[Music] [Applause] so okay so um so plasma who here remers plasma well we all should because uh inmax is the next great thing in inmax as a plasma uh but plasma is an idea that actually has at least a 7year history um inside of the uh ethereum space it was actually one of the very first lar two scaling solutions that we started looking at even before we looked at rollups um and the um and this was at the time when we were still looking quite a lot at State channels and many different kinds of options
and so plasma is uh a scalable layer 2 uh design right and the big difference between plasma and rollups is that plasma requires only o of one data on chain so what this means is no matter how many users there are you only need to publish a fixed amount of data on chain in order to have a plasma system so rollups for every transaction you need to put some number of bites on chain for plasma you need to uh you only need to put hashes you only need to put one hash of everything that happens
on chain uh now the thing how does what are the tradeoffs plasma is not fully general purpose plasma is uh in this complicated space where it's uh more general purpose than State channels so State channels actually do not require putting any information on chain at all except when people deposit in withdraw uh but plasma does require putting a little bit of information on chain uh and what you get for it is that it works for payments and it works for many other applications but it is not a fully general purpose so plasma by itself cannot
run the uh evm uh at least uh with the same kinds of unconditional security guarantees that you can get with a rollup so it plasma works perfectly for payments it does not work uh at least unconditionally for a very general purpose evm and what you can do in the middle it's complicated and Over The Last 5 Years the space of things that you actually can do with these plasma designs has actually improved quite a bit so let's talk about how plasma works right so the way that plasma works is uh that every time there is
a plasma block you create a Mer tree and you can of the Merkel tree as being like dealing with individual coins right so basically think of every single object that's being Trad inside of plasma as being like a separate nft even if you have let's say three eth then each eth is it becomes a separate nft and you have three nfts so in every time there is a block the what what what happens in the block is you create this Merkle tree and in every NFD has an Associated index and at that position in the
tree if there is a transaction at that position you put the transaction in the tree if there's not you put a zero in the tree at that position right so over here for example I you know one example is you know you have coin one going from Alice to Bob and like that's put in position one in the tree because positions start with zero you have coin four going from Charlie to David the transaction is put in in thee and so so that time you have a plasma block you have thise and the root of
the tree gets published to the chain then later on you might have a different tree and if that different tree transacts with the same coin you get a transaction in the same position if it a transa transacts with a different coin you have a coin in a different position so let's uh if you look at this example imagine that these are the last three transaction trees in a basic plasma chin if you assume everything before that is valid then what do we know about this in this case we know that Eve currently owns coin one
right because here you have a on the left a transaction of coin one from Alice to Bob and then on the right a transaction of coin one from Bob to Eve then we know that David owns coin number four because there's only one transaction in position for and uh and that transaction is going to David and George own coin because there's only one transaction that's moving coin number and it's giving it to George so this is like a very you know like simple model but this by itself basically you know like already is a plasma
system so what's interesting about this if you zoom in to any one specific coin and you ask the question who is the owner of that specific coin who is the person who deserves to have that coin right now you do not have to look at that tree you only have to look at the mer branches of one particular index if for example you want to learn who is the current owner of coin number one you just look at the merel branch from in the tree of position one in every single one of these plasma blocks
and so if you have some situation where people are are disagreeing and you're trying to figure out who is the real owner of some coin there's like only a very limited amount of information that you have to look at so this plasma um so it relies on this mechanism that's called a challenge mechanism right basically what happens is let's if you have one of these coins so let's say you're J you are George you wants to exit coin number six so you have coin number six inside of plasma he wants to withdraw you wants to
get back one eth right what do you do you publish an exit message on chain that says I have coin I'm withy it now what if some you someone disagrees with you right so for example let's say over here you are Bob and you received coin number one and you have proof that you received coin number one and you decide well I'm going to try to withdraw coin number one now your Bob is not actually the owner of coin number one because in a later block Bob already sent that coin and so we have a
challenge mechanism the challenge mechanism basically says this is called a not latest owner challenge basically Eve who actually has that coin can challenge it say well no here is a transaction that you signed that gives the coin away and so that coin is not is not actually yours there's two other challenges so there's uh an invalid history challenge where basically uh you know you're you're saying hey you know this is the operator trying to trick the system and you made this coin out of thin air and then the operator has to prove that they didn't
uh there's also a double Spence challenge so basically any way in which the user could cheat or any way in which the operator could cheat there's a challenge mechanism where you can provide evidence to show that they're wrong and uh to show that you know like actually you uh deserve to have some particular coin so what's interesting about this design right is that it works by splitting objects up into individual coins and like it basically splits up responsibility right if for example you know you are George over here and you have coin number six from
your point of view you don't actually have to care who takes coin number four right because no matter what happens there's whatever happens in coin number four you can only withdraw coin number four Once coin number six is separate right so you get this like very nice security property where only a few people needs to like even care about any specific piece of what's happening in the plasma system so these are the basic techniques right so I think uh what's and and then if he wants to extend these techniques to work well with fungible tokens
uh so work well with eth for example then there's like a lot of different ways to extend it so basically an NF in for an nft the history is always linear right Ellis gives it to Bob Bob gives it to Eve Eve gives it to someone else for a coin you might have like a graph you know you might have 0.2 ether were here and they're coming from someone else they came from someone else they came from someone else and then they and then though they actually came from two different uh deposits and then you
keep going back right and so basically you know there are different designs like here you to exit you can provide the last week of history and then you could challenge by showing that any part of that history is already spent so there's a lot of ways to extend this design to work well with coins now one of the challenges with plasma back when people were really seriously thinking about this in 2018 and 2019 is that especially once you try to go beyond nfts and you try to make this work first for fungible tokens like er
c20s or eth and then for decentralized exchanges then for other applications The Challenge Games become very complicated right basically when you're dealing with nfts the challenge games you can fit them like into one screenshot that I can put onto a slide if you start making things more complex then it just quickly becomes much more comp uh much more complicated and there's like a lot of limits to how much you can do since 2020 the big revolution that we've had is sarx Right basically like actually using sarc and star for everything so and what that lets
you do is it lets you actually prove that what that every single object that's being committed to chain is valid right so basically Starks let you prove that the operator of a chain is committing data that is correct they could still be hiding the data but it lets you prove that they're only committing data which is correct now if we look at the types of challenges here right basically so the not latest owner challenge that's that's still exists but then if you look at invalid history or double spending those two types of challenges don't exist
anymore because with snarks there is no longer an opport any ability for someone to commit invalid information to the chain and so the complexity of even this challenge game goes down by a factor of actually a factor of more than three right I think a factor of four because uh you go from three proofs down to one and the invalid history challenge mechanism is actually twice as complicated so complexity goes down a lot if you use Zar and you also get some really interesting properties right basically the uh if you have an operator and the
operator is online then let's what happens if let's say over here Eve decides that Eve wants to withraw and you see on chain that this that that block is the the latest block right you have a guarantee that everything up to that point is valid and you also have a guarantee that there cannot be any further spent because there are not any further blocks and so when the operator is online when the operator is not hiding information when the operator is behaving honestly there's actually no challenges that apply and so um Eve is will be
able to withdraw immediately this is a big deal right it's a big deal because uh if you think about l2s right now especially optimistic rollups arbit optimism they're great uh but withdrawing takes seven days right and the pro and withdrawing takes seven days it's very annoying nobody wants to take seven days and so people withdraw using liquidity providers but then being a liquidity provider is also expensive and like you start getting all of this complexity with a plasma chain in the happy case so we're in any case where the operator honest you can just take
your money out instantly this is uh this is an incredibly powerful benefit um so rollups are still better because rollups even in the unhappy case they can also Force instant withs but uh like this already is a very big deal right and I think it's uh important look really uh think about this right because uh basically plasma was tried and plasma was kind of given up on and replaced with rollups back in 2019 because in the context of only having fraud proofs there was just so much complexity there was so much limitation in the context
of having snarks all and having validity proofs all of that most of that complexity and most of that limitation actually goes away and to me this is like the core reason for why the ethereum ecosystem I think needs to go back to actually taking plasma ideas really seriously so challenges generalizing to the evm right so plasma is designed around the assumption that each state object has a specific owner who cares about exiting it right so like we saw back in the examples right if you're if you're George and you have coin number six you only
care about coin number six you do not need to care about coin number one um and uh in the evm it this things do not really work this way right also in plasma there's uh like in the evm there's no limits on dependency graphs right something that happens in Block n could depend on absolutely anything that happens in Block n minus one right the execution could just go anywhere read this write this read this write this combine them together I know and then write anywhere else in the chain so all of this does make an
evm based of plasma much less convenient once solution that I suggested in my in the post that I made last year is to basically create a parallel state tree using utxos so the way that this works is uh that you have a tree that is just a tree of uh of like a state tree basically accounts account balance is account storage exactly the same way that it works today and then in parallel you also have a separate data structure and that separate data structure just looks like a of transactions or even it could just look
like a list of a list of trees of a list of every individual way like every individual tiny bit of ether that becomes its own nft there's efficient ways to do both of those right and so you basically have these two parallel States and you use a ZK anarc to prove that the two are equivalence to each other right to prove that whatever is happening on one side is also happening on the other side so another challenge is privacy right so with privacy basically the challenge with this is uh let's say we take a system
where you have some kind of privacy protocols you have five coins going in and then you have five coins coming out right and let's suppose that orange with withdraws so orange over here withdraws at the bottom the big question is which of the Five actors at the top do we try to prevent from withdrawing right and uh the challenge is like in this context we actually do not know right in this kind of context like we could try to say let's make a parallel utxo thing and then we just map the bottom to the top
but then the problem is or like you're not providing full security here because uh you're like if orange withdraws orange is basically stealing a coin from Blue right so this is a limitation um and uh the basically the challenge is like how do you actually get past this now inmax actually does solve these problems and inmax is not a pure plasma inmax is a hybrid rollup plasma so it does put about five bytes on chain for every single transaction right and the benefit that you get from this is basically you get just enough extra ability
from having data going on chain that like you can solve these kinds of problems and you can even get stronger properties in terms of what happens if the operator disappears right so it's easier for it Max to be permissionless than it is for regular plasma regular plasma can't be permissionless because uh like you have to trust the operator at least somewhat not to go offline if the operator goes offline nobody loses their money but everyone has to go back to L1 and everyone has to pay fees so this is another limitation so what are some
of the conclusions here right basically one of the ways to think about plasma is I think about plasma as a way of adding extra guarantees to existing evm validium for free right so a lot of the uh e like ethereum L2 rollup providers that we see today a lot of them are already taking a hybrid approach right they're basically saying we operate one version which is a rollup and then we operate another version which is without onchain data available ility right so you know you have arbitrum you have arbitrum Nova you have polygon you have
polygon zkm and so on and so on now the uh version with offchain data is always going to be less secure than the version with onchain data because you just get so much extra security from having the data be directly there but there's this interesting question of like how much extra security can you actually get while still having your data on chain and having super cheap transactions as a result of data being chain so it's uh the way that I think about these plasma ideas is basically yeah so if you have if you're an L2
and you have data off chain Step Zero this is like you know you can build it but it's not that and and the and this is what exists but they're not that interesting is that you're just a multisig right and like you have to trust the multisig step one is you become what's called a validium validum means you have ZK snarks going on chain that are proving the execution if you become aium then you cannot steal people's money but you can still disappear and freeze people's money step two is well if you take a validium
then you ask the question well if the operator does disappear and uh then you have some money that is frozen what if you can look at the information on chain and you can do a little bit more analysis and you can try to figure out in most of those Cas how do you take like can you actually figure out what is the one unique owner of at least some of those frozen coins and it turns out that in most cases you can in most cases this is actually very easy right because most coins that are
on chain are coins that have not moved within a week and so even if you have an incredibly simple thing where all it does is it basically says if you know you want you can try to withdraw using Old State and if nobody challenges you for a week then you get the money if this is all you add then this already is reducing the security risk of a validium by about 90% right and then you can keep going you can keep going and as it turns out even with an evm plasma the amount of situations
where people are still at risk just continues dropping and continues dropping right so basically plasma is something that you can layer on top to all of these systems that already exist in order to make them even more secure this does all depend on ZK right so this does all depend on like using ZK VM proving systems instead of optimistic ones but ZK proving systems are improving quickly so this is one way to think about the applicability of plasma to ethereum a totally different approach is of course what Leona is going to talk about much more
which is uh like plasma for privacy right and uh some of these hybrid designs that can basic Bally get a lot of the benefits of like much greater scaling um basically for a rollup the theoretical minimum amount of data that you need to put on chain even for a non-privacy preserving transaction is about 23 bytes and then for privacy preserving I think it's either 48 or 64 bytes and uh with plasma you could go down to five bytes on chain right and so 10 times more scalability but also like very still keeping some very strong
properties right and I think this is a a design space where there's a huge amount of value right ethereum needs scalability ethereum is getting scalability but uh at some point there's going to be like way too many users even for you know theoretically perfect like data availability in blobs and we have to go even further right and to me plasma is the thing that can really make a dent in actually solving that problem so I really hope that you like people here can continue to do Plasma Research continue to build better plasma designs and uh
we can continue having a much more secure ethereum thank you
