so I will try to make it as technical as
possible so apologies if it sounds like
too deep of a dive but I want everybody
so like you have I have 20 minutes so in
20 minutes you'll learn what plasma
cache is how it works where it works
where it doesn't and why it's the most
like viable like solutions currently at
least at the current research levels
because all the other solutions I'm of
the personal opinion that they're quite
let's say optimistic and ambitious and
it will take some time until we have
them like in production so much late
yeah so who knows here how plasma cash
works like has tried implementing it in
a in a low level essentially oh
okay
okay so the point is that they are their
plasma constructions the original plasma
paper they it was very very important
because it gave the notion of what
plasma is it should be like satoshis
vision thing the Telex region whatever
you wanna call it however it was like
totally unrealistic has it's called
MapReduce construction it had like a
bunch of like it they dream of the three
of chains and now everything
communicating each other like the
Supreme Court I don't
I'm not of the opinion that it works so
this talk will be highly opinionated on
what I'm saying how plasma is involved
so take this with a grain of salt this
is not expressing their general let's
say opinions of the plasma community I
guess so yeah test test one two and the
point is okay anyway the thing is that
the plasma it works like with a classic
side change transaction you have like a
mention the sidechain
you deposit funds you do whatever you
like on the side chain you can take them
out but the thing is that in order to
get scalability we actually need a
consent mechanism advances faster than
the normal making it and a chain
mechanism and you cannot do that like in
my opinion by definition you need to
like make some compromise on either the
internalization or the security aspect
and so what we're doing is that with
plasma you construct essentially an
non-custodial sidechain because at any
given point in time if there's some
involved state transition you can go
through this exit game and
can like just get your money out within
a certain challenge period yeah maybe
I'm not exactly sure like yeah I have
like a bunch of nice like shapes and all
that to explain it so like the whole
difference between like plasma cash and
like the other variants it's because the
plasma casts it's non fungible with it
is in the family let's say of plasma
protocols that it's the securities
enforced by the non fungibility of route
change deposits so each coin you deposit
it has a unique ID it's different from
each other and you can use it to have a
sort of like a single exit game where
like each coin is unique you don't have
to use the whole priority queue
construction to go through your to make
multiple exits there is no need for the
masses exits construction which is like
very important because currently and all
the other plasma non plasma cash
variants designs they require mass exits
and I will make the claim that mass exit
currently aren't viable due to how like
let's say primitive like our signature
aggregation works on the we cannot
verify enough even if you do a multi
signature and you compress it and you do
a threshold signature on all of them you
cannot actually like verify the whole
thing on the EVM yeah and like okay okay
so Jeff just said like explain why
storks are better than XD based
checkpoints and whatever or Isolators so
first of all quantum resistance okay so
the argument is plasma cash has a very
big let's say disadvantage that whenever
you passing coins around and as the side
chain for the progresses the coin Hugh
story grows linearly so I have 10 blocks
I need to pass around 10 blocks worth of
proofs and this sucks
so what we can do is one can just pass
around the proofs - we can do
checkpoints but which is a very
brilliant construction by Kelvin however
let's thing it's it requires so much
social coordination it's like on the
level of the mass exits and I'm not sure
if it works so on the contrary what you
can do is that you can use the RSA
accumulator they are same letters recent
construction which you like assign a
unique prime number to each leaf and you
make some black magic on it
you can somehow prove compactly there
that the consistory is valid and the
final the very sexy alternative is that
you can just take the whole history you
make a stark proof you put it on the
back on the black box without any
trusted setup or anything that you don't
like you just have a combat proof that
can be x power that can be transmitted
to your receiver and actually in these
cases we never need an unchanged
verifier to do that because I'm just I
want to prove like let's say the Jeff I
just want to tell him that you know I
have this going take it and he proves it
on his own and the verification is
really very fast and yeah quantum
resistance because we need to be like
anticipating the quantum computer it's
they're coming to get us
where's my slides more ya Q&A please
actually yeah I'm I'm pretty sure I can
answer like any technical questions so
hit me with your best shot and if I
don't answer here why do we need to
worry about quantum resistance if we're
not even sure if the system's work it
like we're gonna we're gonna multiple
times
well my gosh is it is it because that's
it's gonna exist in perpetuity for a
long period of time and then we need to
be like looking ahead like protecting
against so to rephrase if we didn't have
a quantum system scheme in one year I
believe it's much better than investing
six six months in an on quantum system
scheme so I'll just time in for a second
so I think the danger is is that we
encrypt all this data and we have like
arc browser history encrypted and then
somebody gets a quantum computer we're
all screwed right okay so how do you get
started firstly Kelvin and friends have
done like a great great amazing
educational effort with the site called
little plasma dot org if I'm not
mistaken but I am of the opinion that is
the time we're going if I don't have
slides but I am the opinion that I
literally cannot show you how one thing
works if I lit upon you like to if I
give you ten links it doesn't work that
way so I've been writing a plasma paper
like okay we talked about my work right
and I've been writing sort of plasma
paper that it's like a 20 pager that you
read in maybe two hours and you can like
understand everything
plasma this vine that I'm working on so
you read it and basically you should be
having like a pretty good idea of what's
going on and implementing a plasma
contract isn't actually the hard thing
let me near the client software is the
hardest thing because the smart contract
you need like you define it like you
give it like you need to do this for
exit this to withdrawal this to deposit
that's all there is to it and you had a
submit block function to commit the
molecular route and that's it but the
client software it needs to watch it
needs to cache state because if you pull
the medical proof you need to save it
because if you don't like and you
restart your client you don't have the
proofs you assume that the whatever
entity is providing you the day that way
will provide you the data and if you do
that why even bother with plasma which
is I'm pretty sure there is some like
plasma variants that assume some sort of
data availability and you shoulda never
assume any any kind of it so yeah just
read learn plasma like I'll give a link
to the paper at the end yeah anything
anything yeah
but again my opinion I don't think light
client verification works on mu P I'll
put very contrary opinions of always
with a grain of salt
so I MVP it requires you to validate the
side gene state which by definition it
contradicts the scalability because if
you need to do full client validation on
the light clients you can never run like
a secure plasma gene on your phone you
can never like validate the secure
plasma chain on your phone and you do
that because otherwise you cannot be
sure that the plasma change is not a
fractional reserve like if there is a
also from it and you didn't take note so
yeah that's why like I'm a very bullish
on the plasma cash because everything
that happens on chain you know at that
moment so ok plasma okay so why is
plasma you have the maintain the
sidechain like you deposit some funds
you do the fund whatever you like we
talked about this already so I will skip
this through the big detail that we need
to like insist on is that each block
must be submitted and the gas cause for
this they kind of stack up I actually
really like this purple color it's very
satisfying so
you checkpoint each block and the moment
you consider transaction finalized this
is like security property that you
consider transaction finalized once the
block route has been committed and the
witness data the Medical Branch for that
transaction that you're looking for is
made available to you because if that
data is not made available to you you
literally cannot know if the transaction
was included or it was censored so just
a moment to just say that plasma cash is
real it's working right now it's live
right now you can do NPM install like
this thing you can run this command
these are two real addresses and you can
get connect to rinkeby via fu or your
own node but nobody runs their own nodes
unfortunately yeah and this is like how
the thing like looks from the inside
that help we have a bunch of commands
the user needs to do the very very
minimal amount of things just the
deposit transfer exit withdrawal that's
all you need to do I'm of the opinion
that you never should like force the
user to do anything we are watching it's
all on the client software and yeah
whatever like you can demo it if you
want like I won't do a live demo because
it's total like hubris
it doesn't work so okay I've written
this thing like you should try to read
it give me feedback and so on I'm
basically trying to do what I said
before I'm trying to do a very like
concise overview of a plasma cash works
and what's it about
and soon I will have like some more like
formal notation with how the exit game
and the finalists in the state and
visions work so first of all like why
it's real we didn't do it like in pretty
realistic timeframes I believe that I
started working on it on me and we had
like an implementation within a month
and a half so it's real we have low data
requirements for the light clients like
okay it's not really low but it's lower
than any other available solutions I
will claim it's low and you can have
like this modular architecture where if
anything that you don't like you just
add the plug-in so this whole naming
convention thing I'll talk about also so
I believe that this is very good code
you slide like to like get people to
understand like what are the difference
of its variant so the ones that we are
working on and much thanks to Ron J for
maybe
name wrong - for all the discussion for
this is that they whenever you depose
the coin on this violence of plasma cash
its coin is unique so you have this like
this gives you like a very simple exit
game and it's very like the security's
tight and what you can do is that but it
has some problems it doesn't have like
fungible payments it doesn't history
goes like hell so what you can do is
that you can either like you some magic
like I say accumulator 0 in all its
proofs to prove the coin store in a more
compact way and the other thing is that
we need to like if we want to do like
fungible payments with multiple ones you
can apply the other technique that you
break a coin down in 100 pieces and you
have the user transferring the sub
pieces of it and whenever you're
speaking about the coin you're actually
talking about a range of coins or just
you stay tuned yeah I'm very I'm a very
big fan of states on plasma but we'll
talk about that later so the other
variants there are the plasma MVP ones
which I argued earlier that they require
too much data and they also require they
they also require sort of priority queue
construction for exits because if the
operator or the operator is basically
able to create a huge utak so which
exits the whole chain which would make
the fractional reserve and you need a
mass exit which to my knowledge there is
no working mass mass exit scheme to date
and on top of it we're not the more
viable plasma which first off to like
solve you to make us better and most
viable plasma one day I don't know and
yeah you can use narcs to verify the
state transitions from like one thing to
another so currently what we have is
that we do transaction routes so anytime
you submit a block you don't actually
submit the state route so it's not the
latest state so you need to like go
literal a whole block history well in
this case you just have the state route
and it's like it's there you know it's
there because you have this whatever
black magic box that it it proves your
assumptions so I'm pretty sure this is a
good taxonomy unlike which are the
violence of plasma and they're okay to
be fair these are the variants that are
based on payments and the payment the
violence are based on smart contracts
I'm not
well-informed women but very very fun so
to do like a quick technology primer so
the main data structure that we use in
plasma cash it's a sparse medical tree
it's basically a tree which has all the
it has like whatever leaf amount you
want it's all pre computed so it's all
like in the default values
it's the hash of 0 or whether or not one
you want and to prove their inclusion of
an element you do in the classic way
that you just provide the Myrtle branch
with the siblings everything I'm
assuming that people know how it works
and the fun part is that you can
actually prove non-inclusion
by giving an proof of inclusion of the
zero hash of the hash of zero at this
leaf and this is very convenient because
we can this is what basically makes
plasma cash work and you can actually
have some very nice optimizations on top
of this so because all the values are
computed when I'm giving the miracle
proof I'd not need to give like 32 bytes
every time whenever I want to give the
default value for a sibling I can just
give a bit field and this like it's
really one bit where it's 32 bytes and
in this very simple example so like
instead normal is a miracle path you
have been house of zero and they and the
higher lever one that's 64 bytes well
with the optimization for the bitmap
it's two bits and much love to the world
theme for singing this up and having a
working implementation so the usual
suspect Alice deposit five ether was
like the actual flow so so at least
deposits like five III do this part
contract the smart Condor amid some
deposed event that the plasma chain
listens the plasma thing is supposed to
create a new block one new block per
deposit this is not a security
requirement but it makes proving like
it's an optimization basically this has
been asked a number of times just to
post the coin and you get a new blog
this isn't necessary but it's better and
what it does it is it creates a plasma
block and get literally a five ether
bill if you will and the thing is that
the transaction flow it's like you took
so based but it's one input one output I
cannot break a cone I just say new owner
and that's a new owner
just like catch yeah so I will just go
through a simple like example of how
they deposit their transaction flow work
so deposit always deposit the five is
like the five III example so five if
they're like it just appears Alex gives
the current Bob but the thing is that at
this moment Bob must actually verify
that the Cohen history is valid and now
let's consider that there is a new blog
where Alice does a very Bob who is the
latest valadon over the doesn't move the
coin and if Bob wants to give the coin
to Charlie Charlie must not only verify
the inclusion block one and two he must
also verify the non-inclusion
in block three which is why I was I
spoke before about the non-inclusion
proofs in sparse milking trees and he
needs to do that because considering the
fact that there might have been a
transfer from two to three the two to
three would make the to two for a double
spend and we don't own double spins so
yeah and she does that and she exits by
by providing an ancestor there has been
some discussion lately that there might
be a way to optimize this to not require
an ancestor but I'm not sure about the
safety of it if you want to evaluate it
fine but I haven't been able to evaluate
it but basically the thing that we know
that works parent rates you give it a
coin in the parent coin and you use
these to exit and I will go over the
exit game play the game let's play it
like very soon so the whole plasma
constructions they work based on a
challenge period like the classic
dispute period where I make a claim I
put up a bond I wait some amount of time
and if nobody challenges yeah my my
claim must probably be right right it's
all like crypto economics I hate that
word
so the time currently and they bond
amounts are totally arbitrary
I'm not the opinion that somebody just
wrote the first MVP implementation maybe
it was David actually like it just put
like seven days for an exit period and
everybody said that's it the Holy Grail
or baby vitalik say I don't know but the
point is that currently there has been
no game theoretic like proper analysis
unlike what the deposit what the
challenge periods should be and what the
bond amount should be and I'm very
interesting to that so if you have any
return please speak to me and yeah so
this is like a good takeaway from the
presentation that we model each coin has
its own state machine so state machines
like it's yeah we have the initial
deposited state and basically you define
the transition function that whenever
you want to go from one state to another
some certain things need to happen and
what you do it's simple
whenever you want to go from deposited
to exiting you start an exit and you put
up a bond let's start exit you put
whatever proofs you like it doesn't
matter and there are two types of
challenges the one type of challenge is
the interactive one and the other is the
non interactive so speak about the non
interactive which is simpler so the non
interactive challenge it is essentially
I see a claim and I instantly challenge
it and the exit goes home like it like
it never happened right and it's a
simple form of challenges however they
interact the challenge is essentially in
order to finalize an exit it must not
have any pending challenges in any
outstanding challenges so what you do is
I start at exit somebody else challenges
my exit and in order for me to be able
to finalize my exit the word exit has
been sent many times you need to
actually respond to the exit and like
you have let's say you have a counter a
challenge counter that goes up and down
and all the way to finalize it's when
it's at zero
I hope this slide is clear because it's
like more or less the whole like
construction of how it works and now
I'll talk about the challenges so I'm
hoping things are clear so far because
like this where we examples let's say
that Alice has a coin eight block and
whatever you like and Alice spends the
coins you give it Bob or whoever else
and Bob maybe then gives it Charlie so
the thing is that Alice isn't forced to
exit from a later stage you can always
go to a stale scene just say I'll exit
so yeah she can do that but the thing is
that she needs to wait seven days or
whatever to do the exit and at that
point another entity they can challenge
by providing a spend so Alice a signal
makes the claim I am the latest owner of
the coin and the other very MN and then
a challenger comes and says no you're
not
basically if that's the whole thing that
you need to know about it and this is
the one type of attack that you can do
and this shadow to Carl because he did
like a very good like specification
which is explained all that stuff I used
it you should use it the other
alternative is that you do a double
spend so the example I was talking about
before I was considering the fact that
the Charlie Webb or Alice prime note
plasma prime is actually like it's not a
colluding party so what can happen in
this case that Alice gives the coins Bob
and Alice in collusion with the operator
they double spending so they give it
themselves some other friend of them
and what happens in this case if Charlie
wants to exit the coin he needs to
provide the parent as I said and the
whole like exit game here that words
that you need to provide the coin that
is in between and this actually proves
the double span because you say no I
owned it before you did and yeah and the
final example of like the ex game it's
like when you're exiting a coin you
actually so when you're receiving going
you I shall validate the whole time in
history but what if you don't so I want
to say in this example like to try to
imagine that the radar doesn't exist it
exists but it's like the response state
so let's say that Alice gives a coin and
that the operator they collude with some
party to give a Cohen to Bob so they
make an invalid state transition so to
say in plasma MVP if an invalid state
transition happens the whole change has
to move which is impossible so what you
do is that if somehow Alice somehow
there is a transaction that gives the
coin to Bob and Bob starts transacting
with this coin this is an invalid state
and if Bob Charlie Dylan aren't
malicious parties they will check the
consistory but they're trying to steal
the coin so Dylan tries to exit and at
this point at the seven day period
Alice can say no I am the latest of the
owner of the coin in this example what
you can do is that you can actually
respond to the exit so this is the
interactive challenge the previous two
they were non interactive in this one
when you make an exit when you make a
challenge you can live also some amount
of time to respond because if Alice made
an invalid exit in an invalid challenge
somebody would should be able to respond
so that's there where the radar who
comes in that you should be able to
bridge essentially you should prove that
there is actually spent from Alice to
Bob and invalidates here challenge and
there can be a number of these so you
can have like multiple challenges with
invalid histories and the final result
is that you want it to be you can only
finalize the exit when it has to do so
from my experience like towards building
a client like it has been a pain to
actually like keep like on the
implementation part has been a paint
like I actually keep the plasma contract
and the plasma team in sync because you
have essentially cron job with submits
blog to the main chain and today I
Syrian whatever you want to call it and
the thing is that you have to make
essentially you mustn't make any
synchrony assumptions at any time like
any state that isn't chained it must be
checkpoint but if there is a delay or if
for some reason the the cron job submits
a block twice you change our out of sync
so you're the main chain contact it's a
block 10 and the plasma chains block 9
so that's not bad and and also relates
the second bullet point that whenever
you're listening so the plasma chain
actually listens for main net events to
actually like modify the state and you
need to apply them in the right order
because if you don't the state will be
botched and so it's a problem on the
client-side so this was on the operator
side lets it have a correct honest
operator or a software on the client
side you also like whenever you go
offline you need to save the block that
you went offline and when you go back
online and you check everything that
happened while you're offline it's like
it sounds like bad but it's like
actually what happened with full nodes
but I guess it's our approach towards
full nodes but we like very light
clients and yeah I'm very much of the
opinion that you need to keep the client
light if you need to store too much data
on it it's bad but also you need to be
able like yeah just catch the satyr so
if you download some data just keep it
there and don't discard it this may
sound obvious but yeah yeah so we should
be able to do better so currently this
is like better is the enemy of good good
is good enough currently it is workable
it is done but we want to do better we
want to reduce the two main problems I
want to solve is reducing the coin
history and making fungible payments and
this pretty much what the plasma prime
construction is so I'll just give a
brief overview of what happens so the
non fungible coins it's a double-edged
sword because it gives you this nice
security providers but you have like you
cannot make the payment so you like so
the one approach is that you have a
change provider so I send Jeff like
seven ether and gives two back to me but
you need an atomic swap transaction
which before plasma Prime from the dream
it didn't exist and the other approach
it was the plasma debit by Dan
whoo I love them but he's not sure yeah
plasma David which basically like
instead of a common like having a
certain value it can have any value
between 0 and that value and you can
think of it as a liquid like a liquid
that goes from zero to that to its max
capacity and essentially if you're able
to reduce the one like liquid by a
certain amount and increase the other
one by another amount essentially we
have simulated a transfer from these two
it's very neat because it also has the
notion of transferable payment channels
because if I have a coin if I only call
him that is like with some balance and
they transferred somebody else it's
essentially that guy who has now it has
the payments on a loan it's very very
convenient and the final approach which
is the cash flow defragmentation
whatever is that I deposit like one
ether and instead of depositing one is
there I get 100 0.01 in three coins and
I can move them around and so on but the
problem with that is that if I have
let's say like 10 coins in a row and I
send the middle coin suddenly I have to
like I have two subtrees and the whole
technically efficiencies of this
technique is that you can exit multiple
coins by exiting the sub-tree by proving
it with whatever magic and yeah and the
other approach is like how will we
reduce the history right so first little
checkpoints the LDR it's like you have a
coin and you instead of validating from
its deposit which is like 10 10 million
blocks ago you filed it up to the last
checkpoint so you pick the checkpoint
I'm arranged to be like manageable
however I claim that this requires too
much social coordination because it
involves the operate or advertising it's
it's complicated and the other approach
is that you can like simply like mess
make less frequent commitments but this
hits on your throughput and your
capacity because if I have like you
basically say that if I have like one
gigabyte of history and they commit one
time every 15 seconds it makes sense to
say that if I commit one time every
minute the coin history goes down by one
fourth by to the one fourth the other
approach to use the probabilistic
structure with the bloom filters but if
the bloom filter has false positives and
it was shown recently that you can
actually like pollute the bloom filter
yeah
in other words the accumulator so
without human leaders what you do is
that the goal without human leaders is
that you succinctly prove the inclusion
or non inclusion of something and you
either are set middle which is the
current like approach that people like
or it is another alternative which is
paying based which I would like to
discuss the plasma called life later and
the final thing that magic black box the
snark stark toolkit which I was at the
historic presentation yesterday and I
was informed that it is possible to
actually do budget proofs and everything
we need like with Starks in a realistic
time frame so that will be like lovely
if we can have it and yeah okay there is
this other thing so currently the UX
sucks you need to wait seven days to
exit the coin if you need to xtogo my
appearance that you don't need to accept
the coin but it must be there so what
you can do is that you little like
tokenized exit so I make an exit instead
of like owning the exit I can get the
near c71 or whatever non fungible and I
can sell that around and whoever owns
that coin it's like a coupon and you can
send it and you can after the exit
period has passed you can withdraw it
and the whole construction is that this
creates a whole market for exits where
instead of like pay if I if I'm exiting
five if essential somebody else is
probably willing to buy my coin for four
point nine five weeks because they have
a lower term preference and this party
it makes sense to say that it will be
the operator because they're running in
the chain and they don't care and they
also run a full node anyway so they they
know what's valid in not and the second
one is the optimistic exit so instead of
exiting
so when exiting you need to provide
medical proof signature whole lot of
stuff it's a lot of data so that the gas
can go from 100 thousand to like two
hundred thousand and maybe more
depending on your proof size
alternatively what you can do is that
you can assume that the exit will be
valid and admin on one more challenge
they equipped economic approach which is
it's nice because like you can
essentially reduce the cost of an exit
like 60k gas like for to store
operations but you you you are denial
challenge and yeah some the final
takeaway from this presentation the
technical stuff it's it's all it like
you should look into it it's not
complicate
and talk to me for learning about it
plasma doesn't improve finality so this
called 1 million is actually per second
dream it's it's not real what you do is
that you increase the capacity that you
can for spare 15 seconds because
currently if everyone can handle like
was it like 9 million gas per block or
eight what you do is that you can put
the whole information that happened on
the plasma chain in 32 bytes and storing
32 bytes it's cheap so if we have like
multiple plasma chains yeah oh yeah the
scale a build it can be 1 million
transactions a second but still settles
every 15 seconds if the data is made
available and yeah essentially just
think of it as a compression literally
maybe not because you assume at the
compression mechanism but the thing is
that you just take everything you put
very little later on it and if you
follow some certain rules of the
protocol like watching your good
and yeah it's a noncustodial sidechain
thank you very much and these are the
repositories go check them break it if
you can yeah yeah and have it take any
questions
maybe is their microphone
thank you for your talk
what's the problem with allowing atomic
multiple transactions to be atomic
within one plasma block because you
cannot force the operator to include
both so what you can do is that you can
construct a game where one transaction
is depend what you want in atomic swaps
is that atomic is a bad word actually so
like either both happen or none happen
right so this matches your exchange use
case I guess so the operator you need to
force them if they include one
transaction but either they must include
the other one or if they include the one
and they don't include the other one
that one is invalid right and you can do
this by essentially like doing a two
step game we just like similar in the
classic atomic swap construction between
chains you just you commit to a pretty
much and you give the pre-much to each
other in here evil but yeah maybe Karl
is better to asked like in depth on how
their atomic swap works because I
haven't been looking the prime how they
how it's being done quick if it's quick
I'm from data exchange protocol and we
were trying to enable micro payments
using plasma cash and milli the POC so
we came up with episode but I want to
know your thoughts how do you think
micro payments can be neighborhood using
wise don't you want to use the payment
seventh question you have the
engineering toolkit and you need to use
the right tool I do not believe that
plasma is a right to you know I think
Georgio's needs a lot more credit for
actually implementing plasma cash which
is pretty amazing so thank you George
yours
[Applause]
you