I wanted to we're gonna start this
presentation with a kind of symbol a
question which is just what did Satoshi
in events anyway right so who here a
sort of Bitcoin who here is aware of the
fact that Satoshi created Bitcoin
okay so Satoshi created Bitcoin right
but what makes Bitcoin interesting now
the way that you might hear a lot of
people describing it is that Satoshi is
the first person who solved this long
elusive 25 year old computer science
problem called the Byzantine generals
problem right you did you can find a
bunch of people saying things like this
that the solution to the Byzantines
generals problem was invented developed
by a mian group open bracket identity
unknown cause bracket who goes by the
name situation Nakamoto the business a
generals problem was quote unsolvable
until Satoshi sidestepped it many
authors have written in the about the
decay of Western civilization and how
the loss of power causes societies to
disintegrate and so we she fixes this
problem apparently so this is not true
the Byzantine generals problem was
solved by am a wonderful fellow named
Melissa oil import in 1982 so in the
paper that introduced the Byzantine
generals problem he basically provided
algorithms for how a set of parties that
all wants to agree on some piece some
piece of data some and if I a choice
between some large set of choices can do
so and can do so fairly easily even
under assuming up to a third of them are
malicious and even assuming like no
assumptions about Network synchrony and
all of these things right so there's a
bunch of different solutions to the
Byzantine generals a problem in the
visiting generals problem paper and I
encourage people to read it
so if visited generals problem was
solved at the very beginning and if
there were
whole bunch of ways of doing
decentralized consensus for 25 years
before Bitcoin and 15 years before proof
of work started to be used for anything
then what did Satoshi really invent
Satoshi she invented crypto economics so
what is crypto economics sorry crypto
economics is basically use of economic
incentives to provide guarantees about
applications so you can view it can
crypto economics us being and if the use
of appended economics and game theoretic
reasoning as a kind of appendage to
cryptographic reasoning I mean so
cryptographic reasoning allows you to
and if believe certain things
conditional on some assumptions that
basically claim that the adversary does
not have a computer that's bigger than
the size of the observable universe and
that's all really nice but crypto
economics allows you to have other kinds
of guarantees that cryptography can't
provide but because of the types of
guarantees that groups we can economics
us trying to provide there they're not
cryptographic guarantees instead they're
guarantee is conditional on certain
kinds of economic assumptions so for
example the assumption that a platform
will continue running liveness a also
known as censorship resistance is
something that can be provided by
economics cannot be provided by
cryptography even the assumption that a
decentralized consensus system will come
to consensus is something that cannot be
guaranteed by cryptography it can only
be guaranteed by some kind of model that
says things about the motivations of
participants in the plan the platform
so what chains are crypto economic
protocols here's a blockchain you have
blocks and five of those blocks are in
one chain one of those blocks is kind of
off to the side and the wrong chain and
in a blockchain you wants to encourage
more miners to create blocks that extend
the correct chain and you do not want to
encourage pea
able to create blocks that just go off
to the side to the side and make a
different chain and confuse people so
how do we do this with economic
incentives now it's actually a bit more
subtle than just talking about
incentives right Bitcoin uses group to
economics to solve two problems what the
first problem that is what I call the
waitest assignment problem but you might
also have heard about basically the same
problem under the name civil resistance
so here's the problem right
we've had these PFT algorithms for a
long time these algorithms that say you
could get together 15 nodes have them
send a bunch of messages to each other
and as long as less than five of them
are malicious then the system is going
to come to consensus and if you can make
assumptions about the maximum amount of
time that messages can will take to pass
between these nodes that instead of
tolerating up to four militias you can
tolerate up to seven militias and that's
like even better and it turns out that
if you can allow even stronger like
really strong security assumptions you
can tolerate all the way up to thirteen
being malicious but that's a topic for
another day so we've had these
algorithms for a long time right and so
we had these centralized consensus
what's the problem what why hasn't this
taken off and the reason is ultimately
that even in a system that has say 15
different parties you have to have some
mechanism for choosing who these 15
parties are right you could say oh it's
like the 15 big major banks who here
trusts at least 11 of the top 15 major
banks it could be 15 of the top world
governments who here trusts at least 11
of the top 15 world governments so this
is this is a challenge right if he wants
to create a system that actually will be
a kind of accepted by large
constituencies around around
world then it's hard to kind of create
this set of 50 of 15 people that
everyone will agree then you actually
can't trust that we still love them it's
hard to come up with a set of actors
running the system that actually is kind
of credibly neutral right and this is
the problem that proof-of-work and proof
of stake so cleverly solve right
basically what proof of work and proof
of stage do as they say
well instead of pre-selecting 15 people
that will be run this system what we're
going to kind of de facto do is we're
going to say anyone who publishes a
certificate that kind of Matt
cryptographically proves that they've
keep I computed some large amounts of
mathematical work gets to join the set
so if you can solve like some extremely
complicated mathematical problem and you
published a solution to this problem
said ah you're part of the set I mean
proof of stake if you have a bunch of
coins and you send those coins to the
deposit contract that I you're part of
the set and so instead of the kind of
pre selecting 15 people that everyone
trusts we create this kind of open
permissionless system where anyone can
join and participate but then we we wait
the birth of participants by the number
of economic resources that they
contribute right so in proof of work the
the kind of the weight of the impacts
that you have on the consensus is
proportional to the amount of computing
power that you're bringing to the table
and in proof of stake it's proportional
to the number of coins and both of those
things take a lot of economic resources
to get the reason we can't just allow
everyone to join in give them one vote
is because well on the internet nobody
knows you're a dog and on the internet
nobody knows you're a virtual machine
inside of a computer with 10,000 virtual
machines where that computer is run by a
dog so like this is the problem that
we're trying to solve right so economics
actually does do a very good job of
solving this problem of kind of creating
this
said of actors and this kind of set of
assignments of voting power to basically
an open permission Allah set of actors
that actually is very economically
difficult to kind of take over and
become 51% of so this is what perfect
work solves and this is basically the
innovation that made vic when possible
the innovation that makes theory
impossible and proof of stake is and it
fundamentally in the exact same spirit
except instead of burning a bunch of
your tricity to to prove that you have
economic resources you just like points
to the address where you deposited some
coins into your contract so this is the
first problem and the second problem is
the incentive problem right you have a
bunch of permissionless actors and some
of them might be wonderful people and
some of them might might be people in
some country that can mind really
cheaply that you have and you have like
no you don't really understand what
their psychology is some of them might
be like big big corporations
some of them might might be hobbyist
some some of them might be like hackers
that gain and gain access to computing
resources and like these are kind of
disparate groups of people and we can
know and of fairly little about what
motivates them well what's the thing
that motivates a lot of people economic
incentives right like we know that
people in all these disparate regions
like money and wants the game more it's
generally people that don't like money
and what to gain more are not going to
be the ones that have you know the
economic resources to make up 51% of the
network in the first place so we can
infuse economic incentives as a way of
driving over and of driving this wide
disparate group of participants to
participate in the network in good ways
instead of participating in the network
in bad ways so these are both kind of
crazy uses that use cases of crypto
economics and they're used in Bitcoin
they're used in aetherium they're used
in basically an every main major public
watching so incentives pretty clear if
you make a block that's part of the main
chain you get a reward
and you have to pay some electricity
costs to make a plug but the rewards
gonna be a bit bigger than the cost and
if you make a block that's not part of
the main chain you have to pay a cost
and so if you're making blocks you have
an incentive to kind of continue to
extend the chain that everyone else's
who here understands this yay
so crypto economics is great because
cryptography lets us prove things with
very minimal assumptions about behavior
actually without assumptions about
behavior group to economics allowed us
to approve things with kind of minimal
assumptions about participants so this
an assumption that they're motivated by
economic incentives and actually systems
can even work even if people are not
willing to kind of just motivated by
economic incentives all you need to
assume is just an upper bound on like
basically how much money attackers have
that they're willing to burn and both of
these assumptions are pretty ideal for
decentralized and trust me to my systems
so what are the security goals that we
have in corruptive economic systems
right so first of all we want the
correct execution of the protocol to be
a robust equilibrium so you have Nash
equilibriums that basically say if
everyone is following the protocol it
should be in each individual
participants interest to also follow the
protocol well we need something that's
even more robust we wants the incentive
to follow the protocol honestly to be
pretty substantial and we want the
equilibrium to survive even if some sort
of significant percentage of other
participants start doing nasty things
take into account kind of games that are
perturbed by third parties like
attackers making bribes and also ideally
to just maximize the cost of a
successful attack so if a successful
attack happens then someone who who
caused the attacks to happen who is a
lot of money there's different security
models that you can have so for example
you can have different kinds of
assumptions about participants you can
assume participants are honest you can
assume that they're rational but they're
not coordinated so they want to make
money but they're not kind of colluding
with each other to make as much money as
possible
you could assume they are coordinated do
your assumptions apply to a super
majority of participants your majority
adjust to a minority assumptions about
the network is the network synchronous
our message is guaranteed to get across
within some very strict time bound is
there partial synchrony is there a
complete a synchrony where you have no
idea how long messages will take to
arrive outside influences so if there's
an attacker that's willing to make
economic rewards to participants already
in the system is there a balance on the
budget the amount they need willing to
pay is there a bound on the email that
they actually have to pay if an attack
happens so one common kind of critique
of the crypto economic approach which
focuses on incentives rather than
focusing on honest majorities is
basically like what about attackers that
just have this really large extra
protocol incentive like participants
that basically just wants to watch the
world burn right this could be a keep
eating blockchain this could be a
government saying this could be the just
hackers that take over and want to have
some fun so the the critique here
basically says well we're assuming that
you have these participants that are
motivated by economic incentives and
what if there's people that just wants
to break the thing regardless of how of
how much money is on the table if they
don't break the thing so there's two
replies to this right
one of them is that the traditional kind
of honest majority driven approach
actually is even more realistic because
it assumed even more unrealistic because
it assumes that the majority of the
participants are kind of altruistically
honest they're honest even if they have
incentives to be dishonest which is even
more unrealistic than the economic
approach right it's basically saying
that like more than half of this network
that that in order to get into you have
to like put in a huge pile of money with
the expectation of getting more money
and more than one half of these
participants are going to just
voluntarily forego forgo opportunities
to save money and this has already been
falsified right so for example a couple
of years ago there was this
fork that happens on the Bitcoin
blockchain where miners stopped
verifying blocks because they just
assumed that everyone else was verifying
blocks and so one invalid block got in
and a bunch of other blocks but built on
top of it and about six blocks had to
get thrown out right so we know for a
fact that participants in these networks
are willing to be lazy if they can get
away with it and the second argument
here is that well pushing the cost of
attack as high as possible matters right
because the higher the cost of an attack
the lower the risk that there is an
attacker with enough resources they're
not just incentive if you also need
resources and enough will to kind of
actually attack the system actually
exists so another kind of version of
this critique basically says well you
can't assume that people don't have an
incentive to break the chain because if
they have an incentive to break the
chain then you can just like hedge on
financial markets and you can kind of
have you basically make money on
derivatives from like watching the
watching the coin price drop and so does
it really matter if like two million of
your eath get burned if you make your
two million he's back by doing a short
on bid Finex
and like a lot of people say this right
as an argument for why kind of the
economic model that's broken but the
problem with this is right that first of
all there is a man there is some maximum
amount that you can earn by breaking the
chain right there like finding financial
markets are not infinitely cheap and the
attacker is motivated to already have
taken this maximum trade the attack if
an attacker is gonna try to break the
chain they're gonna be motivated to like
Meek not just enough money to cover
their losses but as much money as
possible to benefit from the attack and
there is kind of some fixed number that
the is the amount of money that they can
make and so if the cost of attack is
higher than this number then you've won
and if the cost of attack is lower than
this number well the lower it is then
the more of a risk that this kind of
attack actually will happen right so
there is an a very significant benefit
to you
increasing the cost of attack and so
increasing the amount of like basically
kind of course but outside the system
incentives you know you need to have in
order to actually be willing to attack
the chain so like for example if you're
going to attack the chain then it's
going to be fairly easy to make say a
few thousand worth of even profits
anonymous way on decentralized markets
but if the cost of attack goes up to a
million if then making the corresponding
amount on financial markets anonymously
and getting away with it is gonna be
vastly harder right so the more you but
you push up the requirement for how much
money they need to make to offset the
cost of an attack then the harder and
attack the more unrealistic an attack
becomes so we can look at proof of work
in a kind of cryptic economic context
right so you can look at like models
that say the majority of the network is
honest or the majority of the network is
uncoordinated or we can talk about the
amount of budget an attacker needs to
have to be able to make an attack or we
can talk about the cost of an attack if
it succeeds and then we can also talk
about kind of different assumptions
about network synchrony assaut or do
messages arrive immediately do they
arrive after one minute to the arrive
after 10 minutes so the first column is
just the usual kind of 51 percent
argument and the longer there the
network latency the more the percentage
goes up because the honest network like
sometimes accidentally make stale blogs
the second column uncoordinated the
reason why that column what kind of
looks much harsher is because you have
selfish minding and the cost of an
attack is zero because well if you make
an attack and you succeed then sure you
have to grind a bunch and like pay for a
bunch of the electricity it's to create
the plea attacking blocks which is what
the budget is but you get you get paid a
block reward for all of the attack for
all of the blocks that you make and so
actually the total cost of the attack
after you factoring the rewards becomes
either 0 or negative so we can look at
different consensus algorithms in this
way and proof of stake is actually kind
of in a large part about trying to take
this chair
improve on it one important concept
encrypt of economics is this distinction
between and if attributable or uniquely
attributable false and not uniquely
attributable false so I am not uniquely
attributable fault is a fault where you
know that some mistake happened but you
have no idea who is responsible
right so for example if you have a
blockchain and you have two different
Forks then one of the two sides here is
responsible right one of the two sides
here builds on top of an old block
instead of building on top of a newer
block but you don't know which one you
don't know whether the top chain came
first or or whether in the bottom chain
came first like some people might know
if they're watching the network closely
but there is no way of proving who did
what first cryptographically and so the
fault here is not uniquely attributable
and the problem with them not uniquely
attributable faults is that there's a
limit to how much you can penalize them
because if you penalized on a non unique
way to your variable faults too much
then there's a risk that innocent people
will get caught and so you're making the
system much was attractive to
participate in unique way attributable
faults are faults where if some actor
misbehaves it can be unambiguously shown
that it was their fault so if some
protocol requires you to shell the
result of a calculation and someone
shouts 2+2 equals 5 then that's
something that you can kind of point to
and say look at this guy over here and
clearly it's definitely this guy over
here who me who made a mistake and
published a false statement and you can
given them a pretty large in protocol
penalty so this kind of gets us to the
goals of proof of stake right so in
proof of stake validators have to make
deposits they have to put their eath
into a smart contract in order to
participate and the reason why those
coins have to be locked up is so that if
validators make uniquely available
faults if validators do wrong things
that they that can be identified as
specifically them doing wrong things
then you can have in protocol penalties
touch these deposits and take away than
the deposits and this is what weeds - in
extremely
my cost of attacking purpose take that
you just do not get any proof of work
system so finality a block is finalized
basically if validators kind of make a
series of messages supporting a blog in
such a way that in order to also
finalize a competing block the valid at
least one third of validators would
basically have to publicly contradict
themselves so the kind of naive way to
think about it is for a block to be
finalized two-thirds of people have to
vote for it and so for a competing block
to be finalized then two-thirds of
people would also have to vote for the
competing block and so one-third of
validators would have to contradict
themselves and if a validator
contradicts themselves you can take the
evidence of that and you can use that to
penalize them in a reality it's more
complex than one round of voting it's
kind of at least two rounds of voting
using this clever algorithm called
Caspar FFG I encourage people to learn
more about Caspar FFG by reading the
paper on archive yay so proof of stake
is all about crypto economics at the
core proof of work is all about crypto
economics at the core there is a lot of
other things that are also about crypto
economics at the core one interesting
thing is that crypto economics can
sometimes compete with cryptography
right so for this one useful example to
think about is interactive computation
so interactive computation is this kind
of scalability primitive that basically
is trying to allow block chains to learn
the results of complex facts about
computations without actually doing the
entire computation on the blockchain so
for example suppose you have some
function y equals f of X and it turns
out that f it can be decomposed into
this format where it's like you start
with X then you apply f 1 then you apply
F 2 then you apply F 3 blah blah then
you apply F 99 and then you apply F 100
and basically you have a small value and
you go through a series of small values
and you get Y at the end so here is a
protocol for kind of how the blockchain
can warn the result of this computation
without executing all of it on chaining
so
yes you set the problem you said here is
f here is X we wants to learn why then
you have a smart contract that contains
some reward and the smart contract
implements this protocol anyone has the
ability to submit a sequence of values
basically X 1 X 2 X 3 so all of the
intermediate steps of the computation of
all and you can you can have the
individual steps have quite a bit of
computation in them right you just
basically each individual step has to be
small enough that you can execute it
inside of a block so the proposer
submits a sequence of values X 1 X 2 X 3
all the way up to X 100 along with a
deposit so this is step one step two you
wait right and there's a challenge
period so suppose for example that as a
kind of quote as a simple example the
the channel the problem that we're going
to make the blockchain try to solve is
we're gonna try to calculate 2 to the
power of 10 in suppose we live in a
universe where multiplying by 2 is
really hard and so you can only multiply
by 2 once inside of a block so how do
you do an interactive computation to
compute 2 to the power of 10 right
basically you would have to submit all
the intermediate values right you would
submit these 10 intermediate values you
would submit 1 2 4 8 16 blah blah blah
and you would submit these values and
then you would have this challenge
period and in this challenge period
basically anyone has the ability to kind
of points to one particular value and
say wait this value actually isn't 2
times the value before so in this case
so like suppose we have this kind of
evil smiley face guy and the evil smiley
face guy is just really really tired of
this stupid idea that that aquila byte
is a thousand and 24 bytes instead of
being a thousand bytes and so this guy
wants to solve the problem by convincing
the world that two to the power of 10 is
not a thousand 24 it's actually a
thousand and the evil smiley face guy is
going to do this by well submitting
these 10 values right these are the
powers of two 1 to 4
eight 16 32 64 128 - and 250 500 1000
there the powers of two each one is
twice the other the thing at the end is
a thousand what's the big deal so within
this challenge period a challenger can
say hmm someone is wrong on the
blockchain
I disagree well I disagree with that 250
there
I think of hundred twenty eight times
two it's two hundred and fifty six and
the the Challenger can submit a
transaction that points to this index
and when that happens the calculation
actually runs on the blockchain that
particular multiplication by two 128
times two is run on the blockchain and
the block chains like wait the actual
inserts 256 and this guy submitted 250
so this guy's fraud and so the original
submitters deposit gets destroyed and
part of the deposit is given to the
Challenger as a reward so this is a
crypto economic protocol right because
the ability of this protocol to work
relies on incentives it relies on the
penalty that the submitter gets if they
submit a set of values though where one
of those values is wrong and it also
relies on this reward and that the sum
that the Challenger can get if the
detects that one of these values is
wrong and they send a transaction that
we've kind of for show us up watching
which transaction is wrong allows it to
be verified and allows the submission to
get rejected
now this crypto economic protocol
basically is in some ways the core of
how optimistic roll-up works right so if
anyone has seen am optimistic roll-up
like the the unipeg exchange thing
that's been floating around recently
like this is the kind of fundamental
crypto economic math and that that
protocol works on and basically how it
allows scalability to happen by just
doing computation off chain by default
unless someone complains about some
particular transaction in some
particular block being incorrect
so notice that interactive computation
does the same thing as GK snarks right
Ziqi snarks are about doing computation
off chain
being a proof on chain and allowing
everyone else to just verify the proof
instead of running the entire
computation themselves interactive
computation does the same thing a few
people run the computation off chain and
they run the scripts of economic
interactive protocol and the fact that
this crypto economic interactive
protocol happens in the clear on chain
and everyone saw this happening it can
convince people that the results of the
computation is correct without them
having to run the entire computation
themselves and this is kind of the the
schism between ZK roll up versus
optimistic roll up which is better well
they have different advantages right so
snarks do not require a challenge period
so with a snark you can know the answer
immediately
whereas within up an optimistic or
interactive computation game you have to
kind of wait for some period of time to
make sure that nobody challenged the
computation snarks are less efficient so
a zero knowledge proof have a very high
computational overhead and with general
purpose of your virtual machine
execution the overhead goes way higher
all optimistic computation does not have
this problem an interactive computation
is also easier to implement so if you do
not want to have a challenge period if
you do not want to have this fraud proof
dependency then snarks are better but
otherwise kind of especially in the
short term and especially for more
complicated general purpose applications
then you can also look at this
optimistic approach so crypto economics
is used in a theory emily and for lots
of things it protects the base layer of
the protocols that we all know and love
it protects our white clients it
protects the security of our glorious
and sacred layer to games plasma
channels optimistic roll-up trivet it
can be used for das vs. dots resistance
such an improved security of option
messaging protocols and so much more so
this really is kind of the bedrock of
what large parts of our ecosystem are
based on and since we're by kind of
planting the seed in 2009 Satoshi Aaron
have created a really interesting and
great
and now we're here building great things
on top of it thank you
[Applause]
you