Skip to content

Commit 8dfa66c

Browse files
snjaxsnjax
committed
Add blog
1 parent 5764c56 commit 8dfa66c

14 files changed

+1263
-71
lines changed

‎docusaurus.config.js‎

Lines changed: 15 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ const darkCodeTheme = require('prism-react-renderer/themes/dracula');
66
const math = require('remark-math');
77
const katex = require('rehype-katex');
88

9+
910
/** @type {import('@docusaurus/types').Config} */
1011
const config = {
1112
title: 'ZeroPool',
@@ -37,7 +38,13 @@ const config = {
3738
docs: {
3839
path: 'docs/privacy-engine',
3940
routeBasePath: 'docs/privacy-engine',
40-
sidebarPath: require.resolve('./sidebars-privacy.js'),
41+
sidebarPath: require.resolve('./sidebars.js'),
42+
remarkPlugins: [math],
43+
rehypePlugins: [katex],
44+
},
45+
blog: {
46+
path: 'research',
47+
routeBasePath: 'research',
4148
remarkPlugins: [math],
4249
rehypePlugins: [katex],
4350
},
@@ -55,7 +62,7 @@ const config = {
5562
id: 'storage',
5663
path: 'docs/sharded-storage',
5764
routeBasePath: 'docs/sharded-storage',
58-
sidebarPath: require.resolve('./sidebars-storage.js'),
65+
sidebarPath: require.resolve('./sidebars.js'),
5966
remarkPlugins: [math],
6067
rehypePlugins: [katex],
6168
},
@@ -79,44 +86,25 @@ const config = {
7986
{
8087
href: '/',
8188
position: 'left',
82-
label: 'What is ZeroPool',
83-
},
84-
{
85-
href: '/#technologies',
86-
position: 'left',
87-
label: 'Key technologies',
89+
label: 'ZeroPool',
8890
},
8991
{
90-
href: '/#partners',
92+
href: '#contacts',
9193
position: 'left',
92-
label: 'Our partners',
94+
label: 'Contact us',
9395
},
9496
{
95-
href: '/#contacts',
97+
href: '/research',
9698
position: 'left',
97-
label: 'Contact us',
99+
label: 'Research',
98100
},
99101
{
100102
to: '/docs',
101103
position: 'left',
102104
label: 'Docs',
103105
},
104106
],
105-
},
106-
footer: {
107-
style: 'dark',
108-
links: [
109-
// {
110-
// title: 'Docs',
111-
// items: [
112-
// {
113-
// label: 'Tutorial',
114-
// to: '/docs/intro',
115-
// },
116-
// ],
117-
// },
118-
],
119-
},
107+
},
120108
prism: {
121109
theme: lightCodeTheme,
122110
darkTheme: darkCodeTheme,

‎research/blockchain-sharded-storage-web2-costs-and-web3-security-with-shamir-secret-sharing.md‎

Lines changed: 604 additions & 0 deletions
Large diffs are not rendered by default.

‎research/fast-fourier-inspired-sangria.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
title: Fast Fourier Inspired Folding for Sangria
3+
date: 2023-04-03
4+
---
5+
6+
This is a crosspost with [zkresear.ch/t/fast-fourier-inspired-sangria](https://zkresear.ch/t/fast-fourier-inspired-sangria).
7+
8+
## Introduction
9+
10+
[Sangria](https://geometry.xyz/notebook/sangria-a-folding-scheme-for-plonk) is the folding protocol for Plonk prover. In the original model, the prover works iteratively and merges a new execution trace with an execution trace accumulator.
11+
12+
Here we will show, how to build an optimized folding process, requiring only 2 or 1 scalar multiplications per folding on the verifier side.
13+
14+
## Original Protocol
15+
16+
Accumulated instance and witness:
17+
18+
$U'_n := (\mathbf{X}'_n, u'_n, \overline{W}'_n, \overline{E}'_n),$
19+
$W'_n := (\mathbf{W}'_n, \mathbf{e}'_n, r'_{Wn}, r'_{En})$
20+
21+
Iteration instance and witness:
22+
23+
$U_n := (\mathbf{X}_n, u_n, \overline{W}_n, \overline{E}_n),$
24+
$W_n := (\mathbf{W}_n, \mathbf{e}, r_{Wn}, r_{En})$
25+
26+
Where $\overline{W}=\text{Com}(\text{pp}_W, \mathbf{W}, r_W),\ \overline{E} = \text{Com}(\text{pp}_W, \mathbf{e}, r_E)$.
27+
28+
We use a relaxed Plonk gate equation:
29+
$C(\mathbf{a}, {\mathbf{b}}, {\mathbf{c}}, u, {\mathbf{e}})={\mathbf{a}} {\mathbf{b}} {\mathbf{q_M}} + {\mathbf{q_C}} {u}^{2} + {\left({\mathbf{a}} {\mathbf{q_L}} + {\mathbf{c}} {\mathbf{q_O}} + {\mathbf{b}} {\mathbf{q_R}}\right)} {u} + {\mathbf{e}}$
30+
31+
1. Prover send to Verifier $\overline{T}_n = \text{Com}(\text{pp}_W, \mathbf{t}_n, r_{Tn})$,
32+
## Introduction
33+
34+
[Sangria](https://geometry.xyz/notebook/sangria-a-folding-scheme-for-plonk) is the folding protocol for Plonk prover. In the original model, the prover works iteratively and merges a new execution trace with an execution trace accumulator.
35+
36+
Here we will show, how to build an optimized folding process, requiring only 2 or 1 scalar multiplications per folding on the verifier side.
37+
38+
## Original Protocol
39+
40+
Accumulated instance and witness:
41+
42+
$U'_n := (\mathbf{X}'_n, u'_n, \overline{W}'_n, \overline{E}'_n),$
43+
$W'_n := (\mathbf{W}'_n, \mathbf{e}'_n, r'_{Wn}, r'_{En})$
44+
45+
Iteration instance and witness:
46+
47+
$U_n := (\mathbf{X}_n, u_n, \overline{W}_n, \overline{E}_n),$
48+
$W_n := (\mathbf{W}_n, \mathbf{e}, r_{Wn}, r_{En})$
49+
50+
Where $\overline{W}=\text{Com}(\text{pp}_W, \mathbf{W}, r_W),\ \overline{E} = \text{Com}(\text{pp}_W, \mathbf{e}, r_E)$.
51+
52+
We use a relaxed Plonk gate equation:
53+
$C(\mathbf{a}, {\mathbf{b}}, {\mathbf{c}}, u, {\mathbf{e}})={\mathbf{a}} {\mathbf{b}} {\mathbf{q_M}} + {\mathbf{q_C}} {u}^{2} + {\left({\mathbf{a}} {\mathbf{q_L}} + {\mathbf{c}} {\mathbf{q_O}} + {\mathbf{b}} {\mathbf{q_R}}\right)} {u} + {\mathbf{e}}$
54+
55+
1. Prover send to Verifier $\overline{T}_n = \text{Com}(\text{pp}_W, \mathbf{t}_n, r_{Tn})$,
56+
where $t_n=2 \, {\mathbf{q_C}} {u'_n} {u_n} + {\left({\mathbf{a}_n} {\mathbf{b}'_n} + {\mathbf{a}'_n} {\mathbf{b}_n}\right)} {\mathbf{q_M}} + {\left({\mathbf{a}_n} {\mathbf{q_L}} + {\mathbf{c}_n} {\mathbf{q_O}} + {\mathbf{b}_n} {\mathbf{q_R}}\right)} {u'_n} + {\left({\mathbf{a}'_n} {\mathbf{q_L}} + {\mathbf{c}'_n} {\mathbf{q_O}} + {\mathbf{b}'_n} {\mathbf{q_R}}\right)} {u_n}$
57+
where $t_n=2 \, {\mathbf{q_C}} {u'_n} {u_n} + {\left({\mathbf{a}_n} {\mathbf{b}'_n} + {\mathbf{a}'_n} {\mathbf{b}_n}\right)} {\mathbf{q_M}} + {\left({\mathbf{a}_n} {\mathbf{q_L}} + {\mathbf{c}_n} {\mathbf{q_O}} + {\mathbf{b}_n} {\mathbf{q_R}}\right)} {u'_n} +\\ {\left({\mathbf{a}'_n} {\mathbf{q_L}} + {\mathbf{c}'_n} {\mathbf{q_O}} + {\mathbf{b}'_n} {\mathbf{q_R}}\right)} {u_n}$
58+
2. Verifier sends to prover random $r$
59+
3. Prover and Verifier output the folded instance
60+
$U'_{n+1}=(\mathbf{X}'_{n+1}, u'_{n+1}, \overline{W}'_{n+1}, \overline{E}'_{n+1}),$
61+
where
62+
$\mathbf{X}'_{n+1} = \mathbf{X}'_n + r \mathbf{X}_n,$
63+
$u'_{n+1} = u'_n + r u_n,$
64+
$\overline{W}'_{n+1} = \overline{W}'_n + r \overline{W}_n,$
65+
$\overline{E}'_{n+1} = \overline{E}'_n + r^2 \overline{E}_n - r \overline{T}_n.$
66+
4. Prover output the folded witness
67+
$W'_{n+1} = (\mathbf{W}'_{n+1}, \mathbf{e}'_{n+1}, r'_{W\ n+1}, r'_{E\ n+1}),$
68+
where
69+
$\mathbf{W}'_{n+1} = \mathbf{W}'_n + r \mathbf{W}_n,$
70+
$\mathbf{e}'_{n+1} = \mathbf{e}'_n + r^2 \mathbf{e}_n - r \mathbf{t}_n,$
71+
$r'_{W\ n+1} = r'_{W\ n} + r r_{Wn},$
72+
$r'_{E\ n+1} = r'_{E\ n} + r^2 r_{En} - r r_{Tn}.$
73+
74+
We can check, that $C(\mathbf{a}'_{n+1}, \mathbf{b}'_{n+1}, \mathbf{c}'_{n+1}, u'_{n+1}, \mathbf{e}'_{n+1}) = C(\mathbf{a}'_n, \mathbf{b}'_n, \mathbf{c}'_n, u'_n, \mathbf{e}'_n) + r^2 C(\mathbf{a}_n, \mathbf{b}_n, \mathbf{c}_n, u_n, \mathbf{e}_n)$.
75+
76+
## Fast-Fourier Inspired Approach
77+
78+
We see, that most operations on the verifier side are linear. So, we can use the approach from [GW21](https://eprint.iacr.org/2021/1167.pdf).
79+
80+
Let's define the following functions:
81+
82+
$f_L(X) = a(X^4) + X b(X^4) + X^2 c(X^4) + X^3 e(X^4),$
83+
$f_R(X) = a(X^4) + X b(X^4) + X^2 c(X^4) - X^3 t(X^4),$
84+
$\epsilon_R(X) = X^3 e(X^4)$
85+
86+
where $a, b, c, e, t$ are polynomials corresponding to vectors $\mathbf{a}, \mathbf{b}, \mathbf{c}, \mathbf{e}, \mathbf{t}$. It is important, that the field has a multiplicative subgroup of order $4$. If we need more columns, we can use the same approach with bigger subgroups.
87+
88+
Then we can rewrite the witness part of the folding procedure as follows:
89+
90+
1. Prover computes $\mathbf{t}$ and sends to verifier $[f_{R\ n}]$, $[\epsilon_{R\ n}]$
91+
2. Verifier sends to prover random $r$
92+
3. Prover and Verifier output the folded instance
93+
94+
$[f'_{L\ n+1}] = [f'_{L\ n}] + r [f_{R\ n}] + r^2 [\epsilon_{R\ n}]$
95+
96+
4. Prover output the folded witness
97+
98+
$f'_{L\ n+1} = f'_{L\ n} + r f_{R\ n} + r^2 \epsilon_{R\ n},$
99+
100+
101+
For final check we should make openings of $f_L$ at points $x, x \sqrt{-1}, -x, -x \sqrt{-1}$, where $x$ is random, and recover $a(x^4), b(x^4), c(x^4), e(x^4)$.
102+
103+
It is important to note that the folding process complexity is still linear. We don't need an explicit representation of f(x) in the prover-side folding process:
104+
105+
$[f_L(x)] = [\sum_{i=0}^{n-1} (a_i + b_i x \lambda_i(x^4) + c_i x^2 \lambda_i(x^4) + e_i x^3 \lambda_i(x^4))] =\\
106+
\sum_{i=0}^{n-1} ([a_i] + b_i [x \lambda_i(x^4)] + c_i [x^2 \lambda_i(x^4)] + e_i [x^3 \lambda_i(x^4)]).$
107+
108+
109+
The proposed method provides only 2 scalar multiplications per folding instead of 5 or more. And it requires 4 times bigger CRS.
110+
111+
UPD:
112+
In the case of IVC, when the 2nd instance is original Plonk, $\epsilon_R(X)=0$ and we need only one scalar multiplication per folding.
113+

‎research/minimal-fully-recursive-zkda-rollup-with-sharded-storage.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
title: Minimal fully recursive zkDA rollup with sharded storage
3+
date: 2024-03-16
4+
---
5+
6+
## Current zk rollup state
7+
8+
zkRollups scale execution efficiently, but publish all blocks at L1. This is not scalable for storage and forbids recursive rollups: if we deploy a rollup on a rollup, we need to publish all the blocks of the inner rollup on the outer rollup, and the outer rollup will publish all its blocks on L1.
9+
10+
![native rollup](https://raw.githubusercontent.com/zeropoolnetwork/sharded-storage/main/assets/rollup.svg)
11+
12+
There were some attempts to solve this problem, like validiums, but they are weak on both decentralization and security (2 of 3 in Vitalik's trilemma).
13+
14+
15+
## Existing improvements in unlocking data availability and decentralized storage
16+
17+
### Chia
18+
19+
Chia introduced a novel consensus algorithm called Proof of Space and Time (PoST), which provides a more decentralized and energy-efficient alternative to Proof of Work (PoW): Proof of Space-Time (PoST). PoST is a consensus algorithm that uses storage space as a resource to secure the network.
20+
The current capacity of Chia Network is 33 EiB.
21+
22+
23+
### EthStorage
24+
25+
Ethstorage is replication-based DA and storage, managed by a smart contract.
26+
27+
28+
## Our results
29+
30+
In our [research draft](https://ethresear.ch/t/blockchain-sharded-storage-web2-costs-and-web3-security-with-shamir-secret-sharing/18881) we propose a solution for storage and data availability, friendly to zk rollups and unlocking new scalability opportunities.
31+
32+
### Sharding instead of replication
33+
34+
It is proposed to use $k$ of $n$ threshold data representation. So, any $k$ numbers from the source file are transformed into $n$ numbers. And any $k$ of these $n$ numbers can restore the source $k$ numbers. This is called Shamir's Secret Sharing.
35+
36+
This approach allows us to utilize storage 10-20 times more efficiently than the replication-based approach, according to our modeling.
37+
38+
Also, it gives us better protection from physical-level attacks, like target node destruction.
39+
40+
### Unlimited horizontal scalability
41+
42+
We propose to use a 2-level nested rollup structure (below we will describe, why it is possible). The top-level rollup manages participants of low-level rollups and mixes them to prevent the accumulation of malicious participants in one low-level rollup. Low-level rollups manages the data, stored in the nodes.
43+
44+
### Polynomial commitments everywhere
45+
46+
We propose to use Merkle trees on the top level of database. However, the minimal structure is a polynomial commitment to a cluster of data. So, it is very friendly to rollups, because we can use the same polynomial commitment to represent the rollup's block.
47+
48+
Also, out of the box we have data availability oracle (just provide random polynomial lookup on the commitment) and all linear algebra we needed for sharding.
49+
50+
### Data mining
51+
52+
Nodes can use the data for mining, like in Chia. And the result of mining is zero-knowledge proof of data availability.
53+
54+
The complexity of storage is leveled, so it is the same complexity to store random data or zeros.
55+
56+
Nodes can join to network with trustless zk proof of their capacity.
57+
58+
## Bring it all together
59+
60+
ZK Rollups usually publish on-chain proof of execution and data of the block.
61+
But our data availability and proof of storage are zk. So, we can merge it all together and publish the proof of execution and data availability and storage in one single ZK proof.
62+
63+
It unlocks the deployment of rollups on rollups, and the rollups on rollups on rollups, and so on. And way to transform Web2 into Web3.
64+
65+
Also, we can prevent the bloating of the blockchain: if we publish the snapshot state of the rollup, previous history could be removed.
66+
67+
![zkDA rollup](https://raw.githubusercontent.com/zeropoolnetwork/sharded-storage/main/assets/rollup-zkda.svg)
68+
69+
70+
## Some economics
71+
72+
On 1st Jan 2024 cost of storage, 1GiB was:
73+
74+
* Ethereum $1.8M
75+
* EthStorage $10k
76+
* Celestia $300
77+
* Near $10
78+
79+
Based on [Hetzner sx294](https://www.hetzner.com/dedicated-rootserver/sx294/) with 8 blowup factor (what we need for >100 bits of security), the annual cost of storage 1GB is $0.15 usd.
80+
81+
The cost will be lower on specialized rigs.
82+
83+
## Call for discussion and feedback
84+
85+
We believe our proposed solution has the potential to significantly improve the scalability and efficiency of zk rollups and upgrade Web2 to Web3. However, we acknowledge that this is still a research draft and there may be challenges or considerations we haven't fully addressed.
86+
87+
We welcome discussion, feedback, and constructive criticism from the community. If you have insights, ideas, or see potential issues with our approach, please share them.

0 commit comments

Comments
 (0)