Whiteboard Series with NEAR | Ep: 8 Ben Jones from Plasma Group |

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:02

   hi everyone this is Alex from ear and with me today is Ben Jones from plasma group guys and we will talk today about plasma cash flow the new flavor of plasma and we will go into a lot of technical details and Ben would you like to introduce yourself and I give us a quick overview sure yeah absolutely so I'm Ben and I'm a part of plasma group which is an open source community driven plasma implementation so we're

2. 0:26

   going to talk about something today that's been called cash flow we kind of considered just a plasma cash variant and it's our specification implementation so particularly the thing that we're going to talk about is we're gonna assume that you have a bit of knowledge about plasma cash and we're going to talk about the like the key difference in this particular variant that we've implemented and basically what it comes down to is an attempt to

3. 0:48

   solve the fixed coin denomination problem so like if you remember in you know maybe in in in the plasma cash world you have these unique coins which have a unique coin ID right and of course these are the things in the bottom of the Merkle tree in the block structure and if you want to send a coin at this particular you know spot in the miracle tree you know you can send a coin so it's you know like a new color

4. 1:12

   new owner whatever okay so that's really really cool and it's great because plasma cash solves like a lot of problems by doing this over like what's called like plasma MVP which was the state of the art before so like the main thing that it solves is like no mass exits okay so very very briefly like why that's important this is just important like with cosmic plasma cash generally

5. 1:36

   is in earlier versions of plasma because coins weren't defined with this sort of non fungible ID what ended up happening was the operator could like create a you tx0 sort of like out of nowhere right it's just like a like a magic poof of aut EXO and then they could try to exit that and this was really really bad because in plasma cash when you exit you're specifying this coin but before you weren't really specifying anything you were two-sport sort of specifying this poof of a previous input and so

6. 2:08

   because of that if anyone saw this occur within the next whatever challenge period we'll call it a week week everyone had to get out okay so plasma cash was great because by making all these coins non fungible you can fix that problem by making exits beyond coins not on these sort of poofy UT EXO's so there's actually really not a ut EXO's in the plasma cash model there's just like coin transfers okay

7. 2:32

   great so that was really really good really really good thing that plasma cash introduced kind of bad thing that introduced was these coins have to be a fixed size right they're like these discrete non fungible things absolutely right so in theory these can have different denominations and I believe there are some cosmic cash implementations that do have different uh nominations however for example in

8. 2:59

   our implementation we do still have a notion of these coins however they're all fixed denomination because we solve this sort of changing denominations in a different way okay so what is it that we actually do to change that it's a pretty simple change it just requires like like thinking about very carefully to make sure that it's still secure in the context of the exit game it's a very simple concept the concept is simply that we treat transactions over ranges

9. 3:27

   of coins instead of particular coins so now here now instead of sending just one coin I define a transaction on a range of coins okay and this is one transaction just one single transaction and with this transaction we may update all of these coins simultaneously but how do you ensure that your coins are in a contiguous range ah so that's a very good question and we'll hopefully get

10. 3:59

    into that later the essence of it is is you have to do that separately and that's gonna involve basically atomic swaps we've explored a few ways to do it it seems like the best is probably voluntary atomic swaps in essence like the idea is that if you have some points here and some coins up here and someone has some points here and some coins here it's advantageous for both of you to align all of those coins because you can treat them and one exit right okay so that's that's the sort of basic

11. 4:23

    transaction format is just you want to do transactions over range of coins okay so what does that mean there's a lot of in in previous discussions on plasma plasma cash flow some people have definitely talked about this as being like coin splitting or coin merging I want to sort of try to break down that idea with this with this video it's really not about coin splitting or coin merging it's about the

12. 4:46

    coins being very very very very small so maybe a three coin transfer is very bad to transfer example in this case in reality in our implementation we have 16 bytes worth of coins and so that's literally like you know bajillions whatever you know exactly 1 bajillion possible coins and you might transfer like thousands of coins so you can so basically the way to really imagine it

13. 5:09

    is like coins on a number line right so that's literally how we treat these transactions so we say like you know a transaction might be on the range 100 200 right and what that means is there's you know like a zero here and then out here is a hundred and then out here is 200 so you can send all of these coins right in just one go and that is the really important property that we have

14. 5:32

    so it's gonna be even probably in practice way more than 100 it's gonna be like you know you could do a million there's really no reason not to yeah and so what now when I send I need to send the proofs over like including whatever they call tin plasma it for each of those 201 collect coins right right yes so this so what you're getting at is like going to be probably ended up being

15. 5:55

    the meat and potatoes in this video because what it turns out to be it turns out to be the case is that it's very tricky to define a transaction format in this way that does still allows you to have like clients okay so maybe we'll like erase this and let go over a little bit on how light clients work in plasma cash so along with mass exits yeah maybe we'll just write it here first like light light proofs we call them like

16. 6:20

    proofs white proofs are a really really really important thing that you can get okay so what does this mean this means that to ensure that your particular coins are safe instead of downloading an entire block you may download just one branch in the block one branch in this Merkle tree and that allows you to have clients which like like we have like if you go to burner class mode that group you can do full verification and it's like a

17. 6:44

    full full node on these light proofs on your phone and that's because they only have to download one branch so even if you have the operator running this massive like AWS instance that's like a bajillion transactions per second you can verify just one and about the same height and so it's just one single inclusion and you're then loading it still for every block right absolutely you are downloading it for every block you absolutely must do that yeah okay so the light Crips were the other big thing

18. 7:08

    that we do maybe will erase this and talk about what those light proofs look like in plasma cash and why they work and that will sort of inform why the range based version is a little tricky okay so I love my Merkle trees right aligned I don't know how the other viewers feel about this but I think this is just like the best way to draw Merkle tree so I'm a big fan as I say messing it up hahaha okay so this is like we can

19. 7:35

    think of this the block structure in plasma cash so we're just gonna review how plasma cash work so at each of these things are these non fungible coins right so we have like Z 0 1 2 by the lot right so in normal plasma cash the way that you do a transaction on say coin to write if we want to turn that into like you color it in square right the way that you do that is in the pipe block at high 10 whatever in this block you must

20. 8:01

    get like the inclusion proof for to write that is like you know Alice sending to Bob let's say right ok so at this exact trace right along the Merkel branch right you must get a transaction right and of course if there's no transaction here then you know things that have been computed right so very simply like that is the light proof structure and the whole point is that because a transaction on point 2 is only valid in index 2 then you don't care

21. 8:34

    about any of the rest of the structure this whole subtree you can ignore write this this apart you can ignore you don't need the whole thing so of course one note in Merkel incursion proofs right you need like the siblings of each node right so in reality it's going to be like you know this guy and a guy here and a guy here right corresponding to this guy and this guy and this guy right yeah and that's how you that's how you do that but effectively you can think of it as just

22. 8:57

    like this branch right that's how I like to think about it okay so that makes sense that's possible that's plasma cash okay cool okay so that's wonderful we don't have to download any of this stuff it doesn't matter at all now here's where the problem comes in the question that you have to ask yourself is what branch what index what leaf index in the Merkle tree does a range go in right because we don't want

23. 9:24

    it to go in every coin that's in the range right so for example if we had a transaction let's say we want to do a transaction over coins two three and four right we want to have just one inclusion proof for that if we had one at point two and at coin three and icon for that might as well just be a transaction of point two three and four so we need some way to describe ranges so we need something right that looks like something like this branch right that says okay actually it's the range two through four right that's what we

24. 9:49

    want to do there was a quick question so if in plasma cash flow if someone sent me a range from 100 to 200 and let's say I already possessed previously the range from 50 to 100 can I send later 50 to 110 you absolutely may yes awesome it is a quite wonderful property of the system and so this is something interesting is why I mentioned before we don't have utx those sort of all of the logic here like is not referencing previous transactions it's all pretty much implicit so like

25. 10:24

    it's implicit that like a like a transaction on a particular range is spending the transaction that was like the last transaction in that particular coin so that that's like the most recent one then some non-inclusion proofs and then the new one right and so it's like implicit that that's referencing that so because of that if you receive this transaction and you receive this transaction and you may spend that immediately but before before we go into

26. 10:48

    how it is actually implemented there's some fundamental limit as it feels to me imagine that I received over the course of time 1 billion consecutive tokens but each of them was an individual transaction you think you have some magic way for me to send all billion of them in a single transaction so that the light client will be convinced that I'm not tricking them without the loading 1 billion proofs ah very good so absolutely you

27. 11:15

    can send in one transaction though absolutely the light client may must check the 1 billion coin sends in the past that's another three unfortunate ok so if you want to get to that point like let's snark it right that's that's like that's the answer to all the problems right exactly but notably like this is like the the right so maybe one thing to note is that it is important that this is not a history

28. 11:39

    it doesn't intertwine histories of coins so one interesting property that we'll see later perhaps is for instance if the range 50 to 150 is transaction transacted right and then I'd like you know I'd like an and then at like block n plus 1 right we see on like a hundred hundred to two hundred transacted right if I and then like let's say like I eventually received coins like one

29. 12:08

    hundred through 150 okay I do not need to know whether or not the owner and this transaction owned coins 50 200 and I do not need to know whether the the the person transacting coins one hundred to two hundred owned coins one fifty to one hundred so this section because I'm not receiving it this section I don't care about and in this section I don't care about so how so like the real worry with that so sure you're like 1 billion coins thing is a problem the really bad thing would be if this could sort of like fan out and end up like everyone

30. 12:40

    downloads the full history so we do at least have this property maintained that you only care about the transactions and the owners on the particular range of the transactions they care about so very interestingly right like it could be that this transaction is like both valid and invalid at the same time but the event that part that you care about is valid the part that you care about is ID so you don't care so you really literally literally the the 15022 could be completely wrong

31. 13:05

    doesn't affect your safety so effectively if the if there's a transaction which sends tokens from 100 to 200 yeah the validity property is per each individual token its particular and the way that that is manifested in practice is that the challenges that you perform are on a particular coin ID they are not on like a range so when you like when you like submit a challenge on an exit

32. 13:29

    and exit is over arranged and you say i'm shaoling that exit but i only have to specify one invalid coin in that exit to invalidate the whole thing and so I just specified the one and it doesn't matter yeah cool let's see how it's done cool okay great so we kind of got to it before I don't you know I think maybe we'll go to a better example than points 2 through 4 because that's kind of a small range and like in practice what we want here is like it's like much larger things so let's do that ok so basically the

33. 13:55

    problem that we're gonna outline here is like is effectively a double spent problem this is effectively like a naive attack on this range space solution okay so let's see what that means okay I'm just gonna do like a height well yeah let's just let's just do it you know I hate to tree okay so let's say right here we have a transaction on 100 200 and by the notation that we usually use this is like inclusive and next-closest but whatever okay okay so let's say that

34. 14:26

    we have a transaction here on on range 100 to 200 okay that's great that's what we want however anytime that I receive a transaction I must be insured not only did I am receiving a transaction but also that there is not a double spend included at the same height okay so here's the problem what if in this block structure like let's say I just download this right so I see this so I see this thing and I see this thing but I don't see these guys right this is the whole struct oh you're saying like this leaf corresponds to the entire range so let's

35. 14:58

    say that this leaf is the transaction on this range yep we want the property so maybe maybe wants me to know they're one of the one of the huge advantages that this scheme gives you over over like the the simpler plasma cash right it is a positive cash variance but one of the huge improvements is that the height of the tree is not determined by the number of coins this is very interesting so before in plasma cash like the height of the there

36. 15:23

    was a max height of the tree defined right in in plasma cash and not defined but for based on that height that fanning out of these Merkel trees to find the total number of possible coins in this version there's unlimited deposits and the height the the thing in every single one of these slots is simply one transaction all right very critically just one so what that means is that the height of the tree is not the log of the number of coins

37. 15:47

    it's the logarithm of the number of transactions which is a really nice property so to get that we need one transaction per leaf okay that doesn't sound like it will work yet it does it it's yes it's very it's very very tricky you're totally right right so what is the problem so obviously the attack here is if I download this branch right basically what I get is I get this thing I get this guy and I get this guy right and I'd use that to compute the route and verify it against the route on the

38. 16:11

    etherion main chain okay so what's the problem the problem is that I haven't downloaded these guys right so it's a really really problematic thing because what if right here there was also you know 100 200 right and this was like you know A to B and this was you know a to C and I presumed transactions are sorted in some way and they ah so the solution that we will impose will like be sorting

39. 16:36

    will end up being sorted absolutely however like it's one thing to note here that you don't like you could theoretically implement this stuff without doing any sorting environment and you just would lose like client support which is very interesting because you remember that before we wrote the 2mass exit the mass exit problem as being one of the problems with older versions of plasma where if

40. 16:58

    an invalid exit began everyone else had to get out those those older versions also didn't have light clients like plasma cash sort of like found both the mass exit solution and like clients and one go if we do this range thing interestingly we can actually get rid of mass exits but not have support for light clients so if you just were required to download all of these leaves and make sure that there wasn't a 100

41. 17:22

    200 transaction there that would be that would actually still be better because it would solve the math eggs problem but it's that ideal because we really really like the idea of light clients so was it the beautiful solution okay so the beautiful solution is that we need some way for just the information in this branch we need a way for just that information to be sufficient to prove to the white client

42. 17:46

    that no other such valid transaction on the same range on an intersecting arrangement and an intersecting range exactly right exists over here right and so effectively what we're gonna do is we're gonna do like a like like a branch validity condition right so we already had one of these in vanilla plasma cash okay the bridge validity condition is very very very simple for a transaction on

43. 18:13

    range three for a transaction of coin three the valid branch is branch three right that was a very very very simple ability condition and that's the basis for like crime proofs so all we need to do is do a blanch loaded condition for ranges right that's what we need to figure out right and like that really ends up being like the key problem that you have to solve with this okay so does

44. 18:39

    that make sense questions well let's see how with a competent smell the agent works okay great okay so the trick is we no longer are doing a simple Merkel tree okay so there's actually so interestingly enough shout out to Dan Robinson who came up with an incredibly beautiful even more elegant solution to this than we previously had so in like lots of nice research posts and stuff there's been a more contrived answer called the Merkel

45. 19:03

    some tree okay what we're going to go over today is something that actually I don't think has been written up to date but it is a merkel index tree and it's a little more intuitive way to think about it actually a lot a lot a lot more intuitive way it's like it's very very beautiful shout-out to Dan he's amazing okay but the basic idea in all this is that a Merkel tree just ain't gonna cut it we need to add something into the

46. 19:28

    Merkel tree something extra does it allow us to prevent this now you might consider like separate an entirely separate data structure that the validity condition also references both of these data structures and does it that way I haven't really explored thoughts either but you might even imagine that you know you could do some RSA accumulator magic all the fun plasma memes right but the best one would be to just embed it in the block structure itself okay so that's we're gonna do

47. 19:52

    okay so like what does that mean in practice like it's like to define like an arbitrary binary tree right like what like like the way that you define that is simply like the parent function right of left and right right so this is the left sibling and the right sibling whoops I'm saying sibling right right so in a Merkel tree right a Merkel tree is a binary tree where a parent equals hash right very very very very very simple okay so we are going to

48. 20:24

    make so that so that's like Merkel right like this is like vanilla Merkel right what we are going to define is something called a Merkel index tree okay so maybe one other thing to note here is that we would have to define like what are the what is the set that left and right belong to as well like you know sort of math sense so like in practice we would also have to say that the left and right

49. 20:46

    are these 32 byte hashes that the parent resolves to okay so now we're gonna define a new parent function and we're going to define new data elements for the left and right so before maybe I'll just maybe I'll just like continue the like the vanilla Merkel tree thing here right and we will save vanilla so there's been no Merkel tree has a parent that's just a hash function right and the elements right like the the nodes

50. 21:10

    will call them the nodes right like every one of these things right is a node in the Merkel tree so the nodes are bytes 32 hashes okay very very simple most hash functions return to 32 bytes so the hash function is like the only thing that we need is that the parent emptied resolves to a node so it requires that the hash function resolve to 32 byte hashes and then we have the effect that we want that do you

51. 21:34

    you know we can build the whole binary recursive beautiful thing with this data structure okay so now we've got to update the nodes and we've got to update the parent okay great so let's do this we're going to call this index index merkel some tree okay and so as a spoiler alert like the reason we're gonna call this index is because it's gonna refer to the index of some coins so it's actually gonna refer to

52. 22:00

    some coins as we go up the tree and maybe that'll begin to start making you think about what this actually does so very simply a now a node equal is a tuple it is a bytes 32 hash and it is a coin ID so now every node in the Merkle tree has a coordinating absolutely and so so you know you'd be careful when we say has a coin ID right like it it references a clone ID it's not that it has it and there like an ownership sense right of course but it does indeed point

53. 22:34

    to the coin ID that's one of the like it would be like 173 for example it's not arranged exactly it's not arranged it's just one exactly and so and so yep it's by 32 on ID and similarly the parent just the only thing to note on the parent is that the parent equals hash the parent function is the hash of the nodes so like left and right note that this includes the cornea is the coin IDs as well right so you're committing both to this hash in this hash so like in practice what you do is you take the left bytes 32 concatenate

54. 23:07

    the left coin ID concatenate the right bytes 32 concatenate the right coin ID right and so that's all we're gonna Express with that and then believe it or not it's simply the left that's going a coin ID this is why it's a it's much more beautiful this part it's very very beautiful before we were doing an edition of the coin IDs effectively it was very very messy this is a lot cleaner yep so that says left coin ID

55. 23:30

    there so let's give me the property so believe it or not that's gonna give us backlight clients super cool super cool let's let's see how it works yeah let's do it let's do an example okay so I'll clear this off here great great okay okay so and then oh the other thing we're gonna have to do obviously is define an ability of validity condition but maybe it makes sense for me to just do an example wanted yeah it has done example yeah oh it's an example

56. 23:57

    okay so I'm going to start with the leaves because that seems smart so let's say we have a but also doing it to know by now what is the sorting is the ordering of the ranges of the transactions very very interesting question so interestingly the validity condition will enforce a sorting so namely the property that we must have is that as you go up the tree the coin IDs for the things that are being merged in from higher and higher up must be

57. 24:27

    greater than the previous step down so as you work your way back up the Merkle tree the coin ids that you're pushing in must be to the right of the coin ids on the left and they must be like increasingly to the right and that's gonna end up being the property obviously the leaf coin ID is just the coin idea right oh wait there's no point against transactions yeah exactly so we're get one thing that we're gonna

58. 24:50

    need to figure out how to do is what we call like parsing the the the transactions into the bottom nodes like turning the leaves into the bottom level of the tree and it's and it's and it's and it's actually going to end up being the effectively the left of the the left of the range is what it's uniting as well we had a much more complex thing where you had to subtract stuff Oh point ID so beautiful it's so beautiful

59. 25:14

    alright so example okay so let's say maybe 0 10 let's say 10 50 let's say you know whatever 50 100 and then let's say like 100 500 okay let's go with that and maybe I'll erase it very simple Markel tree here okay so we're just gonna do four we'll just do four for now okay it's maybe hopefully won't be to degenerate we might want to add more but and so that's something that's a valid example where there's no intersection this is yes so this is a valid example

60. 25:55

    is there's no intersections and what we're gonna do later like spoiler alert we're gonna try to change one of these to an overlapping range and we're gonna show why that breaks the validity condition so that's what I'm doing yeah so that's in effect the idea is that if this has ability condition this can't also have a validity condition it's like one or the other right absolutely okay cool so let's let's get

61. 26:19

    our let's get our handy-dandy parent minds okay cool so this aren't gonna end to be pretty easy I'm not going to write the hashes up here right because that's like sort of just like you know we we assume that we're committing things it's a Merkle tree whatever right so the base property is that you literally it's it's so simple honestly you take the leftmost thing in in each of the ranges so here we're gonna get 0 here we're gonna get ten here we're gonna get 50 here we're

62. 26:50

    gonna get 100 okay so that is our that is our thing and like notably this was like an actual steps that we just did here where we took this transaction which is also going to have like you know in a sender and recipient Alice Bob blah blah blah we turn that into just the hash of that thing and we also pull out the start right so like each of these are really like we implicitly did a function here to turn these from transactions into hashes with an index

63. 27:14

    but we're just gonna write the index cuz that's the important part okay so it's very simple parent function is equal the hash of both of them right we're gonna execute the hash and the left coin ID okay so here where you take the hash it's the left so zero here we take the hat that you know we take the hash take the left so it's 50 right and here you have the hash it's your right it's always going to end up being zero at the

64. 27:38

    top okay right so what is the validity condition so the validity condition states that that this zero I'm able this like pointed out and say in words it's like a little tricky to write this 0 must be greater than or equal to this 0 and this 0 and this 0 right effectively like the the transactions range it must be within the bound of this 0 right the other property is that this 10 must be less than or equal to this 1 and it must

65. 28:17

    also be less than equal to this 1 in fact even more strictly this 50 must be greater than this 10 so this town must be greater than equal to this this 15 must be greater than this 10 and there's another condition right so if I go if I start from here and this 50 must be greater or equal there's ten right like in you you need the you need to check both ah so notably when you get this 50 you never actually

66. 28:40

    see this 10 so let's maybe this was simply this is a better case actually right so let's look at this 50 when you download this Merkel branch what do you get you get this and you get this right right and so you know it'll probably useful to do like an S size 8 tree because this is you know there's not like a lot of things going on here but it's a good simple example so the property is actually that this 50 must

67. 29:03

    be so so so actually what it is you also get this one and so the real property is that this 50 must be greater than equal to this 50 and this 100 must be less than or equal to this 100 I might be running ahead of the trend right but let's say that this one was 55 yep and I as a light client it seems like I verified everything and everything's checks checks out but there is actually an intersecting transaction right yes so that's so this is the beauty okay so

68. 29:33

    that's exactly right what we want to do is try to break this thing right okay so what you're saying is a great way to break it like the way that you break things is you make intersecting ranges the trick is though oh that only really breaks it if both of the ranges pass the validity condition so let's change this to 55 like you said and let's do the check so I'm going to I'm gonna erase these circles because we're gonna get some new circles for this inclusion proof and it's probably worth probably

69. 29:57

    worth circling them so hopefully that is very aesthetic right okay so we're gonna do this one so what do we get we get this one we get this one right okay so check it out we get this we get this zero we see the you know blah blah blah so the ten is good right because the pan is greater than the zero its greater than the ten here right yes so we also did get this one actually so the 10 is greater than here right and then like the you know this is a valid left

70. 30:21

    index umm tree where this zero isn't you know indeed goes up right right so the 10 the 10 checks out however the 55 does not check out why is that the reason is because this 55 is greater than this 50 but there's a live client I don't under then load my transaction I have no idea that this will EDT check doesn't check out that's the beauty okay we'll restate your question maybe so as a light client right so let's say I'm a light client and I receive this transaction right so someone says I'm sending you range from

71. 30:52

    50 to 100 and it's going to be in the Merkel tree it's going to be at the position here and so what I assumed what I'm going to do is I'm going to get this position and then load it from like all the way from the past like for in every block I will download this miracle path right with indexes but I will not download this one right so so there's two things there one of the things is that actually the leaf index changes every single block so every single block

72. 31:16

    you download a different binary trace to a different index so that's one that's one but it's going to be the same arrangement every time well you might have to download multiple indexes if the rangers was transacted but i'm provided with the proofs for all of them you provided with the proofs exactly and so the operator gives you the proofs and he says look this is the range you want to see but for the light client in this particular block yes let's say I'm receiving transaction from 50 to 100 yeah what will be the proof the proof

73. 31:40

    oh so for 50 to 100 yeah so for 50 100 the proof will be circled before it will be this 50 so maybe I'll put that in square and we'll do like circle square so do you get this you'll get this you'll get this and then as a light client I give this proof I'm not aware that there's an intersecting transaction ah and that is the beauty of it you are not aware that there's an intersecting

74. 32:03

    thing here and you don't care because you know as soon as you see this number right here you have a 100 percent guarantee that this 55 will fail the validity check assam named Elisha has actor could possibly exact all that even if a malicious actor does place a 55 here the smart contract will reject it right and the reason for that rejection is because this 55 is invalid because

75. 32:26

    it's greater than this 50 right and so and so the fact that you have this 50 means that you know that anything greater than 50 here will will break at that level so even though you've only downloaded this even though you just download this square branch because this square branch like gets you the 50 right because it does that you have like a hundred percent guaranteed that this horrible invalid stuff will be

76. 32:50

    invalidated and that that is the light client property yeah I'm completely sold nice yes should we go through maybe we can go through a more complex example like maybe yeah yeah I think it makes sense to do examples okay and then the other thing so the other thing we'll do in this example is you'll note that you'll note that this is like the range 0 through a 500 was all transacted on this like was all transaction there's no coins that weren't transacted in practice this isn't going to be the case right there's

77. 33:21

    gonna be big ranges of coins where the owner is doesn't want to spend the coins and so there's going to be gaps and so the next example that we'll look at will increase the height of this tree will double the height or increment the height and we will make some gaps and then that may be that will be pretty informative and and to prove that something does not exist you provide like two two paths or like you actually or you actually have an amp to get very interestingly will even show

78. 33:51

    that it can be just one it's very very it's very very interesting and it's even shared between all of the adjacent ranges that also aren't transacted so we'll do that we'll do that okay so let's do a simple example let's do 0 10 okay am i maybe I'm gonna start I'm gonna start down a little lower and bigger so I don't kick myself in the foot here okay so let's go here we'll say 0 10 okay now we'll go here we'll

79. 34:15

    say let's make a gap so we'll say 20 30 okay and my space inside right 3 4 5 ok I need to do this smaller honestly don't I so I'm just gonna do that okay so let's go 2030 let's do you know whatever I mean this can be you know literally whatever we want so 50 hundred right let's make it thousand two thousand maybe maybe I'm gonna regret having to read one check two zeros up there but oh well something invalid maybe oh that's a good idea yeah so why don't we do why don't we do

80. 34:56

    7 to 75 75 to 100 so the idea with the single ranges that you actually like like if I if I give this range and then somewhere along the way I will get 50 as the left right exactly right exactly right exactly right yes it's yes exactly okay so we've only drawn eight transactions here so it's not a full tree but maybe I will do one more so we have this invalid 75-100 here and then I'll maybe give that a sibling and we'll

81. 35:25

    call this like you know back to a valid thing so we'll call it like you know two thousand three thousand okay so take there's gonna be some extras here we're just gonna draw like a truncated version sort of ignore the subtree okay so let's do that OOP here we go all right how are my Merkle tree skills we're doing okay we're doing okay of course this is going to have a like that we haven't seen but imagine it's there it's not gonna matter for our examples and

82. 35:56

    then of course we have the root okay how does this look does this look fine yes yes we have drawn a Merkle tree wonderful well we've drawn a binary tree I suppose okay so why don't we consider some of these some of these gaps over here so maybe we'll choose saying this guy's a good guy did inclusion for for yeah sounds good sounds good or actually let's construct the whole part of the subtree that we have here let's do that okay so again so 110 we take the left to 0 20 30 20 and quick question so if

83. 36:29

    let's say that that malicious operator created a they just populate at one of the left or one of the how do we call them coin egg isn't correctly that then then is it some sort of a challenge that will show that this is the case so imagine the time of militias operator I'm colluding actually on this example right as I compute the merkel root then the murder the miracle tree i will just say that the coin ID here is 2,000 which

84. 37:04

    is incorrect which is a lie which is a lie but but i will compute the proof all the way up right so it's also going to be 2,000 here and then for someone over here i will say oh you know what your proof is your proof is this node right yeah it's I guess this node this node right and this is this node honest and this one says says it's 2,000 and and then you as a as a light clan you say perfect my-my-my

85. 37:30

    transaction is correct right so I presume there's got to be some challenge right that's the trick well that that's that's the beauty of it because this says mm you are guaranteed because when it is because when this because when this person tries to exit right they'll they'll they'll they'll try to submit that proof to the smart contract in smart country okay 75 Shore 2,000 Shore now we want the left node they won't get

86. 37:54

    a 75 there's 75 years 2000 oh go and it's not going to work so it's it's an invalidity it's a validity condition and then in practice like where it is in our code right now for example is what what is going to happen is the route hash is not going to be the same route hash that you end up with as the root hash of the as root hash that was submitted right because the smart contracts as it's simulating the the inclusion proof is

87. 38:17

    going to put a 75 here and because the mm was put here the entire root hash was going to be wrong and so it won't be used and so that's the beauty of it as soon as this guy sees this mm he knows that even if this range does intersect this stuff it's going to be invalidated it's not gonna be okay and so he doesn't care what's there the operator can screw up other portions of the coin but he knows his is good of the corn range yep

88. 38:41

    okay yeah so maybe we'll just finish this tree so we go to zero 5000 it's always zero at the top mm mm yeah so this is an interesting case here we're like we sort of did the wrong example right for this thing I think we've actually gone over this exam pretty well so I'll leave this as invalid here let's say this is 75 mm yeah okay okay but look very notably right now what we have is a very broken

89. 39:06

    tree um so for this tree only these two transactions check out right it's very interesting this one's checks out oh you're absolutely right yeah yeah you're you totally right yeah so particularly the coins like in the range like 50 to 75 are sort of like these proofs they're like ah I don't know what to do with this it's sort of invalid right and that's like interview a problem for them

90. 39:32

    hundred percent yeah but you're totally right this guy this guy will be totally pleased and these maybe pleased as well yeah that's right that's right yeah okay so what do we want to do with this okay so maybe we can walk through like a simple check so let's walk let's walk through the check of this guy I'm sure that it's right and then we'll walk through the checks of these guys I'm sure that this screwed things up okay so let's let's do let's

91. 39:56

    do this check so let's call us let's do a triangle okay and so what is this inclusion proof get this gets this guy gets this guy gets this guy and that's it right the wonders of vlogs haha so ok so this guy he gets this this and this so what are the checks he needs to perform the 1 check they need to perform is that for the left guy the the his his start of his transaction right is like is like greater you know it's greater than or equal to all of like the indices going up so oh and actually he also gets

92. 40:31

    this one as well it is required to give this thing that this is parse to like take it back actually it can be it can be implicitly inferred okay yeah you don't yeah it just it calculates it from the 20 right there okay so the 20 he looks here he goes okay great is my is my is my 0 less than my 20 yes okay we're good sweet does this check out through the left thing yes we're good okay now he goes through this level he goes okay is my 30 less than or equal to

93. 41:03

    my 50 he goes yes oh my gosh great it is so we can go here is this zero the same as the zero here yes it is does the hash check out obviously to now he gets this guy he goes okay we've got a 75 so for the 75 he needs to be sure that this 75 is greater than this previous 50 so he goes okay 75 is getting the 50 oh my gosh we're almost there 75 and zero does it go to zero yes we're good okay so the triangle

94. 41:26

    transaction in this tree that we've constructed the triangle is like totally happy he's a happy cat can keep on transacting do it every one right but of course we did insert this sneaky little guy here so we're gonna see how it breaks okay so let's watch how it breaks okay so let's do maybe a square for the 50 to 100 note that this is going to be the one that really really breaks because there's a 75 to 100 there right as well okay so what

95. 41:52

    the square get the square gets this guy he gets this guy and this guy as well right so very very quit somewhat similar okay so what does he do so he sees okay I've got 50 to 100 what did my 50 turn into a 50 yes we're good did this 50 turn into this 50 yes we're good 50s you know less than equal to 50 so we're okay now he goes to his 100 he goes okay I got this guy is my 100 greater than or equal to less than or equal to my 1,000 yes oh my gosh it is wonderful okay so we go up here okay we got the zero here is the zero less than

96. 42:27

    the 50 yes is the zero the one propagated up yes okay great now he gets this one he goes okay is our 75 greater than or equal to our a thousand because oh no we're not so we see here that this is like the breaking point for this inclusion proof because of this overlap right that is what ends up happening so like we have because 75 is not greater than a thousand because that's not true then this would be an invalid block and it's an invalid block and this person

97. 42:59

    must stop so any transactions and exit there it's found the greater equal right I can't be equal it can be it can be equal actually it can't be greater than equal yeah that's absolutely fine right okay so this is a simple example of how it broke right and of course if we were to like invert our heads and imagine again like we did in the beginning that this 75 was like the invalid thing and this was the 2000 and this was 2000 then

98. 43:26

    it would be good because we would have to thousands greater than equal to 1000 that was exam played before and we would know that that invalidates this all types of these things so we're good okay so that is maybe a more complex like eight you know you know eight eight eight eight transaction tree that make sense yeah this is yeah I'm completely sold yes it's it's wonderful okay so let's talk about cool properties of this oh yeah because we're gonna talk about

99. 43:52

    the gaps and this is very important right oh yeah that's let's say that we need to prove that 10 to 20 is a gap exactly exact whatever the better 30 up to 50 I guess 50 so let's say that I own range 30 to 50 and I want to be ensured that my money was not spent what do I need for that believe it or not it is just one branch and that is really really really awesome so as a matter of fact this triangle

100. 44:21

     branch both fruit is what we call a an a non-inclusion proof for coins 3250 just as much is an inclusion proof for coins 20 to 30 okay so let's let's think about that why that is okay so when we get the triangle thing right what do we get we get this guy we get this guy and we get this guy right right and maybe should we change this back to 2004 now I think yeah sure no oh no no no because it's okay for him it's okay for him yeah it

101. 44:51

     will work Yeah right okay yeah wonderful so okay so let's say I didn't transact coins 30 to 50 right what do I see what from this well they're really the only thing that I care about is I see that this that this 30 is like you know less than or equal to my 30 that you know that I own right so like because this transaction ends at 30 I know that this transaction can only talk about twenty

102. 45:15

     to thirty right so at work so we're so we're good on what this guy can do right and then we see obviously the zero and the zero and the zero it's like a valid branch like that's obviously important and the other thing we see is we see this 50 right here and the cool thing about this 50 is we know because of this 50 that the start of this transaction must be 50 right and it cannot be less than 50 is really the key property there

103. 45:39

     cannot be less than 50 so therefore simply by getting this triangle the same inclusion proof for the 20 to 30 spend this single inclusion proof is both a span of 20 to 30 and it is a non include and it is a unspent proof a proof that the coins weren't committed to being spent on the range 30 through 50 here right so like it's like both an X here and like a check here right and it is

104. 46:03

     the same exact sort of triangle proof but supplies you both so that makes sense yeah seems reasonable okay so what is like one really cool thing about that one really cool thing about that is you know this is like a very simple example but imagine this this is of 30 and this was a 2 million right even with that it's just one inclusion proof and let's say you know let's say there were like a thousand owners between 30 and 2 million and none of them transacted all of them shared the same single Vonnie pollution proof that

105. 46:35

     is just this triangle transaction and so what that means is you actually have like history overlaps which is really cool so in plasma cash normally like every coin had a unique history that was at a unique branch in this version anytime a coin is unspent if its neighbor is unspent both of them download each other's inclusion proofs right so you can argue that there's like dangers for that with regard to privacy like maybe that's a little less private but you can actually like you can split

106. 46:59

     it up and have like a transaction that says like one hundred to one hundred like it has no it's like empty and that would be fine as well so it's really it's a really really interesting property that you actually have like shared sort of non inclusion proofs for adjacent coins that weren't transacted cool so I think my the most interesting question that I have right now is so let's say I'm I'm a merchant I'm a

107. 47:23

     coffee shop and I saw a lot of coffee during the day so during the day I got a lot of and let's say lowest elimination is five dollars and happens to be exactly the price of a latte and so I got a lot of them how do i defragment how do i how do I bring all of them together to send all of them to my cold storage so I will so I will push back on one thing you just said which is let's

108. 47:46

     say the lowest a nomination is five so in this model even means this 15 or 100 is way smaller numbers than we deal with in practice so like we actually in code like in code way into our into our coin IDs because literally like the size of like the the what these numbers are defined the size not like the amount of transactions or anything so in reality like the all of these constructions allow you to do like you know many like

109. 48:10

     a millionth of a cent pretty much at the same price as if the minimum denomination was five anyway your point is still totally valid right so the question is so high maybe there's like a good way to visualize this okay so like the way that I sort of visualize the plasma cash flow construction is I imagine like a number line and I imagine different colors on differ segments of that number line and colors going there and the color is the owner

110. 48:36

     exactly yeah so we might have liked it you know like a like a dark purple section here and then a light section here and then like a Dayak you know a diagonal thing obviously we don't have a lot of Karluk colors so this is like the best we can do right but but you might have something like this right and so absolutely the the thing that you need to solve in this in in this scheme is even though we've broken down the

111. 48:59

     denominations the coins are not adjacent and that means that they need to be exited separately and that's bad so like imagine that this guy so imagine the coffee the cup let's say the coffee shop owner is like a squiggly squiggly right so imagine that like this is block N and like a ten plus one like a bunch of people buy coffee right so now so now like this guy bought some squiggly coffee here and the rest is still his

112. 49:23

     right and this guy bought some scooted coffee here but the rest is still his it's like it's changed right almost right the next guy bought is who they coffee here Oh God I kind of did squeal spice here we'll crosshatch there we go and then and then this guy still has his leftovers here right and similarly this guy did a bit here so azen's leftovers there right so the problem is that now the coffee owner the squiggly guy owns this is this oops

113. 49:48

     this and owns this right the problem is that this so so there's a few things to note about this in theory there's something called like a mass exit or like like the like how do I want to say this okay so like in theory what we need to do at the smart contract level is support effectively like arbitrary compression algorithms on the ranges of coins that you're exiting so like we have a very simple compression algorithm in effect on our in our current exit game which is start and end right you

114. 50:27

     know when you exit coins 50 to 100 right in plasma cash what you do is you say I magazine coin 50 on I'm 51 on exiting 20 50 - I'm Isaac 153 right and so we technically like our exits are like a compression of that right which is very very simple it's just the start and the end right so very very like basic like compression you don't the structure of these coin IDs is all being adjacent so one thing that we want

115. 50:50

     might want to do is like provide the coffee store owner the ability to begin an exit in which they sort of describe these intervals in like a compress useful way so like the simplest way might be that the coffee owner says well my coffees are all $5 so I'm exiting a bunch of coffee payments and they're each five dollars long so instead of giving you the start in the end I'm just going to

116. 51:14

     give you the start right and so then they just give this start and this start and this start and this start right and buy the thing about a boom they've they cut it in half because it just starts and one length instead of start and start and start and start in it's like already that's an improvement right and in general what we're talking about here is like compression right and there's like massive amounts of you know like it's lossless compression specifically right but for the a I can I just say I

117. 51:36

     want to exit all my coins from here up to here so then transaction is very small I mean it's still like the the operator will have to record each of them what my exit transaction is tiny now in what I've just described I'm suggesting so then your turns are in what you just wrapped you effectively reducing the size by a factor of two right yeah well I'm saying what if I just because for each of those tokens

118. 52:02

     right the owner is known like the public key of the owner is known right that is true for like for like people with availability on the plasma chain from the cart smart conscious respected the smart contract has no idea so when use whenever you submit an exit to the smart contract you need to specify this is the exact set of coins that are owned right now and like you need to accept challenges if they disprove that this is

119. 52:26

     the coins that are owned by whom right so it's not just a simplest thing I'm gonna exit all the coins that are owned by me it's my contract needs to know how many coins those are and and very importantly which coins they're like very very critically okay so I just subscribed one weird like sort of compression thing and like you know to the extent that we can do on chained compression like we're gonna strive to have things like that and this is like a general class of what what has been previously called like mass exits you can do all sort of fun stuff here you

120. 52:51

     can like do true bits over these numbers you can like submit a merkel root of this and have someone challenge you to reveal them and lots of optimistic finance stuff but the core of it is that it would be much better if we could just get all these things mixed up so that it is one contiguous range like like like even if we have better compression we want to make the data like as compressible as possible and big long continuous ranges are like very very compressible okay so

121. 53:17

     the way to solve this we've considered a few different ways there's like two classes of it but what we're calling it as defragmentation right we want to take all these squiggles right take all these squiggles and make them one big long squiggle right and then we want to like shift all this you know this dark section and this skinny section and these cross hashes and these dots we

122. 53:34

     want to shift them all so that they're all pressed up against each other as well okay so we're calling that defragmentation and like there's like several III search posts on this for all listeners the III sir dot CH III search is an awesome form you guys should all check out Vitalik has some defragmentation posts on there but the one that seems most promising is atomic swaps so basically the idea like without rewriting another example which I will do in a second basically the idea out loud though you simply have this guy

123. 54:04

     swap his dark section over to here and move this section over here so it's like I'm exchanging coin one with your coin five and even though the coins are both worth the same amount so it's not like we're actually transacting in terms of value we are transacting the like excitability because they're not fungible in terms of their history so like maybe we'll do a much simpler example here right so imagine that this

124. 54:28

     coin range is owned by Alice and then this coin range is owned by Bob right and then this coin range is owned by Alice right and then this coin range is owned by Bob right it should be very clear what we want to do here what we want to do is switch these two guys back right so instead what we want to end up with is like a you know this is a high down and then at high n plus one we want to have suddenly this right right and so

125. 54:58

     what has been done here it's an atomic swap on these two things right and we want to insure for Alice and Bob sake well obviously you know if we're assuming these are all equal quarters and let should all be right the the thing that we want to ensure is for both Alice and Bob that they are like safe in the event this happens in other words Bob can't somehow be tricked to sending these coins to

126. 55:22

     Alice without receiving Alice's coins right okay and one very important thing here and this is like this is in general I think something that people very much struggle with intuitively in like the cash flow interpretation because we think of these ranges as like we think of like the things in the Merkel tree or like the transactions as being coins really they are like updates to the underlying coins so when I draw these

127. 55:47

     arrow here arrows here I actually think that this is maybe a little misleading because it almost looks like you're taking these coins and you're swapping places with them so actually I think that's probably a bad way to draw it and probably is like badly reinforcing what you're really doing is you're keeping these coins like here like they're the same coins but you're swapping the owners you're swapping the owners so that's really what you want to do you

128. 56:10

     want to take you know you want to take continuous ranges and maximize look like continuous range miss at each owner and so you need atomic swaps to enable that it's pretty easy to do an atomic swap well it's it's it's non-trivial but it's relatively easy to do an atomic swap basically like two atomic swap this range with this range you need inclusion groups on both and like if both inclusion groups are present that's good

129. 56:33

     so now instead of just checking the triangle like the transaction says you got to check the triangle and the square for this guy and you check both the triangle and the square and they swap so our contracts for example currently support this point this atomic swap functionality but like the strategies as to how we're going to convince people to do this because people have to be online and like sign off to agree to do it in this case like we think it's

130. 56:56

     incentive compatible because both Alice and Bob like are helped by this right like their exits go down but the coefficient for example is more interesting actually not true the coffee shop is that was much harder okay but like if we if we replicated here right so this is my coffee shop yeah that is definitely soon so that's the coffee shop owner is the rectangles and that's like one guy and this is my the co-efficient of owner some other guy and

131. 57:20

     the coffee shop owner and some third guy yeah so here the first so let's assume that people are willing to help even if it doesn't benefit them much so here the first guy will say yeah you know I'm going to be willing to help you and exchange and like coffee coupon yeah so yeah those guys are willing to help and so what happens after he helps me is that his continues here and my and I

132. 57:48

     haven't exchanged or even that would have been a bad idea for my aunt actually for me it would have been better to have him here and myself here because that helps me to convince this guy to exchange because pre-human still no castle exactly but then I'm sort of in trouble because like like for this person it's not beneficial to exchange with me because right they will get ya and so

133. 58:14

     these problems are tough and in general it like like we can hypothesize a lot about like what like these defragmentation like structures may look like so like one one I want observation that we've made for example is that it's probably going to be a role of the operator to suggest to these two clients it's like what we want is will abstract all that away like we don't actually when you're buying coffee you don't have to agree with the coffee you know I I joked that you get a coffee coupon but

134. 58:39

     in reality you don't want ever to be buying a coffee and then like the coffee shop is like by the way can you like switch those around so you know like canopy right there in force changes can the operator in force changes so it's it's the operator can enforce so it's tricky so the for the people checking us out on III search we have a plasma cash defragmentation take two there's three

135. 59:01

     defrag posts fatah like and one talks about this and it's very tricky you can't allow the operator to enforce this off chain so if you indeed I'll do the swap it must be the case that all of that swap data is put on the main chain so it doesn't have very good scalability but if you don't the operator can swap you and like withhold that he's swapping you and he can exit the things that he swapped you to and like you don't have a way to challenge it and then he like and then he like you know exits the things that

136. 59:32

     he swapped you from and he can like steal you know like he effectively like you imagine that Bob is the operator and the operator exits this and then exits this right and like takes but like what you know both of both this total range and only half of it was owned by him so to prevent that you have to put this like the ranges being swapped have to be available on the main chain which is kind of bad there's maybe more complex things you do you can like

137. 59:57

     define like a non chain permutation and like compress that permutation or something right but in general it seems like atomic swaps are the way to go because one of the things that we'll probably have here is probably in reality there's gonna be times when there's just a big long range of coins that is like a whale you know I'm like this decks or whatever and like it's gonna be an extra like source of like like fee revenue if they use their liquidity to help a bunch of people just

138. 1:00:21

     totally like migrate atomic swap into them right you know and just like totally move everything over but it's definitely an active area of research and like one that like is gonna be explored more in the future for sure cool okay I think we covered quite a bit of material yeah and so let's wrap up here and I think one thing would be good to know is where can people find implementations of that or like where to go for research and stuff sure absolutely so if you've got a plasma dot group we have the all the info you need so the state of the implementation is as

139. 1:00:54

     follows we have a spec we have a smart contract written in Viper we have a node a an operator and like helper libraries like it's kind of like an SDK all written in JavaScript so github.com slash plasma - group or go to plasma group and we'll link to all that stuff and we would absolutely love that like we're absolutely trying to build a community of developers this is like we're a nonprofit organization like it's just our goal to help promote this stuff

140. 1:01:19

     as free public good stuff yeah so that's fantastic if you want to just try it out you know I mean it's like an NPM install for both running up here on spinning up you're an operator which feels really cool to be making these trees on your laptop right that's really fun is there a visualization there's a black Explorer there's a black Explorer yep it's not as cool I wish we have that the visualization of like just this it's just kind of lists of transactions my end goal is we're gonna have amazing

141. 1:01:43

     colorful rainbows of ranges and all that right but for now there's a black Explorer up if you just want to like try it out and transact and like learn about depositing stuff you can also go to a burner cause plasmon group and we've integrated like the amazing Austin Griffith Springer wallet 4x die right on plasma so those are all things you can try and we like super encourage you to check that out yeah okay thanks for coming thanks guys