{"id":"jM-om3AqH94","title":"Whiteboard Series with NEAR | Ep: 40 Part 1, John Adler from Celestia (previously Lazy Ledger)","description":"John Adler, Chief Research Officer & Co-Founder of Celestia (previously Lazy Ledger)       (  / celestiaorg  )  discusses with Alexander Skidanov, Co-Founder of NEAR Protocol (  / nearprotocol  ) about the technology behind Celestia (previously Lazy Ledger)\n\n------ About Whiteboard Series --------\n\nThe Whiteboard Series with NEAR is a set of video interviews with Founders who are building scalable solutions for Blockchain.  We deep dive into their story, what they're developing and how it is helping the ecosystem. \n\nFollow the latest from NEAR Protocol on, \n\nWebsite: https://nearprotocol.com/\nDiscord: https://near.ai/discord\nMedium: https://near.ai/medium\nTwitter: https://near.ai/twitter\nGitHub: https://near.ai/github\n\n#WhiteboardSeries #Blockchain #FutureIsNEAR","channel_name":"NEAR Protocol","published_at":"2020-10-20T00:00:00.000Z","thumbnail_url":"https://img.youtube.com/vi/jM-om3AqH94/hqdefault.jpg","transcript_text":"uh hi everyone this is alex from near with me today is john adler chief researcher and the co-founder of lazy ledger we will talk about laser ledger today and john would you like to introduce yourself and give us an overview of what lazy legendaries and technology behind it sure yeah so as you said i'm the chief research officer at lazyledger and i'm a co-founder uh so i do protocol specification and applied research uh so i guess i can start with uh i'll move this over and i guess i can start with a kind of a brief overview of what lazy ledger does and then we can start talking kind of about the techniques we use to get there so lazy ledger is essentially a blockchain that is specifically designed and optimized just for data availability throughput it doesn't do any execution at the base layer rather it just orders messages in other words just zeros and ones it just orders them through the consensus mechanism and then uh applications can run on top of lazy ledger and execute over the ordered messages okay are we ready to start talking about the fundamentals yes absolutely yeah so this is a kind of a terribly drum drawn blockchain uh we all know you know what the blockchain does you know each each block header points to to the previous block uh and let's see if we can draw the pencil and each block is composed of two parts so here is the block header so this is the header and this is the body and the body consists of a list of transactions you know transaction one transaction two and and so on right uh in in in some in some order uh usually it's going to be in you know particular some topological order uh some other blockchains have proposed other things like you know uh lexical ordering and stuff but you know there's going to be some ordering of these transactions and there's going to be a block header and the block header uh usually consists of a pointer to the previous block and it'll have a route of transactions and a root of the state so let's kind of add some text here so this one here is going to be a transactions route and here you're going to have a state route and the text is tiny i don't know if is that big enough or do you want me to make it bigger uh let's make it bigger i think bigger would be better size bigger is that better yes transactions that makes this bigger state route here's your body and this over here is your blockchain right i don't know how do you how do you move things just uh i use this select tool v ah actually okay okay this doesn't make sense great so this is the state route and this is the transactions route over here right and every block header has this now there might be some other some smaller routes in there you know there might be a route of receipts there might be some proof of work non so there might be a list or a route of votes if you're using a proof of stake style protocol but those are kind of not relevant to what we're going to discuss uh so in uh in a normal blockchain what will happen is you run a full node and the full node fully executes every single transaction in in the block body okay it goes through the transactions well one after the other and it fully executes them and then it uh make sure that you know the transactions in here match up with the transactions route and then make sure that the computed state at the end of the block matches up with the state route so you know it's fairly straightforward and let's pretend that you have an attacker so an attacker will create a longer chain of blocks arrow forget my very uneven arrows but hopefully that'll suffice uh oh so let's undo this this block should come from the side there's a block over here there's a block over here right so the attacker you know forks off of over here somewhere and he creates a longer chain of blocks so the attacker has more than 51 percent or more than 50 of the hashrate uh if all of these blocks are valid then the full nodes will follow this as the longest chain right they'll do a reorganization they'll follow this along this chain now there's you know things that might happen there you know penalties might be enforced some people might you know decide the coin price to drop or you know the the cost of the the price of the the hashing hardware should drop stuff like that uh that's not really too important to to our discussion here but you know the way that consensus protocol works is they'll just follow the longest chain so if all these blocks are valid you know the the full nodes are going to follow this and the light nodes will also follow this chain right uh light nodes just check the proof of work so they just follow the follow the longest chain and they don't validate transactions in the block body okay so now this is where things get interesting what happens if let's see if we can draw with a different color let's use red right so there's some transaction in here that's invalid uh the miner decides to insert you know there's cool this collusion that's these looting miners that have you know more than 50 of the hash rate they decide they're going to insert a transaction there that you know gives them a whole bunch of coins like let's say a billion bitcoins something like that right and so there's obviously an invalid transaction you can't have a transaction that has a billion bitcoins but they do it so full nodes will reject this this this fork here obviously because this is an invalid transaction and full nodes will follow the longest valid chain not the longest chain uh but light nodes will still follow this chain it's the because light nodes just follow the longest chain they don't care about transaction validity right so the the light nodes will follow follow this chain so now you see that there is a problem because if many users run light nodes and only a few users a few user users run full nodes that means the light nodes can be tricked by this attack which is you know especially dangerous so the reason that bitcoiners and the bitcoin philosophy is everyone should run a full node is because of an attack like this is that you know everyone who isn't running a full node could end up getting tricked and if everyone and all those people get tricked they could still continue using bitcoin and we don't really have a way of enforcing a penalty to the miners that have done this reorg right like the miners could just do a reorg and then if the price of bitcoin doesn't drop if the hashing hardware or if the hash function doesn't get changed in response to this attack then the miners have just executed an attack and there's no penalty for it there's no cost of the attack so they can this means they would be able to attack bitcoin anytime they wanted for free which would obviously be a terrible conclusion so this is why they encourage everyone to run a full node uh because bitcoin doesn't have a way of protecting against this so can we do better do we have a way of protecting light nodes uh from this kind of attack and the answer is is yes and and two steps so we'll cover the first step the first step is fraud proofs so let's see if i can so so before we dive in uh for me to understand the uh the without an ability to to insert an invalid transaction right or i guess a more general case sense it is not just an invalid transaction it could be that all the transactions are valid right but the state root uh does not correspond to the to the output of them right that would be data that would be like a block withholding no no what i mean is that the the block like let's say the block contains 10 valid transactions uh the state route is incorrect then the full node would also reject it right they will validate it yeah yeah yeah yeah yeah but the light client will still accept it right yes yes so the the miners they can attack the previous attack you described with the longest chain uh does not contain invalid transactions this is still a valid attack that the miners can execute right yeah i guess i said transactions or transactions but relationships transactions plus the state route because you know the state route defines the state and transactions just modify the state so you know instead of having an invalid transaction they can just directly modify the state in an invalid way by just changing the state again so yes but my question is more of so without so so let's say everybody is running full node right uh the attacker which has 51 percent of hash power can still attack the attack you described first right they will create a longer chain and they will double spend for example oh yeah they can still do that so fraud proofs don't protect against that yes so so we have effectively we're saying that the attack with an invalid transition is way more dangerous uh because it allows you to apply state transitions which are completely invalid while the the longer the longer chain or like reward attacks while they still dangerous they're less dangerous because it is still on the valid transactions that can go through is it the idea or why why we're thinking that yeah so so the reason is that uh we want to move beyond the model if everyone has to run a full node for the system to be secure that's that's essential we want to move beyond uh if if let's say you know 99 of bitcoin users and traders and investors and everyone you know involved in bitcoin ran spv knows ran light notes you know if someone attacked the system the full nodes wouldn't have any way of proving that an invalid transaction was included in a bitcoin block to any of those people so you know the bitcoin economy would just continue the so the attacker essentially has you know minted himself a bunch of bitcoins for free right and they can do this do do this whenever they want so we need a compact way for people who are running light nodes to have some sort of guarantee of block validity does that make sense yeah yes what's david yeah so now let's see how do i okay there we go so i'll push this up uh lion so line which is red okay so the first thing we need is one broad proofs and i'm going to talk about the specifically the state transition fraud proofs there there's one other scheme for the utxo data model but for here we're going to talk about the the state transition fraud proofs okay so how do they work so we have our blockchain again we have arrows and then we have again our block headers right so our block headers have you know in here they have the state route here's another state route right and again the state route commits to or it's the merkel root of the state tree uh state trees can be represented multiple ways in ethereum you have the merkle patricia tree all those systems have a sparse merkle tree and and so on but you know essentially just the root of the state uh and we want to make sure that uh going we want we so we want to have a way of proving that the state root of say the next block or this yeah let's say the state root of this block here this the state of the next block we want to prove that this is invalid assuming the previous one is valid right so let's draw some let's draw some check marks so this one here the state road is good and this one here as they do it is bad right so you know they do they do they do an attack by either inserting an invalid transaction or the stage is just invalid and you know they've just given themselves a billion coins in the state you know and then so did that as leaf in the state all right so so this is the kind of thing that we want to prove uh by induction we can by induction this is sufficient because we always know the state route at the genesis block so as long as you as long as you can show this for one step then then by induction you can do this anytime you want uh so how would we do this uh the oh let's see pencil so this block has a bunch of transactions so we know that we know that if we start at this stage root here and we execute these transactions if this state route is not what we get then that means this block is invalid in some way do we agree yes great uh so the name that the you know the obvious naive way is saying well just give someone a block and they just execute all the transactions and compare the state routes right they have a pre-state and then there's a post state and the post state that's committed to here in this block doesn't match up with the post state they compute then that's that's that's an invalid block right there's your fraud proof uh so this is kind of the native way of doing doing a fraud proof they don't have a pre-state right a light node does not have the state oh yeah yeah so the light node is given the pre-state route over here right uh so in order to in order for the light node to know so in order for the light node to be able to execute these transactions the only thing it needs to know is the pre-state that is touched it doesn't need to know the entire pre-state all right so the first thing that you give which is thank you for bringing that up so what do you need to give to the to the light now so the light node get has previous state route it's also given merkel branches to previous state elements that are touched and it's given the and it's given you know this this this the well has given the entire block so it's given you know the prostate route pro state route and you know all the transaction i'm using mark down here which ones okay and it's given the transactions right and in the in the nav case uh and then you know if the miracle branches aren't sufficient then you know as it executes a transaction it's going to say well i'm touching a state that isn't part of part of this part of these merkel branches you know the proof you've given to me is insufficient right so that means it's not a good proof right so if it executes all the all the transactions successfully and then you know the merkle branches are sufficient then at least you know the fraud proof itself is is correct you don't know if it's uh it's correctly formatted okay so essentially what you're doing is you know you run through all the transactions then you check to make sure you know is this is this post date rule different uh so this works but there's an issue uh what's the issue uh well it's it's heavy well yeah it's heavy because you have to execute every single transaction right right well i guess the other issue is that when the access to transactions you you won we might not have access to the transactions themselves that's part two so in this case let's assume that they have full access to the transactions i see all right so so this works but the problem is that as you said it's heavy executing all the transactions could be expensive especially in a resource-constrained environment like a blockchain right so can we do better the answer is yes so draw a line draw line so can we do better the answer is yes so what we do is uh let's see pencil so here's our oh i can write here's our transaction route right it's the merkle tree off some transactions right so here's transaction one here's transaction m right there's a bunch of transactions in between dots uh so what we do is we say well what happens if after this transaction i also put inside this tree i just put some enter need yet state route and see how do i select select let's move this over here yeah so after every sun every single transaction i'm going to insert an intermediate stage this is the naiva you can you don't have to do it after every transaction it could be after every some parameter number of transactions it could be after a certain amount of gas but in naive case we say after every transaction so enter immediate state root right and then you commit to this into a tree so instead of a transactions route now you have a data route so this is a route of a route of where the leaves are you know transaction then the intermediate stage after executing this transaction then the next transaction then the intermediate stage after executing that one and so on right and intuitively that makes sense because each transaction is a state transition and a block is a group of state transitions so when we're doing this this naive fraud proof over here let me fix this typo but when we're doing this naive fraud proof we're essentially doing a state transition fraud proof but over a block right we're saying here's the previous state route here's the next stage route execute a bunch of state transitions and then you know the state routes at the end should not match up so we can do the same thing it just we include a state route after every transaction and then we do the same process but instead of executing all the transactions in a block you just execute one transaction does that make sense yeah that makes perfect sense yeah so and then you give exactly what you give here except instead of a list of transactions you just give one transaction right and then again you just run the transaction through uh so this is when is there an eraser erase let's erase this yeah so this is how you do fraud proofs uh so now you brought up a a very good point which is what happens if these transactions here what happens if the majority miners just hide them what happens if they just don't show them to anyone right they show the block headers so the block headers are still being sent out and light nodes will still follow the block headers but no one can actually construct this fraud proof because no one knows what's inside the block right and in fact they don't even know if it's invalid it could be a valid block it just hidden right so so how do we deal with this and this is where the more involved data availability proofs come in uh which is where we're going to probably spend a bit more time and and the existence of data availability proofs is something that uh you know the bitcoin research community has generally considered not possible and that's why they didn't consider fraud was possible exactly because of the problem of data withholding but they are possible with with pretty decent guarantees with pretty weak assumptions which is which is what we're going to discuss here so data availability proofs so this is the data availability proof scheme that was formally formalized by mustafa bassam and alberto sassini i think and vintella buterin uh in a paper i think it's around september 2018 or yeah so i think around september 2018 or october 2018 somewhere around there so it's been but you know the idea of you know doing this fraud and data availability proofs uh last formally has been has been around for a bit longer so this is the scheme that we're going to be using at lazy ledger it's also the scheme that is used for serenity or that has been proposed for serenity uh so how does it work so let's start with kind of the most naive way so this one here is going to be like uh like a straw man the most naive way right straw strong the data availability scheme right so this is like as naive as as you can imagine so what we're going to say is let's let's draw a rectangle let's take the block right let's say this is the block i'm going to draw it out in a nice rectangle so that you know we can we can chunk it up and stuff okay so let's say i chunk it up into eight pieces like so is there a way for me to copy this by any chance let's see select select i can copy nice paste this will come and this will be useful let's put this over let's put this over here i'll need this later okay so this is now this let's consider this to be our block so the uh you know you have all the block headers but you don't have the block bodies right so let's consider this to be the the block body right of one of our blocks so what you could do is you can say well i'm going to i'm going to let's use blue blue is a good color all right let's say i'm going i'm going to randomly sample like i'm a light node uh not a full this doesn't really apply to full nodes again because full nodes fully fully download blocks right they they don't have a problem with data withholding if they see a block doesn't have a block body then they say okay there's an invalid block i reject it so this is really only for for the purposes of light noise right so uh how can a light now can convince itself that the data is available so well the light node can say well i don't want to download the full block because that would make me a full node so what i'm going to do is i'm going to download just a small portion of the block right you know and let's say there's eight transactions in this block right if there are eight transactions in this block you know the and let's say the node randomly samples three the light node right so it's going to sample this one and let's say this one and then this one right uh right it just it just randomly samples three this is again this is the the naive naive case right but now what happens if the attacker you know the let's say there's a guy here with horns because he's an attacker right the attacker hides just this one transaction right if he hired just this one transaction then a light node that does this data availability check has convinced himself yes okay i checked these three transactions i've been given them they're valid they seem to be valid transactions right uh therefore i assume the block data is available right and another line now is do this too the chance that a light note asks for this one transaction and doesn't get it because you know the hacker's trying to hide this the chance that i'd find the chance that uh it lands on this would be you know what three three out of eight or whatever right uh which is you know in this case you know we're using a very large number it's like you're sampling half the block but you know imagine that you sample you know let's say it's a thousand transactions and you sample five right then in that case you can see the probability that a light node finds that you know this thing here is being hidden is very very small right uh so this is you know not a great scheme because the attacker can only need to hide one transaction in fact they only need to hide one byte right they just need to hide one thing and then the entire block you can't you can't you can if it's hidden then you can't show that you know you can't show that this transaction is invalid if it's hidden if you don't know what the transaction is right you can't construct one of these state transition fraud proofs because the one of the point of the fraud proof is you need to execute a transaction if the transaction's hidden you can't execute it so uh so this you know this generally is not a great scheme because the chance that a light node will actually find out that this block or that part of this block is hidden is very very small so we want something better so how how do we how do we do it let's let's do b let's use a razor coating and again we'll make this naive uh i guess i could say we can say 1d i want 1b 1d naive so let me scoot this over a bit let me copy this because we'll need it again and move this here okay so what we're going to do now is we're going to use a razor coating so the the way razor coating essentially works is that with while it uses math which we're not going to cover here but essentially you can think of it like let's say these four are the original data that i have just just these four what i can do is i can actually compute some parity shares so here's my here's my original data red general beta and here's the parity so i'm i'm given this original data i'll compute some some parity data and how much parity data you get is dependent on some parameter you can you can change it so it doesn't in this case as you can see it's one to one it doesn't have to be one to one it can be it can be different uh but uh essentially you have this original parity data now right uh so as you can see you're getting more data so this is bigger the original data is fours four chunks the parity di data is also four chunks so total you have eight chunks uh and you know depending on your parameter choice uh essentially what uh what this gives you is if you can recover four chunks out of these eight any four you can recover the original data and of course you can also recover the parity data because you just recompute the parity data right so this is this seems like it's a it's kind of solves our problem because now you no longer have the problem you no longer have the problem of the straw man scheme over here up here uh the strongman scheme again is that an attacker could just hide one of these one of these chunks over here one of these transactions and you would have to the light node would have to specifically request that transaction right otherwise it wouldn't know that something is being hidden in this case if you have this how let's say you have this example where you have four and four how many of these chunks does an attacker have to hide to be able to hide the block yeah they need to hide five they need to fire five right if they hide three it doesn't matter which three they hide if they still broadcast the other five then or they even let's say they even hide four and they broadcast the other four it doesn't matter which four they broadcast the entire block can be reconstructed right the original data can be reconstructed and from there we can also recompute the parity data so in the entire thing so they need to hide more than half in this in the symbol example it's five right uh so we're going to draw draw that out let's say the same red right so an attacker hides five five right an attacker hides these five shares right uh and i didn't draw that properly let's undo this that's one attacker hides one two three five like this yeah that's better all right so attacker hides five they broadcast out the other three right uh now here's kind of where where some of assumptions assumptions come into place so one thing that's important is we assume that there's at least one honest full node in the network that the light nodes can connect to and we assume that they can communicate with each other so there's no eclipse attack the reason this is important is that you know the light nodes and the full nodes can't talk to each other then you know the full node can't even construct a fraud proof right uh so the light node sample stuff but you know there's no fraud proof random thing and then what are you doing right uh so we we do make that network assumption so what this means is essentially if the attacker broadcasts out any share we assume that the entire network is eventually going to hear that share it might take a bit of work but we assume that the entire honest network will eventually hear of that share right right so they can't like you know oh they can't hide they can't hide say like these two over here for one full node and then they used to be for the other full node and then for another full node hide these five they very much have to hide the same five right uh okay so we have to say this construction so now our light node comes along and the light node does some samples right so the first time it samples uh it will get tricked that the data is available if it lands on an available chunk right like if if the light node samples this trunk here then it says okay that chunk is available i've been given it right oh oh i guess i guess one thing to be to be to make clear is this uh this erasure coded version of the chunks of original and parody data gets committed to in the block header so right yeah this is a merkle root so we marking this obviously although if you just have the data floating around then the light node samples it doesn't know what it's happening right so okay so when a light node samples this chunkier it has to get a merkle proof from the block header to to the trunk just over there okay so you know if a light node samples this trunk it says okay this trunk is available uh so if it stops there then it would be convinced that the block is available and it would have gotten tricked right so the the first time on samples what's the approximate probability that it got tricked it will get tricked with the three over eight right uh yeah sure uh sure well let can we let's simplify that a bit just well then perito minus one over two let's assume yeah apparently minus one over total let's assume that the the large number of chunks it'll be it'll be approximately yeah then one one half yeah one half right because it's uh we assume a large number of chunks great so so round one count one uh you have the probability b is approximately half right okay so now it does a second round of sampling because you don't stop there and one round of sampling is is pretty terrible so it does the second round of sampling uh without replacement uh so what's what's the approximate probability that it has gotten tricked after k around so it's going to be one over two to the k right yeah so this is one corner uh with with around with around m or k oh sure uh p is you know one over two two to the k right uh so as you can see the probability of it getting trick decreases exponentially so you don't and one thing that's interesting to note here this probability decreasing of getting tricked is it in any way related to the number of chunks it is well well it is it is important that parity is one to one with the original data right oh yeah yeah yeah yeah yeah but we assume the parameters the system parameters set up that the parity and original data are one to one yeah yes uh well there are a couple of things so so one is if you assume that the number is sufficiently large right so one second is a good estimate then it should be independent of the number of chunks but yeah but also i guess something we didn't touch on is we assumed that the adversary decides on what to to to reveal in advance right which i guess it doesn't have to uh well again is that we we assume that the network set up that you know if uh if a chunk is distributed to an honest full node it will get distributed to all honest full nodes eventually right but if i'm a light node right and i'm sampling and i just happen to be connected to several non non honest nodes right i will sample like i will start sampling uh and then adversary as they receive my request for for for for a share they will decide to to reveal it right or wrong we assume that the light nodes are connected to a full node an honest full node i see and we're also saying that if the so so then i guess what is not uh one assumption we did not discuss is so so let's say i'm a light client i'm connected i'm a light node i'm connected to let's say a dozen 12 12 full nodes right so so i chose to sample a particular share and i chose a particular full node to sample it from so if i fail to sample it from it what do i say do i say that the date is unavailable or do i try to sample from another full node you continue trying until some parameterizable timeout right so therefore if i'm connected to any full node which is controlled by adversary eventually i will sample all my shares from that adversary adversarial node right and so adversary can choose uh to specific sure but the shares oh well we assume the light nodes aren't under eclipse attack if they're connected to at least one honest full node then they're not under an eclipse attack right but in this case i'm saying let's say i'm connected to exactly one malicious node and everybody else i'm connected to is a full node which is honest right so i'm saying i want to sample let's say the parameter is five i want to sample five five shares out of a thousand right so i go to the full nodes uh and the full and let's say that the uh so okay so the way i see it is adversary first sends me the hash of the block right yeah so at this point from someone i heard that the block exists other full notes haven't heard about it yet so i try i start sampling the shares and all other full notes tell me well i don't know the block i'm not gonna tell you the share so i keep on trying and i end up trying to download it from the malicious note and malicious note at that point decides for the first time to reveal the particular share right so so maybe it will not be able to check all the light client because all the light clients collectively will probably hit all the shares but it will be able to check one particular one so let's say it wants to coinbase right so there's specific in our coinbase is coinbase goes on and samples and ultimately coinbase ends up sampling from uh from the adversary an adversary reveals specifically the shares coinbase wants to see uh so we also assume a network model where queries can be made anonymously as in you can you can't associate who is making the query uh in practice the reason that this is an okay assumption even if we don't use things like tor and whatnot is that say a coinbase they can run two full nodes or they can run 100 full nodes and you might know one full node is coinbases but you don't know all of them are operated by a single entity yeah well in behind the scene right we're checking the light clients so i guess this will not be running a light client well they wouldn't be running a like line right uh but like an end user is like an end user okay they run one for one light client but how do you know they're not running two like clients one on the phone and one on their computer that belong to the same person that can and they can the two nodes can communicate with each other off-chain and you know the the the you know the the human is essentially a very good way of you know having private communication between two computers right like that you can't you get you can't you can't really it's pretty hard for a computer to spy on human typing and a keyboard here and then you know typing on the keyboard there yeah okay so with those assumptions uh because because i see you have the third one drawn right so we we are about to find out something bad about this model so yeah oh yeah it's not at all obvious to me what is wrong with it with the assumptions we discussed so i'm i'm uh i'm excited to hear what what is it we we we will because you know this is that's the name yeah so so this is kind of a few and interesting things to note uh this uh the chance that a light node can be tricked is completely independent of the block size what this means is the number of rounds you need to do is constant it is not you know big o of n where n is the block side there's not big o of you know some function of n it's big o of one uh with respect to the number of transactions in the block or you know the number of bytes the number of gas or whatever whatever you want right uh this is constant uh which is pretty amazing because it means that uh you you can have you just have to do a constant number of samples and and each of these sampling operations is you know logarithm logarithmic in the size of the size of the block because it's a merkle it's a merkle branch too to the particular share right uh so this is you know a very very cheap operation uh which is great but now here's kind of where the problem is let's say i have one light node right i have one light now the light node samples three shares right uh well this example is bad because then the number of shares is pretty small right uh let's say let's say the lightning samples two shares just again the the the small number so it makes things a little disproportionate but you know those light nodes samples two shares right uh so let's say uh pencils use green right so let's say the light node samples the share right uh and in fact the light node could sample the share right okay you just have one light note uh a bls green is a terrible color choice because maybe a non-trivial number of our viewers are red green color blind but these x's here are green so you know the light note samples these these two shares uh just just as light now and there's not a single other note on that in the network let's say right or you know this could be the full node right because we assume there's one on a full node uh so you know the full node tries it's best to by asking the network and everyone around you know the full node tries to reconstruct the whole data somehow uh if it can't directly download the original data it has to ask the network for you know the shares individually but it should be able to reconstruct the block so let's say this you know this this full node is is you know you know out there making requests and you know it downloads these these two these two so that you know uh this is this is what it gets uh do can we reconstruct the block using only these two shares uh no no right because you need four yeah uh so the problem is that if we fix even if we fix this let's say you know we set our k is the two at some in some fixed number uh okay so you have one you know a light client or a full node or whatever you know they download these two there's no guarantee that you'll be able to reconstruct a block if only one client does these requests right right but wouldn't full node uh the full node will try to fetch all the shares right yeah so the full node will try to fetch all the shares yes uh but the problem is okay the phone does but the full node can't really prove to a live client that it hasn't been able to fetch all the shares right but but uh so the way i see it so far is that the the chunk sorry the block could either be available meaning that it does it did broadcast so so effectively uh let's go through the timeline right so the block was published for the first time so so uh because we assume that if some message was sent over the network it will eventually reach everybody so eventually everybody learned that the block was at least uh announced meaning that the header was announced yes so after that everybody will attempt to sample some shares and again we're saying that the sum share was published on the network eventually everybody who tried to sample it uh will be able to to receive it right so with this assumption it seems to me that with a sufficiently large key uh for every available block every light client and every full node in the system will know that it's available and moreover the full nodes will actually reconstruct it because fullness no no so they can convince themselves as available uh but there's a problem you might not be able to reconstruct the original data right and okay and this is very nice this is like strongman example let's say you have exactly one node that's doing this sampling right i see the sample these two shares yes right but even then is this not a light client or a full client it doesn't really matter because if it's a full client uh it will not it will not try to fetch case shares it will try to fetch all the shares right the phone number will try to fetch all of them okay so let's say there's a like line right uh but if it's a light client uh then then there's not a single honest full note in the system the phone is still honest it's trying to do its job but it can't so so so there's another assumption here uh the the the reason the reason is confusing is because there's another assumption which is what we're going to talk about so let's say one you know one honest phone though that's trying to do its work and you have one like client like client shop samples these two shares it sees they're available and there's only two shares that are distributed right but sorry for interruption but consider the following model right let's say that the full client will not distribute any shares until it has the full block right so the full node does not have full block i don't know the full node the phone should all distribute shares even if it's only seen a few of them right yeah right and in the in the model but let's let's say we're changing the model right we're saying the full note will not be distributing shares until it has the full block oh no but that'll be terrible because then full mode would never be able to reconstruct the block unless they've been given a full block so full nodes can obviously gossip individual shares the full nodes can gossip individual shares like if the only way a full node would be able to broadcast anything out outwards is if it received a full block that means an attacker could just not ever show a full block and only do like right only give out individual shares and then full nodes would never would ever send an outgoing message right so obviously of course of course you cannot break every uh like it will not be a productive time if you will be breaking every every modal so let's do the last one and and then we will proceed with the yeah so so notes always send they brought they they re gossip to other full nodes but they would not respond to light clients unless they have all the shapes they can also respond to like clients too right but i'm saying how will it break right so no no no no no i think the reason is that the assumption seems very obvious so can i go through the assumption yes and then when i say it they'll seem very obvious because like oh obviously this happens in practice so the the the attack is is very contrived but it's still an assumption that we have to make because we have to make all our assumptions let's assume there's one full node and there's one like client like client samples these two shares they're this is this is bad i shouldn't put this here i should like say let's say sample this share and then let's erase this just so we don't get confused now the like client samples these two shares it sees that these two shares are available right and let's say there's only this an imaginary world there's one like client samples these two shares they're available right uh and then the full node tries to reconstruct the block also seeing the full node can also only see these two shares but the so the like client is convinced that the block is available but the full node can't reconstruct the block right and that's the problem right but now what happens if we have like 100 like clients 100 like clients each sample two so maybe one samples these two one samples these two one samples these two and so on and then you know if the block isn't being hidden then a full node can reconstruct it by asking around for the shares right so the trick is we assume there's a minimum number of flight clients that are making these requests i see and those numbers can be fairly small the the paper gives numbers i think around 100 or something so you know it's a very it's a very weak assumption uh obviously in practice for any reasonably sized network you're going to have 100 nodes right especially light nodes so this isn't a very strong assumption but it is something that we have to point out is that you do need a a certain number of nodes proportional to the block size uh doing doing random doing this random sampling does that make sense yeah that makes sense yeah so so yeah so that's always confusing is because it's it's a it is kind of a contrived thing that contrives thing that doesn't really happen in practice so you know assumption here assumption uh some number of light nodes and we know that this is going to be proportional to block size right right and so is it specifically the number of light client nodes or is it the number of light or full nodes which are honest in the network uh so let's have that many full nodes but not a single light client will it work or we specifically need that many light clients uh if you have this number of full nodes also doing they can pretend to be like clients and do it then do these requests so it's sure the number of notes okay we can simplify the like number of nodes really number of honest nodes oh yeah of course yeah this is yeah honestly number of honest notes yeah okay great so now why why doesn't this work why why is this on each game uh also it seems to be we're running a bit out of time from the schedule uh is that an issue no that's not an issue oh yeah perfect i i have some i have some time so uh so what's the issue the issue is if this is erasure coded correctly then we can do all this but what happens if this is not erasure coded correctly what happens if the block producer just doesn't they you know they either don't erase or code it correctly or you know they commit to they commit to something incorrect because again this has to be committed to in some merkle route would you mercalyze all these shares what happens if they just don't commit to it correctly uh in that case you can't do that you can't do this right uh or or rather it's like even if you do this and then you know the block is available you might not be able to reconstruct the data nicely so what you have to do is if the razer coding is incorrect you need a fraud proof so how do i prove that these parity shares are do not uh are like are not correct based on the original data how would i prove that so so here you would have to share at least uh at least four shares right let's assume that they can reconstruct the data yeah let's let's assume that you know they reconstruct the data so you know a full node reconstructs the whole thing right well i'm saying the proof would have to be the size of the number of yeah right yes right so the proof is essentially yeah the proof is essentially you give the entire original data and you give the para the parity shares right or you give you know the merkle root and the original data or four of these right and then you just say okay compute the parity shares and then you'll see that you know the merkle root doesn't match up so the problem is that a fraud proof of this that this is the that this is being computed incorrectly is the whole data which exactly you know this is basically saying just download the full block and then then you can see that the data that the parity shares haven't been computed correctly which is exactly what we're trying to avoid right we're trying to avoid having to download the whole block uh because line nodes are resource constraint so uh what what what do we do so this is where the 2d scheme comes in so see this is razer coding duty oh this i realized that this thing here is probably not useful anymore so i can probably erase it we can replicate it uh seven times i could but it would still look it would probably be way too big so let's let's do this let's do a smaller table let's do let's do like oops let's drag this down okay let's do a square and then some lines and this is this is this is it so what we're going to do is we're going to arrange our original data in rows and columns so instead of being just like a single a single list a single array we're going to arrange it in rows and columns so this thing here is our original data right uh so what we're going to do is for each row we're going to compute the parity share the parity shares for that row so we extend it this way right so here's the parity shares of this row i know there's supposed to be lines here but i'll not draw them for simplicity all right so again for this row we compute the parity shares and so on now for each column we're also going to compute the parity shares of this column this right and then you can do this you know this the third square if you you know if you copy one of these two or if you you compute parity shares this way it doesn't really matter right just this is kind of an implementation detail but this is also going to be some sort of parity shares right so this is important mentioning here which is obvious for people with the background in math but it is not as obvious otherwise is that it doesn't matter how you compute this fourth square whether you erase your code columns or azure code rows you'll get the same values right yeah so like a particular value yeah yeah so so that is not immediately obvious i guess it requires understanding of some math behind yeah but like ultimately this this doesn't matter what really matters is that you know as long as everything is is a parody in some way then that's all that all that matters uh yeah so even if it were different it wouldn't matter just you know you just say you know this is this is this is the direction i choose essentially so this is your original data so we note that uh the 1d scheme our parity shares are twice as big as our original data right here our parity shares are three times as big as our original data right so each of the side here is like square root of block size square root of block size so the length of this big square would be you know two square root of block size and two square root of block size right so let's type this out so this one here is you know oof this one is square root and let's say n is n is a block size right this one here is also squared and there's also the square root of n and this one here is also square root of n right so in total the length of these things is 2 square root of n uh and then what we're going to do is we're going to commit to a merkle root for each row and each column so in total so with this one here we just need one one merkle root right we just take these and we just microlight them right so one marker root here we need to mark the root for each row and each column so in total our commitment here is going to be 2 times 2 times 2 squared of n right because this is 2 this is a two square root of n and then we have we have two of these right so so in total it's four is four square root of n oops per square event so this is our commitment size so this one here needs to go into the block header now we can have like a super compact commit commitment where you mercalize this so you can kind of represent it as like a two like two in two stages but ultimately uh nodes that want to do these data availability checks need to download this four squared event commitment on commitments uh so what this means is that this does increase the size of the block header uh it means that now the block header has some overhead that's proportional to the square root of the block size as opposed to just being constant sized right and it's assumed that all light nodes will have to download this again the super light nodes can just download the merkle root of these and not do data availability checks and just trust it on a majority uh but you know the the secure light clients or that do data availability checks uh will need to to download this four squared event commitment okay great uh so now that we have this uh how many how many shares does an attacker have to hide to prevent uh to prevent someone from reconstructing this the original data and therefore the full block approximately okay so approximately it will be so to reconstruct everything we need approximately n right uh of those little shares yeah yeah that's true yeah to reconstruct everything you need around n yeah where n is the block size right so so i will need to hide 3m right oh wait or do i need to hit n you need to hide n so n is sufficient i know it's confusing we can use ratios right here here the attacker hide half plus one right yes here here they need to hide three three fourths plus one right or like three fourths plus plus seven three chord for three three-fourths uh they have to hide let me draw the rectangle in red they have to hide this much right so it's one quarter plus one oh yes yes that's correct yeah so we and we can see is that if they hide let's you know let's say this is eight right if they hide five from this row you can't reconstruct the row if they hide five from this row you can't reconstruct the row and so on for the columns right but if they didn't hide these you know if they left you they left you a bit here if they revealed this one then you could compute the whole column and then from that then you can compute the rest one by one right so they kind of have to hide this uh for a further large enough for a large enough number now you know if if you have very light note and it starts you know random you know it starts rounding the sampling here here here uh for each round we'll do the same as before uh so here's round one what's the probability that a light node has been tricked that the data is available but it's not uh it's uh one quarter right uh the light node will get tricked if it lands on something that's being disclosed yeah it's going to be three quarters uh so our round two uh tries to sample again what's the probability now uh nine sixteenths yeah not nine or nine over 16 right so that so you you keep going right uh so we see it it doesn't decrease as sharply as the previous time but you know it does still decrease exponentially which is good so you need to do more rounds of sampling to get the same guarantees but it means you get a better guarantee elsewhere so that's a better guarantee elsewhere if we have to prove that the whole thing is erasure coded incorrectly note that we only have to prove that a single erasure coding computation was done incorrectly right which means the fraud proof is now a single row or a single column in size right do we agree which is just square root yep so now the fraud proof would be 2 square root of n as opposed to being the as opposed to being n with like the the size of the original data right so now so fraud proof is big o of uh square root n where n is our block size right over here up top the naive scheme the fraud proof is big o of n right so this is kind of this is kind of where where we see the amazing thing is that we now have a fraud proof that's sub linear in size and again if you only have the broadcast as fraud proof out uh if there's a fraud proof in the happy case uh the only thing you need to download is this commitment and then a fixed number of of samples a fixed number of sampling right uh so so this is kind of this is this is kind of the nice property is that the number of samplings you have to do is is fixed uh it's not related to block size at all uh so how would you increase let's say while the number of samplings is not related to the size of the block the uh the light header now is uh yes to the square root right yeah yes no yes it does so yeah so one of the trade-offs is the light client headers are larger uh so what this means is that if you want to kind of take full advantage of this you would want to have a smaller number of headers each of which have larger blocks right which means that generally you'd want to have slightly longer block times than what you would see in you know some changes that have really really fast block times right so instead of going for the one second block time maybe you want to go for the 30 second block time uh which will allow you to take bet to take more advantage of of this factor here right so that's one potential downside but you know the gains is that you have now secure light clients which is amazing because as before if the two choices are run a full node or absolutely no security uh that's not exactly a very good trade-off especially if you want your base layer to process many transactions where full node could be potentially expensive right right so now we have a third choice which is you can run a light client with data availability proofs and do this with sublinear cost and still be pretty damn secure so long as there's one honest full node out there which is a good choice right no one's forced to use this but now we have this option oh wait so well it's one oldest full node among our peers right so we need to you know no no eclipse attack yeah which which is you know clubs attacks are kind of hard to pull off maybe maybe not but yeah there's a is an assumption so uh so one thing we know is that if let's say we want to keep some we have some security guarantee parameter right security purity guarantee right so this is kind of like our guarantee that you know some some fixed fraction of light nodes aren't going to get tricked right so this is this is going to be proportional to the number of rounds right number of rounds that we set as a parameter times uh times the number of nodes doing sampling right so as the as the number of nodes increases then our security guarantee increases right right and as the number of rounds increases so does our security guarantee right yeah also i don't see your text until you continue let me oh okay uh so so you know we have we have some relationship here so if we want to keep our security guarantee fixed and we keep the number of rounds fixed right note that if we increase the number of nodes right we can actually increase the block size and have the same guarantees right all right so this is kind of an amazing property that you know regular like the we're not talking about lazy ledger yet but just just this property we have the amazing property that data availability checking uh allows you to have the same guarantees for larger blocks as you increase the number of nodes right know in a regular blockchain if you execute all the transactions then okay you increase the number of nodes you don't get more throughput right like every node still has to validate every transaction here every node doesn't fully fully check the entire block right every light node only checks the uh only only checks the fixed number of samples and you download the square root stuff so as the number of nodes increases we can have the same security uh for larger block size which is which is a really nice property okay so now now kind of the two pieces of the puzzle are together we have uh we have fraud proofs for any arbitrary state transition and we have a way for light nodes to make sure the data is available so that fraud proofs can be constructed right so there's kind of one additional side caveat here before we start talking about lazy ledger which is uh note that blockchains always need to check for data availability you may have heard some people talk about say of one block chains right where instead of using fraud proofs you use validity proofs which you know is like a succinct cryptographic proof that some computation is valid and you might think well the only reason you need this is for religious for fraud boost right you might say if you have validity proofs you why do what do you care if the data is available or not right uh the transactions are valid the the miners can't create a billion coins well you know that some state is valid it would be nice to know what exactly is the state that is valid that is the problem is that if a minor block producer in general makes a new block but doesn't tell anyone what the new state is like do you have a state route but you don't know what the state is essentially everyone's coins are burned you they can move their coins because they don't know what the state is so there is no such thing as no one blockchain all blockchains to be secure need some way of solving data availability and that means either have everyone run a full node and uh and like actually try to fully download the block it means making an honest majority assumption at which point what's the point of the validity proof if you're assuming that or it means doing these data availability checks right so there's no such thing as one blockchain you","transcript_synced_at":"2026-11-04T04:24:10.483Z","segments":[{"start_seconds":4,"text":"uh hi everyone this is alex from near with me today is john adler chief researcher and the co-founder of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=4s"},{"start_seconds":12,"text":"lazy ledger we will talk about laser ledger today and john would you like to introduce yourself and give us an overview of what lazy legendaries and technology behind it","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=12s"},{"start_seconds":20,"text":"sure yeah so as you said i'm the chief research officer at lazyledger and i'm a co-founder uh so i do protocol specification and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=20s"},{"start_seconds":28,"text":"applied research uh so i guess i can start with uh i'll move this over and i guess i can","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=28s"},{"start_seconds":34,"text":"start with a kind of a brief overview of what lazy ledger does and then we can start talking kind of about the techniques we use to get there so lazy ledger is essentially a","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=34s"},{"start_seconds":43,"text":"blockchain that is specifically designed and optimized just for data availability throughput it doesn't do any execution at the base","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=43s"},{"start_seconds":51,"text":"layer rather it just orders messages in other words just zeros and ones it just orders them through the consensus mechanism","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=51s"},{"start_seconds":59,"text":"and then uh applications can run on top of lazy ledger and execute over the ordered messages","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=59s"},{"start_seconds":68,"text":"okay are we ready to start talking about the fundamentals yes absolutely yeah so this is a","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=68s"},{"start_seconds":75,"text":"kind of a terribly drum drawn blockchain uh we all know you know what the blockchain does you know each each block header points to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=75s"},{"start_seconds":81,"text":"to the previous block uh and let's see if we can draw the pencil","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=81s"},{"start_seconds":90,"text":"and each block is composed of two parts so here is the block header","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=90s"},{"start_seconds":98,"text":"so this is the header and this is the body","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=98s"},{"start_seconds":107,"text":"and the body consists of a list of transactions you know transaction one transaction two and and so on right uh in in in some in","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=107s"},{"start_seconds":116,"text":"some order uh usually it's going to be in you know particular some topological order uh some other blockchains","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=116s"},{"start_seconds":123,"text":"have proposed other things like you know uh lexical ordering and stuff but you know there's going to be some ordering of these transactions and there's going to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=123s"},{"start_seconds":130,"text":"be a block header and the block header uh usually consists of a pointer to the previous block and it'll have a","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=130s"},{"start_seconds":139,"text":"route of transactions and a root of the state so let's kind of add some text here so this one here is going to be a transactions route","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=139s"},{"start_seconds":147,"text":"and here you're going to have a state route and the text is tiny i don't know if is that big enough or do you want me to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=147s"},{"start_seconds":156,"text":"make it bigger uh let's make it bigger i think bigger would be better size bigger is that better","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=156s"},{"start_seconds":165,"text":"yes transactions that makes this bigger state route here's your body","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=165s"},{"start_seconds":175,"text":"and this over here is your blockchain right i don't know how do you how do you move things","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=175s"},{"start_seconds":182,"text":"just uh i use this select tool v ah actually okay okay this doesn't make sense","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=182s"},{"start_seconds":189,"text":"great so this is the state route and this is the transactions route over here right and every block header has this now there might be some other some smaller","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=189s"},{"start_seconds":198,"text":"routes in there you know there might be a route of receipts there might be some proof of work non so there might be a list or a route of votes if you're using a proof of stake","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=198s"},{"start_seconds":206,"text":"style protocol but those are kind of not relevant to what we're going to discuss uh so in uh in a normal blockchain what","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=206s"},{"start_seconds":215,"text":"will happen is you run a full node and the full node fully executes every single transaction in in the block body okay it goes through the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=215s"},{"start_seconds":223,"text":"transactions well one after the other and it fully executes them and then it uh make sure that you know the transactions in here match up with the transactions route and then make","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=223s"},{"start_seconds":231,"text":"sure that the computed state at the end of the block matches up with the state route so you know it's fairly straightforward and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=231s"},{"start_seconds":238,"text":"let's pretend that you have an attacker so an attacker","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=238s"},{"start_seconds":245,"text":"will create a longer chain of blocks","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=245s"},{"start_seconds":254,"text":"arrow forget my very uneven arrows but hopefully that'll suffice","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=254s"},{"start_seconds":261,"text":"uh oh so let's undo this this block should come from the side there's a block over here","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=261s"},{"start_seconds":270,"text":"there's a block over here right so the attacker you know forks off of over here somewhere and he creates a longer chain of blocks so the attacker","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=270s"},{"start_seconds":277,"text":"has more than 51 percent or more than 50 of the hashrate uh if all of these blocks are valid then the full nodes will follow this as","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=277s"},{"start_seconds":286,"text":"the longest chain right they'll do a reorganization they'll follow this along this chain now there's you know things that might happen there you know penalties might be","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=286s"},{"start_seconds":294,"text":"enforced some people might you know decide the coin price to drop or you know the the cost of the the price of the the hashing hardware","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=294s"},{"start_seconds":301,"text":"should drop stuff like that uh that's not really too important to to our discussion here but you know the way that consensus protocol works is they'll just follow the longest chain so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=301s"},{"start_seconds":309,"text":"if all these blocks are valid you know the the full nodes are going to follow this and the light nodes will also follow this chain right uh light nodes just check the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=309s"},{"start_seconds":318,"text":"proof of work so they just follow the follow the longest chain and they don't validate transactions in the block body okay so now this is where things get interesting","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=318s"},{"start_seconds":326,"text":"what happens if let's see if we can draw with a different color let's use red right so there's some","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=326s"},{"start_seconds":335,"text":"transaction in here that's invalid uh the miner decides to insert you know there's cool this collusion that's these looting miners that have","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=335s"},{"start_seconds":343,"text":"you know more than 50 of the hash rate they decide they're going to insert a transaction there that you know gives them a whole bunch of coins like let's say a billion bitcoins","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=343s"},{"start_seconds":351,"text":"something like that right and so there's obviously an invalid transaction you can't have a transaction that has a billion bitcoins but they do it so full nodes will","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=351s"},{"start_seconds":360,"text":"reject this this this fork here obviously because this is an invalid transaction and full nodes will follow the longest valid","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=360s"},{"start_seconds":367,"text":"chain not the longest chain uh but light nodes will still follow this chain it's the because light nodes just follow the longest chain they don't","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=367s"},{"start_seconds":374,"text":"care about transaction validity right so the the light nodes will follow follow this chain so now you see that there is a problem because","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=374s"},{"start_seconds":383,"text":"if many users run light nodes and only a few users a few user users run full nodes that means the light nodes can be tricked by","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=383s"},{"start_seconds":391,"text":"this attack which is you know especially dangerous so the reason that bitcoiners and the bitcoin philosophy is everyone should run a full node is because of an attack","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=391s"},{"start_seconds":400,"text":"like this is that you know everyone who isn't running a full node could end up getting tricked and if everyone","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=400s"},{"start_seconds":407,"text":"and all those people get tricked they could still continue using bitcoin and we don't really have a way of enforcing a penalty to the miners that have done this reorg","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=407s"},{"start_seconds":416,"text":"right like the miners could just do a reorg and then if the price of bitcoin doesn't drop if the hashing hardware or if the hash function doesn't get changed in response to this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=416s"},{"start_seconds":424,"text":"attack then the miners have just executed an attack and there's no penalty for it there's no cost of the attack so they can this means they would be able to attack bitcoin","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=424s"},{"start_seconds":431,"text":"anytime they wanted for free which would obviously be a terrible conclusion so this is why they encourage everyone to run a full node uh because bitcoin doesn't have a way of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=431s"},{"start_seconds":440,"text":"protecting against this so can we do better do we have a way of protecting light nodes uh from this kind of attack and the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=440s"},{"start_seconds":448,"text":"answer is is yes and and two steps so we'll cover the first step the first step is fraud proofs so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=448s"},{"start_seconds":455,"text":"let's see if i can so so before we dive in uh for me to understand the uh the without an ability","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=455s"},{"start_seconds":462,"text":"to to insert an invalid transaction right or i guess a more general case sense it is not just an invalid transaction it could be that all the transactions are valid right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=462s"},{"start_seconds":470,"text":"but the state root uh does not correspond to the to the output of them right that would be data that would be like a block withholding","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=470s"},{"start_seconds":479,"text":"no no what i mean is that the the block like let's say the block contains 10 valid transactions uh the state route is incorrect then the full node would also reject it right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=479s"},{"start_seconds":487,"text":"they will validate it yeah yeah yeah yeah yeah but the light client will still accept it right yes yes so the the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=487s"},{"start_seconds":496,"text":"miners they can attack the previous attack you described with the longest chain uh does not contain invalid transactions this is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=496s"},{"start_seconds":504,"text":"still a valid attack that the miners can execute right yeah i guess i said transactions or transactions but relationships transactions plus the state route","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=504s"},{"start_seconds":512,"text":"because you know the state route defines the state and transactions just modify the state so you know instead of having an invalid transaction they can just directly modify the state","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=512s"},{"start_seconds":519,"text":"in an invalid way by just changing the state again so yes but my question is more of so without so so let's say everybody is running","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=519s"},{"start_seconds":527,"text":"full node right uh the attacker which has 51 percent of hash power can still attack the attack you described first right they will create a longer chain and they will double spend for","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=527s"},{"start_seconds":535,"text":"example oh yeah they can still do that so fraud proofs don't protect against that yes so so we have effectively we're saying that the attack with an invalid transition","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=535s"},{"start_seconds":544,"text":"is way more dangerous uh because it allows you to apply state transitions which are completely invalid while the the longer the longer chain","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=544s"},{"start_seconds":552,"text":"or like reward attacks while they still dangerous they're less dangerous because it is still on the valid transactions that can go through is it the idea or","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=552s"},{"start_seconds":560,"text":"why why we're thinking that yeah so so the reason is that uh we want to move beyond the model if","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=560s"},{"start_seconds":568,"text":"everyone has to run a full node for the system to be secure that's that's essential we want to move beyond uh if if let's say you know 99","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=568s"},{"start_seconds":577,"text":"of bitcoin users and traders and investors and everyone you know involved in bitcoin ran spv knows ran light notes you know if someone attacked the system","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=577s"},{"start_seconds":585,"text":"the full nodes wouldn't have any way of proving that an invalid transaction was included in a bitcoin block to any of those people so you know the bitcoin economy would","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=585s"},{"start_seconds":593,"text":"just continue the so the attacker essentially has you know minted himself a bunch of bitcoins for free right and they can do this do do this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=593s"},{"start_seconds":600,"text":"whenever they want so we need a compact way for people who are running light nodes to have","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=600s"},{"start_seconds":606,"text":"some sort of guarantee of block validity does that make sense yeah yes what's david yeah","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=606s"},{"start_seconds":614,"text":"so now let's see how do i okay there we go so i'll push this up uh","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=614s"},{"start_seconds":622,"text":"lion so line which is red okay so the first thing we need","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=622s"},{"start_seconds":630,"text":"is one broad proofs and i'm going to talk about the specifically the state transition fraud proofs there there's one other","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=630s"},{"start_seconds":639,"text":"scheme for the utxo data model but for here we're going to talk about the the state transition fraud proofs okay so how do they work","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=639s"},{"start_seconds":649,"text":"so we have our blockchain again we have arrows","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=649s"},{"start_seconds":657,"text":"and then we have again our block headers right so our block headers have","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=657s"},{"start_seconds":664,"text":"you know in here they have the state route here's another state route right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=664s"},{"start_seconds":671,"text":"and again the state route commits to or it's the merkel root of the state tree","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=671s"},{"start_seconds":679,"text":"uh state trees can be represented multiple ways in ethereum you have the merkle patricia tree all those systems have a sparse merkle tree and and so on","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=679s"},{"start_seconds":687,"text":"but you know essentially just the root of the state uh and we want to make sure that","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=687s"},{"start_seconds":694,"text":"uh going we want we so we want to have a way of proving that the state root of say the next block or this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=694s"},{"start_seconds":701,"text":"yeah let's say the state root of this block here this the state of the next block we want to prove that this is invalid assuming the previous one is valid","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=701s"},{"start_seconds":708,"text":"right so let's draw some let's draw some check marks so this one here the state road is good","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=708s"},{"start_seconds":716,"text":"and this one here as they do it is bad right so you know they do they do they do an attack by either inserting an","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=716s"},{"start_seconds":723,"text":"invalid transaction or the stage is just invalid and you know they've just given themselves a billion coins in the state you know and then so did that as leaf in","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=723s"},{"start_seconds":730,"text":"the state all right so so this is the kind of thing that we want to prove uh by induction we can by induction this is sufficient because","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=730s"},{"start_seconds":738,"text":"we always know the state route at the genesis block so as long as you as long as you can show this for one step then then by induction you can do this anytime you","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=738s"},{"start_seconds":746,"text":"want uh so how would we do this uh the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=746s"},{"start_seconds":752,"text":"oh let's see pencil so this block has a bunch of transactions","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=752s"},{"start_seconds":760,"text":"so we know that we know that if we start at this stage root here and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=760s"},{"start_seconds":766,"text":"we execute these transactions if this state route is not what we get then that means this block is invalid in some way","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=766s"},{"start_seconds":774,"text":"do we agree yes great uh so the name that the you know the obvious naive way is saying well","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=774s"},{"start_seconds":782,"text":"just give someone a block and they just execute all the transactions and compare the state routes right they have a pre-state and then","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=782s"},{"start_seconds":789,"text":"there's a post state and the post state that's committed to here in this block doesn't match up with the post state they compute then that's that's that's an invalid","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=789s"},{"start_seconds":797,"text":"block right there's your fraud proof uh so this is kind of the native way of doing doing a fraud proof they don't have a pre-state right a","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=797s"},{"start_seconds":805,"text":"light node does not have the state oh yeah yeah so the light node is given the pre-state route over here right uh so in order","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=805s"},{"start_seconds":814,"text":"to in order for the light node to know so in order for the light node to be able to execute these transactions","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=814s"},{"start_seconds":821,"text":"the only thing it needs to know is the pre-state that is touched it doesn't need to know the entire pre-state","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=821s"},{"start_seconds":828,"text":"all right so the first thing that you give which is thank you for bringing that up so what do you need to give to the to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=828s"},{"start_seconds":836,"text":"the light now so the light node get has previous state route it's also given","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=836s"},{"start_seconds":843,"text":"merkel branches to previous state elements","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=843s"},{"start_seconds":850,"text":"that are touched and it's given the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=850s"},{"start_seconds":857,"text":"and it's given you know this this this the well has given the entire block so it's given you know the prostate route pro state route and you know all the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=857s"},{"start_seconds":864,"text":"transaction i'm using mark down here which ones okay and it's given the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=864s"},{"start_seconds":871,"text":"transactions right and in the in the nav case uh and then you know if the miracle","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=871s"},{"start_seconds":878,"text":"branches aren't sufficient then you know as it executes a transaction it's going to say well i'm touching a state that isn't part of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=878s"},{"start_seconds":886,"text":"part of this part of these merkel branches you know the proof you've given to me is insufficient right so that means it's not a good proof right so if it","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=886s"},{"start_seconds":894,"text":"executes all the all the transactions successfully and then you know the merkle branches are sufficient then at least you know the fraud proof itself is is correct you don't know if it's uh","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=894s"},{"start_seconds":903,"text":"it's correctly formatted okay so essentially what you're doing is you know you run through all the transactions then you check to make sure you know is this is this post date rule","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=903s"},{"start_seconds":911,"text":"different uh so this works but there's an issue uh what's the issue","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=911s"},{"start_seconds":919,"text":"uh well it's it's heavy well yeah it's heavy because you have to execute every single transaction right right well i guess the other issue is that","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=919s"},{"start_seconds":927,"text":"when the access to transactions you you won we might not have access to the transactions themselves that's part two so in this case let's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=927s"},{"start_seconds":936,"text":"assume that they have full access to the transactions i see all right so so this works but the problem is that as","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=936s"},{"start_seconds":945,"text":"you said it's heavy executing all the transactions could be expensive especially in a resource-constrained environment like a blockchain","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=945s"},{"start_seconds":952,"text":"right so can we do better the answer is yes so draw a line","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=952s"},{"start_seconds":959,"text":"draw line so can we do better the answer is yes so what we do is uh let's see","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=959s"},{"start_seconds":968,"text":"pencil so here's our oh i can write here's our transaction","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=968s"},{"start_seconds":976,"text":"route right it's the merkle tree off some transactions","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=976s"},{"start_seconds":983,"text":"right so here's transaction one here's transaction m","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=983s"},{"start_seconds":990,"text":"right there's a bunch of transactions in between dots uh so what we do is we say","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=990s"},{"start_seconds":998,"text":"well what happens if after this transaction i also put inside this tree i just put","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=998s"},{"start_seconds":1006,"text":"some enter need yet state route","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1006s"},{"start_seconds":1013,"text":"and see how do i select select let's move this over here yeah so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1013s"},{"start_seconds":1023,"text":"after every sun every single transaction i'm going to insert an intermediate stage this is the naiva you can you don't have to do it after every transaction it","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1023s"},{"start_seconds":1032,"text":"could be after every some parameter number of transactions it could be after a certain amount of gas but in naive case we say after every","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1032s"},{"start_seconds":1040,"text":"transaction so enter immediate state root","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1040s"},{"start_seconds":1048,"text":"right and then you commit to this into a tree so instead of a transactions route now you have a data route so this is a route of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1048s"},{"start_seconds":1057,"text":"a route of where the leaves are you know transaction then the intermediate stage after executing this transaction then the next transaction then the intermediate stage after executing that","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1057s"},{"start_seconds":1066,"text":"one and so on right and intuitively that makes sense because each transaction is a state transition and a block is a group of state transitions so when we're doing this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1066s"},{"start_seconds":1074,"text":"this naive fraud proof over here let me fix this typo but when we're doing this naive fraud proof we're essentially doing a state transition fraud proof but","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1074s"},{"start_seconds":1082,"text":"over a block right we're saying here's the previous state route here's the next stage route execute a bunch of state transitions and then you know the state routes at","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1082s"},{"start_seconds":1091,"text":"the end should not match up so we can do the same thing it just we include a state route after every transaction and then we do the same process but instead of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1091s"},{"start_seconds":1099,"text":"executing all the transactions in a block you just execute one transaction does that make sense yeah that makes","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1099s"},{"start_seconds":1107,"text":"perfect sense yeah so and then you give exactly what you give here except instead of a list of transactions you just give one transaction right and then again you just run the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1107s"},{"start_seconds":1116,"text":"transaction through uh so this is when is there an eraser erase","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1116s"},{"start_seconds":1125,"text":"let's erase this yeah so this is how you do fraud proofs uh so now you brought up a","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1125s"},{"start_seconds":1133,"text":"a very good point which is what happens if these transactions here what happens if the majority miners just hide them what happens if they just don't show them to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1133s"},{"start_seconds":1142,"text":"anyone right they show the block headers so the block headers are still being sent out and light nodes will still follow the block headers","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1142s"},{"start_seconds":1149,"text":"but no one can actually construct this fraud proof because no one knows what's inside the block right and in fact they don't even know if it's invalid it could be a valid","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1149s"},{"start_seconds":1157,"text":"block it just hidden right so so how do we deal with this and this is where the more involved data availability proofs come in","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1157s"},{"start_seconds":1166,"text":"uh which is where we're going to probably spend a bit more time and and the existence of data","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1166s"},{"start_seconds":1173,"text":"availability proofs is something that uh you know the bitcoin research community has generally considered not possible and that's why they didn't consider","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1173s"},{"start_seconds":1180,"text":"fraud was possible exactly because of the problem of data withholding but they are possible with with pretty decent guarantees with pretty weak","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1180s"},{"start_seconds":1188,"text":"assumptions which is which is what we're going to discuss here so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1188s"},{"start_seconds":1196,"text":"data availability proofs so this is the data availability proof scheme that was formally formalized by mustafa bassam","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1196s"},{"start_seconds":1205,"text":"and alberto sassini i think and vintella buterin uh in a paper i think it's around september","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1205s"},{"start_seconds":1213,"text":"2018 or yeah so i think around september 2018 or october 2018 somewhere around there so it's been but you know the idea of you know doing","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1213s"},{"start_seconds":1220,"text":"this fraud and data availability proofs uh last formally has been has been around for a bit longer so this is the scheme that we're going to be using at lazy ledger it's also the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1220s"},{"start_seconds":1229,"text":"scheme that is used for serenity or that has been proposed for serenity uh so how does it work so let's start with","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1229s"},{"start_seconds":1238,"text":"kind of the most naive way so this one here is going to be like uh like a straw man the most naive way","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1238s"},{"start_seconds":1245,"text":"right straw strong the data availability scheme right so this is like","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1245s"},{"start_seconds":1252,"text":"as naive as as you can imagine so what we're going to say is let's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1252s"},{"start_seconds":1260,"text":"let's draw a rectangle let's take the block right let's say this is the block i'm going to draw it out in a nice","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1260s"},{"start_seconds":1267,"text":"rectangle so that you know we can we can chunk it up and stuff okay so let's say i chunk it up into","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1267s"},{"start_seconds":1276,"text":"eight pieces like so is there a way for me to copy","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1276s"},{"start_seconds":1284,"text":"this by any chance let's see select select","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1284s"},{"start_seconds":1290,"text":"i can copy nice paste this will come and this will be useful let's put this over","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1290s"},{"start_seconds":1298,"text":"let's put this over here i'll need this later okay so this is now this let's consider","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1298s"},{"start_seconds":1306,"text":"this to be our block so the uh you know you have all the block headers but you don't have the block bodies right so let's consider this to be the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1306s"},{"start_seconds":1314,"text":"the block body right of one of our blocks so what you could do is you can say well i'm going to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1314s"},{"start_seconds":1322,"text":"i'm going to let's use blue blue is a good color all right let's say i'm going i'm going to randomly sample like i'm a light node","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1322s"},{"start_seconds":1331,"text":"uh not a full this doesn't really apply to full nodes again because full nodes fully fully download blocks right they they don't have a problem with data withholding","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1331s"},{"start_seconds":1339,"text":"if they see a block doesn't have a block body then they say okay there's an invalid block i reject it so this is really only for for the purposes of light noise right so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1339s"},{"start_seconds":1347,"text":"uh how can a light now can convince itself that the data is available so well the light node can say well i don't want to download the full block","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1347s"},{"start_seconds":1355,"text":"because that would make me a full node so what i'm going to do is i'm going to download just a small portion of the block right you know and let's say there's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1355s"},{"start_seconds":1362,"text":"eight transactions in this block right if there are eight transactions in this block you know the and let's say the node randomly samples three the light node right so it's going to sample","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1362s"},{"start_seconds":1371,"text":"this one and let's say this one and then this one right uh right it just it just randomly","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1371s"},{"start_seconds":1378,"text":"samples three this is again this is the the naive naive case right but now what happens if the attacker","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1378s"},{"start_seconds":1386,"text":"you know the let's say there's a guy here with horns because he's an attacker right the attacker hides just this one transaction","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1386s"},{"start_seconds":1393,"text":"right if he hired just this one transaction then a light node that does this data availability check has convinced himself yes okay i checked","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1393s"},{"start_seconds":1402,"text":"these three transactions i've been given them they're valid they seem to be valid transactions right uh therefore i assume the block data is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1402s"},{"start_seconds":1410,"text":"available right and another line now is do this too the chance that a light note asks for this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1410s"},{"start_seconds":1417,"text":"one transaction and doesn't get it because you know the hacker's trying to hide this the chance that i'd find","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1417s"},{"start_seconds":1424,"text":"the chance that uh it lands on this would be you know what three three out of eight or whatever right uh which is you know in this case you know we're using a very","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1424s"},{"start_seconds":1433,"text":"large number it's like you're sampling half the block but you know imagine that you sample you know let's say it's a thousand transactions and you sample five right then in that case you can see the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1433s"},{"start_seconds":1441,"text":"probability that a light node finds that you know this thing here is being hidden is very very small","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1441s"},{"start_seconds":1448,"text":"right uh so this is you know not a great scheme because the attacker can only need to hide one transaction in fact they only need to hide one byte","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1448s"},{"start_seconds":1456,"text":"right they just need to hide one thing and then the entire block you can't you can't you can if it's hidden then you can't show that","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1456s"},{"start_seconds":1464,"text":"you know you can't show that this transaction is invalid if it's hidden if you don't know what the transaction is right you can't construct one of these state","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1464s"},{"start_seconds":1472,"text":"transition fraud proofs because the one of the point of the fraud proof is you need to execute a transaction if the transaction's hidden you can't execute it","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1472s"},{"start_seconds":1481,"text":"so uh so this you know this generally is not a great scheme because the chance that a light node will actually find out that this block","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1481s"},{"start_seconds":1489,"text":"or that part of this block is hidden is very very small so we want something better so how how do we","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1489s"},{"start_seconds":1496,"text":"how do we do it let's let's do b let's use a razor coating and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1496s"},{"start_seconds":1504,"text":"again we'll make this naive uh i guess i could say we can say 1d i","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1504s"},{"start_seconds":1514,"text":"want 1b 1d naive so let me scoot this over a bit","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1514s"},{"start_seconds":1521,"text":"let me copy this because we'll need it again","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1521s"},{"start_seconds":1529,"text":"and move this here okay so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1529s"},{"start_seconds":1538,"text":"what we're going to do now is we're going to use a razor coating so the the way razor coating essentially works is that with while it uses math which we're not going","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1538s"},{"start_seconds":1546,"text":"to cover here but essentially you can think of it like let's say these four are the original data that i have just just","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1546s"},{"start_seconds":1554,"text":"these four what i can do is i can actually compute some parity shares","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1554s"},{"start_seconds":1560,"text":"so here's my here's my original data","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1560s"},{"start_seconds":1568,"text":"red general beta and here's the parity so i'm i'm given this original data i'll","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1568s"},{"start_seconds":1576,"text":"compute some some parity data and how much parity data you get is dependent on some parameter you can you can change it so it doesn't in this case","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1576s"},{"start_seconds":1585,"text":"as you can see it's one to one it doesn't have to be one to one it can be it can be different uh but uh essentially you have this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1585s"},{"start_seconds":1592,"text":"original parity data now right uh so as you can see you're getting more data so this is bigger the original data is fours four chunks","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1592s"},{"start_seconds":1600,"text":"the parity di data is also four chunks so total you have eight chunks uh and you know depending on your parameter choice uh","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1600s"},{"start_seconds":1608,"text":"essentially what uh what this gives you is if you can recover four chunks out of these eight any four you can recover the original data","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1608s"},{"start_seconds":1617,"text":"and of course you can also recover the parity data because you just recompute the parity data right so this is this seems like it's a","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1617s"},{"start_seconds":1625,"text":"it's kind of solves our problem because now you no longer have the problem you no longer have the problem of the straw man scheme over here","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1625s"},{"start_seconds":1632,"text":"up here uh the strongman scheme again is that an attacker could just hide one of these one of these chunks over here one of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1632s"},{"start_seconds":1640,"text":"these transactions and you would have to the light node would have to specifically request that transaction right otherwise","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1640s"},{"start_seconds":1648,"text":"it wouldn't know that something is being hidden in this case if you have this how let's say you have this example where","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1648s"},{"start_seconds":1655,"text":"you have four and four how many of these chunks does an attacker have to hide to be able to hide the block yeah they need","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1655s"},{"start_seconds":1664,"text":"to hide five they need to fire five right if they hide three it doesn't matter which three they hide if they still broadcast the other five then or they even let's say they even","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1664s"},{"start_seconds":1673,"text":"hide four and they broadcast the other four it doesn't matter which four they broadcast the entire block can be reconstructed right the original data can be reconstructed and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1673s"},{"start_seconds":1680,"text":"from there we can also recompute the parity data so in the entire thing so they need to hide more than half in this in the symbol example it's five","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1680s"},{"start_seconds":1689,"text":"right uh so we're going to draw draw that out let's say the same red right so an attacker hides","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1689s"},{"start_seconds":1698,"text":"five five right an attacker hides these five shares right uh and i didn't draw that properly","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1698s"},{"start_seconds":1706,"text":"let's undo this that's one attacker hides one two three five like this yeah that's better","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1706s"},{"start_seconds":1715,"text":"all right so attacker hides five they broadcast out the other three right uh now here's kind of where where some of assumptions assumptions come into place","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1715s"},{"start_seconds":1723,"text":"so one thing that's important is we assume that there's at least one honest full node in the network that the light nodes can connect to and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1723s"},{"start_seconds":1731,"text":"we assume that they can communicate with each other so there's no eclipse attack the reason this is important is that you know the light nodes and the full nodes","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1731s"},{"start_seconds":1740,"text":"can't talk to each other then you know the full node can't even construct a fraud proof right uh so the light node sample stuff but you know","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1740s"},{"start_seconds":1748,"text":"there's no fraud proof random thing and then what are you doing right uh so we we do make that network assumption so what this means is essentially if the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1748s"},{"start_seconds":1757,"text":"attacker broadcasts out any share we assume that the entire network is eventually going to hear that share it might take a bit of work but we assume that the entire honest","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1757s"},{"start_seconds":1765,"text":"network will eventually hear of that share right right so they can't like you know oh they can't hide they can't hide say like these two over here for one full","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1765s"},{"start_seconds":1774,"text":"node and then they used to be for the other full node and then for another full node hide these five they very much have to hide the same five","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1774s"},{"start_seconds":1781,"text":"right uh okay so we have to say this construction so now our light node comes along and the light node does some samples right so the first","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1781s"},{"start_seconds":1790,"text":"time it samples uh it will get tricked that the data is available if it lands on an available chunk right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1790s"},{"start_seconds":1798,"text":"like if if the light node samples this trunk here then it says okay that chunk is available i've been given it right oh oh i guess i guess one thing to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1798s"},{"start_seconds":1806,"text":"be to be to make clear is this uh this erasure coded version of the chunks of original and parody data","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1806s"},{"start_seconds":1813,"text":"gets committed to in the block header so right yeah this is a merkle root so we marking this obviously although if you just have","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1813s"},{"start_seconds":1822,"text":"the data floating around then the light node samples it doesn't know what it's happening right so okay so when a light node samples this chunkier it has to get a merkle proof","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1822s"},{"start_seconds":1829,"text":"from the block header to to the trunk just over there okay so you know if a light node samples this trunk it says okay this trunk is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1829s"},{"start_seconds":1837,"text":"available uh so if it stops there then it would be convinced that the block is available and it would have gotten tricked right so the the first time on samples what's the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1837s"},{"start_seconds":1846,"text":"approximate probability that it got tricked it will get tricked with the three over eight right uh","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1846s"},{"start_seconds":1854,"text":"yeah sure uh sure well let can we let's simplify that a bit just well then perito minus one over two","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1854s"},{"start_seconds":1862,"text":"let's assume yeah apparently minus one over total let's assume that the the large number of chunks it'll be it'll be approximately","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1862s"},{"start_seconds":1869,"text":"yeah then one one half yeah one half right because it's uh we assume a large number of chunks great so so round one","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1869s"},{"start_seconds":1878,"text":"count one uh you have the probability b is approximately half right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1878s"},{"start_seconds":1886,"text":"okay so now it does a second round of sampling because you don't stop there and one round of sampling is is pretty terrible so it does the second","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1886s"},{"start_seconds":1894,"text":"round of sampling uh without replacement uh so what's what's the approximate probability that it has gotten tricked after k","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1894s"},{"start_seconds":1902,"text":"around so it's going to be one over two to the k right yeah so this is one corner uh with with around with around m or k oh sure uh p is you","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1902s"},{"start_seconds":1911,"text":"know one over two two to the k right uh so as you can see the probability of it getting trick decreases exponentially","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1911s"},{"start_seconds":1920,"text":"so you don't and one thing that's interesting to note here this probability decreasing of getting tricked is it in any way","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1920s"},{"start_seconds":1928,"text":"related to the number of chunks it is well well it is it is important that parity","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1928s"},{"start_seconds":1936,"text":"is one to one with the original data right oh yeah yeah yeah yeah yeah but we assume the parameters the system parameters set up that the parity and original data are one to one yeah","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1936s"},{"start_seconds":1945,"text":"yes uh well there are a couple of things so so one is if you assume that the number is sufficiently large right so one second is a good estimate then","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1945s"},{"start_seconds":1953,"text":"it should be independent of the number of chunks but yeah but also i guess something we didn't touch on is we assumed that the adversary decides on","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1953s"},{"start_seconds":1961,"text":"what to to to reveal in advance right which i guess it doesn't have to uh well again is that we","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1961s"},{"start_seconds":1969,"text":"we assume that the network set up that you know if uh if a chunk is distributed to an honest full node it will get distributed to all honest full nodes eventually","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1969s"},{"start_seconds":1978,"text":"right but if i'm a light node right and i'm sampling and i just happen to be connected to several non non honest nodes right i will sample","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1978s"},{"start_seconds":1986,"text":"like i will start sampling uh and then adversary as they receive my request for for for for a share they will decide to to reveal it right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1986s"},{"start_seconds":1994,"text":"or wrong we assume that the light nodes are connected to a full node an honest full node i see and we're also saying that if the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=1994s"},{"start_seconds":2002,"text":"so so then i guess what is not uh one assumption we did not discuss is so so let's say i'm a light client i'm connected i'm a light node i'm","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2002s"},{"start_seconds":2010,"text":"connected to let's say a dozen 12 12 full nodes right so so i chose to sample a particular share and i chose a particular full node to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2010s"},{"start_seconds":2018,"text":"sample it from so if i fail to sample it from it what do i say do i say that the date is unavailable or do i try to sample from another full node","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2018s"},{"start_seconds":2026,"text":"you continue trying until some parameterizable timeout right so therefore if i'm connected to any full node which is controlled by adversary","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2026s"},{"start_seconds":2033,"text":"eventually i will sample all my shares from that adversary adversarial node right and so adversary can choose uh to specific sure but the shares","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2033s"},{"start_seconds":2043,"text":"oh well we assume the light nodes aren't under eclipse attack if they're connected to at least one honest full node then they're not under an eclipse attack right but in this case i'm saying let's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2043s"},{"start_seconds":2052,"text":"say i'm connected to exactly one malicious node and everybody else i'm connected to is a full node which is honest right so i'm saying i want to sample let's say","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2052s"},{"start_seconds":2060,"text":"the parameter is five i want to sample five five shares out of a thousand right so i go to the full nodes uh and the full and let's say that the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2060s"},{"start_seconds":2070,"text":"uh so okay so the way i see it is adversary first sends me the hash of the block right yeah so at this point from someone i heard that the block exists other full","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2070s"},{"start_seconds":2079,"text":"notes haven't heard about it yet so i try i start sampling the shares and all other full notes tell me well i don't know the block i'm not gonna tell you the share so i keep on trying","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2079s"},{"start_seconds":2087,"text":"and i end up trying to download it from the malicious note and malicious note at that point decides for the first time to reveal the particular share","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2087s"},{"start_seconds":2095,"text":"right so so maybe it will not be able to check all the light client because all the light clients collectively will probably hit all the shares but it will be able to check one particular one so let's say it wants to coinbase","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2095s"},{"start_seconds":2104,"text":"right so there's specific in our coinbase is coinbase goes on and samples and ultimately coinbase ends up sampling from uh from the adversary an adversary","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2104s"},{"start_seconds":2112,"text":"reveals specifically the shares coinbase wants to see uh so we also assume a network model where","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2112s"},{"start_seconds":2118,"text":"queries can be made anonymously as in you can you can't associate who is making the query uh in practice the reason that this is an","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2118s"},{"start_seconds":2127,"text":"okay assumption even if we don't use things like tor and whatnot is that say a coinbase they can run two full nodes or they can run 100 full nodes and you","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2127s"},{"start_seconds":2135,"text":"might know one full node is coinbases but you don't know all of them are operated by a single entity yeah well in behind the scene right we're checking the light clients","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2135s"},{"start_seconds":2143,"text":"so i guess this will not be running a light client well they wouldn't be running a like line right uh but like an end user is like an end user okay they run one for one light client but how do you know","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2143s"},{"start_seconds":2150,"text":"they're not running two like clients one on the phone and one on their computer that belong to the same person that can and they can the two nodes can communicate","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2150s"},{"start_seconds":2158,"text":"with each other off-chain and you know the the the you know the the human is essentially a very good way of you know","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2158s"},{"start_seconds":2165,"text":"having private communication between two computers right like that you can't you get you can't you can't really it's pretty hard for a computer to spy on human","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2165s"},{"start_seconds":2173,"text":"typing and a keyboard here and then you know typing on the keyboard there yeah okay so with those assumptions uh because because i see you have the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2173s"},{"start_seconds":2180,"text":"third one drawn right so we we are about to find out something bad about this model so yeah oh yeah it's not at all obvious to me what is wrong with it with the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2180s"},{"start_seconds":2189,"text":"assumptions we discussed so i'm i'm uh i'm excited to hear what what is it we we we will because you know this is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2189s"},{"start_seconds":2196,"text":"that's the name yeah so so this is kind of a few and interesting things to note uh this uh the chance that a light node can be","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2196s"},{"start_seconds":2204,"text":"tricked is completely independent of the block size what this means is the number of rounds you need to do is constant","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2204s"},{"start_seconds":2211,"text":"it is not you know big o of n where n is the block side there's not big o of you know some function of n it's big o of one uh with respect to the number of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2211s"},{"start_seconds":2220,"text":"transactions in the block or you know the number of bytes the number of gas or whatever whatever you want right uh this is constant uh which is pretty","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2220s"},{"start_seconds":2228,"text":"amazing because it means that uh you you can have you just have to do a constant number of samples and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2228s"},{"start_seconds":2235,"text":"and each of these sampling operations is you know logarithm logarithmic in the size of the size of the block because it's a merkle it's a","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2235s"},{"start_seconds":2242,"text":"merkle branch too to the particular share right uh so this is you know a very very cheap operation","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2242s"},{"start_seconds":2250,"text":"uh which is great but now here's kind of where the problem is let's say i have one light node right i have one light now the light node samples","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2250s"},{"start_seconds":2258,"text":"three shares right uh well this example is bad because then the number of shares is pretty small right uh let's say let's say the lightning","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2258s"},{"start_seconds":2266,"text":"samples two shares just again the the the small number so it makes things a little disproportionate but you know those light nodes samples two shares","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2266s"},{"start_seconds":2274,"text":"right uh so let's say uh pencils use green right so let's say the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2274s"},{"start_seconds":2284,"text":"light node samples the share right uh and in fact the light node could sample the share right okay you just have one light note","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2284s"},{"start_seconds":2293,"text":"uh a bls green is a terrible color choice because maybe a non-trivial number of our viewers are red green color blind but these x's here are green","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2293s"},{"start_seconds":2302,"text":"so you know the light note samples these these two shares uh just just as light now and there's not a single other note on that in the network let's say right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2302s"},{"start_seconds":2310,"text":"or you know this could be the full node right because we assume there's one on a full node uh so you know the full node tries it's best to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2310s"},{"start_seconds":2317,"text":"by asking the network and everyone around you know the full node tries to reconstruct the whole data somehow uh if it can't directly download the original data it has to ask the network","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2317s"},{"start_seconds":2326,"text":"for you know the shares individually but it should be able to reconstruct the block so let's say this you know this this full node is is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2326s"},{"start_seconds":2334,"text":"you know you know out there making requests and you know it downloads these these two these two so that you know","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2334s"},{"start_seconds":2340,"text":"uh this is this is what it gets uh do can we reconstruct the block using","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2340s"},{"start_seconds":2347,"text":"only these two shares uh no no right because you need four yeah uh so the problem is that if we fix","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2347s"},{"start_seconds":2357,"text":"even if we fix this let's say you know we set our k is the two at some in some fixed number uh okay so you have one you know a light client or a full node or whatever","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2357s"},{"start_seconds":2365,"text":"you know they download these two there's no guarantee that you'll be able to reconstruct a block if only one client does these requests","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2365s"},{"start_seconds":2374,"text":"right right but wouldn't full node uh the full node will try to fetch all the shares right yeah so the full node will try to fetch all the shares yes","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2374s"},{"start_seconds":2383,"text":"uh but the problem is okay the phone does but the full node can't really prove to a live client that it hasn't been able to fetch all the shares","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2383s"},{"start_seconds":2390,"text":"right but but uh so the way i see it so far is that the the chunk sorry the block could either be available","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2390s"},{"start_seconds":2397,"text":"meaning that it does it did broadcast so so effectively uh let's go through the timeline right so the block was","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2397s"},{"start_seconds":2405,"text":"published for the first time so so uh because we assume that if some message was sent over the network it will eventually reach everybody so eventually everybody learned that the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2405s"},{"start_seconds":2413,"text":"block was at least uh announced meaning that the header was announced yes so after that everybody will attempt to sample some","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2413s"},{"start_seconds":2421,"text":"shares and again we're saying that the sum share was published on the network eventually everybody who tried to sample it uh will be able to to receive it right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2421s"},{"start_seconds":2429,"text":"so with this assumption it seems to me that with a sufficiently large key uh for every available block every light","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2429s"},{"start_seconds":2436,"text":"client and every full node in the system will know that it's available and moreover the full nodes will actually reconstruct it because fullness no no so they can convince themselves as","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2436s"},{"start_seconds":2445,"text":"available uh but there's a problem you might not be able to reconstruct the original data right and okay and this is very nice this is like strongman example let's say","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2445s"},{"start_seconds":2454,"text":"you have exactly one node that's doing this sampling right i see the sample these two shares yes right but even then is this not a light","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2454s"},{"start_seconds":2462,"text":"client or a full client it doesn't really matter because if it's a full client uh it will not it will not try to fetch case shares it will try to fetch all the shares right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2462s"},{"start_seconds":2471,"text":"the phone number will try to fetch all of them okay so let's say there's a like line right uh but if it's a light client uh then then there's not a single honest","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2471s"},{"start_seconds":2478,"text":"full note in the system the phone is still honest it's trying to do its job but it can't so so so there's another assumption here","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2478s"},{"start_seconds":2487,"text":"uh the the the reason the reason is confusing is because there's another assumption which is what we're going to talk about so let's say one you know one honest phone though that's trying to do its work","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2487s"},{"start_seconds":2495,"text":"and you have one like client like client shop samples these two shares it sees they're available and there's only two shares that are distributed right but","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2495s"},{"start_seconds":2502,"text":"sorry for interruption but consider the following model right let's say that the full client will not distribute any shares until it has the full block","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2502s"},{"start_seconds":2510,"text":"right so the full node does not have full block i don't know the full node the phone should all distribute shares even if it's only seen a few of them right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2510s"},{"start_seconds":2517,"text":"yeah right and in the in the model but let's let's say we're changing the model right we're saying the full note will not be distributing shares until it has the full block oh no but that'll be","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2517s"},{"start_seconds":2525,"text":"terrible because then full mode would never be able to reconstruct the block unless they've been given a full block so full nodes can obviously gossip","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2525s"},{"start_seconds":2532,"text":"individual shares the full nodes can gossip individual shares","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2532s"},{"start_seconds":2540,"text":"like if the only way a full node would be able to broadcast anything out outwards is if it received a full block that means an attacker could just not","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2540s"},{"start_seconds":2548,"text":"ever show a full block and only do like right only give out individual shares and then full nodes would never would ever send an outgoing message","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2548s"},{"start_seconds":2556,"text":"right so obviously of course of course you cannot break every uh like it will not be a productive time if you will be breaking every every modal so let's do the last one and and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2556s"},{"start_seconds":2564,"text":"then we will proceed with the yeah so so notes always send they brought they they re gossip to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2564s"},{"start_seconds":2573,"text":"other full nodes but they would not respond to light clients unless they have all the shapes they can also respond to like clients too right but i'm saying how will it break","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2573s"},{"start_seconds":2581,"text":"right so no no no no no i think the reason is that the assumption seems very obvious so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2581s"},{"start_seconds":2588,"text":"can i go through the assumption yes and then when i say it they'll seem very obvious because like oh obviously this happens in practice so the the the attack is is very","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2588s"},{"start_seconds":2596,"text":"contrived but it's still an assumption that we have to make because we have to make all our assumptions let's assume there's one full node and there's one like client like client samples these two shares","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2596s"},{"start_seconds":2604,"text":"they're this is this is bad i shouldn't put this here i should like say let's say sample this share and then let's erase this just so we","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2604s"},{"start_seconds":2612,"text":"don't get confused now the like client samples these two shares it sees that these two shares are available right and let's say there's only this an","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2612s"},{"start_seconds":2619,"text":"imaginary world there's one like client samples these two shares they're available right uh and then the full node tries","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2619s"},{"start_seconds":2626,"text":"to reconstruct the block also seeing the full node can also only see these two shares but the so the like client is convinced that the block is available","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2626s"},{"start_seconds":2634,"text":"but the full node can't reconstruct the block right and that's the problem right but now what happens if we have like","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2634s"},{"start_seconds":2642,"text":"100 like clients 100 like clients each sample two so maybe one samples these two one samples these two one samples these two and so on","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2642s"},{"start_seconds":2649,"text":"and then you know if the block isn't being hidden then a full node can reconstruct it by asking around for the shares","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2649s"},{"start_seconds":2657,"text":"right so the trick is we assume there's a minimum number of flight clients that are making these requests i see and those numbers","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2657s"},{"start_seconds":2664,"text":"can be fairly small the the paper gives numbers i think around 100 or something so you know it's a very it's a very weak assumption uh obviously in practice","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2664s"},{"start_seconds":2672,"text":"for any reasonably sized network you're going to have 100 nodes right especially light nodes so this isn't a very strong assumption but it is something that we have to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2672s"},{"start_seconds":2680,"text":"point out is that you do need a a certain number of nodes proportional to the block size uh doing","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2680s"},{"start_seconds":2687,"text":"doing random doing this random sampling does that make sense yeah that makes sense yeah so so yeah so that's always confusing is because it's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2687s"},{"start_seconds":2696,"text":"it's a it is kind of a contrived thing that contrives thing that doesn't really happen in practice so you know assumption here assumption uh some","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2696s"},{"start_seconds":2705,"text":"number of light nodes and we know that this is going to be proportional to block size","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2705s"},{"start_seconds":2712,"text":"right right and so is it specifically the number of light client nodes or is it the number of light or full nodes","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2712s"},{"start_seconds":2719,"text":"which are honest in the network uh so let's have that many full nodes but not a single light client will it work or we specifically need that many light","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2719s"},{"start_seconds":2728,"text":"clients uh if you have this number of full nodes also doing they can pretend to be like clients and do it then do these requests so it's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2728s"},{"start_seconds":2735,"text":"sure the number of notes okay we can simplify the like number of nodes really number of honest nodes oh yeah of course","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2735s"},{"start_seconds":2743,"text":"yeah this is yeah honestly number of honest notes yeah okay great so now why","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2743s"},{"start_seconds":2751,"text":"why doesn't this work why why is this on each game uh also it seems to be we're running a bit out of time from the schedule uh is that an issue no that's not an","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2751s"},{"start_seconds":2759,"text":"issue oh yeah perfect i i have some i have some time so uh so what's the issue the issue is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2759s"},{"start_seconds":2766,"text":"if this is erasure coded correctly then we can do all this but what happens if this is not erasure coded correctly what happens if","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2766s"},{"start_seconds":2775,"text":"the block producer just doesn't they you know they either don't erase or code it correctly or you know they commit to they commit","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2775s"},{"start_seconds":2783,"text":"to something incorrect because again this has to be committed to in some merkle route would you mercalyze all these shares what happens if they just don't commit to it correctly","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2783s"},{"start_seconds":2791,"text":"uh in that case you can't do that you can't do this right uh or or rather it's like even if you do this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2791s"},{"start_seconds":2799,"text":"and then you know the block is available you might not be able to reconstruct the data nicely so what you have to do is if the razer coding is incorrect you need","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2799s"},{"start_seconds":2808,"text":"a fraud proof so how do i prove that these parity shares are","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2808s"},{"start_seconds":2815,"text":"do not uh are like are not correct based on the original data how would i prove that so so here you would have to share at","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2815s"},{"start_seconds":2823,"text":"least uh at least four shares right let's assume that they can reconstruct the data yeah let's let's assume that you know they reconstruct the data so you know a full","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2823s"},{"start_seconds":2832,"text":"node reconstructs the whole thing right well i'm saying the proof would have to be the size of the number of yeah right yes right so the proof is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2832s"},{"start_seconds":2840,"text":"essentially yeah the proof is essentially you give the entire original data and you give the para the parity shares right or you give you know the merkle root and the original","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2840s"},{"start_seconds":2848,"text":"data or four of these right and then you just say okay compute the parity shares and then you'll see that you know the merkle root doesn't match up so the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2848s"},{"start_seconds":2855,"text":"problem is that a fraud proof of this that this is the that this is being computed incorrectly is the whole data","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2855s"},{"start_seconds":2863,"text":"which exactly you know this is basically saying just download the full block and then then you can see that the data that the parity shares haven't been","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2863s"},{"start_seconds":2870,"text":"computed correctly which is exactly what we're trying to avoid right we're trying to avoid having to download the whole block uh because line nodes are resource","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2870s"},{"start_seconds":2877,"text":"constraint so uh what what what do we do so this is where the 2d scheme comes in so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2877s"},{"start_seconds":2885,"text":"see this is razer coding duty","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2885s"},{"start_seconds":2893,"text":"oh this i realized that this thing here is probably not useful anymore so i can probably erase it we can","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2893s"},{"start_seconds":2902,"text":"replicate it uh seven times i could but it would still look it would probably be way too big","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2902s"},{"start_seconds":2910,"text":"so let's let's do this let's do a smaller table let's do let's do like oops let's drag this down","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2910s"},{"start_seconds":2918,"text":"okay let's do a square and then some lines","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2918s"},{"start_seconds":2928,"text":"and this is this is this is it so what we're going to do is we're going to arrange","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2928s"},{"start_seconds":2935,"text":"our original data in rows and columns so instead of being just like a single a single list a single array","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2935s"},{"start_seconds":2943,"text":"we're going to arrange it in rows and columns so this thing here is our original data right uh so what we're going to do is for each","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2943s"},{"start_seconds":2952,"text":"row we're going to compute the parity share the parity shares for that row so we extend it this way right so here's the parity shares of this row","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2952s"},{"start_seconds":2961,"text":"i know there's supposed to be lines here but i'll not draw them for simplicity all right so again for this row we compute the parity shares and so on now for each column","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2961s"},{"start_seconds":2969,"text":"we're also going to compute the parity shares of this column this right and then you can do this you know this the third","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2969s"},{"start_seconds":2977,"text":"square if you you know if you copy one of these two or if you you compute parity shares this way it doesn't really matter right just this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2977s"},{"start_seconds":2985,"text":"is kind of an implementation detail but this is also going to be some sort of parity shares right so this is important mentioning here which is obvious for people with the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2985s"},{"start_seconds":2993,"text":"background in math but it is not as obvious otherwise is that it doesn't matter how you compute this fourth square whether you erase your code columns or azure code","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=2993s"},{"start_seconds":3000,"text":"rows you'll get the same values right yeah so like a particular value yeah yeah so so that is not immediately","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3000s"},{"start_seconds":3009,"text":"obvious i guess it requires understanding of some math behind yeah but like ultimately this this","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3009s"},{"start_seconds":3016,"text":"doesn't matter what really matters is that you know as long as everything is is a parody in some way then that's all that all that matters uh yeah so even if it were different it","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3016s"},{"start_seconds":3024,"text":"wouldn't matter just you know you just say you know this is this is this is the direction i choose essentially so this is your original data so we note","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3024s"},{"start_seconds":3032,"text":"that uh the 1d scheme our parity shares are twice as big as our original data right here our parity shares are three","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3032s"},{"start_seconds":3041,"text":"times as big as our original data right so each of the side here is like square root of block size square root of block size so the length of this big square would","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3041s"},{"start_seconds":3050,"text":"be you know two square root of block size and two square root of block size right so let's type this out so this one here is you know","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3050s"},{"start_seconds":3057,"text":"oof this one is square root and let's say n is n is a block size right this one here is also squared and","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3057s"},{"start_seconds":3066,"text":"there's also the square root of n and this one here is also square root of n right so in total the length of these","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3066s"},{"start_seconds":3073,"text":"things is 2 square root of n uh and then what we're going to do is we're going to commit to a merkle root","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3073s"},{"start_seconds":3081,"text":"for each row and each column so in total so with this one here we just need one","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3081s"},{"start_seconds":3089,"text":"one merkle root right we just take these and we just microlight them right so one marker root here we need to mark the root for each row and each column","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3089s"},{"start_seconds":3097,"text":"so in total our commitment here is going to be 2 times","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3097s"},{"start_seconds":3103,"text":"2 times 2 squared of n right because this is 2 this is a two square root of n and then we have we have two of these","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3103s"},{"start_seconds":3111,"text":"right so so in total it's four is four square root of n oops per square event so this is our","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3111s"},{"start_seconds":3121,"text":"commitment size so this one here needs to go into the block header now we can have like a super compact commit","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3121s"},{"start_seconds":3128,"text":"commitment where you mercalize this so you can kind of represent it as like a two","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3128s"},{"start_seconds":3134,"text":"like two in two stages but ultimately uh nodes that want to do these data availability checks need to download this four squared event","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3134s"},{"start_seconds":3144,"text":"commitment on commitments uh so what this means is that this does increase the size of the block header uh","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3144s"},{"start_seconds":3151,"text":"it means that now the block header has some overhead that's proportional to the square root of the block size as opposed to just being constant sized","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3151s"},{"start_seconds":3159,"text":"right and it's assumed that all light nodes will have to download this again the super light nodes can just download the merkle root of these and not do data availability checks and just","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3159s"},{"start_seconds":3167,"text":"trust it on a majority uh but you know the the secure light clients or that do data availability checks uh will","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3167s"},{"start_seconds":3175,"text":"need to to download this four squared event commitment okay great uh so now that we have this uh how many how many shares does an","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3175s"},{"start_seconds":3184,"text":"attacker have to hide to prevent uh to prevent someone from reconstructing this the original data and therefore the full","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3184s"},{"start_seconds":3191,"text":"block approximately okay so approximately it will be so to reconstruct everything we need","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3191s"},{"start_seconds":3198,"text":"approximately n right uh of those little shares yeah yeah that's true yeah to reconstruct everything you","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3198s"},{"start_seconds":3206,"text":"need around n yeah where n is the block size right so so i will need to hide 3m right oh wait or do i need to hit","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3206s"},{"start_seconds":3216,"text":"n you need to hide n so n is sufficient","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3216s"},{"start_seconds":3224,"text":"i know it's confusing we can use ratios right here here the attacker hide half plus one right yes here here they need to hide three three fourths plus one right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3224s"},{"start_seconds":3232,"text":"or like three fourths plus plus seven three chord for three three-fourths uh they have to hide let me draw the rectangle in red","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3232s"},{"start_seconds":3239,"text":"they have to hide this much right so it's one quarter plus one oh yes yes that's correct yeah so we and we can see is that if","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3239s"},{"start_seconds":3247,"text":"they hide let's you know let's say this is eight right if they hide five from this row you can't reconstruct the row if they hide five from this row you can't reconstruct the row and so on for","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3247s"},{"start_seconds":3256,"text":"the columns right but if they didn't hide these you know if they left you they left you a bit here if they revealed this one then you","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3256s"},{"start_seconds":3263,"text":"could compute the whole column and then from that then you can compute the rest one by one right so they kind of have to hide this uh for a further large enough","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3263s"},{"start_seconds":3272,"text":"for a large enough number now you know if if you have very light note and it starts you know random you know it starts rounding the sampling","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3272s"},{"start_seconds":3280,"text":"here here here uh for each round we'll do the same as before uh so here's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3280s"},{"start_seconds":3288,"text":"round one what's the probability that a light node has been tricked that the data is available but it's not uh","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3288s"},{"start_seconds":3295,"text":"it's uh one quarter right uh the light node will get tricked if it lands on","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3295s"},{"start_seconds":3303,"text":"something that's being disclosed yeah it's going to be three quarters uh so our","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3303s"},{"start_seconds":3311,"text":"round two uh tries to sample again what's the probability now uh nine sixteenths yeah not nine or nine","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3311s"},{"start_seconds":3318,"text":"over 16 right so that so you you keep going right uh so we see it it doesn't decrease as sharply as","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3318s"},{"start_seconds":3326,"text":"the previous time but you know it does still decrease exponentially which is good so you need to do more rounds of sampling to get the same guarantees","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3326s"},{"start_seconds":3335,"text":"but it means you get a better guarantee elsewhere so that's a better guarantee elsewhere if we have to prove that the whole thing","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3335s"},{"start_seconds":3344,"text":"is erasure coded incorrectly note that we only have to prove that a single erasure coding computation was done incorrectly","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3344s"},{"start_seconds":3352,"text":"right which means the fraud proof is now a single row or a single column in size right do we agree","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3352s"},{"start_seconds":3360,"text":"which is just square root yep so now the fraud proof would be 2 square root of n as opposed to being the as opposed to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3360s"},{"start_seconds":3368,"text":"being n with like the the size of the original data right so now so fraud proof is big o","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3368s"},{"start_seconds":3376,"text":"of uh square root n where n is our block size right over here up top the naive scheme the fraud proof","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3376s"},{"start_seconds":3385,"text":"is big o of n right so this is kind of this is kind of where where we see the amazing thing is that we now have a fraud proof that's sub linear","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3385s"},{"start_seconds":3394,"text":"in size and again if you only have the broadcast as fraud proof out uh if there's a fraud proof in the happy case uh the only thing you need to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3394s"},{"start_seconds":3402,"text":"download is this commitment and then a fixed number of of samples a fixed number of sampling right uh so","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3402s"},{"start_seconds":3409,"text":"so this is kind of this is this is kind of the nice property is that the number of samplings you have to do is is fixed uh it's not related to block","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3409s"},{"start_seconds":3417,"text":"size at all uh so how would you increase let's say while the number of samplings","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3417s"},{"start_seconds":3424,"text":"is not related to the size of the block the uh the light header now is uh yes to the square root right yeah yes no","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3424s"},{"start_seconds":3433,"text":"yes it does so yeah so one of the trade-offs is the light client headers are larger uh so what this means is that if you","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3433s"},{"start_seconds":3441,"text":"want to kind of take full advantage of this you would want to have a smaller number of headers each of which have larger blocks right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3441s"},{"start_seconds":3449,"text":"which means that generally you'd want to have slightly longer block times than what you would see in you know some changes that have really really fast block times","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3449s"},{"start_seconds":3457,"text":"right so instead of going for the one second block time maybe you want to go for the 30 second block time uh which will allow you to take bet to take more advantage of","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3457s"},{"start_seconds":3465,"text":"of this factor here right so that's one potential downside but you know the gains is that you have now secure light clients","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3465s"},{"start_seconds":3473,"text":"which is amazing because as before if the two choices are run a full node or absolutely no security","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3473s"},{"start_seconds":3480,"text":"uh that's not exactly a very good trade-off especially if you want your base layer to process many transactions where full node could be potentially expensive","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3480s"},{"start_seconds":3488,"text":"right right so now we have a third choice which is you can run a light client with data availability proofs and do this with sublinear cost and still be pretty damn secure so long","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3488s"},{"start_seconds":3497,"text":"as there's one honest full node out there which is a good choice right no one's forced to use this but now we have this option oh wait so well it's","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3497s"},{"start_seconds":3505,"text":"one oldest full node among our peers right so we need to you know no no eclipse attack yeah which which is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3505s"},{"start_seconds":3513,"text":"you know clubs attacks are kind of hard to pull off maybe maybe not but yeah there's a is an assumption","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3513s"},{"start_seconds":3520,"text":"so uh so one thing we know is that if let's say we want to keep some we have some security guarantee","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3520s"},{"start_seconds":3526,"text":"parameter right security purity guarantee right so this is kind of like","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3526s"},{"start_seconds":3534,"text":"our guarantee that you know some some fixed fraction of light nodes aren't going to get tricked right so this is this is going to be proportional to the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3534s"},{"start_seconds":3543,"text":"number of rounds right number of rounds that we set as a parameter times uh","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3543s"},{"start_seconds":3550,"text":"times the number of nodes doing sampling right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3550s"},{"start_seconds":3560,"text":"so as the as the number of nodes increases then our security guarantee increases right right and as the number of rounds increases so does our security guarantee","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3560s"},{"start_seconds":3568,"text":"right yeah also i don't see your text until you continue let me oh okay uh so so you know we have we have","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3568s"},{"start_seconds":3576,"text":"some relationship here so if we want to keep our security guarantee fixed and we keep the number of rounds fixed right note that if we increase","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3576s"},{"start_seconds":3586,"text":"the number of nodes right we can actually increase the block size and have the same guarantees right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3586s"},{"start_seconds":3594,"text":"all right so this is kind of an amazing property that you know regular like the we're not talking about lazy ledger yet but just just this property","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3594s"},{"start_seconds":3601,"text":"we have the amazing property that data availability checking uh allows you to have the same guarantees","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3601s"},{"start_seconds":3609,"text":"for larger blocks as you increase the number of nodes right know in a regular blockchain if you execute all the transactions then okay you increase the number of nodes","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3609s"},{"start_seconds":3617,"text":"you don't get more throughput right like every node still has to validate every transaction here every node doesn't fully fully check the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3617s"},{"start_seconds":3625,"text":"entire block right every light node only checks the uh only only checks the fixed number of samples and you download the square root stuff","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3625s"},{"start_seconds":3633,"text":"so as the number of nodes increases we can have the same security uh for larger block size which is which is a really nice property","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3633s"},{"start_seconds":3641,"text":"okay so now now kind of the two pieces of the puzzle are together we have uh we have fraud proofs for any","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3641s"},{"start_seconds":3649,"text":"arbitrary state transition and we have a way for light nodes to make sure the data is available so that fraud proofs can be constructed","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3649s"},{"start_seconds":3658,"text":"right so there's kind of one additional side caveat here before we start talking about lazy ledger which is uh note that blockchains always need to","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3658s"},{"start_seconds":3666,"text":"check for data availability you may have heard some people talk about say of one block chains right where instead of using fraud proofs you use validity proofs","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3666s"},{"start_seconds":3675,"text":"which you know is like a succinct cryptographic proof that some computation is valid and you might think well the only reason you need this is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3675s"},{"start_seconds":3682,"text":"for religious for fraud boost right you might say if you have validity proofs you why do what do you care if the data is available or not right","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3682s"},{"start_seconds":3690,"text":"uh the transactions are valid the the miners can't create a billion coins well you know that some state is valid it would be nice to know what exactly is","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3690s"},{"start_seconds":3698,"text":"the state that is valid that is the problem is that if a minor block producer in general makes a new block but doesn't tell","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3698s"},{"start_seconds":3705,"text":"anyone what the new state is like do you have a state route but you don't know what the state is essentially everyone's coins are burned you they can move their coins because","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3705s"},{"start_seconds":3714,"text":"they don't know what the state is so there is no such thing as no one blockchain all blockchains to be secure need some way of solving data availability and that means either","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3714s"},{"start_seconds":3722,"text":"have everyone run a full node and uh and like actually try to fully download the block it means making an honest majority assumption at which point what's the","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3722s"},{"start_seconds":3730,"text":"point of the validity proof if you're assuming that or it means doing these data availability checks right so there's no such thing as","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3730s"},{"start_seconds":3736,"text":"one blockchain","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3736s"},{"start_seconds":3742,"text":"you","url":"https://www.youtube.com/watch?v=jM-om3AqH94&t=3742s"}],"youtube_url":"https://youtube.com/watch?v=jM-om3AqH94","url":"https://near-pedia.xyz/videos/jM-om3AqH94"}