Whiteboard Series with NEAR | Ep: 6 Rongjian Lan from Harmony |

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:02

   hi everyone this is alex from near protocol we're in Cupertino at Harmony office with me today is r.j. one of the developers of harmony and we're going to go into very deep technical details of harmony protocol today RJ would you like to quickly introduce yourself and give us an overview of how harmony works okay hi everyone I'm RJ from harmony I'm the core developer and co-founder of harmony how many is a high-performance blockchain that features sharding and secure proof of

2. 0:33

   stake and our consensus is a fast pbft consensus I also like improve on the network infrastructure so that the Chardon network can operate in a special way you want so let's get the high-level overview so in harmony we have two type of chains or two type of sharks right first is the beacon chain which is like overarching chain that controls the overall network starting construction so there are different Sharks like this

3. 1:22

   each shard has its own chain like this so yeah should play it back so the shark chain will process transactions separately so each chart has its own stage right so for the for the head of the block they contain the states of the shark so harmonies stay sharding which means the state of the parties they are separated and stored separately in shark that those states are different contain different data and the for each chart is separately process transactions in

4. 2:05

   parallel so let's say you have a transaction here and this transaction is specifically for this chart one so this chart one will process this transaction by itself and shower two will like ignore that transaction so this will like multiply the TPS by the number of sharks because they're processing the transition separately and short to medium term how many charge do you expect to have

5. 2:36

   maybe at the first launch of the net will have about like ten or two to like like below 100 but the design of the network like what is the largest number of charge it can support yeah it's a good question it depends on the beacon chains processing power so I haven't said this so in for the beacon chain began chain just like a normal shirt but it has additional functionalities so one

6. 3:09

   of them is for generates secure randomness another is storing the cross link from the other shark howling from the other shark so for the randomness the begin chain need to use is to run distributed randomness a generation protocol to generate this secure randomness that's unpredictable impossible and like verifiable so that it's hard for people to like bias this randomness or like many of you know randomness because the randomness is important in the sharding process why is

7. 3:55

   it is important because we wanna randomly assign the validators to each shark so that the attack the attacker won't concentrate there like voting power inside a single shard so that required this secure randomness another function for beacon chain is the cross link to the other shark so for each of the Block in the char that's generated you will sent the header to some of the blocks in the in the in the shark chain in the

8. 4:34

   beacon change sir so with this we can have a global kind of global ground truth for which chain in the shark that's that's canonical and also for the beacon chain to contain all of the headers of the shark chain you can you can directly broadcast or sync those headers to the other shark so the other shark either like a header chain of or the other shark so that they can act as like a light client for the other shark

9. 5:07

   so that they can verify some some of the proofs from other shark so one of the kind of performance upper bound is how fast the beacon chain can process the cross hatch link right so like a header in terms of in serum header is is about like 500 bytes I think that's about a scale so if we include all the headers from all the other college or the char chains I think you'll scale like a thousand

10. 5:49

    shards 500 or one megabyte about a thousand or 2,000 yeah but there's also a signature right in every charger you'd like also the processing power like a need to be able to verify thousands of the other signatures right and you're saying that you snapshot every block from the short chain right and and the big and chain that they can chain produce blocks as frequently as short chains and they and it also can accept

11. 6:26

    like it has also some state and related to randomness and cross links so you can actually have some transactions to the beacon chain I see now the question is why why do you need to cross me how does cross-linking help so the cross link will make sure there's a one canonical like truth about which shark should be which chain right because there's a cases where one chart like half works you you it's hard to

12. 6:59

    like figure out which shark is which which change the canonical because we're now using a Perl work where is in pbft so and also we're using staking to prevent a civil attack so it will be a little bit easier than pro work to have to have to create Forks and that's kind of hard to distinguish from the canonical one with the cross link because the you can change like a century is like the globo ground truth

13. 7:32

    and that also beacon chain has more security so it's more trustful so if you put the hash link from char chain to the beacon chain we have a better security you're more kind of proof that a single change the canonical one yeah but because using pbft right for as long as and I assume that every participant in the pbft is weighted by the stake right yeah yeah so for as long as one-third of the stake is for as long as less than

14. 8:06

    one-third of the stake belongs to people who are intentionally trying to behave maliciously the fork is impossible right yes so so if actually the design of the system assumes that it is possible to have more than one-third of malicious actors in the short chain so the question is very realistically up to up to what percentage or malicious actors you think can end a cannon that and the reasonable assumptions can end up any single shirt okay okay what can happen

15. 8:38

    in single yeah so yeah and and the reasonable security assumptions what do you think is the maximum percentage of malicious actors in a single shark so our security exemption is will have like 1/4 of malicious token in the global pool validator so when they're doing staking we have this adaptive to actually POS staking which is working like this I'll join here so like so simply we have three

16. 9:11

    meditators that has different amount of stake so this day and I wondered one road token stick and this have like 50 tokens nicked and this one have like 20 tokens staked and after this take this amount of token we'll use the formula two formulas like this this formula is for the price for a single like ticket we call them voting share so this formula is like this is the total amount of steak in the last CPAC over the number of shark x security

17. 10:02

    parameter so the total number of steak right here is up it's like yeah 170 and the number of shark say let's say 10 and now we have the security parameter right here right here if we want to make the shark secure after the random random charting we need to make the security parameter largely enough so we calculated it has to be 600 so that when the process is like this after they do staking they based on these pranks the

18. 10:50

    game voting shares let's say we have 600 let's say this lambda is 600 and the each is voting shares surprises like let's see 600 - 250 no it's like 0.2 something I say fine so this guy will get like 400 voting share this hundred okay 200 this guy will get I'm sure this 880 so we get this amount of voting shares like 200 each others there's 200 this 80 voting share and we'll give extra 0 right because you

19. 11:41

    need 610 charge so it's going to like four thousand two thousand in it so we'll randomly distribute these voting shares into the number of shirts so if we have like 10 yards this water shares will be randomly distributed or to these sharks so and the end result is for each chart this first validator will have some amount of water insurance there because it's randomly you will be in expectation it will be proportional to their original staking right so here let's say here

20. 12:26

    this one I have like 400 what each are here for the linear one and here is like 380 but in follow well either one something like this the reason we're gonna like convert the staking to voting share and then distribute to the shark is because we want to kind of cut the big steak hers steak into pieces and randomly distribute the steak into multiple shark so that they can not concentrate their big steak into a single char and then

21. 13:05

    more overtake - are but if you're making so with your particular constants right let's say that the assumptions about malicious actors in the global pool is a 25% and I say the security parameter is actually 600 then the probability of having 33% of malicious actors is practically zero right it's it's like 1 minus 18 or something so why do we need to cross link if it's like it seems like

22. 13:29

    working is impossible it's because when even we have this security proof that we or this we are sharding the validator orders taking is secure but over time a single shark can get like overtaken or get corrupted by malicious attackers are you saying it can be corrupted adaptively yeah you cannot prevent attackers to corrupt some of the notes and so there are some so what we believe

23. 14:01

    in here effectively is that after the well the deities were signed there's a chance that someone will adaptively corrupt more than one-third do we also believe that someone can adapt the corrupt more than two-thirds right so okay yeah so as I said the shardene need to first distribute at the distribution of the validator need to be done securely but also we need to take care of the corrupt corruption of a

24. 14:31

    single char right where we have this restarting mechanism which means pure article e we're going to reshuffle the validators in the shark or their voting power in the charts across different shards right so when attacker corrupt a single shark you will not like be able to get the whole shards voting power how to say like for a long time because we're gonna reshuffle the voting power again and

25. 15:03

    again so that is it's always they had to keep catching up with the reshuffle so we're gonna keep the reshuffle frequency high enough so that we're a hyper with high probability that attackers can knock cannot be easily overtaking a single shark yeah but we do believe that they can take over the single shark for a very brief period of time all right so let's go to the standard attacks on the shore so the easiest one is forking right and so against working we protect

26. 15:37

    by cross-linking now the the bigger chain when it snapshots the short chains effectively beacon chain acts as a light client right so they can chain does is it gets the header as Jim began chain doesn't unload the entire block right that would be lots of information to them load right it downloads the header it verifies the signature and it snapshots it so let's say that two-thirds of people were corrupted in a single shard right and let's say that

27. 16:08

    what they did is they created the block and in this block the state-transition function is a plate in a completely wrong way right so like out of nowhere one of the malicious actors gets 1,000 for example and on top of that not necessarily but let's say they also built another block which otherwise is valid so like from this from the state that was passed from this block to the state that was final that the state transition was applied properly and now

28. 16:39

    this block is being snapchatted or like I guess both of them get snapchatted to the beacon chain the beacon chain has no way to detect right that the block was wrong so so what is the like I was assuming that that cannot happen or how to how do we defend against this so for for a shard to have like a like a round state you have to have more than 2/3 of the malicious voting power right so with that already already calculated to have

29. 17:16

    like 1/3 is really almost impossible so to have 2/3 is it's like like order thousands more of magnitude even harder right but that is from perspective of something right so simply if sampling 1/3 is very close to zero sampling 2/3 will be practically zero but if we think that is an adduct adaptive adversary then it seems like if we believe that adaptive adversary can corrupt 1/3 it seems to be reasonable to assume that they can also occur up 2/3 like then there is no exponential decay and

30. 17:48

    probabilities that does make sense yeah viewpoint so like we try to make the restarting process frequent so that we're gonna make sure that it's almost impossible to create works that create to create wrong state because also we're using the we have pbft or be empty consensus which is by nature is is hard to create works and they also provide finality faster yes so the effect that Sampson is 2/3 of malicious actors would

31. 18:26

    never end up a nice English writer and also you said that the security of the beacon chain is higher than the security of the first where does that come from do they have more validators assigned though just as I said all the picking chain or chargee are just like a shark it's the sharding process or restarting process apply to all of them so it's just a matter of how much like steak or voting power you're going to assign to them right so as I already analyzed the

32. 19:02

    security of a single char is already kind of proved secure right so for the search for the we can change this it has the same security as the char chain if we treat them as the same shard as the other shark that basically means putting the same amount of voting power or staking into them but we're gonna since the you can change the like the global it can be the single point of failure so we're gonna put a sign more staking

33. 19:32

    effectively lambda Square so say let's say each char has the equal amount of voting show or taking that's assigned to them we're gonna assign like two times of the staking to to the beacon beacon chain so that is like a lot more secure mhm whoo so from here and how how often a block is produced is it like every few seconds yeah this is a PFD consensus every few seconds we'll have a new block

34. 20:04

    and use some flavor of pbft right yeah it's like optimized beauty that scale linearly mm-hmm yeah let's let's talk about the the consensus or like do you want first why we have the shirts they won't talk about cross card transactions we can talk about the cross car transaction since we have shirts already drawn so what happens if I want like let's say I'm Alice or Alex and I'm on

35. 20:29

    this side and this board on this child and these Bob who is on this chart how am i sending money to Bob this is actually a very simple so if I want to send some money from the shark a shark shark one to Sharpie I just create a transaction specifying the source money source account is share one some some account of yours and then destination account in char to some other account other person's account and

36. 21:01

    then the transaction will be they say this the crosswalk reflection will be sent to the source shark right and the source chart will first like kind of debit the term money you're gonna spend right so you're gonna first cut like deduce your balance first and then generate proof in the form of like a receipt like a serum receipt the sender's proof to the destination shark so there's an initial shark as I said destination chart will act as a light

37. 21:39

    client of the other chart right so you can check that proof is valid and also based on the cross link all those stuff you can make sure that that money early data is detected and then the char two is safe too like credit the amount to the destination address and I presume that Carmen is also executing smart contracts right when I'm sending a so let's say I have a crypto zombies account on this short kazoos on this

38. 22:14

    contract and here's a cryptic Aegis contract on this chart and I have a I want to have a method encrypted zombies which would consume a cryptic e key to do something right so how would that as a developer how do we express the the cross chart in vacations is it some sort of like promises or like how does that work so right now we're for smart contract actually most of the work are done by

39. 22:43

    the single char array and for the quash our smart contract we are only allowing kind of the read operation like reading whether there is a cryptic eating in the other we're not supporting the update yet and how does reading work read we had this mechanism of kind of like code it's not it's more like subscribe and listen right so let's say your smart contract won't we'll be reading some fields in the other shards of our contract and you

40. 23:16

    are gonna like specify that in the smart contract and then be the data that you're gonna listen in the in the in this chart those validator in that shirt whoa like publish that part of the data you're interested to your shark right in the keep publishing that it's whenever that data is changed you can publish that and you're a shark that's interested in this view will listen that so the execution of the smart contract

41. 23:52

    won't be like blocked by anything because you you're mostly one of the cases have the updated data from the other shark yeah and but I I can do right operations for the contracts which on the same charges I write you can you can write then the question is you said it at the beginning is going to be let's say 10 charts but then over time I assume you want to go that to thousands

42. 24:15

    of shirts when you increase number of thirds the new charts are the empty or you rebalance it will be created a new are they're going to completely empty so the people I guess that would work I guess cool okay so let's move to the consensus so how does how does consensus work yeah I can draw like a message graph this this is beauty consensus they will be leader right and there will be the

43. 24:59

    validator so there because beauty is following the traditional pbft kind of methodology there will be you two phases there is a face or prepare right and another face go commit and before that the leader will announce the like a block first to all the validator this we call the announce face so once the leader announce the new block to the validator the very very first check whether is valid or not right and then they will sign the POS

44. 25:55

    signature on the on the header and return back to sorry to deliver we turn back to the leader so the leader will aggregate all the BLS signature into a multi signature right and after the aggregation you will send that multi signature again to all the validator and then the same thing kind of same thing happened all the validator need to check this month whether they're more than like two to at plus one where F is the what above is a one third of

45. 26:46

    the committee whether there are more than 2/3 plus one or equal to 2/3 plus one signing on that motor signature if that that's true you will sign that my signature again using BLS and we turn back to the leader so the leader after getting 2/3 plus one you aggregate that signature again and broadcast to the legislature for them to finally commit the new block is it synchronous or is it weekly synchronous it's partially synchronous partial synchronous so well when does part so

46. 27:28

    there's some sort of a timeout here right so at some point like clearly there's not never going to be the case that the leader will accumulate all the signatures or like it's gonna be very rare someone will be applying right you have 600 validators presumably someone is offline so at which point leader stops waiting for more signatures and and start distributing the block once they have to 2/3 + 1 okay so the

47. 27:53

    moment they get 2/3 + 1 the immediately started - they're not waiting for more how is the reward distributed the reward will be distributed equally yeah including those who did not participate what is the motivation to participate like why would I sign any why would I even be online once I'm assigned that's a good question if you don't sign you you won't get a reward you're you're

48. 28:16

    right but that but then the leader only wait for 2/3 plus 1 let's say 100% people are online that's everybody's online but the moment the leader gets two thirds plus one they already descend the block right so two thirds like F people if people did not get their signatures into the block so the block is recorded only having two thirds plus one signatures so f people who were online and participated you know it will

49. 28:40

    not get to avoid right yes isn't that unfortunate no no because you have to wait for exact this amount to like proceed you can not wait more because the security assumption is we we can have at most or or it's possible to have F malicious nodes right so if you wait more there you are busy waiting for at least one malicious guide then tacca if that guy is stalling you'll never get yes not that but my question is more about the fact that

50. 29:13

    like let's say that v1 and v2 signed and so the leader progressed but v3 now we T will not get any word right I said every every everyone will give even people who wore a fine yeah but then we get back to the question why would I why would be three even be online yeah for the guy who are not signing if in some like rare instances where it's kind of slow for him to reply in time it's okay but we have the like slashing Mikhail's or

51. 29:46

    we're not slashing who had we're gonna join their voting power if they continuously like now signing for a long time so if they didn't sign multiple blocks in a row then they will be punished and the leader is rotating right the leader is it rotating at first we're gonna keep keep it stable if it performs like honestly right so if the leader wants to punish the validator they will just not include their signature right yeah that's a good

52. 30:15

    question then this will come to the like filtering problem right the leader have the power to filter anything they don't like so in that case the the nodes were really deter who got filtered can show that some of some proof that he already signed that for a long time for many realms but how can you prove that you signed in the past not now you can you're going to prove that something

53. 30:40

    happened in the past unless it was included on the chain right but it was not included on the chain because they later rejected don't you sign that proof every time when you're when you're like but I can find it I can message and and withhold it so imagine v3 yeah yeah they they will sign they will withhold it they will not send it and then later they will say look I have a signature that's right you

54. 31:03

    you have to like broadcast your like signature so if you're honest you're gonna broadcast the signature as you are precision in the consensus are you put Cassatt to everyone yeah it's not just directly assigned to the station squared communication it's logging rights now because every person sends message to every other person right but is its podcast but the destination is the leader so other validators or student

55. 31:36

    like kind of rebroadcast that message the second question is so let's say the leader is applying at which point the other validators two questions one is how they react the leader and the second question is at which point into that out so whenever after this commit right all the validator let's say so the first round is finished here and they will come to a new round you will set up a like a timer counter let's say like

56. 32:12

    based on how fast the cancer is running normally you have like a timeout and if the leader like that doesn't reach consensus after the timeout everybody is free to initiate like leader change protocol which will be the same as the traditional pbft everton button tradition pbft the the person who is proposing a new leader at some point needs to communicate and cubed amount of information for 600 that's almost a gigabyte of

57. 32:46

    information right it needs to be communicated like effectively in traditional pbft the the leader change the view change is accumulating like every person will send some proof that the consensus wasn't reached to their to the new to the candidate can get the candidate leader and the candidate leader needs to send all those proofs to all the validators right so the proof itself is quadratic and it is being sent

58. 33:12

    to linear number of people which is n cubed of information sent right so then they candidate leader needs to send one gigabyte so you know you don't need that done much of proof you only need to say I want I think this leader is wrong because I I didn't get like it did get like correct consensus by the time and all the other values here you will broadcast your like opinion right and if more than two to third of the people had

59. 33:44

    the same opinion then the leader is behaving dishonestly but that doesn't work because what will happen is what will happen is that these are reason when TB of GD is a quadratic proof the quadratic proof that that you need to send is you need to you need to confirm that everybody is on the same page that we're doing a leader change because otherwise what will happen is that every validator will send like the leader will be acting normally up until this point

60. 34:13

    at this point everybody will send to the leader their signature parts at this point the leader has the block and this block has the has the has a consensus on it like this block is the reversible but the leader doesn't broadcast the block so the leader knows the block nobody else does and so by this time by the time when the commit is supposed to happen every validator says well consensus isn't reached the block wasn't

61. 34:39

    broadcasted and so it could happen that 2/3 of them will message the candidate leader saying we think that the consensus has told has told the candidate leader will say I see 2/3 of people thinking consensus told they will do their own consensus come up with some other block at which point old leader will broadcast their now you have two blocks each of them having two-thirds plus one signatures that's a it's a it's a fault right so

62. 35:06

    that's not to pbft consensus I mean that's not to BFD consensus then the BFG consensus guarantees that you will never have two blocks with two-thirds plus one signatures that's make sense so I don't get how do you get like to block with okay once again so this is the current winner he's malicious he's acting normally up until this moment so they do broadcast the block they accumulate the first set of

63. 35:29

    signatures they broadcast the science signature accumulate two thirds of signatures here at this point they have a block with two thirds of signatures that block is final but they do not broadcast the block from what you described so this is the first block this is the first finalized book but they do not broadcast it so if I understand correctly how you do view change then at some point of time the

64. 35:52

    timeout will be hit at which point all the validators will think that the consensus stopped and so all the validators ten minus one will reach out to some other candidate leader and say we want to kick out the existing leader they act him slowly and start a new consensus all right and then the new leader like the key reality and then you have two blocks and then it's because the view change is initiated by all of our honest validators right so we're going to prefer the opinion of the

65. 36:22

    audience melody how does the beacon chain know about that like usually the leader will snaps of the header to the beacon chain the beacon chain is the light client how does the beacon chain know that it should not accept this block so it's not like so the lead the peak in this case the peak and chain can invalidate that block that's kind of but on which ground right from the beacon

66. 36:48

    chain perspective there are two blocks and each of the two blocks has signatures from two thirds plus one on his balladeer on which ground which is one of the two the the view change have proof have other like a cryptographic trace right to say already like believe this leader is wrong right so that can be like used to distinguish this but then the leader like what could happen

67. 37:11

    is that the leader already cross-linked the block there's going to be some delay before then the the other blog gets preference mm-hmm right but it not be the case that that malicious actors can already go to some other chart and do some some malicious behavior based on the blog that is snapchat at this point so let's call this block one the one that was created here and then after the view change another way they produce blog v2 let's also say that the certain

68. 37:48

    transaction which did getting to be one but did not get him to be - yeah that's a good point yeah that could happen but if that can happen like effectively if we're saying that the owners validators can can send another block to the beacon change like do we even need any any sort of DFT consensus can we just say that the crosslink always has a like why not send block at this point right it we got to this point we send the block to the beacon chain if beacon chain confirm that we say yeah that's final and then we saving a full round of communication

69. 38:21

    right what we'll break in this case you can produce blocks twice as fast but because we're following the BP BRT process you have to have this toothpaste where is the first phase is busy trying to make everybody agree on the order of the block and then the second phase is actually checking the content and commit well my point was more of the fact that the fact that two blocks can be produced yeah it is that's exactly what DFT is

70. 38:56

    supposed to protect against right so if we already know protecting against that we can relax the complexity of people yeah you you're it's like really a trade-off between security and the performance we can totally use like all the real original you change protocol to attach all the proof in which case it will be but I guess the main question is if you can meeting two using a weekly apart partial partial partial with synchronous

71. 39:26

    algorithm why not your standard mint which does not have a you change right so tender means is changing leader every wrong is that the point of temperament is that is yes is that the leader is proposing it's super similar I did leaders proposing the block accumulating signatures accumulating signatures but there are timeout after every step and I've acted this step the consensus isn't

72. 39:50

    reached the the next leader starts starts the castell the next that there is proposing the block and they have certain guarantees that will not allow two blocks being produced but the view change is gone right and without the view change it's it's super cheap alright yeah okay I guess consensus makes sense the with the consensus another problem is that let's say that the leader is malicious but they're not stalling the consensus instead what they're doing is they just producing empty blocks so that's the test the

73. 40:29

    filtering question right so for the transaction insurer you should be able to like because it's broadcasted to the network every other validator will see that whether there is a transaction or not and if issuer found that each transaction did not get included for a long time were people see that the leader is producing and people out for a long time then the movie will have some criterias to say at this point everybody

74. 41:01

    everybody should change the leader is malicious right but what if let's say that the system is at capacity like the shard is at capacity it cannot include all the transactions isn't that the problem that the leader has the sole power to choose which transactions get in and which transactions do not like okay you can prove that your transaction was not included but the leader has an excuse the leader says the block was full right and so now the wither can censor out any transactions without any

75. 41:30

    penalty right yeah yeah that's justice I think it's a common question for all the blockchain leader based leader has more say on which transaction to include yeah but a leader produced AMT block is that way not should be prevented but if if leader is acting like at full speed to include most of the transaction but is kind of including a specific transaction that would be a lot harder to prevent hmm another question is how is this timeout chosen right so let's say that the for

76. 42:06

    some reason network conditioning became worse and and we just like let's say timeout was five seconds and let's say that the network condition conditions became worse like for example the validators were chosen in such a way that a large portion of them like distributed in the world or like let's say that like the cross option link had broken or sampling that look nuclear winter how will timeout increase like

77. 42:29

    what is the process so it's based on the previous blocks like performance right you'll be adjusted based on the history network condition sales for the last epoch how was the average long time and that timeout will be like according to that and the previous key book that's the same validators or it's a different set of validators like a major portion of the weather later will stay the same

78. 42:59

    but some of them need to be like some of them get kicked all right some of some new join so but it's still like a good estimate for for the future time hmm but the question so let's say there was a leader who who had a ridiculously good network or even better here's an example let's say that yeah so let's say there is a leader who has very good network and very good processing power and so that can execute consensus very quickly mm-hmm to an extent it like they finalized the full consensus is let's

79. 43:31

    say 0.3 seconds but let's say that the majority of people have worse hardware and so let's say for them it takes like a second and the leader so let's say this leader produce multiple epochs in every epoch consensus was reached in like 0.3 seconds and then they stood there goes the flame and so my understanding is that the timeout will be let's say 0.5 seconds right but then no leader will be able to produce a block in 0.5 seconds so the leader is only part of the process right

80. 44:03

    so most of the delay are actually based on the rich fire of the validator so a faster leader doesn't guarantee like a lot faster consensus because he's like head this is gossip network right this is not direct communication yeah yeah cool yeah I think that that makes a lot of sense one other topic I want to discuss is randomness randomness is interesting right yeah that's interesting is there anything we didn't discuss about consensus I think that's

81. 44:33

    mostly actually one thing about pbft is that they prove like why the proof is expensive is that I think every unless I remember it wrong I think it's because every validator needs to prove to the candidate that they saw majority of validators wanting to switch and I think that can be optimized with their less signatures yes and then and then it will be quadratic which is like way more doable

82. 45:02

    okay so randomness you guys using the run dial with videos right it's not render yeah it's not exactly a render you can can you walk us through they are yeah and say this is the start of the new year POC and at the start of the new year Park the leader will like pull from all the validators they say this all the validators and tell them hey that were starting the randomness protocol and it was saying it will send send the like previous block hash they say this

83. 45:40

    - wonders and yes the leader will send let us say this is the leader either announced that's he gonna start the protocol with the hash of the end with a block and minus one and then every validator will use the vrf to sign on this message and return back to the leader so the leader waits for F plus one we are at results and then abrogate this into like what we call it like preimage of the randomness so you can

84. 46:37

    aggregate like X or or anything just combine all of this together and it will create this we call preimage of randomness and then run consensus that's a kind of same pbft consensus just just include that in the next walk right and with all the proofs of the VRI proofs so that this get committed to this block and then the because it's in the block everybody is free or the leader can just

85. 47:10

    compute using video I'll verify about delay function right is probably I can show that you spend some time to compute you can never like in the result like instantly so you input that's pre image of the randomness into this vdf and then generate the true randomness so we configure this video so that it's at least more than one more time right so let's say was configured to cave long

86. 47:46

    time and and like what is the order of magnitude of K you can be like 10 or something like that it doesn't have to be that large say this is in K block something somewhere around the n plus K block you you get the true randomness and then you commit that you run consensus again with all the proofs and people will verify that right and will confirm over sign and you can commit it

87. 48:18

    to the block so right here you get the randomness or all the way all the sharding or anything the question is did you guys think which particularly do you have to use will probably go with the assumed one yeah right so so with the theorems PVDF they build an a secret which is going to be give or take hundred times faster than than anything you could have like traditional hardware

88. 48:45

    so if the expectation that the leader has to have the ASIC no no we can we can configure the time that we vdf delay time so that's you will take care of that ASIC at the beginning if we if if say the leader doesn't have the ASIC right you make it even longer but that means that the key needs to be well at the very least more than 100 trade yeah because of the ASIC is hundred times faster than traditional hardware but also ASIC basic is hundred times faster

89. 49:20

    than very good hardware right so if you're running on regular like that you don't have you don't have a super strong hardware it's going to do but the bigger problem is in the theorems case because that's a they use exactly the same approach right they have I'm not sure about like the signature but they have pre commits from multiple people then they compute the vdf and the output of

90. 49:44

    the vdf is Vidya from the aggregate of the pre commits and the output of the VD occurs randomness in the theorems case it is the expectation that the vdf is going to be run by a person with a magic right so it is not expected that anyone will run ggf Isaac as a result for someone to and let's say K is a hundred right as a result for someone to build faster they will need to have an even faster Isaac right and the ASIC that the theorem is building cost fifteen million dollars to build so from to build even faster Isaac

91. 50:15

    it will cost like given more and and like how much how much faster is going to be like you need two hundred times faster which is barely impossible in this case the problem is that lets say the harmony becomes d protocol right so someone actually has a very strong incentive to break it so if K is configured to be let's say two hundred right you're saying you know look at the video music is kind of times faster

92. 50:39

    we're going to configure K to be two hundred no there's no way that if they do magic is going to be this now for someone who wants to break the randomness for them the cost is going to be building an ASIC which is three hundred times faster which is that's expensive but you know like we're talking about like whichever protocol is going to be the protocol we're talking about like hundred billion dollars protocols right so what what is fifty

93. 51:02

    million invested right but but one thing is that you don't you don't have the leader to run DVD you don't need the leader on TV I guess that's a solution cool and that is it also the randomness which is going to be like like it the smart contract will it have access to the randomness we haven't decided that yet because you don't have like a like a defined like a period for the for when you're gonna get the redness right so you may not get randomness for each

94. 51:35

    block so there's a question we're still researching but this is definitely used for the other network charting yeah because this is only happening every epoch mm-hmm I said and and the e-book cannot rotate faster than then keep Lobster yeah yeah yeah so this will like be on again at most like a ten minute so worried probably longer than ten minutes and also what happens give the imagine

95. 52:05

    I'm executing a crosswalk transaction what happens if we'll really make an assumption that it is hard but possible to corrupt 1/3 right so it's possible to me to make a fork yes so what happens if in a shorter winter it doesn't create forks right when they're only stole one 1/4 has a theoretical chance to creative work because what you can do is you can all it's not it I will provide the theoretical what you can do in theory in

96. 52:38

    practice it's hard but like it gives you the theoretical ability effectively what you can do is you can this is like slightly less than one third of one as validators this is slightly less than one third of one is validators and this is your slightly more than one third of malicious validators you can double-doubles yeah and then you know yeah this is not practical because you

97. 53:03

    cannot really split the network but it gives you like you know like a 2/3 you can definitely spork at one-third below one heard you definitely cannot fork but exactly how it grows from zero to one in between we don't know right but let's say we believe that four can happen all right because I mean we cross link they share fight that we cross link effectively means that we delete the four can happen right then that means

98. 53:27

    that the big and chain can fork right because the big can chain has only twice as many validators so it is also feasible to corrupt them adaptively so put the following happen could it be that I have I mean one Charlotte this is hard one and it's building in the blockchain and this is short - can I do this like let's say my adaptive adversary that is capable of working mm-hm then what I can do is I can create a block here in which I send money to the

99. 53:57

    merchants I create a block on the beacon chain or it get cross-linked and and some merchants lease use mine over here right and the merchants receiving money here provides me the service but after that I'm working here and this happens to be the canonical channel I am 14 here and this happens to be a canonical what happens is we have a double spent rate because this like in this chart

100. 54:32

     there is no reason for this not to state the canonical chain there was no Forks right and so money wasn't spent in the canonical chain money wasn't spent but on the destination charge menu money is received mm-hmm all right so is it something that's possible I think in our security assumption this shouldn't happen so that sometimes the beacon chain never works effectively yes I know

101. 54:55

     this is the more like the fork choices in in the like powr POS consensus where they're easily for you have to continually resolve for us right your network this isn't shouldn't be a problem but my but my that gets back to my argument so my argument is the following that one of the two things should be true either one Forks are possible in which case this can happen which is a double spent or argument number two you don't need cross links

102. 55:34

     that make sense so the beacon jail won't have force right well had the will guarantee with the high probability that we can change won't have Forks because we're going to push more staking on there right the only concern is that so the question is how much more stake you put on the big engine if it's twice as much and we talking about gonna die to adaptive adversary then the attack is only three times more expensive because

103. 56:04

     if it if it costs X to corrupt this short that goes to X to crop discharge I'd like that has to be exactly more than two I guess so is so we haven't decided on the exact number I'm just giving an example you can be too or it can be like five it depends on the correct analysis so before the main I will have like clear analysis on how much the state should be awesome and other other aspects of harmony you'd like to discuss

104. 56:35

     too heavy enough do we have time to discuss one more component yeah which which area are you I don't have any other technical questions we can talk more about interesting stuff okay maybe talk about the network oh yes that's the that's your signature signature technology right yes we're optimizing on the network with some of the technology so you guys have a blog post about blog propagation in one second right one year can can you walk us through how that works so so in the

105. 57:20

     traditional peer-to-peer broadcasting I say that this is a sender this is the receiver this is the receivers right so the sender will send a copy of say this is the message and the sender was sent a copy of the message to each of the neighbor each of the neighbor will gossip again to the other neighbor so this will incur like so you have D neighbor people have like M plus D Network consumption on the standard right so when the block is

106. 58:04

     large say like a megabyte of the part of the block so Doby have you be a bottleneck for the sender so what we did is we are using the user coding user code to like encode the block ham with some extra easy report say e and when I cut this into chunks and send like equally sent to to the neighbors right to the D neighbors so each of them only have like a part not encoded lock so this will incre like this m+ e Lord where basically is like a 30%

107. 58:56

     or some percent of the of the block size so it's like a significant reduce from the look on the load of the sender yeah and then how does it recover the block so this this block chance like similarly these elevators need to send about they also sending among themselves because it's missing some of them right it's the same because right here is sending the hop lock so this guy already have the block he doesn't need to sign but here

108. 59:29

     is is sending the chunks right each each others are different so this is the first and they also need to like communicate to get like a full picture yeah but when one note get like like and E and over N plus the portion of the chunks you can like decode that chunks into the whole block and E exists here because we assume that some of these people will not be communicating yes yes he was we assume like one third malicious hmm and if I recall the blog

109. 1:00:14

     post correctly you were using pumpkin codes right yeah yeah because like UDP or Y like what's the what's the traitor because just using razor codes so it isn't code is a jerk the traditional user code is based on the resettlement encoding which is a fixed encoding say you can only add like the sale is a fixed point or say 30% of and if is in the rare case that's not like kind of enough then some node won't get the reconstructed block so instead we're using the fountain Raptor cue

110. 1:00:49

     fountain code code which is more like a continuous adaptive encoding so at first you can have like 30% and you can actually generate additional pieces a little bit of a little bit and for those additional pieces it can also be part of the reconstruction and and this is infinite right yeah you can continuous January so for the sender if it doesn't like if you some of the validator are not getting the block saying it's not getting response of the signature you

111. 1:01:25

     can keep kind of sending more blocks so that it may have a better probability that receiver received the whole block and the moment they have like M or M plus one they can recover right like any yeah yeah awesome great well I think we can conclude the technical part here the now let's have like just very few non-technical questions at the end would you be comfortable sharing when is the

112. 1:01:52

     main that launch oh we're planning to launch the main net in the middle of this year around June and July exciting so when is the test not them Desna will be like in like two months from now great okay so excited looking forward to it and thanks for what for for sharing the knowledge okay thank you