foreign
[Music]
security and how can we be convinced
that the CK AVM implementations that
we're all working on are secure so today
I'm joined by Hai Chen who works with
scroll Tech and has been like leading
engineering there about implementing the
ckvm I'm with Jordy Molina who's who's
part of the polygon Hermos team and has
been leading engineering there one thing
that strikes me about like the
organizations of polygon and scroll is
that their their willingness to
collaborate they've both been like big
collaborators in in Xerox Park and I'm
now exploring like how to security kvms
together I'm also joined by David who's
on the ethereum foundation security team
and has a traditional background in in
security and and all its and things like
that so I hope that today we can have a
nice kind of exploration of how we're
going to be able to make the ZK VMS that
we've been working on secure so that's
my first question how can we how can we
secure the ckvm
how can we secure the ZK evm yeah so
yeah hello everyone I'm hijin so I think
like so the zqm is a very complicated
circuit so to actually make sure like
the uh to make sure that the decayment
is secure I will definitely need to go
through like the all several auditings
like having Auditors to look at look at
the circuits and probably I think like
maybe not even like a one single team of
Auditors maybe have multiple teams look
at that again I can uh and then we can
like find some bugs and then we can fix
that and then after that I think we also
should do like the like on Parallel can
do some bug Bounty program which like
have like the more community members who
like the interesting to looking into
this stuff and then finally they find
any box I'll Attack those things uh
that's nice thing like that to have
that's more secure uh and then last I
think maybe a little bit like to say
like have some more Advanced Techniques
like the very nice people and other
people like to describe have some more
formal verification tools and then
Frameworks do like a model checking
those kind of stuff also like I think
like initially maybe it's more scalable
to a very large circuit but I think we
can eventually get you there yeah that's
like my maybe just to complement that
and first of all uh open source you know
that's probably the first step in in
securing something uh cryptography
bifurcation or just you know probably
cryptography this this has the humanity
already has been tested that this
doesn't work we have experience
Microsoft Google IBM so big corporations
that just pay a lot of money just uh
building private
cryptography systems we know that this
is not the way to go
we need as many A's as possible of all
kinds to take a look at the at the code
at the protocols and that's why it's the
first so the first must this is not
enough but the first is that this needs
to be open source and
the the people and especially the users
have to have uh access to this code this
is the the first step okay and from now
on let's start as as he says is is is
it's a complex system so the first thing
is the first problem that we are
challenging is that uh who can review
that
because it's something that's new it
didn't exist before we are creating a
lot of Primitives a lot of you know
direct meditation all the uh because
we're doing a lot of tricks and a lot of
things and there is no experience on
that side so the first thing is who's
going to review that who's going to take
a look who has the capacity uh to to to
to look at that so first step and this
is where we have started
the partnering here together just to
that is to uh to somehow uh start
teaching start uh explaining uh straight
into the Auditors explaining to the
community explaining to anybody that's
interested in the system this is the
first so this is this is for sure it's
the first step if because we need to
open and the first the open even if it's
open source if nobody can understand
what's in the in that repo it's like
being closed source so so we need this
to to open and to explain to teach
to spread how we are where we are
working and and and and and Publishing
that and this is the the the next step
after that so when we have this let's
say minimal uh
um minimal you know minimal um critical
mass of uh Auditors and and so on next
step is okay then here is how we
organize okay so we organize the the
auditing and because we need to be here
a little we need to talk about
procedures and we need to talk about how
we specifications how we write the good
specifications how we can split these
specifications and uh have them in the
procedures how can we clean the code how
can we uh go and this is this is going
to be the problem the the next step and
once we have this clear we have this
specification phase quite clear that the
things is quite clear then it's a matter
of uh just taking a look
and even that
we will never have the warranty like any
cryptographic system we will never have
the warranty that the system is going to
be 100 safe
here uh we have the responsibility as
projects to
invest as much as possible in resources
uh at least in the polygon side I'm sure
that in
of the other projects too they will not
launch anything until they feel uh
comfortable enough that the system is
reasonably safe
um
David do you have any comments with it
uh yeah uh I think so I think open
source multiple audits um I think
education is important the for me coming
from like a traditional security
research background
um I think we have very strong software
security research capabilities in the
community I think that there's uh you
know there's multiple components here
there's like the L1 verifying contracts
and as you've seen in previous talks you
know three or four years ago we didn't
really we just knew what it re-entrancy
was because uh the big Dow hack now we
have like 101 best practices for
solidity coding so we have like these
different components um pillars to stand
on unfortunately with security uh it's
kind of the weakest link issue here so
um like we've got a great bug tracker
for ZK stuff but I kind of where I see
like a large gap is that we have a lot
of academics um that come from like a
formal verification or like a
mathematical uh background and then we
have these people that understand like
implementation so it's great to one like
multiple audits but we don't really have
multiple firms that know how to audit so
the education stuff is like critical
here some of the tooling stuff is
reusable with like uh formal
verification
but I think like over time it's going to
be about this collaboration
um I think that this is like critical I
think you know you can look at some of
these things and say like hey all these
l2s are competing and I'm not sitting
I'm you know I work for the EF and I
care about systemic things
um so I'm not like on an l2's team here
um but in the long run like you could
say oh yeah it's a zero-sum game for
these l2s but if something catastrophic
happens to any of them I guarantee you
it's a like a it's a positive sum in the
negative direction for everyone nobody
is going to trust billions of dollars on
TBL here and they're all just going to
go to optimistic Roll-Ups right so I
think this approach here I see polygon
zkevm folks in the crowd I see all these
people working together and Xerox Park
kind of like hosting this community
where academics can come together I
think that this is kind of the the only
path forward because it's the only
missing thing that we have here
um that that we don't have some like
tried and true testing methodology and
so I don't think this is anything new
for the blockchain uh Community the
prereq requisites to understand smart
contract security require you to
understand decentralization things like
oracles all these New Primitives and so
we've had this already we've seen people
tackle things where you have to not just
be an expert in like one domain like
software security you have to understand
Economic Security and all these things
or the whole system falls apart so I
think this is just going to be an
evolution and I think that there's like
we're on the correct path uh forward
thank you thank you David
um so the ZK VM is a is a very
complicated piece of software it has
many components and those components
interact with each other my next
question is like what components are you
all specifically worried about what's
what what keeps you up at night
uh yeah I see like this so there are
multiple pieces it's like in the uh ZK
even circus so it's not like uh so you
know architecture is not only one single
circuit so it's actually a set of
circuits that connects with each other
and then so work together to uh to
suddenly like verify the evm behaviors
correctly that the trace is correct so I
think like that first of all like the
most important piece is like the the
original the evm circuits which is the
most like Central piece so it's kind of
like the uh your model like the the evmr
codes and then all that state
transitions correctly so those kind of
things like I think uh so I think like
the people usually I can know how to do
like that so uh integers like big
integer multiplications and then our
integer additions but like if you need
to be true like that all of the
constraint is very true to what evm
specs it does like they will assume
yellow paper defines how evm works
there's a lot of like the corner cases
if you look into the details so those
are kind of cases they usually will be
easily overlooked so I think that's like
the one thing that's very important to
do to check and then the second thing is
that so that because the circuits need
to work together then you connect to
some lookup tables uh to to be sure and
then certain things like maybe checking
one circuit and a certain property will
be guaranteed by another circuit uh then
how can we guarantee that this like the
combination of all the circuits is a
sound and a complete the ones like to
check everything that you have inside
the event uh to fully guarantee or does
Decay even is correct so I think this is
the kind of two biggest things like that
I think it would be uh important to to
auditor that you can even so so like
you're saying that like the two big
issues are the corner cases and the
interfaces between the different
components yeah yeah nice okay yeah I
agree I think that makes sense
kind of maybe a different architecture
uh on that so probably the pieces are
different on that side here I would say
two parts one is the what we call it the
ROM or if you one is the the code that
actually implements the evm itself there
is a lot of lines of code and this is
like it's like writing a smart contract
you know it's it's at the end a single
uh mistake in one of the lines can screw
up everything and and this is well this
is concerning this is because it's it's
it's critical code and if you see that
number of lines that are in there are a
lot actually is you can imagine Geth but
Brighton in assembly you know it's just
it's it's a complex code there okay so
this is probably my biggest concern that
is fine and then there is that in
meditation in Orchestra limitation is
is
probably much more simple uh because at
the end we have just a kind of a
processor there so the Logics is more in
the wrong part
but uh but it's not a lot it's a very
new language it's a very new thing it's
something that uh we don't have
experience designing identity polynomial
identities on that side so and it's very
very easy to to to miss some something
or don't take in account something and
and so on
so probably these are the two things
that are more concerned but I cannot
forget you know even the smart contract
that I'm there and then more things that
are more uh basic if you want but they
need to be safe too
right I I find that there's this
misunderstanding in the space where
people equivocate like L1 to L1 Bridges
with L1 to L2 Bridges and I I I think
that it's the problem is that they call
it even Bridges no I I would like to go
back to the double pegging for for chain
to chain and
and this is maybe it's a bridge but it's
a truthless breed it's it's just a smart
contract just it's a mechanism to moving
funds but it's not what we understand as
uh
classical breach of you know just a kind
of a multi-seek where you need to draw
some
some party yeah absolutely so so to be
clear L2 bridges are much more secure
than L1 Bridges
hopefully
um yeah so I think I think like this
kind of just like points to a lack of
like true terminology everybody's
marketing right now
um so I would say like L2 Bridges I
would call them fast Bridges where
there's like a third party and they're
taking the risk so if there's a double
spend on one of these Bridges like the
person that's getting the one percent uh
fee for transferring your you know off
of an optimistic role than letting you
not take the seven day wait period or
between two ZK VMS or whatever like they
they get a yield and they take the risk
and they're the ones that's like you
know out of luck if something happens
um for me like I'm not sitting here
thinking like what's the like worst
doomsday scenario uh for my ZK evm
um I'm thinking like what happens to eth
when something bad happens to zika evm
and I I hate to say it but like
something bad is gonna happen we've seen
double spin bucks in Aztec we've seen
them in um Z cash we've like these
things are a big deal the one thing
that's like the Saving Grace for
ethereum here is that we have a native
non-privacy like
token standard at the base layer and the
reason this is important is because you
can see when there's insolvency in a
contract whereas if you just had like
the ZK uh like roll up and this is your
entire ecosystem and everything is
either private or it's using ZK to scale
you might not know that somebody's
printed Infinity tokens or that some
other wallet has negative tokens and
that's like how your constraints add up
and so for me it's like this lack of
transparency here I think that there's
some like traditional security
um
like philosophy that we can apply here
you can do things like have like buckets
and I understand like if you're trying
to do something like scale this isn't
that big of a deal if you're trying to
do something like staying private having
buckets for like your your like zero
knowledge cash type transfers like you
can think of like tornado cash that it
reduces the anonymity set so like there
are some issues here but there are also
things that we're starting to see now
um where you might have like a
withdrawal like we do see these like
chain to chain bridges that aren't
really Bridges
um they maybe can have like a uh like a
Floodgate mechanism like if somebody's
gonna drain the entire contract that's
probably not normal when there's a
hundred thousand users that are using
your L2 so like if 10 of the contract
exits in a 24-hour period maybe having
like these kill switches um will be good
and then you can do things like have
guarantees where if there is an issue
everybody takes a 10 or a 20 haircut on
their TBL and nobody's left holding like
the complete Miss like like lost bag I
do think though that like you know if
there is something systemic and like a
like a multi-billion dollar uh zkevm
gets basically drained and this is a
problem then at least the base layer of
ethereum is like still there and and we
can still make those like trust and
rebuild and so for me the like the
scariest part here is the new technology
I mean people were afraid they they
people don't really understand like the
zero spin problem until they see that
like Bitcoin has gone up over time and
like well yeah there's nothing behind it
there's all this stuff but there's
somebody willing to buy it from you
right now for twenty thousand dollars
right and so over time people like start
to trust these things and I think of
like if you guys have seen the Indiana
Jones where he's like stepping on the
like different pieces and like one of
them falls through or like if you're
crossing a creek you kind of want to
like feel the rock that you're going to
put all your weight on before you go I
think that that's going to be the same
thing here we're gonna have to like have
people start to trust you know the
cryptography that they don't understand
yet like this is all Moon math to the
average person right even like Advanced
security Engineers don't understand any
of this stuff and so there's this gap
between the understanding of like you
know this this like high level
multi-dimensional Matrix math that you
guys all understand and then like the
people that like know what like a
traditional software bug looks like and
so that Gap right there is the is the
scariest thing and the lack of
transparency if something goes wrong is
is also scary to me but you know you can
mitigate some of that risk by
bucketizing and these other things I've
mentioned
I I think that like what resonates with
me about what you were saying was how
it's really nice to have this L this
roll-up Centric roadmap so that we're
able to experiment with these new things
and we're able to build systems that
with time can can get the kind of trust
that we need
cool so my next question is like so when
I do all this what I normally do is to I
try to find things that like people
don't know or that the developer didn't
know when they were writing the code so
what are some of the things that people
don't know about about like your code or
things that could be interesting for
people to pay attention to
um yeah I think that's a good question
it's like I'm not sure like that you
hear audits what other stuff that's like
the when they do like other teams but I
see like there'll be things like I think
behind like the foreign
tricks and then that could be make the
circuits like less readable uh which
like the I think Auditors may find like
that's very uh hard to understand
certain part of the logic of the
circuits so I think that seems like we
should explain uh those kind of things
uh to the to the Auditors
um and I think in addition like there's
some certain assumptions we make like
doing certain uh part of gadgets or part
of the circus like you make certain
assumptions and I think those things
like a very important like maybe only
the developers who develop those
circuits knows about that but I think
you need to those also seems like
important to put down into specs so that
the audits can know like the why you're
doing certain things in a while like
you're not doing sentences
yeah
there are many things but uh
one one that's important and the concern
is that from what we have in in the in
the in the program it's a
non-deterministic so it's not
deterministic here it's not anonymizing
means that first of all you want to do a
division actually what you do is you put
the result and then you check the the
multiplication okay and tricks like that
uh well there are many for example one
when we are where we are scanning
transactions actually where we are doing
if we are hashing all the transactions
but we are putting all the data all this
data is we call it free input okay and
then we are uh we have a constraint that
calculates the hash some call and then
the hash is the public that's actually
what needs to be matched okay but you
can put anything in there
it's okay because you have to Hash but
this kind of
um this is something that for a normal
programmer for a normal
um normal drummer something exchange
it's something that's not used to it's
something that's different and
this needs to be explained very well we
seems this we have seen for example
internally in the team you know in the
team maybe it's just the people that
just learn things as people that you
know they come from uh other backgrounds
and uh it's natural that uh what you
first write these programs and you do a
lot of mistakes because you don't have
uh you're deleting absorb this concept
of course you repeat that you do it
again and and then the people is getting
but it's something that needs to be
explained very well because uh I think
this could be one of the big sources of
uh problems
in there
I I actually don't have any real good
input for this question so leave it
there
thank you
um my next question is how can
traditional tools help us
when we're trying to secure the KVM
uh yeah let me just start with like one
more simple things it's like setting
everything to zero CFL can pass that's
like in a lot of cases you can pass
again which is not correct in your
circuits so that's like one simple
scenes and another thing like uh some
basic scenes like a fuzzing so I think
like the inner zero noise stick I think
the first thing could be like slightly
different you know like buzzing
arbitrary data that's putting inside
your circuit with this that's it's very
easy you don't like that the uh that
like that it won't pass the proof
because like it's there's lots of
constraint checks you need to be very
careful to make some Corner cases to
make sure like the there's some
invalidancings that you put into the
circuit but then can pass that but I
think like in the context of the eke ebm
is that you can generate arbitrary Trace
like that you can you can fast the trace
of the the from the evm NSC like that's
uh if that can pass it I think like
that's like the what Paradise was just
like talking about like those buzzing
other people very helpful like to to use
like generate some value trades and some
invalid trades and then just and then
you can tweak a little certain small
amount of things like inside the trace
to make things like the uh that should
not be passed by if they pass the
circuit then there's some bugs inside
yeah in general all these formal
verification tools uh with maybe with
some adoption with some adoption
specifics but can be used at least to to
to understand better some parts of the
circuit maybe not like everything but
there are specific pieces that are quite
clear and that work very well or that
can work very well uh with this tooling
I'm thinking for example they are in
Matic extend machine in our case this is
very clear you know it's very metic you
know this must be a multiplication and
cannot do anything else this is
something that for my application people
love to see this this clear patterns uh
in there so I'm sure that some work can
be done and there if you go to the main
processor that's it's not that
mathematically well defined maybe there
they have more uh more problems and that
here is more free physiologically make
more sense but uh yeah definitively you
can can can help and here maybe it's a
caller for people that's expert in in
some it's it's good to understand and to
see how this this thing works because
I'm sure that there is a lot of tooling
and a lot of these things that can be
very helpful and we are and we don't
even know that those tools exist so here
is uh it's important for the community
to be productive here the Xerox Park
people is doing a great job on that and
there is people that's already looking
at that and there are some ideas that
things can be done in there uh that's
important again it's just explaining
because when you when you really
understand the circus when you really
see what the disease you you can find
people that's expert in that material
that that can see ways to that can help
a lot
um I think so formal verification has
been mentioned uh formal verification
and it's like I can only do so much in
like a regular security testing and so
it just so happens that there's like so
much math in these circuits here um that
it just lends really well to this so I'm
I'm really excited about that
um first of all it's like the first time
I think I've seen it applied in a way
where I'm like well this is going to be
a big part of my life I need to go read
you know brush the dust off of all the
textbooks another thing is that there's
like a lot of there's like a lot of
traditional things
um with security audits that that
actually lend well to to these also and
like a good example would be like typing
like strong typing is is serious and
regular security you have integer
underflows you have integer overflows
you have casting errors things can flip
negative and you see this in these
circuits but you also see like um
there's sometimes optimizations and
developers do this stuff naturally
um a good example is like the Aztec 2.0
uh maybe was not ever exploited but what
was reported there was like an input
that was 128 bits or 64 bits and the
actual constraint was only 32 bits so
you could actually provide multiple
nullifiers if to pass all the
constraints which means you could
potentially like withdraw from Z cash
type thing more than once even though
you only deposited once and that is
something that is queryable and you can
just have a strong typing system so like
the a correct static analysis tool that
was that like could have could have been
applied to that and just said hey error
manual like review required this input
over here is a larger is a different
type than this like the way it's used
and casted over here so anytime there's
like a casting error you can have this I
think there's going to be like plenty of
other queryable examples like this where
we can apply traditional security tools
towards this
cool
um so where do we need to make new tools
to like Lucas talked earlier about his
exploration of trying to make a
polynomial solver and like there seems
like there's a lot of scope for us to
explore like where would you like to see
new tools
yeah I think like uh so a lot of tools
like I mentioned I found traditional
like formal verification they are not
very ready I think for the uh proving
that the uh the the ZK like the circuits
so I think like those things like will
be very good to have and then I think
like not only like some tools like from
the like for auditing I think that
there's more tools will be uh very
useful from the proof system side it's
like they can provide you a very easy to
use interface to uh generate some
arbitrary like the uh error cases like
you can inside the circuit and also have
a very
um bug reporting for example where does
the circuits fail and those kind of bug
reporting will be also very important
tools a second auxiliary uh make the
auditing and then make the testing like
the more easier and then easier to find
some bugs
yeah clearly these uh
back reporting we launched the test net
the public test net on on Monday we
already got a report of uh never was
nothing crazy but it was already a buck
that we already fixed it and that was
because we published that and somebody
just tested and we just put something
there so this is the importance of uh
testing the things and I agree the the
bug reporting is is when you see
something that goes wrong you need to
investigate until the last and fully
understand what's going on because you
probably you have something that can be
getting worse
um I think
a formal specification for differential
fuzzing would be really cool
um I think that there's like a value add
when you could take like 10 different
zkevms and you could potentially throw a
test case at each of them and then you
can compare the output States afterwards
um I think the value out here is
everybody wants to be part of it because
you're going to know that you're
conforming to the spec if you know if
your output matches everyone else's this
has been incredibly fruitful with our
consensus Slayer clients in ethereum for
the beacon chain so we have five clients
there's certain things that are in the
spec like processing an Epoch transition
and so we can hand it Like Us form it's
a it's a specified
beacon block object and we can run it
through every one of them and we can
diff all the outputs afterwards and
that's like incredibly valuable right
like that's uncovered multiple bugs it
would be like chain splitting bugs and
these types of bugs like in the L2 world
would mean that you'd have a state diff
between the L1 and the L2 which means
double spins it means all kinds of other
like horrible things can happen
um another thing that I think is really
important is uh like zoomed out from the
ZK ABM it's more like about L1 contracts
in general and that's like a like an
open security standard of like ahead of
time hey if you're a white hat and you
find a bug please report it to us
obviously like we'll resolve it
privately but there are some cases in
the security world where like a
vulnerability primitive drops and
everybody hears about it at the exact
same freaking time and like when that
happens you've actually seen this like
be fruitful where white hassle front run
black hats they'll steal all the money
out of the contract and then they'll
return it like and you know maybe get a
bounty or whatever and so having like a
previous specified like okay on your bug
Bounty page have a little thing down
there that's like yo if if you guys
drain a billion dollars a tvl from my
contract this is how much the white hat
Bounty is and uh we're like legally
saying you're off the hook ahead of time
if you return it all and you do all this
kind of stuff and we are seeing some of
this stuff kind of come out and flush
out in like the D5 ecosystem there's
gonna be like a spec that's being
working with worked on right now with
the open security
standard or Alliance or something like
that I think there'll be more
information about this like in a few
months I think this is all just kind of
like in the community right now but I
think that's going to be huge because if
you know ahead of time I know a lot of
like white hats that they just don't
want to touch stuff like this so there
was like uh I think it was like The
Nomad hack a bunch of people were able
to just replace like the public key to
receive funds and replay the attackers
uh original like exploit and they were
all like a bunch of white hats stepped
up and started draining this contract
and it was weird you can only drain like
a little bit at a time so they were able
to like actually recover a certain
amount of the funds and you know it
sounds weird to say like Hey we're going
to give you a White House Bounty if you
hack our contract and steal all of our
crap but this is like a phenomenon that
keeps reappearing where everybody hears
about the vulnerability at the same time
and we do need people to drain these
contracts ahead of time so like that's
one example of something like that
um thank you David yeah sorry to
interrupt yeah
um so my last next question is like um
the harder one so when would you all
feel comfortable to put all of
ethereum's assets inside your ckvm
yeah that's a tricky one so I think like
that so when we launched a Mainland I
see that it would be assumed like that's
audited and that would be like very
happy to do that for myself yeah
we have the experience of Hermes one and
other you know other real production
life and yeah it's a hard decision uh
General I I look at the Ace of the
people that audit
uh that and it's who audited that and
I'm talking the specific guy I don't
care about the the brand and it's just
the guy and and
even
the kind of uh questions that the
auditor made uh how deep they went and
uh
the experience that this person have
when you put all these pieces together
so it's just but you need to know
personally like each of the Auditors
each of the internal and external
Auditors and each person of the people
you just check to all the places and uh
here is just a feeling it's it's a
feeling that okay this is uh this uh
should be reasonable safe that's a
feeling it's not uh I wouldn't it's
difficult to put a parameter because
what you say you say oh we need two of
these we need three of these we need
four persons three persons it's really
it's really hard because this person's
now I see now this I pay it out it's
that I'm sure that the guys that made
the audit they didn't check the smart
contract at all and I've seen that
okay so it's not
so okay we have two Audits and and I'm
not gonna I'm not I'm not gonna trust
depending on the who made the Outreach
okay so that's it's more personal thing
it's personal people who made what what
the questions they did what scan it
where they went and this is when you you
I would feel comfortable but it's a very
personal decision it's a very uh uh
feeling decision so it's it's hard
uh to the answer all of ethereum's
assets I say never
um I think I think the zika evm for L1
will be good for having like
statelessness and being able to think of
like client instantly without having to
download all the trends and all the
transaction history I think there's like
value there but I think just like
everything else here
um time is the thing that like makes you
trust it people trust uniswap because
uniswap has a natural bug Bounty of
billions of dollars sitting in it right
now anyone can go after it so like time
will tell the analogy of like kind of
stepping and feeling the rock I think
that's important but I think that like
bounties are are a big deal and and
these things naturally have bounties
um open source is important you need
lots of eyes but shell shock and
Heartbleed were in the Linux kernel for
like how long I mean every for 10 years
every single like 75 of the computers
connected to the internet had an
arbitrary kernel read and nobody knew
about it right somebody was probably
using that the whole time so for me like
you know this stuff is very new ecdsa
tried and true like sure BLS like we we
we took some like we can do this because
we want to aggregate signature years and
the trade-off was important but we're
not putting ZK in the consensus layer
right now for a reason and this is like
I mean I sat in a backyard with vitalik
and and Dan Binet and you know this
guy's been doing ZK stuff since the 70s
when nobody cared about it um and now
we're heading to Golden Age of
cryptography and we're implementing it
and he was like I wouldn't I wouldn't
put in the consensus layer so we're
taking baby steps in the consensus layer
ssle so that we can prevent um we can
have privacy about who's proposing next
so they can't DDOS like targeted DDOS
our proposers and proof of stake that's
like the only place we're taking a tiny
little baby step a ZK
um I think beyond that everything else
is there's a reason you have like this
there's no privacy and like like ZK
scaling in the in the layer one and I
talked a little bit about contract
solvency I think that like my golden
future for ethereum is that all nation
states are issuing their cbdc's and they
have their privacy they have their kyc
all these things in their ZK roll up and
then we can all say like yep the US
government actually has something to
back up their reserves right which is
something that's a benefit on our
current system if we didn't see the M1
and M2 money chart and if we even trust
that we don't actually know how many
dollars are out there because nothing's
backed by gold anymore so I think
there's a reason I think there's always
a trade-off I think anytime you take a
bridge whether it's ZK or it's an
optimistic roll-up you end up inheriting
the risk of all of the pieces there
whether it's the fraud proving or
anything and I think that people will do
things like like uh have their their
large company or their large corporation
or their large government having their
financial reserves being completely
visible on the L1 contract and then all
the fun scalable private stuff we can do
with ZK we do on top of that and and we
take the risk trade-offs the same way
that you have a bank account and you
have the cash in your wallet
thank you David um I think I only have
time for one more question uh so my last
question and hopefully we can go through
this quickly is uh what's your favorite
security bug
uh yeah it's like uh my very secure bug
is like the I think previously for the Z
cash they have like The Trusted setup
like and then they put like in one extra
additional points to there which like
allow people to do like an infinite like
uh counterfeit some C cash tokens on top
of that and then that was like but it
wasn't fun for like many years until
like every like found out that I thought
you said that's a very epic One Security
work in general or specific to the to
the IVM that we're building in general I
can I can I can tell you the intern the
the the internal one this is the Luna
but it's it's I think it's a good
example of this bag that we actually
found but this is a good example that is
okay we found it it's back but you know
we couldn't vote for sure you know I
tell you it's like in the sparse Mercury
there is a condition some point at some
point there is a condition that you need
to check that when you are deleting that
uh the key you need to check that the
key that the keys is to say that that's
not the same key that there is a so
there is a check that you need to do
that
um we didn't
well the first implementation
the check was not there
and when I saw that is it's so easy to
forget that check
it's so easy
that's when you realize how complex this
is this is and this was fun by well but
by the person that was documenting the
was documenting the the this part of the
storage
but
if if it sees this
what else can be in there and this is
the this is the the the the the concern
and and the landmarks
um I have like a million favorite bugs
so I'll say the ZK specific ones I I
think that the uh the like lack of
auditability because of the Privacy that
ZK inherits here is just really cool uh
I mean you see these L1 contracts get
hacked and like Twitter's excellent at
like broadcasting information and like
this like distributed Network way where
if you follow somebody like you can like
infosec Twitter I know about bugs wait
before potentially developers do because
like it just gets spread so fast and you
cannot see a D5 protocol get hacked now
and not know in like 30 minutes if
you're keyed into crypto and infosec
Twitter
um I think it's really cool like that a
hacker could like basically steal all
the funds slide out the back door and
nobody would know for like years
potentially because of ZK I think that's
just really cool
cool um thank you everyone thanks for
taking the time thank you thank you
[Applause]