zkEVM Vs EVM: Full Equivalence? by Ignasi Ramos | Devcon Bogotá

foreign [Music] also thank you all of you for attending the talk my name is ignaci Ramos I work for polygon tkbm and I am at the at the protocol team it's been a year a year and a half that we've been working very hard to release the the ckvm and I am very happy I'm very proud to announce that on Monday um it was announced the release of the ckvm on public.net so I would ask you to do an Applause for the polygon team that they did that effort that it's it's enormous so thank you the detail of the of the presentation is dkvm versus evm full equivalence okay so a little bit what are we going to talk about first of all I will do like an overview to give some context about what is a ckvm and then I will go more more concrete on what is the polygons ckvm after that we will go like to the topic of the talk which is the the difference between the ckvm the polygons GK VM and the evm so what is AC KVM there's a well there are like the three statements that I think that they Define the minimum of RC KVM which is that it is a virtual machine that executes smart contracts in a way that is compatible with zero no less proof computation and why will we like to do this because we already scale ethereum we want to increase like the throughput of ethereum the transactions per second at the same time at the same time that we lower the fees so how can we do it we use gksr technology to make cryptographic proof of execution of ethereum-like transactions in a summary and now when you process like about with a lot of transactions you get a result you get an output you get an estate so how can other people who can other ones to trust you that this process this process of the batch has been done with uh with correctness has been done correctly following like the evm constraints they have to process also those transactions and see that the output is the same with zero knowledge and proofs we can like do it easily because we can after processing all those transaction create acid or knowledge proof and if someone wants to validate that this transactions have been processed correctly like following the constraints of the ABM the only of the ckvm in this case they only have two um verify that proof and this is faster also the verification of a proof it's always constant which is very interesting actually this is like a game center in the in the ecosystem I remember uh it was around the SCC that a lot of companies were doing like release announcements of releases of gkvms and it created like a lot of noise especially in social media and in many places a lot of people was very confused because a lot of new words appeared there like compatibility equivalence what is the approver uh I don't know but luckily we have like beta League that he did a very interesting blog I actually I strongly recommend it to to read it when he classified the ckvms in five times he created what I like to say like the cqm Dilemma like if you have more performance you have less compatibility and if you try to have more compatibility you will have less performance actually at polygon ckvm we aim to be from type 2. and we are not there yet because we still have to finish the pre-compiles but we will be there very soon actually we're liked 2.2 so um the advantage of of these of this type 2 is that it has a lot of compatibility it has as much compatibility that we can talk about equivalence the disadvantage is the performance and the village in vitalik course he said that it takes like a lot of time to generate the proof well this is habit relative I mean what is a lot of time um now we are generating proof in around five minutes but we still know how to do it and we have a lot of ideas in mind and how to reduce these two up to five minutes and also it's not that that a big problem because you also can like parallelize the proofs first of all I would like to explain like very simply when we talk about equivalence what are we talking about we're talking about that putting the batch of transactions in the evm and putting exactly the same batch of transaction or the same block or whatever to the ckvm and get the same state and when I say State it's like the same state route and when they have like the same state route it means that the storage the the state of the blockchain is exactly the same it means that all the accounts have the same balance with the same nodes with the same value code with the same storage with whatever they are exactly the same so are different black boxes because internally they work differently but the equivalence means that for the same input The Hive they have the same map output it could be like a lot of time explaining how we've done it and there's people here sitting that could explain it by far better than me so I just do like some some sentences just to put some context also it's not not the topic of the of the talk but we can discuss about it later but at the end what we're doing is a processor okay um and a processor has clocks so each clock it's like a new test a new state and we are playing with these newer States as steps so as all and processors you can build a an assembly at the top of them you can build an assembly language to Define these steps and this is what we've done with a language called GK assembly with Decay assembly without try to replicate the behavior of the evm in an assembly language when this Assembly Language is completed it creates like a build which is a a big trace of all the steps that and well Define the the processor on the other hand we have the build the polynomial identity language with its uh like one step more of silicon 2.0 is also a language done by or take lead or develina and um what the executor does is that he gets the ROM which is the build of the cksm language that I've just explained it he also uses the pill where there are the state Machines of the ethereum they find it there and he like verifies the correctness of each one of the steps of the ram while it process the transactions so more or less um this is this is how it works like I'm just scrapping the surface this is how it was the the ckvm and of course as all other processors we also have a ram and install it now let's talk about the variances between both of the of the avms and as you may know the ABM which uses a particular tree while we are using a sparse medical tree where the leaves are indexed in each Leaf of the ebm we store uh well the storage the registered all the information of the account they have denounced the balance the storage route and they got the hash but we are doing it differently we are doing it differently on each Leaf we only store one property of the account so this brings me to the second difference which is the hash for the evm it's used the Decay tag but we are using the Poseidon with the goldilock prime number as definite field this is for performance reasons so when on ethereum you want to get the you want to get the key of a leaf you have to Hash the address but as we all we only count retrieve like one property of the account for each Leaf we have to Hash the the address with a property key for example if we have the ethereum address with the property key of balance we will get the Leaf where it should start at the balance another difference is that ethereum uses more than one tree to Define all the system as you can see here in one of the leaves there's the storage root the steriletruth points to a different state three where the storage is restored we are doing it differently we only have one tree that defines the whole system another difference is the memory the ABM uses for detached load of memory um 8 Bits one byte and we are using 256 bit let's like 32 bytes so we are working with a we get a memory slot these um makes that when you are uh according to the memory the what the information that you get is the same but the way that you obtain the information it's a bit different I mean the internal logic of sum of codes had to be changed a bit I will show you an example now for example for the code M load with them load you load 32 bytes from the memory so um well there are different cases some are more tricky than the other ones this is the easiest one when you want to get just 52 bytes users are scored it and you have to return the full slot in our case is the Fuller slot because we have a slot of 52 bytes the fullest load of the of the memory in case of the offset is different from very well when I say different from zero I'm talking about mod 52.

it means that at the beginning of the slot it's not the beginning of the memory that you want to retrieve maybe you will have to get like half of the memory from one slot and half open Memory of the next slot and it gets a bit more tricky sorry when you when you want to retrieve more than 52 bytes in this case for example more or less than 52 watts in this in the first case for example we are only retrieving some bytes of one slot in the second case just um the byte in the middle of the slot and in the third case it's like if you want to do it with an offset different from zero and also more than 32 watts then maybe you have to get some bytes from one slot then get the whole bite of the following three four five slot whatever the length is and some byte from the last slot yes another another difference probably this is very new for a lot of you and I will say that the behavior is like gas but it doesn't reply gas I mean we are Computing the gas exactly the same way as ethereum does but um as I said before we have like a limited number of a step in the processor right so when you are processing about you can you have a limited number of steps and also you have a limited number of State machines that you can consume while doing a kind of code or an operation so in our implementation of the GK VM I will show an example just after this slide we have to check that we have enough counters to process that of code if we go out of context for example the evm the ckvm throws an error which is out of Counter this error is not user fault actually and it's like a folder of the executor but it can be solved easily like processing this bad but with less transaction because it means that the counter the number of counters to process that that batch has been exceed here we have the different the name of the fan and stain machines for example the binary one it just consumed when you compute a binary operation or the key tag when you do a architect hash I will show you uh an example of an up goat well it's a widely used of code it's the equal one the equal of code he compares the two last um to last values in the in the stack and exit they are equal as you can see this is this code it's from GTA assembly as you as you can see the first two lines here I am checking that I have enough counters to process the top code as you can see the binary I'm taking I have at least one binary um counter for the state machine of the account for one one binary counter to process this this of code it's because here I use the equal and the equal consumes one binary also I check the steps each one of the lines of the CK assembly is a step of the processor here I put 120 although the number of lines it's less it's because I will go to read code which means that all the process has been correctly in the best guys the best case a scenario but in the worst case a scenario I may fall out to a stack under flow or maybe a rocus or a stack Overflow and I need and I will need some more steps to handle this error we don't use the self-destruct actually this is a difference now but we have and we guess that it won't be a difference in the near future because probably ethereum will accept the EIP 4758 where it replaces the cell the cell distract by send all so we are not using um self-destruct from the very beginning we are using send all and I'm happy for it because of the stack creates a lot of a lot of problems um what does the essential does instead of removing the bytecode and the storage of the of the account when you call this the track what it does is to empty the account and send all the balance of the account to the um account caller at the end we're just following the this EIP this is also a difference that will disappear uh in the next month because we are really working hard to to finish this and it's this is the way we are not still type 2 but as I said before uh it will this will be over in a few months actually we only support three pre-compiles from the ABM we support DC recover the identity and the model X and this is one of our priorities we are working to finish them all actually the S8 2.56 it won't be that hard because we've only done the easy recover maybe they see biting it's it's a bit more tricky but um but we're working it's working progress okay one of them is the code of the excluding hash obviously if we are using a different hash we're using the procedent instead of the key Tech this excales is returning the the house in with Poseidon also the block has um well this one is not really a difference because uh it's not that uh variant because um now on the AVM you only can't get the block hash of the last 256 blocks um we are supporting to to get it from the blogs all the blogs in the blockchain from the from the very beginning and the memory limit we have a limited memory of around 40 gigabytes um it is different from the ebm because DB game is unlimited The Limited is set by the gas and you can put like 50 million gas in one one block actually this limitation makes that in a batch you can put 8.5 million for its transaction that this is the the cost of the memory expansion and we won't have any more memory but I have to say that a transaction with 8.5 million cars it will be uh enough to do whatever you want it's also very easy like to do different transactions uh if you have a very big transaction it can be like splitted in in different ones and also this is currently uh this last one it's a different now but it won't be different anymore because we are also working on it and it's one of our priorities which is that we are actually not supporting eip155 and eip2718 transactions but it's a matter a matter of time so in conclusion well you all have seen the slide from before but this is like now the most important moment of the of the presentation ah no why is it happening now exactly it's that we are passing the 97 of the ethereum test Suites I think it's the best way and the most empirical way to show to the people that we are compatible we are equivalents with um with the with the AVM so these are the final three marks it's we are fully VM equivalent and I also would like to to send a message like this in the second point which is that the difference that I've been explained now most of them are um for this for n to be more equivalent and with a better performance I mean we've been building the ckvm with a different toolkit that what was done with the evm so we have to take like some technical decisions with different tools but to reach the equivalence also taking in account the performance so I think that maybe also we have learned a lot from all those years of the AVM processing a lot of transactions and actually I think that probably people from the theory Foundation if they had to do the evm again from the very beginning they will do some things different and some of the things are the ones that we trying to do like we've learned from them with the blend from the AVM and we've tried to do it it was better and finally to finish just tell you that what I said at the at the beginning we are on public investment so we really encourage everybody to try to crush it try to test it play with it I mean it will be very good for us if you crush it so we can find a work and we can iterate and deploy again fix the back and and all this so just to to finish thank you very much for thank you very much for for being here hope you enjoyed the talk and thank you