":"but they are required to publish them to anybody in case the exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1290s"},{"start_seconds":1298,"text":"freezes in order to allow an exit does it make sense","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1298s"},{"start_seconds":1305,"text":"yes that makes sense okay great so now i would this was a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1305s"},{"start_seconds":1311,"text":"this is scalability i'll change the color so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1311s"},{"start_seconds":1319,"text":"so it is worth uh very quickly discussing right that uh some other roll-up solutions uh to provide data availability they just submit","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1319s"},{"start_seconds":1327,"text":"all the transactions in the call date as you mentioned they think uh and uh but they don't store them in the storage yeah right so so you also mentioned that very","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1327s"},{"start_seconds":1335,"text":"verification of the stark is 50 million gas right so not 50.","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1335s"},{"start_seconds":1342,"text":"uh a bit less than 5 million oh sorry yeah yes sorry that's what they meant yes a little less than 5 million gas right so a little less than 5 million","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1342s"},{"start_seconds":1351,"text":"gas allows you to send in the cool data on the order of uh 300 kilobytes of data right","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1351s"},{"start_seconds":1358,"text":"so if transaction depending on the size of the transaction that allows you to send on the order of 1000 transactions for the same for the same amount of gas","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1358s"},{"start_seconds":1366,"text":"right so i guess this is not very viable uh how many transactions so so i think well my my calculation","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1366s"},{"start_seconds":1374,"text":"could be a little off but if we assume the transaction is on the order of 300 bytes it will allow you to send approximately 1 000 transactions for the same price if transactions are smaller","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1374s"},{"start_seconds":1383,"text":"that will be more transactions but that's additional right so if you if verification costs 5 million gas 100 yes makes sense","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1383s"},{"start_seconds":1392,"text":"and in this case this gas price for the start proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1392s"},{"start_seconds":1399,"text":"can be a proof of knowledge for actually unbounded number of transactions but how many is usually sent in practice","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1399s"},{"start_seconds":1409,"text":"it depends on the throughput of of each exchange so when there is a load throughput then","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1409s"},{"start_seconds":1418,"text":"each batch contains a a small number of transactions when the when the throughput goes higher","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1418s"},{"start_seconds":1425,"text":"then you have bigger batches so this is something about scalability i","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1425s"},{"start_seconds":1433,"text":"would like to continue by analyzing uh the trade-offs related to trust","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1433s"},{"start_seconds":1441,"text":"in the system so let's go here","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1441s"},{"start_seconds":1457,"text":"trust okay and before i start the discussion about uh trust i want to say","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1457s"},{"start_seconds":1465,"text":"a few things about the blockchain properties and to dive","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1465s"},{"start_seconds":1472,"text":"on a bit deeper discussion about proof systems to analyze it a bit better so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1472s"},{"start_seconds":1479,"text":"there is here and something which is arguably an opinion","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1479s"},{"start_seconds":1486,"text":"but let's look at this this way opinion my personal opinion","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1486s"},{"start_seconds":1495,"text":"maybe somebody else can think so opinion yes okay so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1495s"},{"start_seconds":1502,"text":"it seems to me that if in a system there is no","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1502s"},{"start_seconds":1509,"text":"one one is not something that is promised then 2","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1509s"},{"start_seconds":1517,"text":"would be kind of worthless what do i mean by this if for example uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1517s"},{"start_seconds":1527,"text":"i have a system when i cannot censor but i can do state transition to any state that i want","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1527s"},{"start_seconds":1535,"text":"and alex deposited 100 ether and then alex asked me to withdraw his funds","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1535s"},{"start_seconds":1542,"text":"i will just do a state transition where alex does not have this money anymore and i have this money instead and then they'll tell him okay here i","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1542s"},{"start_seconds":1550,"text":"withdraw everything that you have you have nothing so it seems that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1550s"},{"start_seconds":1558,"text":"one one one is is more basic in the importance","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1558s"},{"start_seconds":1565,"text":"and two is an important addition but does not stand by its own okay","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1565s"},{"start_seconds":1574,"text":"so also by anti-censorship do you specifically mean uh censoring exit transactions or or are we also considering censoring","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1574s"},{"start_seconds":1581,"text":"uh like let's say i'm trying to send a limit order to the exchange and exchange is not including it do we consider it as a censorship","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1581s"},{"start_seconds":1589,"text":"yes this is a great question alex yeah i mean anti-sensorship in regarding uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1589s"},{"start_seconds":1597,"text":"withdrawals regarding the self custody the self has to be property of the exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1597s"},{"start_seconds":1604,"text":"um preventing the exchange from censoring things like","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1604s"},{"start_seconds":1611,"text":"orders or things like that is not directly related to self-custody which is the first","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1611s"},{"start_seconds":1618,"text":"uh the first goal we are trying to solve uh scalable self-custody","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1618s"},{"start_seconds":1626,"text":"and i think it might have some regulatory","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1626s"},{"start_seconds":1632,"text":"or additional issues for example it could be the case that you really don't want or should not serve","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1632s"},{"start_seconds":1642,"text":"a trader for example somebody doing a money laundering tarot or something like","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1642s"},{"start_seconds":1649,"text":"that i'm not sure it is a property that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1649s"},{"start_seconds":1658,"text":"it is very important to have or it might be even problematic uh for the traders to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1658s"},{"start_seconds":1666,"text":"force the exchange to execute their orders but this is this is not a technical","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1666s"},{"start_seconds":1673,"text":"question i think this is a more a question about regulations","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1673s"},{"start_seconds":1680,"text":"and things related to law okay so i would like to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1680s"},{"start_seconds":1689,"text":"go a bit down here and talk about a proof but also i i think it's","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1689s"},{"start_seconds":1697,"text":"it's it's worth comparing uh quickly the the zika roll up in an optimistic roll up right so it's in the model above","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1697s"},{"start_seconds":1705,"text":"uh the difference uh between optimistic roll up and ezekiel roll up right that in ezekiel roll up uh when we when we're submitting a new set of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1705s"},{"start_seconds":1712,"text":"transactions for other new balances we submit a uh a proof right that uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1712s"},{"start_seconds":1720,"text":"they're correct we're submitting a i was called validity proof right yeah while i'm optimistic instead of just submitting your balances and we're saying","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1720s"},{"start_seconds":1728,"text":"those balances are correct trust me and then anyone in the future can submit a fraud proof right providing a prove that they are not","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1728s"},{"start_seconds":1736,"text":"valid in fact right so what is the uh what are the advantages of of the zika rollover optimistic rule","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1736s"},{"start_seconds":1744,"text":"yes as you're absolutely correct uh it's another dimension that i just","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1744s"},{"start_seconds":1751,"text":"put aside for the scheme and did not focus on it so as you said optimistic proof and optimistic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1751s"},{"start_seconds":1758,"text":"systems based on fraud proof are a bit harder to analyze because they require","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1758s"},{"start_seconds":1766,"text":"a liveness of uh of the users of the system uh in in contrast to the systems described","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1766s"},{"start_seconds":1775,"text":"here where you have a safe state transition in some way","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1775s"},{"start_seconds":1783,"text":"in optimism optimistic roll ups are something completely different","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1783s"},{"start_seconds":1791,"text":"the operator can try to do any state transitions and even try by opportunity to cheat","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1791s"},{"start_seconds":1801,"text":"but all the users have some window some time period","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1801s"},{"start_seconds":1808,"text":"they can claim the operator is trying to cheat here and to show it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1808s"},{"start_seconds":1815,"text":"with some kind of a proof that something invalid happened in the system but in contrast to all to the systems here","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1815s"},{"start_seconds":1824,"text":"it requires everybody to be alive and monitor it is very sick it is in the way uh similar to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1824s"},{"start_seconds":1832,"text":"blockchains in a way if we here we somehow took the blockchain the consensus mechanism as a perfect","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1832s"},{"start_seconds":1840,"text":"mechanism but in a way it is kind of an you can think of it as an optimistic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1840s"},{"start_seconds":1849,"text":"mechanism i'm not sure if it is a very correct way to say it because you have all the validators of the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1849s"},{"start_seconds":1856,"text":"network that need to validate it but if i was for example only a single miner","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1856s"},{"start_seconds":1863,"text":"or a small conservation of miners that want to be malicious i could try to mine something which is invalid by the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1863s"},{"start_seconds":1872,"text":"protocol it's not exactly correct because the protocol would not allow it while in optimistic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1872s"},{"start_seconds":1880,"text":"roll-ups for example the protocol does allow to put something invalid as long as nobody","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1880s"},{"start_seconds":1888,"text":"showed the from proof against it but i think in some way the difference between the blockchain","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1888s"},{"start_seconds":1898,"text":"consensus mechanism and the optimistic rollups is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1898s"},{"start_seconds":1904,"text":"something about the amount of validators in the the blockchain for example the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1904s"},{"start_seconds":1911,"text":"bitcoin blockchain the ethereum blockchain i believe there are many validators","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1911s"},{"start_seconds":1919,"text":"and i believe i don't have to run a validator node by myself and i can use","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1919s"},{"start_seconds":1926,"text":"safely etherscan for example or other actually trusted applications and to trust","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1926s"},{"start_seconds":1933,"text":"uh what's going there because there are many many validators uh in sikhiro if there would be some","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1933s"},{"start_seconds":1940,"text":"very very big uh energy sorry optimistic relatives there would be a very big optimistic application in the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1940s"},{"start_seconds":1948,"text":"scale of bitcoin and ethereum it might be the case that i will feel safe about it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1948s"},{"start_seconds":1956,"text":"similarly but if there is a small application where there are a few dozen of validators","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1956s"},{"start_seconds":1964,"text":"and it could be the case that there is some window in the time that none of them is operating i don't know some kind of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1964s"},{"start_seconds":1973,"text":"an issue they're on vacation there is i don't know they're all in some area where there is a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1973s"},{"start_seconds":1981,"text":"issue with electricity right now i don't know what i would be afraid that the system would get","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1981s"},{"start_seconds":1987,"text":"to some invalid state and so i think the analysis of a fraud proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1987s"},{"start_seconds":1995,"text":"based systems is a bit harder and there have their uh they have their","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=1995s"},{"start_seconds":2002,"text":"uh advantages of scalability because in the optimistic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2002s"},{"start_seconds":2010,"text":"systems there is no need for the operator to prove every time and generating proofs is a costly","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2010s"},{"start_seconds":2018,"text":"process to prove every time they transition they just do the same transition and only when somebody wants to show that there is an issue","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2018s"},{"start_seconds":2026,"text":"only then additional work has to be done so in a way they can provide more scale but","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2026s"},{"start_seconds":2034,"text":"the the trust model there or the security is something which is a bit harder to analyze","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2034s"},{"start_seconds":2041,"text":"the way that i see it right so so i think one of the starquer uh engineers had a very good blog post","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2041s"},{"start_seconds":2049,"text":"where they analyzed a very particular attack on the optimistic rolex which is not possible in the ziki rollups in which they were","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2049s"},{"start_seconds":2057,"text":"bribing because if there is an optimistic roll-up which is very active right which is very popular so so let's say optimism actually takes off","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2057s"},{"start_seconds":2065,"text":"and a large number of uh like let's see maker darwin compound move to optimism right and suddenly there's a huge number of assets locked","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2065s"},{"start_seconds":2074,"text":"then stealing those assets becomes a very desirable","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2074s"},{"start_seconds":2080,"text":"attack and so what what an attacker can do they can bribe 51 percent of miners uh and miners daily reward is actually not that large right","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2080s"},{"start_seconds":2088,"text":"uh and uh and so and so the uh the attacker can bring 51 of miners and just ask them not to build on any block which includes the challenge","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2088s"},{"start_seconds":2096,"text":"in which case it doesn't matter how many validators optimistic roll up has right if the challenge cannot go through uh and all you need is just to wait for a week","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2096s"},{"start_seconds":2103,"text":"right so so you need to to cover uh one week you worth of 51 of validators but if you have all the compound and maker assets locked","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2103s"},{"start_seconds":2112,"text":"right yes but also i think to your point uh you mentioned that you can trust etherscan because of number of validators","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2112s"},{"start_seconds":2119,"text":"arguably etherscan can provide you invalid data even if even in the case of many validities right but if you're on a light client i think then then then i think your your","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2119s"},{"start_seconds":2127,"text":"point becomes uh correct because if i run a light client i only validate the the hash the hash complexity of the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2127s"},{"start_seconds":2136,"text":"chain right then i trust that more than 51 of block producers are honest and so the longest chain is the valid chain but if it was a smaller chain","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2136s"},{"start_seconds":2145,"text":"on the blockchain uh then uh then they obviously can attack me and provide an invalid chain which has higher hash power so i think that then","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2145s"},{"start_seconds":2153,"text":"optimized to crawl up on the blockchain become very comparable absolutely yeah i think it's a great example yes","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2153s"},{"start_seconds":2159,"text":"alex absolutely um okay so i'll continue to talk a bit","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2159s"},{"start_seconds":2167,"text":"about uh proof systems not diving very much into them but just a high level","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2167s"},{"start_seconds":2174,"text":"comparison okay so a crash course","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2174s"},{"start_seconds":2186,"text":"in complexity of proof systems uh so there are several proof models","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2186s"},{"start_seconds":2193,"text":"in computer sense complexity uh the simplest one is a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2193s"},{"start_seconds":2200,"text":"proof model where approver provides a proof to a verifier and the verifier","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2200s"},{"start_seconds":2208,"text":"reads the entire proof and checks if it satisfies the claim the statement this model is a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2208s"},{"start_seconds":2217,"text":"very known model it's a class of problems called mp and nondeterministic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2217s"},{"start_seconds":2225,"text":"polynomial time solvable problems and if you think about it anybody who","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2225s"},{"start_seconds":2233,"text":"learned the basic complexity classes it's familiar that with the definition that np","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2233s"},{"start_seconds":2242,"text":"is the set the languages in np the problems that belong to the np class is the set of problems","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2242s"},{"start_seconds":2250,"text":"that there is a polynomial lens uh weakness polynomial in the length of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2250s"},{"start_seconds":2258,"text":"the problem description that a verifier can verify it deterministically","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2258s"},{"start_seconds":2267,"text":"and check if the witness satisfies the statement so this is the the smallest class","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2267s"},{"start_seconds":2276,"text":"of such a proof system something which is a a bit more a class which is a bit bigger is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2276s"},{"start_seconds":2285,"text":"interactive proof system interactive proof is just like i don't want the approver to provide me all the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2285s"},{"start_seconds":2293,"text":"information i interact with the prover it's just it's like a it's like questioning somebody in the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2293s"},{"start_seconds":2301,"text":"court and asking them where did they been what did they do checking their allerby and things like","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2301s"},{"start_seconds":2309,"text":"that this is a an interactive proof class uh it it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2309s"},{"start_seconds":2318,"text":"it has some more languages that we know in it and even a bigger","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2318s"},{"start_seconds":2326,"text":"model is called a pcp","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2326s"},{"start_seconds":2332,"text":"which is probabilistically","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2332s"},{"start_seconds":2343,"text":"checkable proofs which is actually the base of a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2343s"},{"start_seconds":2352,"text":"all the computational integrity proof uh it is based on ideas from the late 80s","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2352s"},{"start_seconds":2361,"text":"and and based on pcp there was the idea of having","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2361s"},{"start_seconds":2369,"text":"any program and that approver can generate a proof showing","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2369s"},{"start_seconds":2377,"text":"that there is no uh some some input to the program that would satisfy for example the program","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2377s"},{"start_seconds":2385,"text":"ends with return true or con false and a verification of such a proof would","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2385s"},{"start_seconds":2391,"text":"take a poly logarithmic time in the length of the execution trace so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2391s"},{"start_seconds":2398,"text":"this the set of languages in this this complexity class is languages that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2398s"},{"start_seconds":2407,"text":"can be determined with a non-deterministic exponential time it's a very big class and","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2407s"},{"start_seconds":2415,"text":"just to get some intuition or what does it mean to be in this model of proofs the publicity checkable proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2415s"},{"start_seconds":2423,"text":"so in probabilistic regional proof uh the prover in order to generate a proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2423s"},{"start_seconds":2430,"text":"to prove something to the verifier they write something very long very very long","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2430s"},{"start_seconds":2443,"text":"this is called the proof and then the approver can disappear the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2443s"},{"start_seconds":2453,"text":"approver can go away and no need to interact with the prover anymore what the verifier does","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2453s"},{"start_seconds":2464,"text":"the verifier chooses a few random places","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2464s"},{"start_seconds":2472,"text":"to query from this proof and then checks consistency between all those places between all those","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2472s"},{"start_seconds":2480,"text":"values that the very fair read from those places uh and with the initial uh problem that the approver wants to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2480s"},{"start_seconds":2488,"text":"prove and only given this information the verifier should decide whether","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2488s"},{"start_seconds":2495,"text":"the proof is valid or invalid okay so that would not work right if the proof can have","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2495s"},{"start_seconds":2503,"text":"like let's say a proof is such that a single a single line can make the entire proofing correct then sampling several lines would not","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2503s"},{"start_seconds":2511,"text":"would not work right so there they need to be some property that the proof is either entirely correct or or has a large number of of incorrect","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2511s"},{"start_seconds":2519,"text":"statements right yes you're absolutely correct alex so the proof in such a case has to be","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2519s"},{"start_seconds":2526,"text":"decoded in something called a locally testable codes in some way and actually","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2526s"},{"start_seconds":2536,"text":"you can't really check the fact that the proof is correct it could always be the case that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2536s"},{"start_seconds":2543,"text":"if you read the proof deterministically you'll see that there is some issue there but there is still high probability that the verifier","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2543s"},{"start_seconds":2551,"text":"given the query is the very first row uh would be satisfied by the proof but what it says","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2551s"},{"start_seconds":2558,"text":"in such a case is not that the proof is correct but the proof is closed","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2558s"},{"start_seconds":2565,"text":"uh as a code word to a correct proof so it means that there exists a correct","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2565s"},{"start_seconds":2573,"text":"proof and if there exists a correct proof it means that the statement is correct and actually if the proof is close to a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2573s"},{"start_seconds":2582,"text":"correct proof then the approver could have generated the correct proof actually because the proof is proof of knowledge","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2582s"},{"start_seconds":2589,"text":"making something close to a correct proof shows knowledge and knowledge shows that you general can generate a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2589s"},{"start_seconds":2597,"text":"correct proof okay just to give some intuition it's not an algebraic intuition but something","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2597s"},{"start_seconds":2604,"text":"because this concept of why would you give somebody to do a lot of work and it would be sound uh to read","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2604s"},{"start_seconds":2613,"text":"only a few places from their work i would like to ask you alex alex how is your hebrew","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2613s"},{"start_seconds":2622,"text":"how's my what hebrew hebrew how is your review do you speak hebrew i don't speak it at all no at all okay if you would like to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2622s"},{"start_seconds":2632,"text":"convince me you actually speak hebrew you know hebrew how would you do that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2632s"},{"start_seconds":2639,"text":"i would ask you to provide me five very complex words that most of the people don't know and i will","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2639s"},{"start_seconds":2647,"text":"i will give you the translations or couple sentences i guess would be enough maybe if if i'll give you a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2647s"},{"start_seconds":2655,"text":"word and i ask you to translate it it might work it might be a case that you actually","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2655s"},{"start_seconds":2663,"text":"speak hebrew but if the word is very complex you don't really know it for example i speak russian but there are several","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2663s"},{"start_seconds":2672,"text":"words that i don't really remember in russian i would it wouldn't be easy for me to remember them a possible test","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2672s"},{"start_seconds":2681,"text":"so so just asking you to give me a word or to translate a single word it might be not the perfect thing and","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2681s"},{"start_seconds":2689,"text":"the sentence is a bit a bit better but it still could be the case that you somehow know how uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2689s"},{"start_seconds":2697,"text":"to translate a sentence i ask you to translate but a test that let me really be convinced that you know","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2697s"},{"start_seconds":2706,"text":"hebrew if you really know hebrew is if i could give you for example an article or a book a short book or an article in","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2706s"},{"start_seconds":2715,"text":"english and i would ask you to translate it to hebrew in such a case you would do actually a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2715s"},{"start_seconds":2722,"text":"lot of work but i'm being busy i wouldn't really read all your translation of the article or","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2722s"},{"start_seconds":2731,"text":"the book i would choose a few random paragraphs or a few random areas and i would verify","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2731s"},{"start_seconds":2739,"text":"the translation is good meaning the syntax the hebrew syntax that you used is indeed a good syntax showing that you know how","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2739s"},{"start_seconds":2748,"text":"to write something that makes sense in hebrew and i would check consistency with the origin with the article for example","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2748s"},{"start_seconds":2756,"text":"to check that it is indeed in line with the original article and it would be very easy for me i think that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2756s"},{"start_seconds":2765,"text":"something that would take you about maybe a few hours to write i could verify it with a few seconds","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2765s"},{"start_seconds":2773,"text":"and actually as more work that you would invest in writing it for example if it if you would write it in five minutes","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2773s"},{"start_seconds":2780,"text":"probably it would require me a bit more than a few seconds to check it because the domain of what i can query is very small","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2780s"},{"start_seconds":2788,"text":"but if it would require me to translate something very boo very big and i would choose randomly a place there","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2788s"},{"start_seconds":2796,"text":"and it would be okay i would be actually very convinced very quickly that you really do know","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2796s"},{"start_seconds":2804,"text":"hebrew does it sound right yes that's that's that makes sense","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2804s"},{"start_seconds":2811,"text":"so this is the pcp model in some way but the verification in this case the example that they","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2811s"},{"start_seconds":2818,"text":"gave requires some natural language processing which is very easy for humans and not so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2818s"},{"start_seconds":2827,"text":"much for machines in in the proof systems in the pcps there is some","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2827s"},{"start_seconds":2835,"text":"algebraic the proof is not worse but some algebraic field elements that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2835s"},{"start_seconds":2842,"text":"should have some relation some consistencies and when the verifier draws the queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2842s"},{"start_seconds":2850,"text":"decides what exactly they want to query they","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2850s"},{"start_seconds":2857,"text":"they generate a circuit let's say x1","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2857s"},{"start_seconds":2866,"text":"2 3. they generate a circuit they can put the answers into x1 x2 x3","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2866s"},{"start_seconds":2876,"text":"and decide if they accept","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2876s"},{"start_seconds":2883,"text":"or reject okay so this is what the verifier would","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2883s"},{"start_seconds":2890,"text":"do the verifier would randomly decide what are the queries and based on this queries based on the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2890s"},{"start_seconds":2899,"text":"indices the verifier is squaring the verifier generates some circuit that would allow it to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2899s"},{"start_seconds":2907,"text":"verify the correctness of the answer okay so but now we have an issue here uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2907s"},{"start_seconds":2916,"text":"the proof size is pretty long for example uh as we said when we talk about computational integrity computational","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2916s"},{"start_seconds":2924,"text":"integrity is defined in the following way given a program both the approver and the verifier agree on","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2924s"},{"start_seconds":2933,"text":"the approver proves that they know an input to the program","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2933s"},{"start_seconds":2940,"text":"that eventually the program accepts for example the program ends with a return true statement","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2940s"},{"start_seconds":2948,"text":"and and it could be a very long run time of the program right the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2948s"},{"start_seconds":2955,"text":"the program the time that it would take the prover for example to run the program could be exponential in the length of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2955s"},{"start_seconds":2962,"text":"the program for example if there is a very long for loop or a while loop in this program","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2962s"},{"start_seconds":2969,"text":"the proof size here is very long it is a quasi-linear","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2969s"},{"start_seconds":2976,"text":"in the length of the trace of the program you can think about this way this is when we talk about programs if we talk about circuits then","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2976s"},{"start_seconds":2983,"text":"it is a it was a linear in the number of uh circuit gates but yeah because you can always think of a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2983s"},{"start_seconds":2992,"text":"circuit as a restricted program and that the time to execute it is as the number of gates so the proof is very very long for","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=2992s"},{"start_seconds":3000,"text":"example you can think about a case of a proof of knowledge of million transactions moving you from","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3000s"},{"start_seconds":3010,"text":"one hash of state to another hash of state such a proof because its length is at least","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3010s"},{"start_seconds":3018,"text":"as a verification of millions of transactions you cannot send it on chain it's a very long proof and as we said","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3018s"},{"start_seconds":3026,"text":"the verifier only need to query a few uh indices from the proof so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3026s"},{"start_seconds":3035,"text":"what we what we actually send is not the proof what called hill the proof but what we send","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3035s"},{"start_seconds":3043,"text":"is the transcript of the communication between the prover","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3043s"},{"start_seconds":3054,"text":"and the verifier and this allows everybody to simulate the verifier and to verify uh that everything is okay","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3054s"},{"start_seconds":3063,"text":"for example if you see the randomness is okay there are the very fair choice then you can know what are the queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3063s"},{"start_seconds":3071,"text":"you know what are what is the circuit and anybody can actually verify the response right","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3071s"},{"start_seconds":3079,"text":"and the verifier used to use some unbiasable unpredictable randomness right yeah which is also deterministic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3079s"},{"start_seconds":3087,"text":"okay yes so this is exactly something that i'm about to to go into uh if you if you somehow magically trust","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3087s"},{"start_seconds":3097,"text":"the verify randomness then you can verify this transcript and now we have a question","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3097s"},{"start_seconds":3103,"text":"how can you trust this verify randomness and another thing how can you trust","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3103s"},{"start_seconds":3110,"text":"that the approver that the the values the approval returned the answers","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3110s"},{"start_seconds":3118,"text":"are indeed a related to this specific proof that this proof was generated before notice that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3118s"},{"start_seconds":3126,"text":"the prover just seeing what are the questions can understand what was the randomness","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3126s"},{"start_seconds":3135,"text":"leading to it or at least what would be what could be the circuit to verify uh those questions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3135s"},{"start_seconds":3142,"text":"and can just return them you don't have something fixed in such a protocol we have to make the prover non-adaptive we have to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3142s"},{"start_seconds":3152,"text":"force the approver to first generate this very long proof and only after this long proof is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3152s"},{"start_seconds":3159,"text":"generated only then we can query the prover proofer the proof and to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3159s"},{"start_seconds":3167,"text":"check the results this transit by the way is called an argument the argument","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3167s"},{"start_seconds":3175,"text":"this is in the academy it is called an argument of knowledge but","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3175s"},{"start_seconds":3182,"text":"in in the space of blockchains this is what we call a proof both when we say that we send proofs on chain","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3182s"},{"start_seconds":3191,"text":"and both when you have snark proofs on chain none of them are actually proofs they're all arguments for something much much bigger","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3191s"},{"start_seconds":3199,"text":"uh so does the term argument specifically refer to these transcripts or in general to something that is not","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3199s"},{"start_seconds":3206,"text":"uh uh a proof but rather probabilistic statement yeah so our argument the difference between a proof and an argument","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3206s"},{"start_seconds":3214,"text":"uh which i did not explain exactly what an argument is and we will see in a moment but a proof is something that you have","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3214s"},{"start_seconds":3223,"text":"a mathematical proof that you cannot cheat for example","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3223s"},{"start_seconds":3230,"text":"if we have a pcp protocol even an almighty entity","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3230s"},{"start_seconds":3239,"text":"would not be able to generate a proof for an invalid statement that would make","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3239s"},{"start_seconds":3245,"text":"a verifier to accept it with high probability an argument on the other way","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3245s"},{"start_seconds":3254,"text":"is uh based on the com on cryptographic assumptions and we will see in a moment","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3254s"},{"start_seconds":3262,"text":"uh two such arguments one used for start systems and the other used for start systems we will see exactly","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3262s"},{"start_seconds":3270,"text":"why it's waterproof and why there are the where there are those assumptions of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3270s"},{"start_seconds":3277,"text":"those complexity assumptions so by this terminology is merkel proof an argument yes exactly miracle proof is an argument","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3277s"},{"start_seconds":3285,"text":"because an almighty entity knows the collision","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3285s"},{"start_seconds":3293,"text":"okay so let's uh see how does it work for starts so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3293s"},{"start_seconds":3299,"text":"in start in starks","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3299s"},{"start_seconds":3309,"text":"what we have is the following we have the proof and we have a miracle tree","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3309s"},{"start_seconds":3321,"text":"and we have a root a root is a commitment to this proof this root is sent to the verifier","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3321s"},{"start_seconds":3329,"text":"and now the verifier knows that when they ask for queries they can get authentication paths","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3329s"},{"start_seconds":3337,"text":"showing that those queries are indeed consistent with what the approver committed to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3337s"},{"start_seconds":3345,"text":"before they knew what the queries would be right","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3345s"},{"start_seconds":3352,"text":"and now the verifier uh given this commitment can i can draw some queries and uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3352s"},{"start_seconds":3359,"text":"and send it to the prover and test it but as you said before alex uh if we want to send it to somebody","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3359s"},{"start_seconds":3366,"text":"else not only the the verifier to check it but for the verifier to send it for example to the blockchain","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3366s"},{"start_seconds":3373,"text":"and so in order for the verifier uh to be to provide the terministic randomness but something that the prover","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3373s"},{"start_seconds":3382,"text":"cannot predict uh what is used is uh is a technique called the theatrical heuristic the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3382s"},{"start_seconds":3390,"text":"verifier has a prng a known photorandom number generator","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3390s"},{"start_seconds":3398,"text":"which he initialized with the vertical route assuming the approver could not predict","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3398s"},{"start_seconds":3406,"text":"this vertical route and this prng provides the queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3406s"},{"start_seconds":3414,"text":"and the queries are sent to the proverb this way notice that the approver doesn't really need to interact with the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3414s"},{"start_seconds":3422,"text":"verifier because the approver knows already what would be the query so the approver can commit","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3422s"},{"start_seconds":3428,"text":"on the proof and then to simulate the verifier putting the merkle root","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3428s"},{"start_seconds":3436,"text":"in the prng and then to answer the queries and eventually to send","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3436s"},{"start_seconds":3443,"text":"everything on chain for example to change the mercury root and the query's results and the authentication path to the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3443s"},{"start_seconds":3451,"text":"results and then everybody would be able to verify verify this correctness","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3451s"},{"start_seconds":3459,"text":"so something they can do is they can grind right they can grind proofs until they get one yeah but the probability of of the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3459s"},{"start_seconds":3466,"text":"success is so low presumably that's impossible right yeah so you're absolutely right alex absolutely correct and this","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3466s"},{"start_seconds":3474,"text":"is a real issue in a way so in a proof system something that i did not get into is a soundness","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3474s"},{"start_seconds":3482,"text":"the what is the soundness for example if we go back to the analogy of translating something when i ask you to translate a word or a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3482s"},{"start_seconds":3491,"text":"sentence or an article or a book we have come to the conclusion that","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3491s"},{"start_seconds":3500,"text":"as you do more work for example uh then it it would be easier for me","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3500s"},{"start_seconds":3509,"text":"to check it this is one thing another thing it would be more sound if i'll check more places right","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3509s"},{"start_seconds":3515,"text":"if i have more queries i can i can have better sounds so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3515s"},{"start_seconds":3522,"text":"if we have an interactive protocol when the approver cannot predict what would be the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3522s"},{"start_seconds":3528,"text":"fair uh randomness just as before not using the feature heuristics and i just want to convince","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3528s"},{"start_seconds":3536,"text":"you something now online i just give you the commitment and then you give me randomness and i have to answer your queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3536s"},{"start_seconds":3544,"text":"i think that if i have probability one to ten to cheat you in such a protocol you will","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3544s"},{"start_seconds":3553,"text":"feel pretty safe and if you want to feel very safe probability one two hundred if i'm able to cheat or really sure","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3553s"},{"start_seconds":3562,"text":"about it one two thousand i think in such an interactive protocol you don't really need","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3562s"},{"start_seconds":3568,"text":"what is called a high sound when the protocol is non-interactive you actually need","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3568s"},{"start_seconds":3576,"text":"much higher soundness because of writing exactly as you set up in such a case","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3576s"},{"start_seconds":3583,"text":"the proverb can try for example to choose some index here","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3583s"},{"start_seconds":3590,"text":"and to grind on it to try there many many different options to this index","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3590s"},{"start_seconds":3598,"text":"until they get a route that would","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3598s"},{"start_seconds":3604,"text":"would generate queries that would make a transcript that would satisfy a verifier","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3604s"},{"start_seconds":3612,"text":"but if the probability of approver to cheat is much lower for example uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3612s"},{"start_seconds":3620,"text":"one to a milliard 2 to the minus 80 to the to the minus 100 cryptographical probability","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3620s"},{"start_seconds":3628,"text":"of cheating then the approval would have to try many different","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3628s"},{"start_seconds":3635,"text":"many infeasible number of options until they are able to cheat in such a proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3635s"},{"start_seconds":3643,"text":"so in such a case and the way to increase the soundness is just by having more queries so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3643s"},{"start_seconds":3652,"text":"a proof which is non-interactive is by nature not a proof in this case an","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3652s"},{"start_seconds":3659,"text":"argument which is non-interactive is by nature bigger than an interactive argument","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3659s"},{"start_seconds":3666,"text":"and because it requires it includes more queries and more vertical authentication paths in the case of stars does it make sense","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3666s"},{"start_seconds":3676,"text":"yes okay great in the case of snarks","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3676s"},{"start_seconds":3683,"text":"it is a a bit different snarks provide non-adaptivity using","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3683s"},{"start_seconds":3693,"text":"something called homomorphic encryption so decay","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3693s"},{"start_seconds":3705,"text":"dk snarks so in a way","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3705s"},{"start_seconds":3714,"text":"snark works the following the prover has a proof and the verifier","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3714s"},{"start_seconds":3722,"text":"so proverb verifier","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3722s"},{"start_seconds":3733,"text":"the verifier drove encryption","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3733s"},{"start_seconds":3743,"text":"encryption key proof encryption and the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3743s"},{"start_seconds":3754,"text":"queries encryption maybe this will be the writing queries encryption","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3754s"},{"start_seconds":3761,"text":"and a circuit to verify it to verify the answers okay","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3761s"},{"start_seconds":3769,"text":"what the verifier does it sends to the approver the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3769s"},{"start_seconds":3778,"text":"prover encryption key encrypted the queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3778s"},{"start_seconds":3789,"text":"okay the prover encrypts the proof using the prover encryption key","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3789s"},{"start_seconds":3796,"text":"this is an encryption it's not a regular encryption it somehow messes up all the structure of the proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3796s"},{"start_seconds":3804,"text":"in a way that when you read something from the proof it's harder for you if the proverb cannot","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3804s"},{"start_seconds":3811,"text":"know what was the original data that needed","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3811s"},{"start_seconds":3818,"text":"that that that caused the values the encrypted values this is something that mixes everything up and the queries are","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3818s"},{"start_seconds":3827,"text":"something that read this mixed up information and","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3827s"},{"start_seconds":3834,"text":"the idea here is the following with this homomorphic encryption","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3834s"},{"start_seconds":3842,"text":"when the prover sees what are the queries the prover doesn't know","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3842s"},{"start_seconds":3849,"text":"what exactly those queries represent they're in an encryption form sent","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3849s"},{"start_seconds":3858,"text":"into an encryption proof and the prover doesn't know how exactly to generate","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3858s"},{"start_seconds":3867,"text":"uh something that would satisfy those queries unless the approval really generated a real","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3867s"},{"start_seconds":3874,"text":"proof so we get here a non-adductivity of the prover in the previous case of snarks","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3874s"},{"start_seconds":3881,"text":"of starks we had non-activity for commitment with vertical trees here we get non-adaptivity of prover","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3881s"},{"start_seconds":3889,"text":"to queries simply by blinding the approver the prover doesn't understand","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3889s"},{"start_seconds":3897,"text":"what are the queries that the approver cannot generate answers that would just satisfy them","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3897s"},{"start_seconds":3904,"text":"and that's the best strategy for the prover is to generate a real proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3904s"},{"start_seconds":3911,"text":"and to answer to those queries and the answers are and the answers","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3911s"},{"start_seconds":3921,"text":"are in encrypted forms form as well and what the verifier does it just","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3921s"},{"start_seconds":3929,"text":"puts the answers into the circuit and verify","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3929s"},{"start_seconds":3937,"text":"if it accepts or reject or reject it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3937s"},{"start_seconds":3940,"text":"accept or reject okay","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3940s"},{"start_seconds":3950,"text":"uh does it make sense right now uh to an extent so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3950s"},{"start_seconds":3958,"text":"um is it also the case that you can use some heuristic to generate those keys in a non-interactive way","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3958s"},{"start_seconds":3965,"text":"again alex what's the question uh so so this uh this scheme is interactive right right and not not only interactive","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3965s"},{"start_seconds":3973,"text":"uh this scheme is actually a verifier designated okay","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3973s"},{"start_seconds":3980,"text":"in this scheme because the soundness of this scheme","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3980s"},{"start_seconds":3986,"text":"requires the prover not to understand what are the queries there is no commitment actually to the proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3986s"},{"start_seconds":3994,"text":"there is only a request for the approver to encrypt the proof with some key and to answer to some queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=3994s"},{"start_seconds":4002,"text":"the prover doesn't have to send to the verifier anything before and and actually the approver can","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4002s"},{"start_seconds":4009,"text":"generate the proof only after it they see what is the encryption key and what are the queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4009s"},{"start_seconds":4017,"text":"and the cryptography says that the approver would still be unable to generate","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4017s"},{"start_seconds":4024,"text":"a proof that would satisfy the verifier to an invalid statement but the assumption here","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4024s"},{"start_seconds":4031,"text":"is that the prover doesn't know what is the randomness what is the encryption key","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4031s"},{"start_seconds":4038,"text":"the verifier generated because those queries here the diver","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4038s"},{"start_seconds":4046,"text":"sends the encrypted queries are deduced from from plain queries the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4046s"},{"start_seconds":4055,"text":"verifier knows in the process if the prover would know what those queries are","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4055s"},{"start_seconds":4063,"text":"then just as before the approver would know what are the queried indexes and how they would be checked so the prover can generate","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4063s"},{"start_seconds":4071,"text":"a proof which is a complete rubbish and only to put a values that would satisfy those","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4071s"},{"start_seconds":4080,"text":"specific proofs and those specific queries in the relevant indices and encrypt it and do everything in the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4080s"},{"start_seconds":4087,"text":"protocol and then the mover actually can generate a proof that satisfies the verifier for any statement even invalid statement","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4087s"},{"start_seconds":4096,"text":"right yeah that makes sense okay so this is so this is a very fair designated","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4096s"},{"start_seconds":4102,"text":"proof and in a way uh in contrast for example to the starts where what the way that we call such a protocol","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4102s"},{"start_seconds":4111,"text":"is the public coin protocol or a transparent protocol because the randomness doesn't have to be secret","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4111s"},{"start_seconds":4118,"text":"as long as the randomness is known to the prover only after the proof generation it doesn't have to be secret","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4118s"},{"start_seconds":4126,"text":"here the randomness have to be secret until the answers to the queries are provided","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4126s"},{"start_seconds":4134,"text":"and for example i would not be able to for example interact with a some prover in this protocol and then try to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4134s"},{"start_seconds":4142,"text":"convince somebody else that they generated a valid proof unless unless i am as the verifier","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4142s"},{"start_seconds":4152,"text":"who generated this encryption set of in particular queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4152s"},{"start_seconds":4158,"text":"entrusted by others not to reveal to the prover what those queries are","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4158s"},{"start_seconds":4166,"text":"right another thing that we can see here that in snarks first of all another difference","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4166s"},{"start_seconds":4174,"text":"is that is that the statement is not about a program it is about the circuit","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4174s"},{"start_seconds":4182,"text":"and the encryption key here is as long as the circuit as the circuit so it is actually it's not some synth work to generate those","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4182s"},{"start_seconds":4191,"text":"keys it is a an expensive work requiring complexity what is usually done is","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4191s"},{"start_seconds":4200,"text":"taking those parts of generating","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4200s"},{"start_seconds":4207,"text":"all those parameters and delegating them to a trusted party this is what","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4207s"},{"start_seconds":4215,"text":"is called the trusted setup and what the trusted party does they just publish","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4215s"},{"start_seconds":4222,"text":"this set of encryption key encrypted queries and the circuit to verify approve","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4222s"},{"start_seconds":4229,"text":"verifier only execute this very small circuit on the answer and the approver has to generate a proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4229s"},{"start_seconds":4237,"text":"encrypt it with the encryption key and answer the predefined queries in the trusted setup this makes","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4237s"},{"start_seconds":4247,"text":"the verification very succinct but as you as the name says and as you understand from this","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4247s"},{"start_seconds":4254,"text":"process this setup has to be trusted in particular it is very important for these queries not to be linked because if those","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4254s"},{"start_seconds":4262,"text":"queries are leaked somehow in this phase and then proofs can be furnished for any","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4262s"},{"start_seconds":4268,"text":"statement even for incorrect statement and so in certain use cases right so so it doesn't matter","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4268s"},{"start_seconds":4277,"text":"in the case of uh so as you mentioned zero knowledge doesn't matter in the case of uh validium or rollups","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4277s"},{"start_seconds":4285,"text":"but in the cases where zero zero knowledge does matter uh even if q leaks right uh that will allow someone to get an invalid proof but will","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4285s"},{"start_seconds":4293,"text":"will it allow someone to uh to break zero knowledge component of the proof um i","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4293s"},{"start_seconds":4300,"text":"i never thought about this question but my intuition says no i don't think it's really related here","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4300s"},{"start_seconds":4307,"text":"to breaking neuro knowledge you know okay no it should not break zero knowledge because for example the zk snarks","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4307s"},{"start_seconds":4314,"text":"the very very designated protocol as i described before is a zero knowledge protocol it protects the youth the approver","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4314s"},{"start_seconds":4322,"text":"and the verifier knows what are the the plane queries the verifying the designated verifier protocol the verifier knows everything here","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4322s"},{"start_seconds":4330,"text":"all the information that can be leaked so and it is still a zero knowledge protocol so no it does not leak information from the prover","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4330s"},{"start_seconds":4339,"text":"this randomness is only protecting the very fire from malicious cougars","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4339s"},{"start_seconds":4346,"text":"makes sense uh and so i guess a natural question arises uh so given snarks do have a trusted","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4346s"},{"start_seconds":4354,"text":"setup and and many people are very unhappy with the with the existence of trusted setup right and and starks do not what are the disadvantages of storks","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4354s"},{"start_seconds":4362,"text":"so so one of them i guess is a complexity right so snark is appears to be constant or rather the size of the of the number of queries","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4362s"},{"start_seconds":4370,"text":"right uh while stork is uh logarithmic in the size of the proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4370s"},{"start_seconds":4379,"text":"yeah so yes starks are the proof in starks is uh bigger the the main difference the main","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4379s"},{"start_seconds":4388,"text":"disadvantage is the is this miracle authentication path that you need to send","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4388s"},{"start_seconds":4395,"text":"to the verifier and end up being part of the argument that for example goes on change and this is of course","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4395s"},{"start_seconds":4403,"text":"uh something which is expensive for example if we have a very big proof","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4403s"},{"start_seconds":4410,"text":"and we usually have we can have proofs that proofs that are of size of gigabytes","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4410s"},{"start_seconds":4418,"text":"or even more and then the authentication path is although logarithmic","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4418s"},{"start_seconds":4424,"text":"in the size of the proof but but you can think about it for every single query","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4424s"},{"start_seconds":4432,"text":"you have to add all this authentication path so it's a pro it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4432s"},{"start_seconds":4440,"text":"blows up the proof by a constant something very close to a constant because uh this logarithmic length of the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4440s"},{"start_seconds":4448,"text":"authentication path does not grow very quickly but it is much more than what you have to send in","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4448s"},{"start_seconds":4457,"text":"a snark which is uh only the answers to the queries and and so uh what is the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4457s"},{"start_seconds":4465,"text":"uh order of magnitude of number of queries which are usually answered uh so it depends","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4465s"},{"start_seconds":4474,"text":"on many parameters um for and and it depends on the parts of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4474s"},{"start_seconds":4482,"text":"the protocol that i did not uh dive into but there are those magnificent is around 30 something of this order of magnitude","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4482s"},{"start_seconds":4491,"text":"right and so so let's say that the proof size is a gigabyte what would be","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4491s"},{"start_seconds":4498,"text":"could it be cheaper to prove that you have a valid uh proof than actually proving the proof itself","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4498s"},{"start_seconds":4507,"text":"proving that we had what do you mean so uh so so so so consider i have a large proof of the of the transactions like on","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4507s"},{"start_seconds":4515,"text":"the exchange right so on the verifier side i will uh to the verifier i will provide the miracle witnesses uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4515s"},{"start_seconds":4524,"text":"of for the for the queries that uh that were submitted right using randomness and so on the verifier side i","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4524s"},{"start_seconds":4532,"text":"will then execute the proof right uh and and executing the proofs successfully if i can prove that there's a proof that i can execute successfully","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4532s"},{"start_seconds":4540,"text":"it is equivalent to an extent you mean to instead of when you're saying the proof here you mean","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4540s"},{"start_seconds":4547,"text":"the numerical authentication path you you're saying you are suggesting instead of sending the explicit","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4547s"},{"start_seconds":4556,"text":"individual authentication pass sending a proof of knowledge of this authentication path yes done in the same way so so if if","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4556s"},{"start_seconds":4564,"text":"if proving the knowledge of those authentication pass is shorter than the original proof yeah so that would be beneficial right","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4564s"},{"start_seconds":4573,"text":"it is indeed an interesting idea it has trade-offs but it could be the case that i guess","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4573s"},{"start_seconds":4581,"text":"for very long proofs uh it might be beneficial right now when we have a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4581s"},{"start_seconds":4589,"text":"authentication path of length i don't know of the order of 30 for example","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4589s"},{"start_seconds":4595,"text":"then replacing them with the proof might seem not really beneficial","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4595s"},{"start_seconds":4604,"text":"make sense i would like to wrap with a with the trust","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4604s"},{"start_seconds":4611,"text":"analysis","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4611s"},{"start_seconds":4614,"text":"which we can do now given the discussion before so i'll just remind what we said","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4614s"},{"start_seconds":4622,"text":"we said that in the blockchain we have two properties one a sound state transition and two anti-censorship","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4622s"},{"start_seconds":4630,"text":"anti-censorship and we said that one seems to be more important than two","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4630s"},{"start_seconds":4636,"text":"so in this case i would just write that we have here","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4636s"},{"start_seconds":4647,"text":"one which is based on trust and","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4647s"},{"start_seconds":4661,"text":"here lower two which is based","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4661s"},{"start_seconds":4669,"text":"on trust","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4669s"},{"start_seconds":4678,"text":"so one uh sorry not one voice of trust two based on trust","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4678s"},{"start_seconds":4686,"text":"is a is is a bit better it requires less trust and here it is actually","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4686s"},{"start_seconds":4694,"text":"one based on trust so two based on trust meaning the anti-censorship","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4694s"},{"start_seconds":4700,"text":"is based on trust so if you remember the discussion that we had before regarding","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4700s"},{"start_seconds":4707,"text":"um regarding the stark exchange so in stark exchange we have a validium","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4707s"},{"start_seconds":4716,"text":"and the anti-steroid ship ends up being based on trust it is just like trust is not always a","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4716s"},{"start_seconds":4723,"text":"very very bad thing for example we trust banks and things like that but it is not as good as","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4723s"},{"start_seconds":4732,"text":"being based on cryptography and here we trust eventually committee members that in case the exchange freezes would allow","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4732s"},{"start_seconds":4742,"text":"the users to escape by providing them the data so here we have","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4742s"},{"start_seconds":4749,"text":"the stark exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4749s"},{"start_seconds":4757,"text":"when one is based on trust it is actually given the discussion that we just had uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4757s"},{"start_seconds":4764,"text":"when we have state transition uh based on zk snarks","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4764s"},{"start_seconds":4771,"text":"then the fact that the proof cannot be forged for example you cannot just move to a new state","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4771s"},{"start_seconds":4780,"text":"that you want and it is sound it is based on the trusted setup because if somehow information from this","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4780s"},{"start_seconds":4788,"text":"trusted that leaked to the operator then the operator can forge any state transition so in this case we","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4788s"},{"start_seconds":4797,"text":"have a vk snark","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4797s"},{"start_seconds":4806,"text":"based so this placement also depends on the on the data availability scheme right if it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4806s"},{"start_seconds":4813,"text":"uses the same data availability scheme as star x it will be uh yes","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4813s"},{"start_seconds":4821,"text":"is this yes it's not about the data availability it's about the trust model if this would give the same data availability as starts","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4821s"},{"start_seconds":4830,"text":"oh i see it does not it does not imply that the two is based on trust here your effect was saying if one is based on trust it doesn't matter what two is based on","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4830s"},{"start_seconds":4837,"text":"yeah because one i see exactly if one is based on trust and you cannot be censored and you ask to","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4837s"},{"start_seconds":4845,"text":"withdraw i can just move to a state when you don't have any money and the something that we just posted a blog","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4845s"},{"start_seconds":4854,"text":"about a few days ago is that we it is not something that is mutually exclusive","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4854s"},{"start_seconds":4863,"text":"we are thinking about a system uh of stark exchange in the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4863s"},{"start_seconds":4870,"text":"in the newer versions that we call a model we call evolution","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4870s"},{"start_seconds":4880,"text":"and that would allow both data on chain and a data off check so","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4880s"},{"start_seconds":4887,"text":"you can have a funds in the same exchange and you can choose if you want your balances","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4887s"},{"start_seconds":4894,"text":"uh to appear on chain when they're changed and in this case it is it should be of course more expensive because","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4894s"},{"start_seconds":4903,"text":"just as the price tag shows here uh it would require all the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4903s"},{"start_seconds":4910,"text":"verifiers of the network to read these balances and to verify them and things like that so it is more expensive but it requires","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4910s"},{"start_seconds":4919,"text":"better less trust in the system or you can choose","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4919s"},{"start_seconds":4926,"text":"to do the cheaper and more scalable uh of putting balances off chain and","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4926s"},{"start_seconds":4933,"text":"this way you would have to trust the committee members and the exchange","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4933s"},{"start_seconds":4940,"text":"not to decide to attack you or in case the exchange freezes uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4940s"},{"start_seconds":4948,"text":"you will get your debt and you you will be able to escape","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4948s"},{"start_seconds":4954,"text":"does it make sense yes that makes sense okay uh so that will effectively change","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4954s"},{"start_seconds":4961,"text":"stark a little bit right so now you will be saying that uh given some unknown balances and also some known balances which are in chain","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4961s"},{"start_seconds":4969,"text":"uh this transition is correct right yes exactly the program in this case uh would be something of the following","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4969s"},{"start_seconds":4977,"text":"uh form it would have two different of uh when it when the knowledge or the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4977s"},{"start_seconds":4985,"text":"public input to the program would include a set of uh balances or a range of balances actually","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4985s"},{"start_seconds":4994,"text":"uh that should appear on chain and the proof would attest that if a balance in this set","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=4994s"},{"start_seconds":5002,"text":"changed then here is the new value of this balance and the smart contract in this case","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5002s"},{"start_seconds":5010,"text":"which has access uh to to those balances would verify that indeed all the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5010s"},{"start_seconds":5018,"text":"balances that should appear on chain are indeed on chain or part of this public input","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5018s"},{"start_seconds":5028,"text":"alex you're muted if you're saying something yes i was thank you so there was something on the lines of given public balances right","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5028s"},{"start_seconds":5036,"text":"uh and hash of private balances i know some transactions","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5036s"},{"start_seconds":5046,"text":"uh that give new public balances right yeah uh and the new hash of private balances yes but you don't even","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5046s"},{"start_seconds":5053,"text":"need it it would be even cheaper not to put the previous public balances before because you don't really need it","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5053s"},{"start_seconds":5061,"text":"i think you only because the the only reason you would need this data availability","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5061s"},{"start_seconds":5068,"text":"to know those the balances is in the case there's the exchange freezes and you want to use the escape patch","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5068s"},{"start_seconds":5076,"text":"so you don't really need to verify what was the values before you only need to keep track of","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5076s"},{"start_seconds":5084,"text":"the most updated values of those balances right but but if we have on the left uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5084s"},{"start_seconds":5091,"text":"hash of all the balances right and on the right we have public and private then the contract will have to compute the hash of all the balances","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5091s"},{"start_seconds":5099,"text":"right yeah i think i think it could be this way it could be the hash of all the balances as well as long as you have the public balances","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5099s"},{"start_seconds":5108,"text":"explicit it is okay i see yeah yeah that makes sense yeah but yeah this is exactly yeah","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5108s"},{"start_seconds":5117,"text":"it shows that that it is clear awesome okay uh is there anything major","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5117s"},{"start_seconds":5126,"text":"we haven't discussed yet well i think we discussed a lot of things uh we did not actually dive into the","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5126s"},{"start_seconds":5135,"text":"structure of the start protocol but i think it is something long enough for uh","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5135s"},{"start_seconds":5143,"text":"for much more than the time left awesome great uh then uh then thanks a lot for uh for presenting","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5143s"},{"start_seconds":5152,"text":"us with the with the design that was that was very interesting and yeah thank you thank you very much","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5152s"},{"start_seconds":5166,"text":"alex","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5166s"},{"start_seconds":5216,"text":"you","url":"https://www.youtube.com/watch?v=JIlLAxFUcwA&t=5216s"}],"youtube_url":"https://youtube.com/watch?v=JIlLAxFUcwA","url":"https://near-pedia.xyz/videos/JIlLAxFUcwA"}