thank you very much for coming so today
we're going to talk about side chains
and layer two and the talk is about like
how they're different yet very similar
in some ways
my name is georges i do consulting and
research on off chain protocols and my
main focus on interoperability and
scalability so the big question is like
why do we want to interoperate and this
is the answer there's a lot of
currencies like they all want to talk
with each other and if the multi chain
thesis is to like survive in the long
term we have to figure something out why
do we want to scale so I just learned
that there is a talk by Joel Rubin
happening right now
like when 1 million mixed herbs who
cares about the devs what about the
users so and there is no way to get the
users like without being able to scale
with like quick confirmation and quick
low fees so let's go back to where it
all started so blocks released this
paper and like I think it's the first
time that science was mention of the
term turns out I'm wrong like this never
happened the first mention of side
chains was by Satoshi in 2010 which he
mentioned on becoming talk as usual like
that side chains to do in the Ribera
building however what she actually was
talking about was merge mining which is
a completely different technique three
years later we have Greg Maxwell a very
prominent Bitcoin core contributor who
described the scheme called the coin
witness which was very similar which is
very similar to what people call today
is EK roll-up and then we have this guy
called killer storm who actually
described the first like sidechain
construction by utilizing certain types
of proofs so the two-way peg as
described in the blockchain paper and by
killer storm describes a mechanism by
which somebody looks some money in an
escrow and then VI peg in transaction
you create the same amount of money on
another chain and that is a side chain
and in that side chain you may have a
different rule set like maybe the chain
progresses faster maybe TouchSmart
contracts and then when you want to get
your money out like you provide the burn
transaction and then the people love
that side chain they allow you to
withdraw your money
back on the original ESCO and there's
multiple ways that you can implement
that so like let's dive into it
the main problem that we're trying to
solve it like how we can observe another
change state and convince ourselves that
this chain that we're being shown is
legit in Bitcoin that's very easy work
hashes are very easy to reason about
their quantifiable you can do some math
and can figure out exactly how hard it
is to attack the trick here is that
however if the proof-of-work algorithm
is very expensive like you need to be
able to verify it and doing it with any
fancier like proof of work algorithm
it's very hard and you cannot verify a
script for example on EVM and the way
that you do this is we are I think all
the SPV proofs the way that most light
clients work and there is a very close
like a interaction between sightings and
light clients that I will get to in
there
very soon so instead of providing like
the full chain you provide the chain of
headers along with Merkle proofs of your
transactions and what you're trying to
convince is that the chain that you're
giving is actually the longest chain
this is too expensive this is too long
it's linear I need to provide you like
so that you're guaranteed that I'm
giving you the best chain like without
ever having any trusted checkpoint I
need to give you Genesis a bunch of
miracle proofs and you should be
convinced that's way too expensive so
there's some techniques called nipple
powers the one technique called super
block nipple powers by the only seasoned
Rose and fly client by Benedict bones
who should be around this area so you
should talk to them about that snarks
which berry-like alluded to earlier and
stateless experience so stateless movies
are not technique by James Parrott who's
also round and you should talk to him
about it the problem here is that all
work is not equal if I have the Bitcoin
chain with a bunch of hash rate and a
bunch of physics and the theorem chain
with a GPUs and like a different hash
rate having an asset on the one chain
and on the other chain even if it
represents the same like kind of like
collateral it's not actually the same
and I have developed this mental model
where I want to think of cross chain
acid this is alloys so similar to how in
chemistry like you can combine one metal
with another and get some different
properties I think I'd like moving a
Bitcoin from the Bitcoin chain to some
other proof of world chain perhaps like
tokenizing Bitcoin unlike
for example for faster confirmation
times is an option but however like due
to the difference in the hash rate
you're no longer as secure as you were
before so you can call that BBC 30 and
what about the BTC X where X can be T
BBC WBC you pick it some derivative off
of the Bitcoin which tries to peg like
the price to it and it's going to be
used in d5 space for example however the
Assumption here changes from like the
honest majority of the miners to the
honest Federation for example if you're
doing a federated peg or like to the
whole mechanism around it working so you
have technical risk arising so it's
solution has a different like trade of
space there's no free lunch but about
perfect steak side chains so prospects
items like don't exist what about well
steak like clients which the argument is
that it's equivalent this is a
proof-of-work block main liberal world
chains many per volt blocks and you
accept a proof-of-work block only if the
hash of the block header plus some
knowns that you change is less than the
number so let's take this and switch
this in the proof of stake situation you
replace the nonce with signatures and
you accept like the block only if the
blocks that you have received have
signed like more than two-thirds of
steak so how does this look like how am
I going to do a proof of proof of steak
I will pick some blokes like every some
amount of time I will check that each
time the validator said would have
changed in this proof of steak sidechain
I would verify that they signed on the
latest block this means that also of
course it's linear because I have to
give you still linear to the size of the
chain blocks and but also the side chain
smart contract or the light client must
always be aware of the latest stake
distribution because how will I know
that who is the two-thirds that I'm
receiving the money from their signature
from there's an attack here which I want
to call the cross chain nothing at stake
attack which basically says usually in
proof of stake change
you have the nothing at stake problem
where validators like start building on
two chains and basically if you can take
the data from one chain and put it on
the other you can slash them like for
equivocating for double signing however
what if I have a chain like imma
validate or I have a chain
I'm building on and then I'm just having
a hidden chain that I'm also building on
but I'm not sending in to anybody except
like clients the light client must be
able to take the signatures that I gave
them off out-of-band and put them on the
on the main chain I'm not aware of any
change currently that has this mechanism
implement tender mint right now has a
few documentation and has some
documentation exploring this they call
this if I'm not mistaken the phantom
validator because like you're a
validator but not really because you're
sending stuff or out-of-band and the
issue also with this is a long-range
attack because what if how like you need
to do in order to incentive align this
mechanism you need to slash how do you
slash if the person that fed you with
like with the signatures is now unbonded
it's complicated so like the rule that
you must say that like you will only
accept proofs like signatures from
people that are still bonded you reject
from unbonded violators how do you know
which what letters are unbonded I don't
know like currently the dominant
approach is having a trusted checkpoint
we are like so that you always know what
is the latest like bonded set the
validators this is an open problem there
is many solutions
there is many other solutions we can
take but they all again they all like 10
to some subjectivity which does not
exist in proof-of-work
everything so far we assume that each
chain is individually secure if we're
both like if both chains are secured I'm
sure you can do you can make them
communicate with each other security and
the likely requires that you have
something that is high cost something
that is high cost is not scalable that
has high cost is not scalable
so I can concentrate on what if the side
chain like mechanism if you try to use
it for scalability and if you try to use
it for scalability inherently it will be
less secure does not want you to get out
so what if the liquid side chain
suddenly becomes devil and like they say
no but your money's gone we're done so
we don't want that the kind of taxonomy
that we have for side chains then means
that we have them at the federated side
chain which is the multi-sig Allah
liquid the proof-of-work side chain
which is with nipple powers for
logarithmic
SPV proofs and some reorganization
proofs because as we all know I hope
when you have a proof of word chain that
Forks like you want to be able to punish
for that pork and you have proof of
steak side chains well you have
basically a multi-sig which gets rotated
each time the mistake changes during
elections all ooh and you also add this
am equivocation and the thing is that
you trade always security for
scalability if you want to use it that
way there is a great paper list like
last week actually by alexei and friends
on communication of course the civil
ledger right now they're doing a
workshop on it which was very
unfortunate to convert because it
conflicts with this talk so make sure
you read this paper to like elaborate on
to conclude on my point about side
chains and they're a better bill
dissolution it's not a scalable solution
you need an independent security model
and the moment that you have independent
security model my argument is that
you're not in the layer two domain space
it's a layer one that talks to that
array once it's like on the same level
how do we scale and what's gonna happen
off the chain so party McCurry's around
here like the everything that's working
on like off chain scalability requires
that you have a layer one and layer two
and some mechanism to make them
communicate you need to put the minimum
amount of data on chain because the
chain has a finite amount of space and
if you're going to support 1 million s
debs you're not going to be able to hold
all that capacity and maybe the theorem
2 is going to do it but what if it
doesn't
so what what's layer 2 so I call it a
bit late settlement protocol with layer
1 guarantees so you have a protocol well
you look some money on the layer one
then you perform some of chain
operations and then you have guarantees
that are like equivalent to your layer
one security model that you'll be able
to get your money out and there's two
like dominant approaches right now which
is the commit chains approach which is
like what plasma is roll-ups no cost and
they have like some certain different
trade-offs whether they can do smart
conduction on various channels and the
dominant channel approach is the
lightning for Bitcoin and as far as I
can tell there is some state channels
initiative which like everything emerged
and could this to them because it was a
very hard task so and they have like
different properties but we're not going
to talk about channels in this talk so
let's dive into they're comedians so
firstly we had plasma like 2017 with
Dalek Joseph they published this paper
noting the paperwork and it describes
basically a mechanism where you have an
operator that takes hashes of the
sidechain and it puts them on the layer
1 but and the security of the commit
chain or the plasma like it comes under
the assumption that you're able that
anytime that like something bad happens
you can take some fraud proof from the
plasma change state put it on the layer
1 compare it to the hash that was
committed earlier and you can get your
money out like within some time and it
has some synchrony assumption that like
you you must be able like to get your
money we did get the fraud profane
within a week's time or two weeks time
so this is like a single new assumption
that very security oriented folks will
argue against but again that's not the
topic of the talk the problem with the
plasma construction is that the operator
it's at their sole discretion to give
you the data so what if they don't like
you have some state they create a metal
tree of the state or of the latest you
take so they committed but they
don't give you the data you have a
problem then because in certain they can
come back they can create an invalid
state transition and this invalid state
transition will never be revealed and
like you will never know that you no
longer have your money so there have
been like changes too lately to the
plasma like protocols to fix that and it
turns out that maybe yes maybe plasma
was a premature optimization maybe like
many people might have raised money on
plasma on something that might be broken
what can we do that's how the commodity
will move forward so how are we going to
solve the data availability problem we
cannot so what we're gonna do instead of
having obtained data a fraud proofs will
put data on chain with fraud proofs and
that's what we call optimistic roll-up
and this is what they're currently
equipped economics lab and the plasma
group teams are working on which is
basically that you take all the data
that is off chain you create a smart
like encoding of them and you dump it on
the cold data of the layer
and that's kind of cheap because the
data is not part of the chain it's just
part of the database like here and the
other people that are working on this
like another like independently like
thought of construction was called meds
consensus by Macario and john adler
which basically says what i just said
you have to commit like all the like the
metal route and also you put an encoding
of the transactions and you use
basically the layer one as a data
availability oracle and then if you plug
out the flood proof and you put the
validity proof as snark stark like
whatever you want whatever they call it
these days you have a sneaky roll-up
like and i'm saying this like just so
that we can get over the word salad and
like understand like that the bits and
pieces that make a mechanism Ziggy
rollup
means that you have the commit the
numerical route of the latest state or
the transaction that happened
you take their knowledge proof which are
tests that this state transition is
valid and you put it on chain the smart
contract verifies that the state an
additional valid with movement the
problem with this is that maybe you need
a trusted set up as we saw in static
September where like five new snarks
were like released
maybe we can remove the trusted set up
but I wouldn't build all cryptography
that was released on 2019 and they can
be expensive like proving times are
expensive verifiers all are so expensive
and they can be slow so again no free
lunch and and not only on training data
availability because it has been like
like pumped as an idea that like it's
gonna solve all our problems I'm not a
fan because the blockchain is supposed
to be the verification layer the
blockchain is not a file storage like
and file core in another change that are
going to do that do not exist yet so we
know that like this is a hard problem
and maybe one gets all the solutions all
via data will abate the problem like
will give us the ability to do like
define all the other likely use cases
that we're trying to figure out for this
industry on the layer too cheap and fast
but like the untainted availability
reduces your scalability benefits like
you cannot have like infinite throughput
like with the other layer tools because
again you're bound
by the layer ones capacity so it's
really a constant size improvement and
also it's parasitic in my view by
parasitic I mean that like the moment
that you start utilizing the change so
heavily what about the other apps that
are not on your layer to your roll-up or
whatever you call it
em are they all going to come to your
roll-up like I think that's - like
ambitious and there is a post by vitalik
recently where he like elaborates on
this and he's a fan about this idea
which yeah some takeaways from this I
from this talk is that we know how to do
both proof of work and proof of stake
side chains it's hard to implement them
and you need them to both be
individually secure and having an honest
majority assumption for more than one
layer one is hard as we have seen for
multiple layer 51% attacks on smaller
light chains layer two inherits security
from layer one and like I have a small
taxonomy of like what goes where I'm a
fan of the like direction this is like
the current direction that we're going
it seems but we should be like very
skeptic about how much like we're just
dumping on the layer one because nobody
can sing in a three-room full node and
this is not going to help with it the
conclusion is side chains are for in
their ability layer two is for
scalability side chains are not layer
two thank you very much and I'll be
happy to take some questions for three
minutes and also the I I should cap
changes we can find a thought at scaling
at side chains 2019 dot PDF there is a
microphone if anybody wants to do a
question we have
hi thank you much for the talk so you
gave I think very detailed criticisms of
both layer two and side-chain solutions
without highlighting too much of their
positive aspects what solutions are you
actually fund of I'm fond of the plasma
construction for simple state transition
for payments because this industry
solves payments and I'm happy like if I
can get a construction that can do
multi-sig time looks like and that's it
and plasma does that fine right now
plasma for simple payments I I do not
care much about smart contracts like
smart contracts multi-sig time locks are
sufficient okay thank you
thanks for the breakdown one thing that
you didn't talk about which I thought
would be interesting to hear perspective
on is hybrid approaches for roll-ups so
where we use you know proofs of work
from other chains to make the data
availability there but do the fraud
proofs on another chain right so with if
the question but I have a rollup where I
don't post all the data on chain were
only for specific States so it's using
availability from something other than
the l1 that you know I do not think
that's good because your security model
change is wildly the security model that
I want as I have a later on I know
exactly how secure it is I know that I
have the Bitcoin chain it has this much
censorship resistance this much capacity
I can dump all this data the moment I'm
going to use Bitcoin cache as a data
availability layer which is what you're
like talking about means that like I
have to trust between caches miners and
do you know how is it is 2 percent or
fifth cone cache very easy like 10
percent of bitcoins - wait so no like
one chain for if you're gonna dump data
somewhere dumb become launching in my
view ok ok thank you so much
[Applause]
you