A Better Mental Model for Rollups, Plasma, and Validating Bridges by Patrick McCorry

foreign [Music] hi everyone my name is Patrick McCory and today I'm going to hopefully come across or give across a better mental model for Roll-Ups and bridges so just before I begin Has anyone used the roll up Has anyone used like are most people here are awesome and when you used it like did you feel like it was like more secure than using coinbase or hey read your hand if you think it's secure maybe that's a good phrase only one person that's great uh okay um so hopefully by the end of this you'll have a good idea of what it means for these systems to be secure and whether they're actually secure or not is a whole different world so the whole point of uh Roll-Ups and everything we're trying to build is really just Bridge engineering all we're building are bridges so let's consider the coinbius bridge your own ethereum you lock your phones into this bridge and then it magically appears on coinbase you're going coinbase you transfer your assets you buy some coins you sell some coins you lose some money you make some money and then eventually you want to get your coins back to ethereum and so your ping coinbase and say coinbase let me withdraw my 1000 eighth because I'm a wheel and then what you'll imagine is that coinbase will send a message to the bridge they say Bridge let Alice withdraw her 1000 eighth now from the perspective of the bridge the bridge has to be convinced that Alice is entitled to this 1000 eighth so how does the bridge check this in the Columbia's example the bridge will just blindly trust coinbase if coinbius says Alice is entitled to one thousand eight then Alice will get her 1000 each and then it gets sent off and we're all very happy now generically speaking what's happening in this type of interaction generically there's this all chain database the OMG and database records the account balances the program State the program smart contract code you know everything that a database you probably have but most importantly it's recording the liabilities of the system if you have 10 coins in the database then your owed 10 coins from the bridge and the bridge has the assets and the whole point of these rule Ops or these layer tree systems is to guarantee that the Assets in the bridge can cover the liabilities in this off-chain system and so we have to consider everything from the Bridge's perspective because it's up to the bridge to protect your funds but this trust assumption has evolved over the years after all we've all used bridges for the past 10 years in order to use these you know cryptocurrency exchanges and services the first way to build it was this single Authority the coinbase is the bit Stomps and the Krakens you know I lock my phones in the coinbase and they have custody of the funds and they're responsible for protecting the assets and today I think they protect about 10 percent of all cryptocurrency assets then we moved on and thought well can we have a multi-authority bridge you know instead of just trusting coinbius kubi trust five out of nine validators to protect the funds and then we went a little further and thought well what about these cryptoeconomic Bridges you know what if I could stick assets and then become a validator and appoint myself to protect the funds now in all three cases especially these crypto economic Bridges they're still just multi-authority so in late 2021 around six entities represented I believe 85 percent of the stake on polygon and as these six entities that you're trusting to protect the Assets in the polygons proof of stake Bridge if they collude they can steal your funds but so far they've actually done a pretty good job but in all these cases it sucks you know we're trusting less than 10 people our tan parties to protect billions of dollars you know the whole point of cryptocurrencies was to remove the intermediaries and now we've just reintroduced them now there's ten of them that will protect most assets but it doesn't suck from an ideological perspective it sucks practically because they keep getting hacked I mean maybe a good reason hansier who's ever lost money with a third party service look at this yeah comedy gens last hope you didn't use a Luna but anyway but you know but basically they all keep getting hacked the biggest hack was monk Ox you know they lost nearly six percent of all Bitcoin that will ever exist around 800 000 Bitcoin or about 6 800 give or take and now he sort of just you know put it under the table and we just pretend it didn't happen but you know it's it's very frustrating but why did this happen it hopped like these hacks occur because in reality we're taking a set of human processes we're implementing these human processes and we're trying to protect billions of dollars and humans don't scale so every time we take the human processes and instantiate it somewhere else to protect more phones you know there's this increases the likelihood that it's going to feel and then they get hacked what about a multi-authority bridge you know that should be a they're a little better in practice you know there's more targets to hack but of course the run-on Bridge you know five out of nine validators were compromised and they lost their funds although in reality it's not really five validators because four of them belong to one company but you get the idea you know multi-authority Bridges and I feel like over the past 10 years when we're designing these Bridges we've sort of forgot about our old school motto you know not your keys not your coins there were blind leads has given our coins away and says hoping they can protect the funds so the question for these Bridges is you know can we build and transact on an off-chain system by still allowing users to maintain custody of their funds and not have to trust the operator to protect the funds and this was the original goal of the sidechamp paper in 2014. they don't use the word Bridge they use they call it a two-way Peg but the ideas of our history of forward you take your Bitcoin you lock it into a bridge and it appears on an experimental blockchain so this is the ethereum example you know you're on ethereum you lock it on an experimental blockchain you transact a way then eventually you bring your funds back to ethereum now on the side GM paper the idea is that there would be a smart contract on ethereum in this case that would check you know the the consensus protocol off the other system that may be it's proof of work maybe the validators of that system but there's a smart contract here with the assets just checking of the other blockchain agrees that the fund should be withdrawn but the issue is that when you have a consensus protocol you're still trusting the Judgment of a set of parties and and there's two you know ways this is trusted the first kiss is you know what if the consensus protocol agrees to an invalid block you send it to the bridge the bridge gets the invalid block but all of the validators agreed again your funds get stolen now you could use a validity proof or zero knowledge proofs to make that a little better and there's a lot six years of work to make that better but the real issue with the side chains or the sidechin paper was availability now what are the experimental blockchain goes offline on The Operators disappear if the operators disappear the consensus protocol stalls it can't make any more decisions and then your funds get stuck on the bridge and you can never get your funds out so that was the issue with the sidecham paper so again I'm going to ask a better question you know can we build a bridge that can protect us from an all-powerful adversary so even if the entire system goes offline I can still get my funds out and this was Dakota plasma you know back in 2017 the plasma paper came out has anyone tried to read the paper by the way you know that okay maybe a better question did anyone read it and understand it Noah look at that I met I spoke to Joseph recently and he called it aspirational in terms of his writing because it's a very difficult people to read but the idea in the paper was amazing it tried to solve that availability problem that liveness problem so even if the entire system goes offline you can still get your funds out you know I tried to do better than this IGN paper and for about two years as a community we had all these different variants of plasma you know plasma cash you know plasma and a partial spending whatever plasma MVP but none of the solutions were satisfactory no they only supported payments they all have these nitty-gritty details that made it not practical and in a way we sort of wasted two years but we didn't really waste two years then eventually Barry whiteheart came along and he just released his GitHub and total ethereum style that really you know helped simplify the design space he separated out data availability on making sure the updates to the database are valid and you know the way he solved it was the roll up where you roll up the transaction data and you just post it to ethereum then all you've got to solve is making sure the data is correct and valid and this led to the roll ups this wonderful little GitHub now if we want to categorize this as a bridge we would call this the validating Bridge because now the bridge will end a bit independently protect the funds so let's give an example we have an Executor and they want to update the offchain database so they do this 1990 automation they update the database and they'll propose an update to the database to the bridge now the bridge will not blindly trust the executor regardless of who's authorized this update it will not trust the executor it must be independent or it must independently be convinced that this update is valid and correct and that updates frequently occur as well so then the executor has to send convincing evidence for why this is valid that you know and then the bridge will check the evidence check how frequent it is and say yep the off chin database is correct the liabilities are fine I can let the user withdraw their funds and this is what the rule-ups are trying to build you know the loop brings optimistic ethereum ZK saying Stark arbitrim they're all trying to build a validating Bridge and if they can build this then that's really exciting because now we're gonna have a bridge that runs in ethereum and it's ethereum that's protecting your funds from the adversary you know they try to steal your funds nope they try to censor your transaction nope it will always try to defeat this all-powerful adversary you know it's a great great punch isn't it um but this sounds cool it sounds really exciting but is it too good to be true you know come the rule UPS really satisfy this and clearly no one in the room earlier trusted the rule ups at all apart from one person you're a good soul okay so let's try to define the environment a bit we're going to talk about here are the agents you know who's involved in the protocol we're going to provide a high level overview of how it works in the threat model and of course the security properties for what it means to be secure so who's involved in the protocol first we have the honest user or an honest party the honors user really just wants to you know lock their Moon cat into the system buy and sell their Moon cat and then get their Moon cat back out you know they don't really care about the system itself we have the sequencer who will take the user's transactions order them and then pass them on so they're a transaction ordering service then we have the executor we will take the transactions execute them and then propose an update to the bridge that's I know let's watch this in action so you have Alice and Alice will deposit one coin into the bridge then this will magically appear in the off chain database then Bob comes along you know hi Bob and Alex is going to send one coin the Bob so she'll sign a transaction and give it to the sequencer now the sequencer can notify Bob and say Bob you're going to receive one coin but what's important is that that's only a promise the transaction is in public it's not vital it's not even pending it simply held by the sequencer so when you send a transaction an arbor trim is the sequencer that's getting it and it's making a promise to you that it will be executed but it's just a promise the sequencer waits around for a while more transactions come in then eventually the sequencer will order the transactions and pass it on in this example the sequencer will give the transactions directly to the bridge the bridge will order the transactions but they're not yet executed we need someone to come along to execute the transactions so the executor comes he picks up the transactions again the wonderful 1990 animation he executes the transactions and he'll post a checkpoint to the bridge and he'll say Bridge here's an update to the database and this is why it is valid and this happens continuously you know we order transactions we execute transactions and then we convince the bridge that this is correct and valid and that convincing is again the most important part of a bridge or a validating Bridge so who's the adversary you know who are we trying to defend against who's trying to steal our funds so there's two aspects to consider first the masses flow control the adversary can view reorder and drop all messages on the layer 2 system the only guarantee that an honest party has is that they can send a transaction to ethereum and to the bridge that's the only guarantee they get for Massey's delivery foreign is that the adversary can corrupt nearly every single party on the off-chean system we simply assume that the bridge cannot be corrupted and there's one honest party who can assist the bridge that's the only guarantee we get in terms of honest parties everything else can be corrupt and evil and out to steal our funds and this is the most powerful adversary that you can or you can you have to defend against you know they'd literally control the entire auction system and if you look at L2 beats you will notice that no rule up today the smart contract enabled can actually defend against this Beast the very very difficult adversary to beat and it's probably going to be another year or two before a rule app can defeat this Beast so what's the security properties then what does it mean to be secure for a roll-up or a validating Bridge the overall goal the overarching goal is that there's this off chain database we have to protect the cfd and a sliveness and there's three sub goals and again these sub-goals are from the perspective of the bridge because all that matters is the bridge the bridge has to have a guarantee you know is the data available that's data availability can anyone get a copy of the data the second property is steer transition Integrity is you know from the bridges perspective are all proposed updates to the database valid and correct and finally censorship resistance if the entire system goes all flying can the bridge independently forcefully order and eventually execute transactions that make sure you can unwind your position and withdraw your funds from the system so what about the availability you know what is this problem and there's three questions we're going to answer you know why does the data need to be public what theater needs to be public and how do we guarantee it's how do we guarantee that it is publicly available so why do we care about the database being public remember we had one assumption there's one honest party out there who can assist the bridge so anyone here ideally could help the bridge you know protect from the all-powerful adversary so the only way the honest party can help is that they have a copy of the database you know they need a copy of the most recent database so they can take the transactions execute them and actually propose an update to the bridge if the adversary can withhold One update and prevent anyone from getting an up-to-date copy of the database then they you know they win the game and you can't propose an actual update so that's why it has to be public for one honors party what theater needs to be public and this sort of varies between the optimistic rule apps and the validity Roll-Ups but generally speaking enough data has to be public so the honest party can compute the database so it needs you know all the updates to the database and there's two types of data one is transaction history you know get out get the entire list of order transactions sort of like a blockchain execute the transactions and then you'll create a copy of the database or you know you have data BSA data BSB you get the state diff you know the difference in the storage values and you can post the state diff and so as a you know as a user you get the state diff applied to your database and then you compute the new database so there you hide the transactions you only see the result of the transactions but in both cases that has to be valid and finally how do we guarantee the deal is publicly available so in plasma the focus was this challenge process you know could I challenge the operator that make the data available but for many years it was considered too complicated too complex today I think it could solve that problem in a reasonable manner but most in the communities just ignore it the other problem the other way to solve it is a committee is take this starknet committee or the any trust committee I think is arbitrum Nova they have a data availability committee and the committee will sign a message to attest to the fact they will make the data available or you do the roll up you just post the data to ethereum an ethereum guarantees that the data was available at one point in time so what about the state transition Integrity problem well this is very straightforward if one object to the database can include a can include an invalid transaction then the adversary conceal all the funds in the system you know we've seen this time and time again with all of the bridges the most recent one being binance you know it's this is how they keep stealing the funds now there's two different ways to solve this problem there's optimistic or ZK fraud proofs or validity proofs you know you're going to hear about this topic over and over and over again because this is the one thing they all talk about you know this is the most important problem in their mind uh so I'll skip it for now but to me the most important problem that no one talks about and this is really the difference between the side chain paper you know what is a side chain on what will be a rule up or a layer two protocol is censorship resistance if the entire system goes offline can I still get my funds out and that is really the biggest important topic for rule Ops and no one likes to talk about it because it's really hard so what is censorship resistance a margin that Allah sponsor seller Moon cat he gives the transaction to the sequencer and the sequences like no no I'm not going to let you sell your mooncat you know how dare they the user should be able to forcefully order this transaction so the user will simply tick their transaction and send it directly to the bridge this is what we call forced inclusion they send it to the bridge and the bridge will force its ordering and now it's ordered for execution and this is really cool because then if we consider liveness you know how do we guarantee this eventually gets executed we can assume that the sequencer has absolutely nothing to do with censorship resistance whatsoever you can have a centralized front end a centralized sequencer but the back end is decentralized and that's cool that provides an amazing user experience because you know exactly what sequencer they interact with but they are not responsible for protecting the system we really assume there's one honest executor you can join the system take the transactions execute them and then you know post the update to the bridge we just need one honest party to protect the system so to summarize if you can solve all three problems then maybe we can slay the Beast and just you know deploy a secure layer to your system and for the ogs out there this is the bare wheel from 2014 you know the I think the three bear markets before and I replaced the Bitcoin shield with an ethereum Shield because eat this money now but anyway um what I want to finish off with is uh there's these three core problems are they not the only problems there's a whole host of other problems that you can get your you know teeth into if you're interested in solving cool problems about real Labs as I mentioned censorship resistance is non-trivial there's a lot of nitty-gritty details that makes it difficult um what I'm excited for are those experimental virtual machines this was the original goal of the sidechain paper you know we lock our coins in Bitcoin and we unlock it on this experimental blockchain and now we have this you know we have Cairo for starknet we had the arbitrine virtual machine we have the optimism Bedrock we have fuel in their sway language all these really cool virtual machines and custom you know languages and software but we're still retaining the security of ethereum and that's probably the most exciting part of these rule Ops as well and finally um I guess the last point I'll highlight is fragmentation of assets a lot of people are worried that if you have you know 10 different rollouts the assets get fragmented across the Roll-Ups is that not a problem for liquidity well we've always had this problem with crypto exchanges you know you have coinbius Kraken binance so it's not a new problem but now anyone in this room can deploy a solution on something like arbitrim we could quickly move your phone to the optimism this you know cross chain transfers interruptability this is now a venture that anyone can build or if you tried to do that in coinbase you know coinbase is going to probably tell you to go away so um that's also really exciting we can really solve that fragmentation issue now but is it worth it just to finish up you know is this worth it is it worth all the work to build this validating Bridge now web 3 is a bit of a buzzword you know I'm all if you're all developers and we're all sort of like oh well web3 is this a real thing but uh to me my vision of web3 is that if you consider the web 2 world web 2 we've always had to trust the off-chan system you know I take my coins I lock it in the coinbase and I really have to trust coinbase to protect my funds in the web 3 world I would hope we can have a user experience that's similar to the coinbius I lock my funds in a nice UI you know I get instant confirmations but the difference is that I don't have to trust coinbase for my funds so the actual service is exactly the same but the difference is whether I trust the operator or not or what I trust the operator to do and that's really web three so we use these rule UPS eventually it will feel like using a web 2 service but much better you know security and Trust guarantees and I hope and this is a coupe by vitalik you know is a wonderful blog post on this cursody's becoming a liability and what do I mean by that so if you consider if you were to do a startup maybe five years ago you know you could be the new mangoc so the new bitstamp or binance you know you run your service you get these human processes and you have to secure billions of dollars that obviously doesn't skill as far as scary you know who wants to be liable for protecting billions of dollars I mean that's reasons does anyone here want to be responsible for protecting billions of dollars no I'm look at that exactly you know screw that that's weight that's way scary so what I'm excited for is the rule lumps if there's one rule up that can get a good you know a good implementation that's easy to deploy and reinstantiate there's a good developer experience says that anyone here can build on it then we've solved the problem you know we've replaced those human processes with software we almost offer skills so you deploy your rule up you offer a really cute UI I can go on there and buy and sell my mooncat I don't trust you with it so I believe it's worth it because I don't think users care about custody you know we all still use custodial Services what is the operators who care no one here raised their hand when you wanted to protect billions of dollars so if you're all going to do a new startup you're probably going to look into the rule out to say you know could I reinstantiate this and reuse the software that's the layer 3 goal and so that's why I think it's worth it you know custody is an unnecessary liability and that's the end of my talk I have three minutes left I believe so thank you guys for listening and have a great time cool awesome