{"id":"TZxw_SxnIRk","title":"Whiteboard Series with NEAR | Ep: 52 Bowen Wang & Yi Sun cover zero-knowledge proofs","description":"This Whiteboard Series episode features Director of Protocol Bowen Wang in conversation with Yi Sun, cofounder of Axiom. Axiom is a ZK coprocessor for Ethereum, which provides smart contracts trustless access to all on-chain data. Bowen and Yi cover how Axiom leverages zero-knowledge proofs to provide developers with the ability to run computation on historical data that is otherwise infeasible to do.\n\n\nJoin NEAR's community:\nWebsite: https://near.org/\nReddit:   / nearprotocol  \nDiscord: https://near.chat/\nMedium:   / nearprotocol  \nBlog: https://near.org/blog/\nTwitter:   / nearprotocol  \nGitHub: https://github.com/near  https://github.com/nearprotocol\nDev Docs: https://docs.near.org/\nCreate a wallet: https://wallet.near.org/create\nApps on NEAR: https://awesomenear.com/\nLearn to Build On NEAR: https://www.near.university/\nGrants & Funding: https://near.org/grants/\n#Blockchain #FutureisNEAR #NEAR #nearprotocol\n#nft #dao","channel_name":"NEAR Protocol","published_at":"2023-12-07T00:00:00.000Z","thumbnail_url":"https://img.youtube.com/vi/TZxw_SxnIRk/hqdefault.jpg","transcript_text":"okay welcome uh to another whiteboard series I'm Bowen from near and today we'll have uh with us e co-founder of axium so you do want to introduce a bit of yourself and also talk a bit about what axium is hey my name is y I'm one of the co-founders of axium uh we allow smart contracts on ethereum to access the entire history of ethereum and do verifiable computation on top of it using Zer knowledge proofs okay um cool so I guess maybe um just to give us um just to give people some background I know um so for those who don't know is definitely one of the most prominent figures in the the knowledge space and has been working um like on blockchain related things like for many years um like you know given there are so many things that the knowledge proofs can do like uh why specifically do you choose to to work on like axium versus like you know some like other things like layer twos or whatever that is yeah as bone mentioned one of the biggest use cases for ZK until now has been building rollups um and rollups generally scale ethereum by allowing uh smart contract developers to build similar types of applications to those which exist on L1 but just at greater scale on L2 and so when coming up with the idea for axm our Northstar has always been to allow smart contracts to do new types of things that weren't possible on L1 before uh not just because of scale but because they're fundamentally a little bit different and with axom what we're doing is just building a type of system that allows smart contracts to make asynchronous calls to read more data and then do compute on that data um so to start we're offering access as I mentioned to the history of ethereum and then we're allowing developers to do compute on that history so maybe I can draw a little diagram the so in general we have sort of of the axium contract and later on we'll expand to this to the you know real architecture so for now cartoon y um and so a developer will you know make a query and this query will uh require some access to some historic data so imagine a receipt or a transaction and then it will also access some computation over that data you might imagine adding up a user's uh trading volume yep yep and so what axim is going to do is generate a ZK proof that you know whatever claimed data value or computation actually authentically be belonged to the history of ethereum and after this proof is generated it's going to send this proof to the a verifier on chain and once that zerge proof is verified uh we actually send a call back to the developer's contract and so in this way uh we allow developers to actually access sorts of data that weren't possible to access before within the evf yeah so I think one obvious question people would have is probably regarding this part right so uh I think the the natural question people want to ask is well why couldn't we just do it like as is today like where where does they help yeah so that's a great question so I think unless you've tried to develop uh smart contract before you probably wouldn't know that uh within the evm and actually within most uh smart contract development languages you can't access any type of historic information so that means the previous owner of an nft or any type of transaction history um just isn't present in the state of ethereum or any other blockchain and there's actually a fundamental reason for that which is that suppose we just changed ethereum so you could access any historic state that that would mean that every validating node on ethereum would need to be able to access historic State extremely quickly in order to validate a transaction and so that would mean that they would have to turn every full node into an archive node which definitely hurts the decentralization of ethereum so there's sort of a fundamental trade-off between increasing the set of data that uh contracts can access and decentralization so as someone ask like how do we how does ZK help this situation well the answer is that uh when you currently run a a transaction on ethereum we're relying on the ethereum consensus to um to validate your data access in your compute uh instead we're replacing that consensus here with ZK so ZK uses cryptography instead to do that to do that so let me explain like how that works so first of all you know why is that even possible we're going to use actually the simplest possible property of a blockchain okay so a blockchain is a chain of blocks and what that means is that the current block well it contains a commitment to the previous block the block before and actually the entire en history of the blockchain and so what that means is we wanted to access a piece of data from this historic block well in principle this historic block is actually committed to in the current block so we could Supply a decommitment proof of this chain of block headers from a past block to the current block and so what would that decommitment proof look like it would simply say that hey I know a sequence of block headers let's say this intermediate one and this intermediate one such that the hash of this block is contained in the header of this block the hash of this header is contained in the header of this one and so on so if I could exhibit that to you then you would know that this historic block was authentically present in the history of this chain um now that that in principle allows you to know the entire block history of ethereum and within the historic block well we actually have a commitment to the entire states of ethereum at that block so that's takes the form of the state rout uh the transactions root and the receipts route so the state route commits to all accounts and account storage uh the transactions rout of course commits to the transactions in this block and the receipts route commits to the receipts or log events in this block so again we could just decommit and maybe we would get a receipt here so yeah so I think one issue well one problem here is that um if the decom chain is very very long if you're trying to prove something that like like one million blocks ago um this structure by itself may become some problem my understanding is that certain like blockchain by itself doesn't have the M like merco Mountain s that building so like need to like build some structure yourself I guess yeah that's exactly right so if you think about actually performing these decommitments in the evm you're going to run into sort of two class es of challenges so the first is that this so challenge one is the chain could be huge so if you just want to put the block headers on ethereum that's going to be way too much data and your costs will explode uh the Second Challenge is that the uh let's call this decommitment number two uh the decommitment number two for actually proving data from each block requires something called a Merkel Patricia Tri proof so this is a Merkle proof into this degree 16 Merkel tree that ethereum uses to commit to all data and the other problem the problem with that is that it's also huge and so if you actually want to do this on ethereum uh just in the Raw evm your cost is going to be exorbitant um so we have sort of two techniques at axium to resolve uh these two problems so the first uh pertains to this first step of decommitting the chain of block headers so what we do there is that as Bowen mentioned sometimes this chain could be like quite long so let's say that this is not four blocks in the past but let's pretend that this is 1 million blocks well in this case you have to exhibit 1 million block headers which is not great so what we do instead is we actually maintain a cash on ethereum to that commits to the entire history of ethereum block hashes so we call this axium core and this is a cache of all ethereum block caches now when I say cash I don't mean that we literally store them all since obviously accessing them is pretty costly instead what I mean is we have a commitment to all block caches and we want that commitment to actually satisfy two properties uh the first is that um we want updates to be cheap uh namely you know more block cashes are post pended and we need to update the cache uh the second is that we want the uh commitment of effectively 01 size um I say effectively because in reality this is going to be log n size but n log doesn't grow that fast for for blockchain and so what we use is something called a Merkel mountain range and we actually use a small Twist on a merel mountain range which I'll explain in a little bit yeah maybe let's actually dive into yeah let's dive into what I don't think this is a very well-known uh data structure that people use and actually even though we have this building to near um I think that was like at least these three years ago at the time I I didn't know this seemed like there's like a name to this yeah I think I remember talking to Ilia about this yeah two years ago yeah yeah yeah yeah okay so to explain like what AAL mountain range is maybe I'll draw a picture of all block cashes on ethereum starting from Genesis so we have so this is block number so we have block of zero to I think we're on like 17 million now maybe 18 million let's just say 17 minut so a miracle mountain range is a structure which allows you to commit to um any number of hashes um while taking Only log and commitment size and it has these two property like properties that updates are relatively cheap uh the commitment is relatively small and you can actually decommit any uh block has in this interval in a cheap way so here's how it works um um it's basically just a sequence of Merkel trees hence a merel mountain rid so first you're going to fit the largest binary Merkel tree you can into this range so in this case we take the leaves from zero to I should okay let's imagine this is roughly 16 million that's going to be the value my diagram is going to be not so good yeah and then so first we chose the largest m tree we can fit into this range and we take the Merkel root so this will be Peak zero of the Merk mountain range then we repeat we take another Merkel tree that's as big as possible and this will be peak one and we just keep going and so so a mer mountain range is just a sequence of Peaks uh of Merkel roots of Merkel trees yep of descending size um now what's the benefit of this well as you can see the whole commitment is of size log n in particular it's the number of ones in the binary representation of the total number of blocks uh the second thing is as we append blocks here you can sort of see intuitively that you're only going to modify those Peaks which change MH and that size is pretty small um so it has these two properties and so if we want to prove that some block cash was in the history of eum all we need to do is give a standard Merkel proof into one of the Peaks and that would show sort of that it was committed to in this Merle mountain range um so now I want to talk a little bit about a slight tweak we make to address uh this update issue yep so what we actually store is not quite a merel mountain range we actually store a merkl mountain range of Merle roots of uh 124 block hash chunks okay that's interesting um and in addition to this we always store the trailing 124 um sorry how' I say the we we store the mer root of a zero padded Merle tree M of size 2024 holding the last few leaves uh last few hashes and what does the last few hates mean yeah so so this will store from zero to 124 * k for some K okay and this will store from 1024 * K okay to 1024 * K plus m I see I see m is the trailing segment I see I see I see so what we do is that we will keep this Merkel route updated until such time as we need to update the full Merkel mountain range makes sense yeah so the reason for this is that in ethereum It's relatively expensive to update storage so if you think about blocks being appended these last 10 peaks of the Merle mountain range to account for up to 1024 they get updated quite a bit so instead of actually updating them we it's much simpler for us to just update this Merle route I see I see I see and then once you get to the next one you merge it back into the yeah exactly so once we get to the next one we merge it back into this Merle mountain range so we call this a padded Merkel mountain range but okay it's this is sort of a non-standard data structure so we have a Merle M range for almost all of it and then we have this uh zero padded Miracle route at the end how much does this save you in practice it it's quite a bit so so um basically if suppose you do an update for let's say 200 uh block cashes then in expectation you're going to update uh you know eight of the peaks of M Mountain merch so that's uh eight S stor they're they're warm but okay that that's quite a bit I see I see I see okay um okay so I so far we've just talked about the data structure we're using right right and these updates you know in principle could be done in evm y but now in practice doing the updates in evm has sort of two challenges so as we see we have this chain of blocks and let's indicate here which blocks are actually already committed to in our Merr mod range so let's say that this is in the so mount range abbreviated MMR so suppose we're in the Merle mountain range and now some new blocks have occurred and we want to update M so the the fact we can use is that in ethereum you actually have access to the last 256 blocks uh baches it's a bit of a mystery to me why it's 256 uh I think there's no actual issues if you make it all block caches to be honest but you know we have to work with what we have so we're currently at 256 um and so what we do is we we use the fact that we have a single recent one okay so now you might imagine that in evm you can just access the last 256 do some Merkel root computations in evm and start appending to this data structure M uh the challenge with that is that suppose you just don't manage to do the update in a 256 block window so that's sort of 45 minutes well now you're kind of in trouble because how do you connect back to your m round um so that's not very robust system right uh so instead what we do is we just choose this recent one and we generate a Zer knowledge proof M of the chain of block hashes back to the last multiple of 1024 oh I see so so let's not so clear how to denote that but let's say it's like this so we do this in ZK I see I see um so what that means is that in the typical happy path uh if we're within this 250 6 block Window M we check that this chain of block headers connects to each other MH uh that the last block has is in this 256 block window MH uh and then we check that this like starting point actually aligns with the end point of our merlan range um now suppose that we missed some yep then what we can do is we first prove this chunk of up to 1024 and we can sort of backfill with chunks of 1024 mhm so no matter what happens we can always get back to this where we were in the mer M range and in practice how often do you do this update so in practice we do it every 192 blocks 192 blocks and we we could probably get a little bit more aggressive but there's and then how long does it take to generate this zero knowledge proof oh it's it's pretty fast like I think two minutes or something oh okay okay and and we're that that's with some cost saving so so if you really wanted to you could do lower oh okay okay okay I see We R run on like not a great machine I see I see I see I see so so our philosophy is we always want to maintain the property that this commitment with the Merkel mountain range always overlaps the 256 block caches MH and that way the cash will always commit the Cash Plus the evm block cash op code always conits to the entire history of ethereum y y okay that that makes makes L sense um yes there's maybe one more thing which we didn't discuss which is when we deploy the contract mhm there's nothing in it ah right so what do we do then we have to build this like from scratch yeah yeah yeah uh so okay so we we actually have a separate uh way of bootstrapping MH um which proves the Block hashes in chunks of 128,000 um so so yeah we start we can yeah maybe we erase erase some part like yeah I'll Erase here so so suppose we start you know again at 17 million M we're going to prove you know this is 128 * 1024 then we prove 128 * 1024 and we just keep going back and okay there's some complication surrounding that 17 million is not a multiple of 1024 but we just handle this and we eventually get here mhm so so now we have sort of in groups of 128 * 1024 we actually write the groups uh every Merkel route of 1024 and then we construct the Merkel mountain range in evm actually I see but that is quite expensive to do right that that construction it's like okay okay like it's definitely a little bit expensive I think it costs like 20K total okay but it just simplifies the system so that we don't have to think about like some parts of the system chunks of 128,000 other parts have chunks of 1024 yeah yeah yeah we we could definitely probably cost optimize by dropping some of these oh sense yeah the cost is not crazy so we we kind of just do it okay okay um so yeah we have to do I think it's something like 130 of these mhh and then once we have bootstrapped the system to this state all we need to do is maintain it in this way right right right so basically in this entire part of this uh chain proof the only part where you use Decay is like this part like of maintaining uh the mer mountain range uh in light of the more recent blocks yeah both the recent blocks and uh this historic bootstrapping ah okay sure yeah yeah yeah okay so we obey the principle that a user of our system shouldn't need to trust us really in any way like if something has been posted it really has been verified either in evm or by ZK mhmh yep makes sense um okay so should we move on to the other part of the proof the yeah yeah cool so so so far we have this cache and we sort of maintain it to have this proper um all right I'll just redraw now the next step is that we actually need to access the history of ethereum from this cach so let say we're in this situation and let's say that the MMR committed to this much so far MH and this is axium core and so this is just the vanilla smart contract on ethereum MH MH so now now we want to actually ask like hey I want a transaction from uh from this block I want a storage value from this block and so on so the way that we allow users to express this is in something we call a quer so what what's a quer well okay it's a couple things it's a list of data that the the user wants and so we allow pretty arbitrary data so we format the data as just 32 byte chunks from the history of ethereum and they can come from uh block headers uh accounts storage M transactions receipts M and we're also handling a solidity mappings oh okay so it's a subset of storage of course y but as you probably know like the mapping of solidity key value pair to storage slot is a bit complex and it's actually better to handle in ZK I see and so our principle is that anything in the history of ethereum is parameterized in this way and okay we have some pretty long complicated list of How It's parameterized and so the user can specify um basically these 32 bytes at a time so for example if you want to read transaction call data we let you just specify hey I want you know this index to this index and multiples of 32 um similarly for receipts you can access uh you know I want the first log I see and I want this data field in that log and so on and and what's the reason why it has to be 32 bu at the time um so so we let you do multiple queries right this is just a way to make your query like more sensible okay so you can you can definitely write some sort of wrapper language around it that like concatenates these queries right right right okay okay um okay so there's this data side of the query and then we also allow users to specify uh compute um so so we we talked with a lot of users about what type of compute they want and we decided that the answer is that they kind of just want arbitrary compute so so we created the system that you can actually plug in your own ZK circuit to specify the computation you want over this data so you can and so I think one thing that's maybe not so obvious is that if you want to use onchain data for your application even if you don't think you're using compute you probably are using some small amount of compute yep um so just to give for example suppose you want to find a user's average ethereum balance mhm over the last y like over five blocks at some interval MH then what you'd want to find um let me let's say here so okay yeah so suppose we want to take the average with a 10 block Gap and with over five blocks MH so what you would fetch in the data query is sort of you know the balance of the address at block the balance of the address at block plus 10 mhm and so on and so so you might ask like what's the computation okay of course we have to average these numbers yep uh but what you also have to do is constrain that the block that you're putting in here really differs by 10 right right and there's all sorts of these sort of bookkeeping constraints yep and so we allow users just to specify this in an arbitrary way in the computation yeah yeah yeah and I guess from like user point of view they're not really writing a circular directly right if because if they do then probably that not that many people would actually do it yeah so we created a uh a JavaScript front end mhm for users to they are writing a circuit right but for this sort of circuit it's it's not quite what you think of as writing a circuit you're literally just constraining some equalities right right right let's see um but if I imagine if they actually want to do like a lot more complex computation then um it might actually get more involved um I don't know what's a good example like they want to compute some complex function over like a some like data and yeah yeah that's right like we think that the computations are going to split into two categories m one is just sort of this bookkeeping stuff right and we think that a user can write that with no issue sure um but of course if you want to write let's say a machine learning model or something complicated then yeah you need to use something you you need to plug in something not written in this sort of framework right right and then do you have like a separate framework for that or like what's the plan for for that yes So the plan is and I'll explain Maybe So the plan for that comes in when we connect these two right so so far we let let's just assume that we can you know prove the data yep and we can prove the computation so the way our system works is that within the computation um okay let me I'll erase this yeah so so the idea is that here's the computation and this is actually on the lap on a user's laptop um so we have sort of the computation which is pretty trivial like we have block block block plus 10 and so on right and then we have a bunch of sort of requests right so in this request you would ask for hey here's give me the balance here's a request for the balance and so on yep then what the user does is actually send a proof of this MH which carries these requests right to our um axm query contract M so we Index this contract and we glue this together with the Fulfillment of those requests with data proofs so we take so in here we do compute Plus data mhm so what I what I mean by that is that the user saying making some claims about the history of ethereum like hey my balance at this block was whatever was one my balance at 10 blocks later was 10 and so on so these are just assertions in this compute proof and what we do is we provide ZK proofs for those assertions in this data part and then we also check that the assertions we provided y are compatible with the request mhm mhm and we wrap all of those together into a single proof MH and we feedback that back here right and okay so so how does that answer your question about the more complicated computations our vision is that the user can just start adding more requests so there's nothing about the request that is specific to the fact that it's you know data right it could be let's say I see I see MH or or anything complex right and so in general we think that there should be this division between what's happening on the client side and the server side right right or M MH and and really it's more like what's happening on the user interface side versus like the uh the ZK like back end side yeah yeah um and actually here like why does this part need to happen on the on the user side like what's the I mean because like all the data is public right there's no like privacy um it's actually just uh like free option okay so we let we have a flexible system you can do it on the user side uh the reason that's really helpful for developers is they don't have to set up any improving infrastructure right right they kind of they can put it we we developed a web assembly prover and so yeah your user can just run it in their web app and okay it's a pretty small proof and everything else that's heavy is delegated to our system right right but I I imagine at some point um well maybe like um maybe single about it in another way maybe um if the if what user wants to do is something that's uh more heavy than I imagine most of the things would actually be delegated to the server right in that case what are they actually doing on the kind of the user interface side yeah so I think there's there are two possibilities here uh one option is that on the user interface side it's really just glue code yeah yeah yeah Mak sense yeah so it's it's just things like oh I wanted my balance let's say I want 100 balances and I feed it into machine learning model so then on the user side it would just be hey my balance at block at whatever block at 10 blocks later and so on right and then also that hey the outputs from these balances really are the inputs to this machine learning model yeah yeah makes sense uh and coming back to this uh the more heavy lifting part because you eventually you need to generate a proof that uh that needs to be verified in contract I imagine you have to do some kind of proof compression or something and also there's some like limitation to like how how like how much computer can prove in like single proof and yeah yeah exactly so let's talk about this part yeah or I guess all the substantial stuff that's happening yeah so there's two pieces of this one is you know how are these data proofs generated and the second is you know how is this compatibility between the compute proof and the data proof happening MH um given what we have here maybe we start with the second yep y yeah okay so as Primitives here I'm going to assume that we have a compute proof and so this could be either from a laptop or server so we don't really care comes from if it's small as we discussed it could come from a laptop if it's big it should come from a server yep yep um now we have and I just call it a data proof but it could include things like ecdsa oh the ecdsa would actually come from here yeah okay so so you could imagine like so here we just currently we're currently on testnet we're supporting like any piece of ethereum data but we also have circuits for you know you can imagine ecdsa here okay okay and our system is flexible enough that you can just modular now what do we need to do we need to check that the data proof actually proved everything that was requested by the computer so we do this operation called proof aggregation and what that does is kind of exactly what I said y so it creates a combined proof so an aggregate proof um that so it does like a couple things the first is that the uh the compute proof is valid MH and one thing that we one special thing we offer is that the compute proof carries its own verification key M and so we do an operation here the aggregation it's actually Universal oh I see so what that means is that what we're checking is not that the compute proof is valid against a fixed verification key but against the verification key that the user actually provides the second statement we're checking is that the data proof is compatible with the compute proof as we just discussed how is that checked exactly when is like you you actually need to check some um like assertion of of like the data right like how how is this part checked yes yes I yeah we we I I will get to that but basically the maybe the last thing to say is like yeah the data proof is valid right right yeah yeah now when I say the data proof is valid well you can't prove in isolation as you're alluding to that some piece of data occurs in the need some Ro of TR so so what our Ro of trust it's going to actually be a mer mountain range it's a claimed mer mountain range I see and when I say claimed mical mountain range it's just a string of hashes that we claim our valid M mountain range in the history of theum and this we are going to need to verify onchain I see so we need to reconcile this claim against the uh data structure that we had before against this uh this cache of block hashes in axm core um I see yeah so so I want to talk about a couple subtleties relating to this Universal aggregation yep uh the first is that you know why do we do this at all mhm and the main motivation is that we don't have to change our onchain verif fire mhm even if the compute circuit is just completely swapped out so and all of these components because they carry their V keys with them yep and we actually have in an output um okay we we call it an aggregate vkey hash what they say so okay what is that that is a commitment to all the V keys and the aggregation structure I see so if you know the aggregate V key has you know exactly what was proven M even if the compute proof structure is totally different or if these components are different um once if the user knows the aggregate VY hash then it knows what the proof was about so when we verify onchain we always give you hey this proof was valid here's what it claimed and here is like the hash of all the vkeys and the structure that entered it right so the user can know from this like whether this query result actually corres responds to like something they're interested in mhm mhm and and and this Aggregates all the V keys from like all the from all of these okay okay okay I see and so what that means is that a user can use our system to do a compute proof that we don't have to know about the user just sends us their vkey sends us their proof yep and to us it's all kind of the same yep yep yeah makes sense um so the the second thing I want to mention is that they don't have to deploy a very verifier like so so here we have like a verifier and it's Universal oh I see yeah yeah yeah um so so that means that if you're a smart contract developer and you want to use the system you all you need to do is to validate this aggregate vky hash coming from our system and there's no like ZK specific contract deployments mhh yep yep yep makes sense um okay should we come back to some of the points here like how exactly yeah yeah okay so so so far we've talked about here we have the compute proof and the data proof we do this Universal aggregation procedure yep that gives a commitment to what was aggregated y checks the validity of the compute proof and the data proof and those validities are the the trust is rooted in a claimed meral mountain range y um and in the validity of computer proof obviously depends on the yep now there's uh maybe two points left the first is what does it mean that the compute and data proofs are compatible yep um that's actually easy just the computer proofs makes some requests and we check in ZK that those requests correspond to what the data proof was proved okay so so the data proof would say like hey here's the balance of account ABC we just check that that is actually the same as or crested in the computer I see but but from like a zq point of view how exactly does it work because those are two separate proofs right yes yes so from ZK point of view we have sort of a public instance mhm and a public instance okay so what the aggregation proof is doing is in the proofs they don't say anything you just verify y but now in the instances you're actually allowed to manipulate them within the aggregation procedure I see I see so so these public instances are private inputs to the aggregation circuit oh and that circuit will just constrain certain equalities between them I see I see I see okay okay okay so it's so this aggregation oh I see so those are the input to this I see so each aggregation proof has this different uh private private inputs right yeah yeah exact exactly so so the compute proof as well as these instances are inputs to the agation pro right right I see I see okay yeah that makes sense um okay so the details of how to do it are a little bit complicated because there's quite a bit of bookkeeping yeah but at the fundamental level we're just checking that certain requests here actually correspond to the answers here okay so so maybe the last missing piece of all this is how does like the data proof really work y right this is sort of big black box right now yeah okay so I'm going to redraw thear so remember we had this axian core contract we have this MMR and now for the data proofs they aggregate sort of a number of of what we call subqueries so subquery is just a request for a single piece of data into history so let me talk about how to just do a single subquery so let's imagine we're trying to prove a storage value so we call this a storage subquery and what does that have to prove it has to prove that the value of slot so maybe let me say how to parameter when we talk about a value a piece of ethereum storage we about the block number M the address we're talking about and then for each address the local contract storage is a key value pair so it's a key value pair um from uent 256 to ENT 256 M and this is called a slot so we care about the slot Y and the output is the slot value right okay so how do we prove this so the data structure in ethereum is that we have a block header within the block header we have a state root mhm and the state rout is a commitment to a meracle Patricia triy which holds all information about accounts so I will attempt to depict this so this thing is the account try MH so let's imagine that this address really corresponds to this account M now this account we have the not balance storage route and then code hash so don't worry about the others but what's important is that the contract storage is committed to in the storage rout and the storage route is again a root of a degree 16 Merle po Tri and so somewhere let's say here is the um key value is the the value that we're looking for so this is the uh storage tribe and here we will get the value so what is the statement we're actually proving we're proving that we have a block header that's indexed by block number MH that's this one then we we're looking up the we're looking up an account by the address in the account try then for the storage route from that account try yep we're looking up a slot yep and so the slot is the key in the storage try and we end up with the value MH so okay so that's a pretty complicated procedure Y and what do we actually have to do so the first thing is that we look up the block header in this MMR m and so I'm describing operations we're doing just as pure computations but in in reality we're going to do all these computations in Z yep now the second is we have to do lookups into these account and storage tries uh so these will be pretty parallel and so I'll describe them just kind of separately MH okay so how does that work we have a root we have a degree 16 M try and then we have a leaf that we're interested in yep so in in a degree 16 Merkle trate try what we have to prove or how to exhibit that this Leaf actually is committed to in the root what we have to do is just display all nodes that it visited on the path up to the rout so that corresponds to commitments y or to to the data of each of these nodes and so there's basically two steps to this the first is because it's a Merkle tree we care about the serialization of the nodes and so ethereum uses what's called rlp serialization Y and RL p is recursive length prefix so this is some type of serialization that is self-describing so the first few byes uh tell you about the length of the whole structure um so that's what's used to serialize each node and we have to in ZK deserialize it's a little bit complicated because of the dynamic length properties y okay so the next step is we have to do the hash checks with a c check yep so the hash function in ethereum is ketak so we need to check that the hash of this node really appears in this node at this proper location MH and this is actually the most um most expensive operation yep just because katak is the most expensive operation in ZK yep y yeah actually this whole thing like I mean this whole thing obviously people do in in like different block blockchains and pretty well known that but I think the problem in DK is that it's actually quite expensive because you're doing a lot of potentially a lot of catch like both in the MMR also in like the different tries um so like how expensive um is it to actually generate the approving in practice Yeah it's um we okay so it's actually kind of complicated question to answer yeah so I'll describe some of the optimizations I think the best way to answer is two components one is how many catch acts can you do per second and then how can you use those cats optim so we can do I think it's around 30 cats per second right now um and how given that how do we actually do these y so one complicated issue is that this is a dynamic depth right and these are Dynamic size right M um so what we do is actually because catch Haack actually takes something like 90% of the pro time M we create a catak table oh okay so we have just a separate set of circuits that do just catac and their job is just to produce as outputs like catac input output pairs um so remember I I had this picture of we had like the uh we have the compute proof we had the data proof and the reality is we actually have a third proof which is the catch proof I see I see and in the aggregation we reconciled the compute proof with the data proof I see and for each data proof we reconcile with the catch proof so the data proofs just do the sort of parsing logic I see and make requests for catak input output pairs I see and they reconcile against this catch proof I see I see okay okay so basically like each time you need to do a catch proof you like kind of delegate that to the the other circuit yes exactly yeah and that also helps us with the dynamic depth because if you think about let's say this was depth four but maybe we need it up to dep depth 10 in some cases so what we would have here is sort of dummy values right right and so crucially when we have a repeated catac reques MH we only use one row of this table ah I see see and so what that means is that we can have a pretty large maxed step Without Really imposing more catch costs I see I see see okay yeah that's quite interesting and then then in practice how expensive like in maybe in terms of time or like cost is should to to actually do this thing yeah yeah so in okay so so there's sort of two considerations for us one is parallel latency MH and the other is just total latency and or cost um so for in practice we have a configuration with up to 32 of any type of query okay so we had the block header queries account queries storage queries and so on and that takes six minutes to run and end so that includes all the proofs all the aggregation to a form that can be verified on chain that's pretty fast okay yeah and actually one thing that we learned that is not so obvious is that there's quite a bit of trade-off between flexibility and performance I see so so here like we're allowing you to query any Block in the history of ethereum in a totally heterogenous way so you can have a transaction from this block an account from this block and we have to pay for that a bit in the ZK side so I think if we like reduce some of the flexibility we could probably get that number down maybe by half maybe more I see see cool um given that we're kind of about to run out of time um and we also kind of already dive deep into the two parts of the the proof is there anything else you want to talk about regarding axum yeah one thing I want to say about is well we're going to launch this on testnet I think probably will be already live by the time this video comes out um one thing I want to mention is that we're going to bring axium to layer twos as well oh that's cool and actually one thing we were a little bit worried about how complex that would be but it's actually pretty simple so this is all about layer one yep and so the first step is we're going to verify layer one on Layer Two ah I see I see and so our design is that we're not going to change the ZK proof at all instead what we're going to do is to take this axm core structure and basically Port it to you know optimism arbitrum scroll whatever mhm and once you have that then you can verify all these proofs just on on our contracts on each of these I see I see I see so they're basically just like a regular smart contract in each of those um later twos yeah just a regular smart contract um it depends a bit on the bridge structure so for let's say arbitrum or scroll Ork sync yep the bridge structure is uh via message passing from L1 so what we have to do is just message pass a commitment to our MMR I see and we just verify against that I see I see uh for optimism we can also do that and there's some chance we can optimize a little bit because on op stack you can access L1 just natively uh right right right yep y that that is very cool um and excited to see that that launch yeah um yeah other enough I think we covered most things went pretty deep actually yeah yeah yeah okay I think then it's time to wrap up and again thanks e for joining me on another uh episode of the white board session and yep thanks everyone","transcript_synced_at":"2026-11-03T06:10:07.635Z","segments":[{"start_seconds":3,"text":"okay welcome uh to another whiteboard series I'm Bowen from near and today we'll have uh with us e co-founder of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3s"},{"start_seconds":10,"text":"axium so you do want to introduce a bit of yourself and also talk a bit about what axium is hey my name is y I'm one","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=10s"},{"start_seconds":17,"text":"of the co-founders of axium uh we allow smart contracts on ethereum to access the entire history of ethereum and do","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=17s"},{"start_seconds":24,"text":"verifiable computation on top of it using Zer knowledge proofs okay um cool so I guess maybe um","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=24s"},{"start_seconds":32,"text":"just to give us um just to give people some background I know um so for those who don't know is definitely one of the most prominent figures in the the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=32s"},{"start_seconds":40,"text":"knowledge space and has been working um like on blockchain related things like for many years um like you know given there are so many things that the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=40s"},{"start_seconds":48,"text":"knowledge proofs can do like uh why specifically do you choose to to work on like axium versus like you know some like other things like layer twos or","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=48s"},{"start_seconds":57,"text":"whatever that is yeah as bone mentioned one of the biggest use cases for ZK until now has been building rollups um","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=57s"},{"start_seconds":65,"text":"and rollups generally scale ethereum by allowing uh smart contract developers to build similar types of applications to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=65s"},{"start_seconds":73,"text":"those which exist on L1 but just at greater scale on L2 and so when coming up with the idea for axm our Northstar","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=73s"},{"start_seconds":81,"text":"has always been to allow smart contracts to do new types of things that weren't possible on L1 before uh not just","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=81s"},{"start_seconds":89,"text":"because of scale but because they're fundamentally a little bit different and with axom what we're doing is just building a type of system that allows","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=89s"},{"start_seconds":97,"text":"smart contracts to make asynchronous calls to read more data and then do compute on that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=97s"},{"start_seconds":104,"text":"data um so to start we're offering access as I mentioned to the history of ethereum and then we're allowing","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=104s"},{"start_seconds":111,"text":"developers to do compute on that history so maybe I can draw a little diagram the so in general we have sort of of the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=111s"},{"start_seconds":120,"text":"axium contract and later on we'll expand to this to the you know real architecture","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=120s"},{"start_seconds":128,"text":"so for now cartoon y um and so a developer will you know make a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=128s"},{"start_seconds":138,"text":"query and this query will uh require some access to some historic","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=138s"},{"start_seconds":146,"text":"data so imagine a receipt or a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=146s"},{"start_seconds":153,"text":"transaction and then it will also access some computation over that data you might imagine adding up a user's uh","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=153s"},{"start_seconds":161,"text":"trading volume yep yep and so what axim is going to do","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=161s"},{"start_seconds":170,"text":"is generate a ZK proof that you know whatever claimed","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=170s"},{"start_seconds":178,"text":"data value or computation actually authentically be belonged to the history of ethereum and after this proof is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=178s"},{"start_seconds":185,"text":"generated it's going to send this proof to the a verifier on","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=185s"},{"start_seconds":198,"text":"chain and once that zerge proof is verified uh we actually send a call","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=198s"},{"start_seconds":206,"text":"back to the developer's contract and so in this way uh we allow","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=206s"},{"start_seconds":216,"text":"developers to actually access sorts of data that weren't possible to access before within the evf yeah so I think one obvious question people would have","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=216s"},{"start_seconds":224,"text":"is probably regarding this part right so uh I think the the natural question people want to ask is well why couldn't we just do it like as is today like","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=224s"},{"start_seconds":233,"text":"where where does they help yeah so that's a great question so I think unless you've tried to develop uh smart contract before you probably wouldn't","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=233s"},{"start_seconds":241,"text":"know that uh within the evm and actually within most uh smart contract development languages you can't access","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=241s"},{"start_seconds":248,"text":"any type of historic information so that means the previous owner of an nft or any type of transaction history um just","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=248s"},{"start_seconds":256,"text":"isn't present in the state of ethereum or any other blockchain and there's actually a fundamental reason for that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=256s"},{"start_seconds":264,"text":"which is that suppose we just changed ethereum so you could access any historic state that that would mean that every validating node on ethereum would","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=264s"},{"start_seconds":272,"text":"need to be able to access historic State extremely quickly in order to validate a transaction and so that would mean that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=272s"},{"start_seconds":280,"text":"they would have to turn every full node into an archive node which definitely hurts the decentralization of ethereum so there's sort of a fundamental","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=280s"},{"start_seconds":287,"text":"trade-off between increasing the set of data that uh contracts can access and decentralization so as someone ask like","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=287s"},{"start_seconds":296,"text":"how do we how does ZK help this situation well the answer is that uh when you currently run a a transaction on ethereum we're relying on","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=296s"},{"start_seconds":304,"text":"the ethereum consensus to um to validate your data access in your compute uh instead we're replacing that consensus","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=304s"},{"start_seconds":313,"text":"here with ZK so ZK uses cryptography instead to do that to do that so let me explain like how that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=313s"},{"start_seconds":328,"text":"works so first of all you know why is that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=328s"},{"start_seconds":335,"text":"even possible we're going to use actually the simplest possible property of a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=335s"},{"start_seconds":343,"text":"blockchain okay so a blockchain is a chain of blocks and what that means is that the current","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=343s"},{"start_seconds":353,"text":"block well it contains a commitment to the previous block the block before and actually the entire en history of the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=353s"},{"start_seconds":360,"text":"blockchain and so what that means is we wanted to access a piece of data from this historic","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=360s"},{"start_seconds":371,"text":"block well in principle this historic block is actually committed to in the current block so we could Supply a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=371s"},{"start_seconds":379,"text":"decommitment proof of this chain of block headers from a past block to the current","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=379s"},{"start_seconds":388,"text":"block and so what would that decommitment proof look","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=388s"},{"start_seconds":396,"text":"like it would simply say that hey I know a sequence of block headers let's say this intermediate one and this intermediate one such that the hash of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=396s"},{"start_seconds":405,"text":"this block is contained in the header of this block the hash of this header is contained in the header of this one and so on so if I could exhibit that to you","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=405s"},{"start_seconds":413,"text":"then you would know that this historic block was authentically present in the history of this chain","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=413s"},{"start_seconds":420,"text":"um now that that in principle allows you to know the entire block history of ethereum and within the historic","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=420s"},{"start_seconds":429,"text":"block well we actually have a commitment to the entire states of ethereum at that block so that's takes the form of the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=429s"},{"start_seconds":438,"text":"state rout uh the transactions root and the receipts","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=438s"},{"start_seconds":448,"text":"route so the state route commits to all accounts and account storage uh the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=448s"},{"start_seconds":456,"text":"transactions rout of course commits to the transactions in this block and the receipts route commits to the receipts or log events in this block so again we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=456s"},{"start_seconds":465,"text":"could just decommit and maybe we would get a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=465s"},{"start_seconds":472,"text":"receipt here so yeah so I think one issue well one problem here is that um if the decom","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=472s"},{"start_seconds":482,"text":"chain is very very long if you're trying to prove something that like like one million blocks ago um this structure by itself may become some problem my","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=482s"},{"start_seconds":491,"text":"understanding is that certain like blockchain by itself doesn't have the M like merco Mountain s that building so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=491s"},{"start_seconds":498,"text":"like need to like build some structure yourself I guess yeah that's exactly right so if you think about actually performing these decommitments in the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=498s"},{"start_seconds":506,"text":"evm you're going to run into sort of two class es of challenges so the first is that this so challenge one is the chain","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=506s"},{"start_seconds":514,"text":"could be huge so if you just want to put the block headers on ethereum that's going","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=514s"},{"start_seconds":522,"text":"to be way too much data and your costs will explode uh the Second Challenge is that the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=522s"},{"start_seconds":530,"text":"uh let's call this decommitment number two uh the decommitment number two for actually proving data from each","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=530s"},{"start_seconds":540,"text":"block requires something called a Merkel Patricia Tri","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=540s"},{"start_seconds":552,"text":"proof so this is a Merkle proof into this degree 16 Merkel tree that ethereum uses to commit to all data and the other","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=552s"},{"start_seconds":561,"text":"problem the problem with that is that it's also huge and so if you actually want to do","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=561s"},{"start_seconds":568,"text":"this on ethereum uh just in the Raw evm your cost is going to be exorbitant um so we have sort of two techniques at","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=568s"},{"start_seconds":576,"text":"axium to resolve uh these two problems so the first uh pertains to this first","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=576s"},{"start_seconds":583,"text":"step of decommitting the chain of block headers so what we do there is that as","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=583s"},{"start_seconds":591,"text":"Bowen mentioned sometimes this chain could be like quite long so let's say that this is not four blocks in the past","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=591s"},{"start_seconds":598,"text":"but let's pretend that this is 1 million blocks well in this case you have to exhibit 1 million block headers which is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=598s"},{"start_seconds":607,"text":"not great so what we do instead is we actually maintain a cash on ethereum to that commits to the entire history of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=607s"},{"start_seconds":616,"text":"ethereum block hashes so we call this axium","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=616s"},{"start_seconds":625,"text":"core and this is a cache of all ethereum block","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=625s"},{"start_seconds":635,"text":"caches now when I say cash I don't mean that we literally store them all since obviously accessing them is pretty costly instead what I mean is we have a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=635s"},{"start_seconds":644,"text":"commitment to all block caches and we want that commitment to actually satisfy two properties uh the first is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=644s"},{"start_seconds":653,"text":"that um we want updates","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=653s"},{"start_seconds":661,"text":"to be cheap uh namely you know more block cashes are post pended and we need to update the cache uh the second is that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=661s"},{"start_seconds":670,"text":"we want the uh commitment of effectively 01","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=670s"},{"start_seconds":679,"text":"size um I say effectively because in reality this is going to be log n size but n log doesn't grow that fast for for","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=679s"},{"start_seconds":687,"text":"blockchain and so what we use is something called a Merkel mountain","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=687s"},{"start_seconds":699,"text":"range and we actually use a small Twist on a merel mountain range which I'll explain in a little bit yeah maybe let's actually dive into yeah let's dive into","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=699s"},{"start_seconds":708,"text":"what I don't think this is a very well-known uh data structure that people use and actually even though we have","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=708s"},{"start_seconds":715,"text":"this building to near um I think that was like at least these three years ago at the time I I didn't know this seemed like there's like a name to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=715s"},{"start_seconds":723,"text":"this yeah I think I remember talking to Ilia about this yeah two years ago yeah yeah yeah yeah okay so to explain like","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=723s"},{"start_seconds":731,"text":"what AAL mountain range is maybe I'll draw a picture of all block cashes on ethereum starting from","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=731s"},{"start_seconds":738,"text":"Genesis so we have so this is block number so we have block of zero to I think we're on like 17 million now maybe","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=738s"},{"start_seconds":747,"text":"18 million let's just say 17 minut so a miracle mountain range is a structure which allows you to commit","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=747s"},{"start_seconds":755,"text":"to um any number of hashes um while taking Only log and commitment size and","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=755s"},{"start_seconds":764,"text":"it has these two property like properties that updates are relatively cheap uh the commitment is relatively","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=764s"},{"start_seconds":770,"text":"small and you can actually decommit any uh block has in this interval in a cheap","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=770s"},{"start_seconds":776,"text":"way so here's how it works um um it's basically just a sequence of Merkel trees hence a merel mountain rid","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=776s"},{"start_seconds":786,"text":"so first you're going to fit the largest binary Merkel tree you can into this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=786s"},{"start_seconds":793,"text":"range so in this case we take the leaves from zero to I should okay let's imagine this is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=793s"},{"start_seconds":801,"text":"roughly 16 million that's going to be the value my diagram is going to be not so good yeah and then so first we chose the largest m tree we can fit into this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=801s"},{"start_seconds":810,"text":"range and we take the Merkel root so this will be","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=810s"},{"start_seconds":818,"text":"Peak zero of the Merk mountain range then we repeat we take another Merkel tree that's as big as possible and this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=818s"},{"start_seconds":826,"text":"will be peak one and we just keep going and so so a mer mountain range is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=826s"},{"start_seconds":836,"text":"just a sequence of Peaks uh of Merkel roots of Merkel trees yep of descending","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=836s"},{"start_seconds":843,"text":"size um now what's the benefit of this well as you can see the whole commitment is of size log n in particular it's the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=843s"},{"start_seconds":852,"text":"number of ones in the binary representation of the total number of blocks uh the second thing is as we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=852s"},{"start_seconds":859,"text":"append blocks here you can sort of see intuitively that you're only going to modify those Peaks which change MH and","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=859s"},{"start_seconds":867,"text":"that size is pretty small um so it has these two properties and so if we want to prove that some block cash","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=867s"},{"start_seconds":874,"text":"was in the history of eum all we need to do is give a standard Merkel proof into one of the Peaks and that would show","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=874s"},{"start_seconds":882,"text":"sort of that it was committed to in this Merle mountain range um so now I want to talk a little","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=882s"},{"start_seconds":888,"text":"bit about a slight tweak we make to address uh this update issue yep so what we actually store is not quite a merel","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=888s"},{"start_seconds":897,"text":"mountain range we actually store a merkl mountain","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=897s"},{"start_seconds":907,"text":"range of Merle","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=907s"},{"start_seconds":915,"text":"roots of uh 124 block hash","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=915s"},{"start_seconds":924,"text":"chunks okay that's interesting um and in addition to this we always store the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=924s"},{"start_seconds":931,"text":"trailing 124 um sorry how' I","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=931s"},{"start_seconds":941,"text":"say the we we store the mer","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=941s"},{"start_seconds":947,"text":"root of a zero padded Merle tree","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=947s"},{"start_seconds":954,"text":"M of size 2024","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=954s"},{"start_seconds":961,"text":"holding the last few leaves uh last few hashes and what does the last few hates","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=961s"},{"start_seconds":970,"text":"mean yeah so so this will store from zero to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=970s"},{"start_seconds":976,"text":"124 * k for some K okay and this will store from 1024 * K okay to 1024 * K","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=976s"},{"start_seconds":987,"text":"plus m I see I see m is the trailing segment I see I see I see so what we do","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=987s"},{"start_seconds":996,"text":"is that we will keep this Merkel route updated until such time as we need to update the full Merkel mountain","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=996s"},{"start_seconds":1003,"text":"range makes sense yeah so the reason for this is that in ethereum It's relatively expensive to update","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1003s"},{"start_seconds":1011,"text":"storage so if you think about blocks being appended these last 10 peaks of the Merle mountain range to account for","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1011s"},{"start_seconds":1018,"text":"up to 1024 they get updated quite a bit so instead of actually updating them we it's much simpler for us to just update","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1018s"},{"start_seconds":1027,"text":"this Merle route I see I see I see and then once you get to the next one you merge it back into the yeah exactly so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1027s"},{"start_seconds":1034,"text":"once we get to the next one we merge it back into this Merle mountain range so we call this a padded Merkel mountain range but okay it's this is sort of a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1034s"},{"start_seconds":1042,"text":"non-standard data structure so we have a Merle M range for almost all of it and then we have this uh zero padded Miracle route at the end how much does this save","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1042s"},{"start_seconds":1050,"text":"you in practice it it's quite a bit so so um basically if suppose you do an update","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1050s"},{"start_seconds":1058,"text":"for let's say 200 uh block cashes then in expectation you're going to update uh","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1058s"},{"start_seconds":1065,"text":"you know eight of the peaks of M Mountain merch so that's uh eight S stor they're they're warm but okay that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1065s"},{"start_seconds":1074,"text":"that's quite a bit I see I see I see okay um okay so I so far we've just talked about the data structure we're","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1074s"},{"start_seconds":1082,"text":"using right right and these updates you know in principle could be done in evm y but now in practice doing the updates in","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1082s"},{"start_seconds":1089,"text":"evm has sort of two challenges so as we see we have this chain of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1089s"},{"start_seconds":1100,"text":"blocks and let's indicate here which blocks are actually already committed to in our Merr mod range so let's say that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1100s"},{"start_seconds":1109,"text":"this is in the so mount range abbreviated MMR so suppose we're in the Merle mountain","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1109s"},{"start_seconds":1116,"text":"range and now some new blocks have occurred and we want to update M so the the fact we can use is that in ethereum","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1116s"},{"start_seconds":1124,"text":"you actually have access to the last 256","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1124s"},{"start_seconds":1133,"text":"blocks uh baches it's a bit of a mystery to me why it's","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1133s"},{"start_seconds":1141,"text":"256 uh I think there's no actual issues if you make it all block caches to be honest but you know we have to work with","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1141s"},{"start_seconds":1149,"text":"what we have so we're currently at 256 um and so what we do is we we use","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1149s"},{"start_seconds":1156,"text":"the fact that we have a single recent one okay so now you might imagine that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1156s"},{"start_seconds":1167,"text":"in evm you can just access the last 256 do some Merkel root computations in evm and start appending to this data","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1167s"},{"start_seconds":1176,"text":"structure M uh the challenge with that is that suppose you just don't manage to do the update in a 256 block window so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1176s"},{"start_seconds":1185,"text":"that's sort of 45 minutes well now you're kind of in trouble because how do you connect back to your m round um so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1185s"},{"start_seconds":1193,"text":"that's not very robust system right uh so instead what we do is we just choose this recent one and we generate a Zer","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1193s"},{"start_seconds":1200,"text":"knowledge proof M of the chain of block hashes back to the last multiple of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1200s"},{"start_seconds":1206,"text":"1024 oh I see so so let's not so clear how to denote that but let's say it's like","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1206s"},{"start_seconds":1214,"text":"this so we do this in ZK I see I see um so what that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1214s"},{"start_seconds":1223,"text":"means is that in the typical happy path uh if we're within this 250 6 block Window M we check that this chain of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1223s"},{"start_seconds":1232,"text":"block headers connects to each other MH uh that the last block has is in this 256 block window MH uh and then we check","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1232s"},{"start_seconds":1240,"text":"that this like starting point actually aligns with the end point of our merlan range um now suppose that we missed some","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1240s"},{"start_seconds":1249,"text":"yep then what we can do is we first prove this chunk of up to 1024 and we can sort of backfill with chunks of 1024","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1249s"},{"start_seconds":1257,"text":"mhm so no matter what happens we can always get back to this where we were in the mer M range and in practice how","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1257s"},{"start_seconds":1264,"text":"often do you do this update so in practice we do it every 192 blocks 192 blocks and we we could probably get a little bit more aggressive but there's","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1264s"},{"start_seconds":1273,"text":"and then how long does it take to generate this zero knowledge proof oh it's it's pretty fast like I think two minutes or something oh okay okay and","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1273s"},{"start_seconds":1280,"text":"and we're that that's with some cost saving so so if you really wanted to you could do lower oh okay okay okay I see","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1280s"},{"start_seconds":1288,"text":"We R run on like not a great machine I see I see I see I see so so our philosophy is we always want to maintain the property that this commitment with","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1288s"},{"start_seconds":1295,"text":"the Merkel mountain range always overlaps the 256 block caches MH and that way the cash will always commit the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1295s"},{"start_seconds":1303,"text":"Cash Plus the evm block cash op code always conits to the entire history of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1303s"},{"start_seconds":1309,"text":"ethereum y y okay that that makes makes L sense um yes there's maybe one more","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1309s"},{"start_seconds":1317,"text":"thing which we didn't discuss which is when we deploy the contract mhm there's nothing in it ah right so what do we do then we have to build this like from","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1317s"},{"start_seconds":1325,"text":"scratch yeah yeah yeah uh so okay so we we actually have a separate uh way of bootstrapping MH um which proves the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1325s"},{"start_seconds":1334,"text":"Block hashes in chunks of 128,000 um so so yeah we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1334s"},{"start_seconds":1342,"text":"start we can yeah maybe we erase erase some part like yeah I'll Erase here","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1342s"},{"start_seconds":1353,"text":"so so suppose we start you know again at 17 million M we're going to prove you know this is 128 *","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1353s"},{"start_seconds":1362,"text":"1024 then we prove 128 * 1024 and we just keep going","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1362s"},{"start_seconds":1369,"text":"back and okay there's some complication surrounding that 17 million is not a multiple of 1024 but we just handle this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1369s"},{"start_seconds":1377,"text":"and we eventually get here mhm so so now we have sort of in groups of 128 * 1024","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1377s"},{"start_seconds":1384,"text":"we actually write the groups uh every Merkel route of 1024 and then we construct the Merkel","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1384s"},{"start_seconds":1390,"text":"mountain range in evm actually I see but that is quite expensive to do right that that construction it's like okay okay","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1390s"},{"start_seconds":1398,"text":"like it's definitely a little bit expensive I think it costs like 20K total okay but it just simplifies the system so that we don't have to think","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1398s"},{"start_seconds":1405,"text":"about like some parts of the system chunks of 128,000 other parts have chunks of 1024 yeah yeah yeah we we could definitely probably cost optimize","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1405s"},{"start_seconds":1414,"text":"by dropping some of these oh sense yeah the cost is not crazy so we we kind of just do it okay okay um so yeah we have","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1414s"},{"start_seconds":1420,"text":"to do I think it's something like 130 of these mhh and then once we have bootstrapped the system to this state","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1420s"},{"start_seconds":1428,"text":"all we need to do is maintain it in this way right right right so basically in this entire part of this uh chain proof the only part where you use Decay is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1428s"},{"start_seconds":1437,"text":"like this part like of maintaining uh the mer mountain range uh in light of the more recent blocks yeah both the recent blocks and","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1437s"},{"start_seconds":1446,"text":"uh this historic bootstrapping ah okay sure yeah yeah yeah okay so we obey the principle that a user of our system","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1446s"},{"start_seconds":1454,"text":"shouldn't need to trust us really in any way like if something has been posted it really has been verified either in evm","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1454s"},{"start_seconds":1461,"text":"or by ZK mhmh yep makes sense um okay so should we move on to the other part of the proof the yeah yeah cool so so so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1461s"},{"start_seconds":1471,"text":"far we have this cache and we sort of maintain it to have this proper","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1471s"},{"start_seconds":1486,"text":"um all right I'll just redraw now the next step is that we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1486s"},{"start_seconds":1497,"text":"actually need to access the history of ethereum from this cach so let say we're in this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1497s"},{"start_seconds":1509,"text":"situation and let's say that the MMR committed to this much so far MH and this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1509s"},{"start_seconds":1517,"text":"is axium core and so this is just the vanilla","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1517s"},{"start_seconds":1524,"text":"smart contract on ethereum MH MH so now now we want to actually ask like hey I want a transaction","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1524s"},{"start_seconds":1533,"text":"from uh from this block I want a storage value from this block and so on so the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1533s"},{"start_seconds":1540,"text":"way that we allow users to express this is in something we call a quer so what what's a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1540s"},{"start_seconds":1548,"text":"quer well okay it's a couple things it's a list of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1548s"},{"start_seconds":1555,"text":"data that the the user wants and so we allow pretty arbitrary data so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1555s"},{"start_seconds":1563,"text":"we format the data as just 32 byte chunks from the history of ethereum and they can come from uh block","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1563s"},{"start_seconds":1572,"text":"headers uh accounts storage M","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1572s"},{"start_seconds":1579,"text":"transactions receipts M and we're also handling a solidity mappings oh okay so it's a subset of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1579s"},{"start_seconds":1588,"text":"storage of course y but as you probably know like the mapping of solidity key value pair to storage slot is a bit","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1588s"},{"start_seconds":1596,"text":"complex and it's actually better to handle in ZK I see and so our principle is that anything in the history of ethereum is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1596s"},{"start_seconds":1604,"text":"parameterized in this way and okay we have some pretty long complicated list of How It's parameterized and so the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1604s"},{"start_seconds":1610,"text":"user can specify um basically these 32 bytes at a time","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1610s"},{"start_seconds":1621,"text":"so for example if you want to read transaction call data we let you just specify hey I want you know this index to this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1621s"},{"start_seconds":1628,"text":"index and multiples of 32 um similarly for receipts you can access uh you know I want the first log I see and I want","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1628s"},{"start_seconds":1638,"text":"this data field in that log and so on and and what's the reason why it has to be 32 bu at the time um so so we let you","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1638s"},{"start_seconds":1645,"text":"do multiple queries right this is just a way to make your query like more sensible okay so you can you can definitely write some sort of wrapper language around it that like","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1645s"},{"start_seconds":1654,"text":"concatenates these queries right right right okay okay um okay so there's this data side of the query and then we also","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1654s"},{"start_seconds":1662,"text":"allow users to specify uh compute um","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1662s"},{"start_seconds":1670,"text":"so so we we talked with a lot of users about what type of compute they want and we decided that the answer is that they kind of just want arbitrary compute so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1670s"},{"start_seconds":1678,"text":"so we created the system that you can actually plug in your own ZK circuit to specify the computation you want over","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1678s"},{"start_seconds":1685,"text":"this data so you can and so I think one thing that's","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1685s"},{"start_seconds":1695,"text":"maybe not so obvious is that if you want to use onchain data for your application even if you don't think you're using","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1695s"},{"start_seconds":1702,"text":"compute you probably are using some small amount of compute yep um so just to give for example suppose you want to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1702s"},{"start_seconds":1708,"text":"find a user's average ethereum balance mhm over the last y like over five","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1708s"},{"start_seconds":1715,"text":"blocks at some interval MH then what you'd want to find um let","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1715s"},{"start_seconds":1723,"text":"me let's say here so okay","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1723s"},{"start_seconds":1736,"text":"yeah so suppose we want to take the average with a 10 block Gap and with over five blocks MH so what you would","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1736s"},{"start_seconds":1745,"text":"fetch in the data query is sort of you know the balance of the address at","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1745s"},{"start_seconds":1753,"text":"block the balance of the address at","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1753s"},{"start_seconds":1760,"text":"block plus 10 mhm and so on and so so you might ask like what's the computation okay of course we have to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1760s"},{"start_seconds":1768,"text":"average these numbers yep uh but what you also have to do is constrain that the block that you're putting in here really differs by 10 right right and","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1768s"},{"start_seconds":1777,"text":"there's all sorts of these sort of bookkeeping constraints yep and so we allow users just to specify this in an arbitrary way in the computation yeah","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1777s"},{"start_seconds":1784,"text":"yeah yeah and I guess from like user point of view they're not really writing a circular directly right if because if they do then probably that not that many","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1784s"},{"start_seconds":1792,"text":"people would actually do it yeah so we created a uh a JavaScript front end mhm for users to they are writing a circuit","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1792s"},{"start_seconds":1800,"text":"right but for this sort of circuit it's it's not quite what you think of as writing a circuit you're literally just constraining some equalities right right","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1800s"},{"start_seconds":1807,"text":"right let's see um but if I imagine if they actually want to do like a lot more complex computation then um it might","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1807s"},{"start_seconds":1816,"text":"actually get more involved um I don't know what's a good example like they want to compute some complex function over like a some like data and yeah yeah","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1816s"},{"start_seconds":1824,"text":"that's right like we think that the computations are going to split into two categories m one is just sort of this bookkeeping stuff right and we think","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1824s"},{"start_seconds":1832,"text":"that a user can write that with no issue sure um but of course if you want to write let's say a machine learning model or something complicated then yeah you","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1832s"},{"start_seconds":1840,"text":"need to use something you you need to plug in something not written in this sort of framework right right and then do you have like a separate framework","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1840s"},{"start_seconds":1847,"text":"for that or like what's the plan for for that yes So the plan is and I'll explain Maybe So the plan for that comes in when","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1847s"},{"start_seconds":1855,"text":"we connect these two right so so far we let let's just assume that we can you know prove the data yep and we can prove","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1855s"},{"start_seconds":1863,"text":"the computation so the way our system works is that within the computation um okay let","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1863s"},{"start_seconds":1872,"text":"me I'll erase this yeah so so the idea is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1872s"},{"start_seconds":1884,"text":"that here's the computation and this is actually on the lap on a user's","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1884s"},{"start_seconds":1891,"text":"laptop um so we have sort of the computation which is pretty trivial like we have block block block plus 10 and so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1891s"},{"start_seconds":1898,"text":"on right and then we have a bunch of sort of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1898s"},{"start_seconds":1905,"text":"requests right so in this request you would ask for hey here's give me the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1905s"},{"start_seconds":1912,"text":"balance here's a request for the balance and so on yep then what the user does is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1912s"},{"start_seconds":1919,"text":"actually send a proof of this MH which carries these requests right to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1919s"},{"start_seconds":1925,"text":"our um axm query contract M so we Index this contract and we glue","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1925s"},{"start_seconds":1933,"text":"this together with the Fulfillment of those requests with data proofs so we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1933s"},{"start_seconds":1940,"text":"take so in here we do compute Plus data mhm so what I what I","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1940s"},{"start_seconds":1949,"text":"mean by that is that the user saying making some claims about the history of ethereum like hey my balance at this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1949s"},{"start_seconds":1955,"text":"block was whatever was one my balance at 10 blocks later was 10 and so on so these are just assertions in this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1955s"},{"start_seconds":1963,"text":"compute proof and what we do is we provide ZK proofs for those assertions in this data part and then we also check","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1963s"},{"start_seconds":1972,"text":"that the assertions we provided y are compatible with the request mhm mhm and we wrap all of those together into a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1972s"},{"start_seconds":1980,"text":"single proof MH and we feedback that back here right and okay so so how does that answer your question about the more","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1980s"},{"start_seconds":1988,"text":"complicated computations our vision is that the user can just start adding more requests so there's nothing about the request that is specific to the fact","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1988s"},{"start_seconds":1995,"text":"that it's you know data right it could be let's say I see I see MH or or","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=1995s"},{"start_seconds":2002,"text":"anything complex right and so in general we think that there should be this division between what's happening on the client side and the server side right","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2002s"},{"start_seconds":2010,"text":"right or M MH and and really it's more like what's happening on the user interface side versus like the uh the ZK","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2010s"},{"start_seconds":2019,"text":"like back end side yeah yeah um and actually here like why does this part need to happen on the on the user side","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2019s"},{"start_seconds":2027,"text":"like what's the I mean because like all the data is public right there's no like privacy um it's actually just uh like","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2027s"},{"start_seconds":2035,"text":"free option okay so we let we have a flexible system you can do it on the user side uh the reason that's really helpful for developers is they don't","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2035s"},{"start_seconds":2043,"text":"have to set up any improving infrastructure right right they kind of they can put it we we developed a web assembly prover and so yeah your user","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2043s"},{"start_seconds":2053,"text":"can just run it in their web app and okay it's a pretty small proof and everything else that's heavy is delegated to our system right right but","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2053s"},{"start_seconds":2061,"text":"I I imagine at some point um well maybe like um maybe single about it in another way maybe um if the if what user wants","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2061s"},{"start_seconds":2070,"text":"to do is something that's uh more heavy than I imagine most of the things would actually be delegated to the server right in that case what are they","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2070s"},{"start_seconds":2077,"text":"actually doing on the kind of the user interface side yeah so I think there's there are two possibilities here uh one","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2077s"},{"start_seconds":2085,"text":"option is that on the user interface side it's really just glue code yeah yeah yeah Mak sense yeah so it's it's","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2085s"},{"start_seconds":2092,"text":"just things like oh I wanted my balance let's say I want 100 balances and I feed it into machine learning model so then","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2092s"},{"start_seconds":2100,"text":"on the user side it would just be hey my balance at block at whatever block at 10 blocks later and so on right and then","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2100s"},{"start_seconds":2107,"text":"also that hey the outputs from these balances really are the inputs to this machine learning model yeah yeah makes sense uh and","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2107s"},{"start_seconds":2116,"text":"coming back to this uh the more heavy lifting part because you eventually you need to generate a proof that uh that needs to be verified in contract I","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2116s"},{"start_seconds":2125,"text":"imagine you have to do some kind of proof compression or something and also there's some like limitation to like how","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2125s"},{"start_seconds":2131,"text":"how like how much computer can prove in like single proof and yeah yeah exactly so let's talk about this part yeah or I","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2131s"},{"start_seconds":2140,"text":"guess all the substantial stuff that's happening yeah so there's two pieces of this one is you know how are these data proofs generated and the second is you","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2140s"},{"start_seconds":2149,"text":"know how is this compatibility between the compute proof and the data proof happening MH um given what we have here maybe we start with the second yep y","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2149s"},{"start_seconds":2165,"text":"yeah okay so as Primitives here I'm going to assume that we have a compute","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2165s"},{"start_seconds":2174,"text":"proof and so this could be either from a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2174s"},{"start_seconds":2181,"text":"laptop or server so we don't really care comes from if it's small as we discussed it could come from a laptop if it's big it","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2181s"},{"start_seconds":2190,"text":"should come from a server yep yep um now we have and I just call it a data proof but it could include things like","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2190s"},{"start_seconds":2198,"text":"ecdsa oh the ecdsa would actually come from here yeah okay so so you could imagine like so here we just currently","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2198s"},{"start_seconds":2207,"text":"we're currently on testnet we're supporting like any piece of ethereum data but we also have circuits for you","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2207s"},{"start_seconds":2215,"text":"know you can imagine ecdsa here okay okay and our system is flexible enough that you can just","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2215s"},{"start_seconds":2222,"text":"modular now what do we need to do we need to check that the data proof actually proved everything that was requested by the computer so we do this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2222s"},{"start_seconds":2231,"text":"operation called proof aggregation and what that does is kind","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2231s"},{"start_seconds":2241,"text":"of exactly what I said y so it creates a combined proof so an aggregate","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2241s"},{"start_seconds":2250,"text":"proof um that so it does like a couple things the first is that","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2250s"},{"start_seconds":2257,"text":"the uh the compute proof is valid","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2257s"},{"start_seconds":2265,"text":"MH and one thing that we one special thing we offer is that the compute proof","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2265s"},{"start_seconds":2271,"text":"carries its own verification key M and so we do an operation here the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2271s"},{"start_seconds":2277,"text":"aggregation it's actually Universal oh I see so what that means is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2277s"},{"start_seconds":2285,"text":"that what we're checking is not that the compute proof is valid against a fixed verification key but against the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2285s"},{"start_seconds":2293,"text":"verification key that the user actually provides the second statement we're","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2293s"},{"start_seconds":2300,"text":"checking is that the data proof is compatible with the compute proof as we just discussed","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2300s"},{"start_seconds":2308,"text":"how is that checked exactly when is like you you actually need to check some um like assertion of of like the data right","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2308s"},{"start_seconds":2316,"text":"like how how is this part checked yes yes I yeah we we I I will get to that but basically the maybe the last thing","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2316s"},{"start_seconds":2324,"text":"to say is like yeah the data proof is valid right right yeah yeah now when I say the data proof is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2324s"},{"start_seconds":2331,"text":"valid well you can't prove in isolation as you're alluding to that some piece of data occurs in the need some Ro of TR so so what our Ro of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2331s"},{"start_seconds":2340,"text":"trust it's going to actually be a mer mountain range it's a claimed mer mountain range I","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2340s"},{"start_seconds":2350,"text":"see and when I say claimed mical mountain range it's just a string of hashes that we claim our valid M mountain range in the history of theum","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2350s"},{"start_seconds":2359,"text":"and this we are going to need to verify onchain I see","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2359s"},{"start_seconds":2367,"text":"so we need to reconcile this claim against the uh data structure that we had before against this uh this cache of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2367s"},{"start_seconds":2375,"text":"block hashes in axm core um I","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2375s"},{"start_seconds":2381,"text":"see yeah so so I want to talk about a couple subtleties relating to this Universal aggregation yep uh the first","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2381s"},{"start_seconds":2388,"text":"is that you know why do we do this at all mhm and the main motivation is that we don't have to change our onchain","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2388s"},{"start_seconds":2396,"text":"verif fire mhm even if the compute circuit is just completely swapped out so and all of these components because they carry their V keys with","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2396s"},{"start_seconds":2404,"text":"them yep and we actually have in an output um okay we we call it an aggregate vkey","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2404s"},{"start_seconds":2416,"text":"hash what they say so okay what is that that is a commitment to all the V keys and the aggregation structure I see so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2416s"},{"start_seconds":2424,"text":"if you know the aggregate V key has you know exactly what was proven M even if the compute proof structure is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2424s"},{"start_seconds":2431,"text":"totally different or if these components are different um once if the user knows the aggregate VY hash then it knows what","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2431s"},{"start_seconds":2440,"text":"the proof was about so when we verify onchain we always give you hey this proof was valid here's what it claimed","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2440s"},{"start_seconds":2447,"text":"and here is like the hash of all the vkeys and the structure that entered it right so the user can know from this like whether this query result actually","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2447s"},{"start_seconds":2456,"text":"corres responds to like something they're interested in mhm mhm and and and this Aggregates all the V keys from like all the from all of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2456s"},{"start_seconds":2464,"text":"these okay okay okay I see and so what that means is that a user can use our system to do a compute proof that we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2464s"},{"start_seconds":2474,"text":"don't have to know about the user just sends us their vkey sends us their proof yep and to us it's all kind of the same yep yep yeah makes sense um so the the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2474s"},{"start_seconds":2483,"text":"second thing I want to mention is that they don't have to deploy a very verifier like so so here we have","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2483s"},{"start_seconds":2492,"text":"like a verifier and it's Universal oh I see yeah yeah yeah um so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2492s"},{"start_seconds":2500,"text":"so that means that if you're a smart contract developer and you want to use the system you all you need to do is to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2500s"},{"start_seconds":2506,"text":"validate this aggregate vky hash coming from our system and there's no like ZK specific contract deployments","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2506s"},{"start_seconds":2515,"text":"mhh yep yep yep makes sense um okay should we come back to some of the points here like how exactly","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2515s"},{"start_seconds":2523,"text":"yeah yeah okay so so so far we've talked about here we have the compute proof and the data proof we do this Universal aggregation procedure yep that gives a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2523s"},{"start_seconds":2530,"text":"commitment to what was aggregated y checks the validity of the compute proof and the data proof and those validities","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2530s"},{"start_seconds":2538,"text":"are the the trust is rooted in a claimed meral mountain range y um and in the validity of computer proof obviously","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2538s"},{"start_seconds":2545,"text":"depends on the yep now there's uh maybe two points left the first is what does it mean that the compute and data proofs","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2545s"},{"start_seconds":2552,"text":"are compatible yep um that's actually easy just the computer proofs makes some requests and we check in ZK that those requests correspond to what the data","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2552s"},{"start_seconds":2561,"text":"proof was proved okay so so the data proof would say like hey here's the balance of account ABC we just check","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2561s"},{"start_seconds":2569,"text":"that that is actually the same as or crested in the computer I see but but from like a zq point of view how exactly does it work","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2569s"},{"start_seconds":2576,"text":"because those are two separate proofs right yes yes so from ZK point of view we have sort of a public instance","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2576s"},{"start_seconds":2586,"text":"mhm and a public instance okay so what the aggregation proof is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2586s"},{"start_seconds":2594,"text":"doing is in the proofs they don't say anything you just verify y but now in the instances you're actually allowed to manipulate them within the aggregation","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2594s"},{"start_seconds":2603,"text":"procedure I see I see so so these public instances are private inputs to the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2603s"},{"start_seconds":2610,"text":"aggregation circuit oh and that circuit will just constrain certain equalities between them I see I see I see okay okay","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2610s"},{"start_seconds":2617,"text":"okay so it's so this aggregation oh I see so those are the input to this I see","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2617s"},{"start_seconds":2624,"text":"so each aggregation proof has this different uh private private inputs right yeah yeah exact exactly so so the compute proof as well as these instances","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2624s"},{"start_seconds":2632,"text":"are inputs to the agation pro right right I see I see okay yeah that makes sense um okay so the details of how to do it are a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2632s"},{"start_seconds":2641,"text":"little bit complicated because there's quite a bit of bookkeeping yeah but at the fundamental level we're just checking that certain requests here","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2641s"},{"start_seconds":2648,"text":"actually correspond to the answers here okay so so maybe the last missing piece of all this is how does like the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2648s"},{"start_seconds":2657,"text":"data proof really work y right this is sort of big black box right now yeah","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2657s"},{"start_seconds":2673,"text":"okay so I'm going to redraw thear so remember we had this axian core","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2673s"},{"start_seconds":2682,"text":"contract we have this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2682s"},{"start_seconds":2690,"text":"MMR and now for the data proofs they aggregate sort of a number of of what we call subqueries so subquery is just a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2690s"},{"start_seconds":2699,"text":"request for a single piece of data into history so let me talk about how to just do a single subquery so let's imagine","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2699s"},{"start_seconds":2705,"text":"we're trying to prove a storage value so we call this a storage subquery and what does that have to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2705s"},{"start_seconds":2714,"text":"prove it has to prove that the value of slot so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2714s"},{"start_seconds":2723,"text":"maybe let me say how to parameter when we talk about a value a piece of ethereum storage we about the block","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2723s"},{"start_seconds":2731,"text":"number M the address we're talking","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2731s"},{"start_seconds":2739,"text":"about and then for each address the local contract storage is a key value pair so it's a key value","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2739s"},{"start_seconds":2747,"text":"pair um from uent 256 to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2747s"},{"start_seconds":2754,"text":"ENT 256 M and this is called a slot so we care about the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2754s"},{"start_seconds":2762,"text":"slot Y and the output is the slot value right okay so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2762s"},{"start_seconds":2771,"text":"how do we prove this so the data structure in ethereum is that we have a block","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2771s"},{"start_seconds":2779,"text":"header within the block header we have a state root mhm and the state rout is a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2779s"},{"start_seconds":2787,"text":"commitment to a meracle Patricia triy which holds all information about","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2787s"},{"start_seconds":2793,"text":"accounts so I will attempt to depict","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2793s"},{"start_seconds":2798,"text":"this so this thing is the account try","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2798s"},{"start_seconds":2806,"text":"MH so let's imagine that this address really corresponds to this account M","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2806s"},{"start_seconds":2814,"text":"now this account we have the not balance storage","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2814s"},{"start_seconds":2823,"text":"route and then code hash so don't worry about the others but","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2823s"},{"start_seconds":2831,"text":"what's important is that the contract storage is committed to in the storage rout and the storage route is again a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2831s"},{"start_seconds":2839,"text":"root of a degree 16 Merle po Tri","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2839s"},{"start_seconds":2848,"text":"and so somewhere let's say here is the um key value is the the value that we're","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2848s"},{"start_seconds":2855,"text":"looking for so this is the uh storage","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2855s"},{"start_seconds":2861,"text":"tribe and here we will get the value so what is the statement we're actually proving we're proving that we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2861s"},{"start_seconds":2869,"text":"have a block header that's indexed by block number MH that's this one then we we're looking up the we're looking up an","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2869s"},{"start_seconds":2879,"text":"account by the address in the account try then for the storage route from that account try yep we're looking up a slot","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2879s"},{"start_seconds":2887,"text":"yep and so the slot is the key in the storage try and we end up with the value MH so okay so that's a pretty","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2887s"},{"start_seconds":2895,"text":"complicated procedure Y and what do we actually have to do so the first thing is that we look up the block header in","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2895s"},{"start_seconds":2902,"text":"this MMR m and so I'm describing operations we're doing just as pure computations but in","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2902s"},{"start_seconds":2912,"text":"in reality we're going to do all these computations in Z yep now the second is we have to do lookups into these account and storage","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2912s"},{"start_seconds":2920,"text":"tries uh so these will be pretty parallel and so I'll describe them just kind of separately","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2920s"},{"start_seconds":2934,"text":"MH okay so how does that work we have a","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2934s"},{"start_seconds":2941,"text":"root we have a degree 16 M","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2941s"},{"start_seconds":2952,"text":"try and then we have a leaf that we're interested in yep so in in a degree 16 Merkle trate try what we have to prove","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2952s"},{"start_seconds":2962,"text":"or how to exhibit that this Leaf actually is committed to in the root what we have to do is just display all","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2962s"},{"start_seconds":2969,"text":"nodes that it visited on the path up to the rout so that corresponds to commitments y or to to the data of each","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2969s"},{"start_seconds":2977,"text":"of these nodes and so there's basically two steps to this the first is because it's a Merkle tree we care about the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2977s"},{"start_seconds":2985,"text":"serialization of the nodes and so ethereum uses what's called rlp serialization","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2985s"},{"start_seconds":2994,"text":"Y and RL p is recursive length","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=2994s"},{"start_seconds":3003,"text":"prefix so this is some type of serialization that is self-describing so the first few byes uh tell you about the length of the whole","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3003s"},{"start_seconds":3011,"text":"structure um so that's what's used to serialize each node and we have to in ZK deserialize it's a little bit","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3011s"},{"start_seconds":3019,"text":"complicated because of the dynamic length properties y okay so the next step is we have to do the hash","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3019s"},{"start_seconds":3029,"text":"checks with a c check yep so the hash function in ethereum is ketak so we need to check that the hash of this node","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3029s"},{"start_seconds":3037,"text":"really appears in this node at this proper location MH and this is actually the most um most expensive operation yep","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3037s"},{"start_seconds":3046,"text":"just because katak is the most expensive operation in ZK yep y yeah actually this whole thing like I mean this whole thing","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3046s"},{"start_seconds":3053,"text":"obviously people do in in like different block blockchains and pretty well known that but I think the problem in DK is that it's actually quite expensive because you're doing a lot of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3053s"},{"start_seconds":3060,"text":"potentially a lot of catch like both in the MMR also in like the different tries um so like how expensive um is it to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3060s"},{"start_seconds":3068,"text":"actually generate the approving in practice Yeah it's um we okay so it's actually kind of complicated question to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3068s"},{"start_seconds":3076,"text":"answer yeah so I'll describe some of the optimizations I think the best way to answer is two components one is how many","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3076s"},{"start_seconds":3083,"text":"catch acts can you do per second and then how can you use those cats optim so we can do I think it's around","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3083s"},{"start_seconds":3090,"text":"30 cats per second right now um and how given that how do we actually do these y so one complicated issue is that this is","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3090s"},{"start_seconds":3099,"text":"a dynamic depth right and these are Dynamic","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3099s"},{"start_seconds":3109,"text":"size right M um so what we do is actually because catch Haack actually takes something like 90% of the pro time","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3109s"},{"start_seconds":3117,"text":"M we create a catak table oh okay so we have just a separate set of circuits that do just catac and","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3117s"},{"start_seconds":3125,"text":"their job is just to produce as outputs like catac input output pairs um so remember I I had this picture of we had","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3125s"},{"start_seconds":3133,"text":"like the uh we have the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3133s"},{"start_seconds":3142,"text":"compute proof we had the data proof and the reality is we actually","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3142s"},{"start_seconds":3150,"text":"have a third proof which is the catch proof I see I see and in the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3150s"},{"start_seconds":3159,"text":"aggregation we reconciled the compute proof with the data proof I see and for each data proof we reconcile with the catch proof so the data proofs just do","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3159s"},{"start_seconds":3168,"text":"the sort of parsing logic I see and make requests for catak input output pairs I see and they reconcile against this","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3168s"},{"start_seconds":3175,"text":"catch proof I see I see okay okay so basically like each time you need to do a catch proof you like kind of delegate","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3175s"},{"start_seconds":3183,"text":"that to the the other circuit yes exactly yeah and that also helps us with the dynamic depth because if you think about let's say this was depth four but","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3183s"},{"start_seconds":3192,"text":"maybe we need it up to dep depth 10 in some cases so what we would have here is sort of dummy","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3192s"},{"start_seconds":3199,"text":"values right right and so crucially when we have a repeated catac reques MH we","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3199s"},{"start_seconds":3205,"text":"only use one row of this table ah I see see and so what that means is that we can have a pretty large maxed step","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3205s"},{"start_seconds":3213,"text":"Without Really imposing more catch costs I see I see see okay yeah that's quite interesting and then then in practice","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3213s"},{"start_seconds":3221,"text":"how expensive like in maybe in terms of time or like cost is should to to actually do this thing yeah yeah so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3221s"},{"start_seconds":3230,"text":"in okay so so there's sort of two considerations for us one is parallel latency MH and the other is just total","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3230s"},{"start_seconds":3238,"text":"latency and or cost um so for in practice we have a configuration with up to","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3238s"},{"start_seconds":3245,"text":"32 of any type of query okay so we had the block header queries account queries storage queries and so on and that takes","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3245s"},{"start_seconds":3253,"text":"six minutes to run and end so that includes all the proofs all the aggregation to a form that can be verified on chain that's pretty fast","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3253s"},{"start_seconds":3262,"text":"okay yeah and actually one thing that we learned that is not so obvious is that there's quite a bit of trade-off between","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3262s"},{"start_seconds":3268,"text":"flexibility and performance I see so so here like we're allowing you to query any Block in the history of ethereum in a totally heterogenous way so you can","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3268s"},{"start_seconds":3277,"text":"have a transaction from this block an account from this block and we have to pay for that a bit in the ZK side so I think if we like reduce some of the","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3277s"},{"start_seconds":3286,"text":"flexibility we could probably get that number down maybe by half maybe more I see see cool um given that we're kind of","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3286s"},{"start_seconds":3293,"text":"about to run out of time um and we also kind of already dive deep into the two parts of the the proof is there anything else you want to talk about regarding","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3293s"},{"start_seconds":3303,"text":"axum yeah one thing I want to say about is well we're going to launch this on testnet I think probably will be already live by the time this video comes out um","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3303s"},{"start_seconds":3311,"text":"one thing I want to mention is that we're going to bring axium to layer twos as well oh that's cool and actually one thing we were a little bit worried about","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3311s"},{"start_seconds":3319,"text":"how complex that would be but it's actually pretty simple so this is all about layer one yep and so the first step is we're going to verify layer one","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3319s"},{"start_seconds":3327,"text":"on Layer Two ah I see I see and so our design is that we're not going to change the ZK proof at","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3327s"},{"start_seconds":3335,"text":"all instead what we're going to do is to take this axm core structure and basically Port it to you know","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3335s"},{"start_seconds":3344,"text":"optimism arbitrum scroll whatever mhm and once you have","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3344s"},{"start_seconds":3351,"text":"that then you can verify all these proofs just on on our contracts on each of these I see I see I see so they're","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3351s"},{"start_seconds":3359,"text":"basically just like a regular smart contract in each of those um later twos yeah just a regular smart contract um it depends a bit on the bridge structure so","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3359s"},{"start_seconds":3369,"text":"for let's say arbitrum or scroll Ork sync yep the bridge structure is uh via message passing from L1 so what we have","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3369s"},{"start_seconds":3376,"text":"to do is just message pass a commitment to our MMR I see and we just verify against that I see I see uh for optimism we can also do that and there's some","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3376s"},{"start_seconds":3384,"text":"chance we can optimize a little bit because on op stack you can access L1 just natively uh right right right yep y","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3384s"},{"start_seconds":3393,"text":"that that is very cool um and excited to see that that launch yeah um yeah other enough I think","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3393s"},{"start_seconds":3401,"text":"we covered most things went pretty deep actually yeah yeah yeah okay I think then it's time to wrap up and again","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3401s"},{"start_seconds":3408,"text":"thanks e for joining me on another uh episode of the white board session and yep thanks everyone","url":"https://www.youtube.com/watch?v=TZxw_SxnIRk&t=3408s"}],"youtube_url":"https://youtube.com/watch?v=TZxw_SxnIRk","url":"https://near-pedia.xyz/videos/TZxw_SxnIRk"}