Brendan Farmer
@_bfarmer
Followers
6,783
Following
539
Media
38
Statuses
1,577
co-founder @0xPolygon , previously mir
Joined October 2018
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
メイドの日
• 474503 Tweets
ONGSASUN CONFLICT
• 254850 Tweets
Whindersson
• 220284 Tweets
メイドさん
• 162911 Tweets
Kyungsoo
• 140432 Tweets
メイド服
• 123245 Tweets
Joost
• 94155 Tweets
スタンド
• 69291 Tweets
#PLEDIS_TREAT_JUN_BETTER
• 57016 Tweets
#WHEREISJUN
• 56750 Tweets
Felipe Neto
• 56711 Tweets
トニオさん
• 52297 Tweets
#ساعه_استجابه
• 39472 Tweets
TREAT YOUR ARTISTS EQUALLY
• 36739 Tweets
Gill
• 35932 Tweets
Copa América
• 33897 Tweets
密漁海岸
• 32511 Tweets
露伴先生
• 29620 Tweets
Steve Bannon
• 26706 Tweets
高橋一生
• 23693 Tweets
イタリア料理
• 19657 Tweets
Palermo
• 17738 Tweets
#CSKvsGT
• 14936 Tweets
الامم المتحده
• 13972 Tweets
JUN DESERVES BETTER
• 12993 Tweets
Trenes Argentinos
• 11839 Tweets
Militão
• 11475 Tweets
Pinned Tweet
I wrote this post to go deeper into what the Aggregated Blockchains Thesis means and to describe the Aggregation Layer in more detail.
The scaling debate feels stuck between the monolithic and multi-chain/modular arguments.
I argue that neither approach…
30
67
229
I have a ton of respect for anyone working on ZK tech.
But I’m skeptical of ZK Alt-L1s for two reasons:
1) There’s a false belief that ZKPs are more efficient on ZK L1s than on Ethereum
2) They're effectively impossible to upgrade.
Why you should stick with Ethereum...
[1/n]
35
127
641
A year ago,
@0xPolygon
was seen as a stopgap, an EVM sidechain that served an immediate need before we all transitioned to L2s.
Today, Polygon has the fastest ZK tech and the first production-ready zkEVM.
How? 🧵on feedback loops and specialization...
[1/n]
12
111
530
This is a really important breakthrough from
@0xPolygon
R&D. It allows us to use an *even smaller, even faster* field.
Here's a brief explanation -> [0/n]
57
166
461
The recursive STARKs pioneered by
@0xPolygon
let us parallelize proof generation and reduce latency, but what's really cool is that they allow us to exploit a space/time tradeoff.
This lets us do crazy things like proving ~100 keccak hashes/second...on a laptop [1/4]
26
121
395
I had a debate with
@EdFelten
a few weeks ago - I asserted that optimistic rollups have fundamental disadvantages:
1) They don’t work well for L3s
2) 3rd party bridges don't work well during periods of volatility
Ed disagreed! I don’t want to FUD, so here's the argument.
[1/n]
18
122
356
Controversial ZK opinion: optimizing for proof size below ~100kb - at the cost of prover time, recursion efficiency, and Ethereum compatibility - doesn’t make sense for blockchains. From this perspective, FRI-based schemes are more attractive than ECC-based SNARKs. 🧵
57
122
378
Opening shots fired in the ZKR vs OR war of 2023 😁
I have a ton of respect for
@sgoldfed
and the whole
@arbitrum
team.
I just have a different view, that the best way to scale Ethereum is with ZK, not optimistic rollups.
Here's where I disagree with Steven's thread...🧵
There's a narrative out there that ZK Rollups will be able to do everything that Optimistic Rollups do but better.
The way this story goes is that we're just waiting for ZK rollups to be ready, but as soon as they are, they win hands down.
Let me tell you why I disagree 🍿🧵
69
151
711
23
75
340
We’re so excited to be joining
@0xPolygon
as Polygon Zero. This isn’t the end - we’re just getting started - but I want to recognize the people who have helped us get this far. 🧵
8
36
343
On zkEVMs, EVM-equivalence, definitions, and who gets to define things.
or
Is
@0xPolygon
zkEVM EVM-equivalent? Yes*
1/n
12
62
303
Many people don't know this, but
@0xPolygonZero
implemented recursive STARKs back in February
@0xPolygon
isn't just leading the way in adoption, but also in building the core technology needed to scale Ethereum.🚀
63
114
292
Plonky2 is becoming a focal point for the entire ZK space as the most performant proving system available.
This is extremely cool work from
@0x0ece
, Kevin Bowers, and the team at
@jump_
Great to see contributions from outside of
@0xPolygon
.
54
129
265
Polygon zkEVM is the closest thing to Ethereum blockspace.
[1/n]
28
56
273
We've been working on this for a while now, and we're excited to start a conversation with the community about the Polygon PoS upgrade.
$2.5b bridged, thousands of dapps, millions of users -> a unified ZK ecosystem.
But wait - is this even possible?
0/n
1/ Today a proposal was published to upgrade Polygon PoS to a zkEVM validium, a first-of-its-kind, decentralized ZK Layer 2.
As a zkEVM validium, Polygon PoS would inherit Ethereum's unmatched security, while preserving low fees & high scalability.
👉🏽
154
760
3K
30
98
272
Interesting thread, but worth noting: Stylus wouldn't reduce fees for existing Ethereum applications.
Parallel EVMs do reduce fees but not by increasing the number of cores.
Quick 🧵on EVM+ and parallel EVM
[1/5]
Seeing a lot of misinfo about parallel EVMs. 🙅🏻♀️
Here's a thread on why they're overhyped, and why EVM+ approaches like Stylus yield lower fees. 🧵
32
54
247
14
74
260
This is why the Mir team joined
@0xPolygon
, to be part of a vibrant and growing developer ecosystem.
1/ We're excited to finally publicize metrics on some crazy growth we've seen in the
@0xPolygon
developer ecosystem! 🔥
Thousands of teams and applications are already built on Polygon, and the # of active developers is growing 2x every couple of months! 🧵👇
18
114
423
9
98
260
Besides Plonky2,
@0xPolygonZero
built Starky, the first recursive STARK implementation ever - and it's fast! ().
@0xPolygon
is a ZK project.
11
103
228
L2s like
@0xPolygon
zkEVM aren't just for scaling existing applications, but for enabling radically new ones.
The set of applications that are viable on Ethereum L1 is limited. Apps must have:
- high economic value
- low computational complexity
L2 changes this.
1/n
17
48
235
This is huge for Ethereum and for
@0xPolygon
: first zkEVM with working proofs.
Even a year ago, many people building ORs and ZKRs thought that a full zkEVM was impractical - too expensive, too complex, "5 years away."
This is a tremendous achievement.
The future of Ethereum is
#onPolygon
.🦄💫
When we unveiled Polygon
#zkEVM
in July, it was a milestone not only for Polygon, but also for Ethereum & Web3.
We're proud to announce Polygon zkEVM Public Testnet, the world's 1st open source zkEVM network!
219
764
2K
6
40
218
I'm biased. BUT I think that this is the most significant ZK engineering achievement of the last two years. It's a privilege to work with
@dlubarov
@williamborgeaud
Hamish, Nick,
@jnabaglo
and Brendan.
1/5 Proud to present
#Plonky2
- the world's fastest ZK scaling technology, built by
@0xPolygonZero
! 💫
Plonky2 is a recursive SNARK that is 100x faster than existing alternatives and natively compatible with
#Ethereum
.
A 🧵 on why this is exciting…
248
611
2K
7
27
215
100%, been saying this. Generalized fraud proofs are actually difficult and complex - how do you provably guarantee that the attacker can't put the dispute game in an unreachable state?
ZKPs are complex due to immature tooling, but we're fixing this very quickly. Soon we'll…
the widespread consensus in 2019 was that optimistic rollups and generalized fraud proofs would be faster to market and ZKRs and related tech would be slow and prohibitively complex to build, the opposite seems to be true
12
13
101
21
147
202
This is a consensus view, but I disagree with it for a few reasons. Consider that an OR in this scenario will either be EVM or non-EVM.
If it's EVM, then throughput will be limited by the EVM client, which means that tx fees will be non-negligible for high-throughput…
Optimistic rollups are probably the better solution for extremely high throughput and low composability applications such as onchain games due to the proving overhead of ZK.
ZK probably still wins out for more monolithic usecases where composability matters though like DeFi.
11
8
73
8
30
198
This is an important step. When
@dlubarov
and I were starting Mir five years ago, we encountered a ton of skepticism. Many people thought that ZK tech wasn't ready, that even proving simple transfers would be impractical.
Proving mainnet Ethereum? Not possible.
What the…
Releasing the Type-1 upgrade to the zkEVM prover, the next generation of Polygon’s proving tech. It can generate proofs for any EVM chain—sidechain, optimistic rollup, even Ethereum itself.
When proving Ethereum mainnet blocks, avg per-transaction costs are $0.002 - $0.003.…
117
569
2K
10
28
201
I wrote about Optimium/AnyTrust, arguing that these systems have equivalent security to a sidechain.
21
56
171
A true zkEVM (L1 code, tools, wallets all just work) is the holy grail for scaling Ethereum.
w/ insanely fast ZK tech like plonky2,
@0xPolygon
zkEVM won't just be EVM-equivalent, it'll be the most performant ZK L2.
*someone pls build flashbots for announcements
We are proud to announce a giant leap forward for Ethereum scaling and ZK innovation.
Introducing Polygon
#zkEVM
, the first EVM-equivalent ZK L2.
Today we’re releasing a complete implementation, fully open-source, and we’re just getting started.
[1/6]
1K
3K
10K
5
26
169
Sometimes in crypto, people use the same language to describe very different things.
This is unfortunate, because it obscures real and substantive differences that should be clear to the community - say, between
@0xPolygon
2.0 and
@zksync
.
Here's what I mean.
[0/n]
9
40
171
On zk-rollups, rapid innovation, and optimizing for the right things.
tldr: Sometimes being first can be a bad thing. Here’s how we think about the ZK landscape
@0xPolygon
1/n
13
50
169
Congratulations to the a16z team on developing Jolt. Exploring the design and tradeoff space is important given how early we are in building zkVMs. This is a huge achievement.
[Stephen A Smith voice]: BUT
I think the comparison between SP1 (built on
@0xPolygon
's Plonky3!) and…
1/ We're excited to share the initial release of Jolt, a new approach to zkVM design. Early benchmarks indicate it outperforms RISC Zero by ~6x and SP1 by up to 2x. Major optimizations are still in the pipeline.
105
122
620
11
25
168
Really cool work from
@UHaboeck
on the Polygon Labs team and
@PapiniShahar
and David from Starkware.
We've been looking at the Mersenne-31 field for a while for Plonky3.
Field arithmetic mod 2^31 - 1 is really fast on CPUs, and GPUs but there's a problem. We need to do FFTs…
Introducing Circle STARK 🔵
At Polygon Labs, we’ve been heavily focused on improving ZK performance with Plonky3. For the past three months, we've collaborated closely with the
@StarkWareLtd
team to develop an incredibly fast proving system that will be incorporated into…
47
310
1K
10
19
157
Amazing work from the
@0xPolygonZero
team and contributors from the ZK community. It's only going to get faster...
Plonky3 is getting faster! On my M1 Macbook Air, it can prove around 750 Keccak-f permutations per second, ~5x more than Starky.
This is an important metric for us (
@0xPolygonZero
), since Keccak is the main bottleneck in type-1 zkEVMs.
29
56
383
24
45
133
Plonky3 got 2.5x faster in 2 months 😍
After some optimization work at
@0xPolygonZero
, Plonky3 is up to ~2,500 Keccak-f permutations per second on an M3 Max! In other words, we can prove one of the least ZK-friendly hashes at a rate of about 340 KB/s.
26
48
259
6
37
157
New paper from Angus Gruen
@0xpolygon
on improvements to zerocheck!
Angus joined us after finishing his math PhD at Caltech and we're extremely lucky to have him - he optimized our keccak circuit by 4x as an intern!
16
27
159
ORs have a withdrawal delay so fraud proofs can be published (native withdrawals take 7 days).
Ed noted that 3rd party bridges allow fast withdrawals, and as long as the operator of the bridge is running a full node, there’s no risk that the bridge can lose funds.
[2/n]
2
0
141
Just to clarify - Arbitrum still does not have permissionless fraud proofs. Challenges can only be initiated by a member of the whitelisted validator set.
This isn't meant to be critical of Arb - every L2 has training wheels - but I think that it's indicative of the fact that…
I mean sure if we ignore Arbitrum, the largest L2 ecosystem that's had fraud proofs from day 1, then this is a great talking point
11
11
96
11
12
149
I think that this is a valid argument, though the user is still trusting the bridge multisig/validators and paying a fee. But I don’t think that 3rd party bridging solves the fundamental problem for ORs.
First, this model doesn’t work well for L3s.
[3/n]
1
0
138
Proof aggregation services are great - they reduce the cost of ZK proof verification on L1.
The agglayer has a different goal: to aggregate chains and unlock unified liquidity.
In order to have unified liquidity, you need:
(1) Asset fungibility across chains
(2)…
11
31
158
Unfortunately not true. The referenced audit is for plonky2x, a separate codebase from plonky2 that was developed by an external team.
The vulnerabilities found are specific to plonky2x, not plonky2. Plonky2 was audited by Least Authority (founded by
@zooko
) in 2022. The audit…
Oof!
The good news is that Succinct Labs has published a security audit of the plonky2 codebase. The bad news is that the auditor found *fourteen* dangerous vulnerabilities in it.
⤵️
3
5
75
6
41
147
A core advantage for ZK is that we can add blockspace, in the form of L3s, to meet demand.
Users can seamlessly and atomically interact across L3s or L2s, in the time that it takes to generate a proof (or sometimes even faster).
[4/n]
2
0
129
A few people have been critical of the fact that while
@0xPolygon
zkEVM prover's source code is available on Github, it doesn't have an open source license yet.
This is true, but it's a weak critique for a few reasons.
9
29
128
StarkWare x Polygon = 🔥🔥🔥
Seriously though, it’s great to see dynamic collaboration across teams and amazing results from outside academia.
Here is the recent work of myself and
@UHaboeck
.
The one liner is: you can do lookups with logUp using GKR.
This is inspired by Lasso and
@SuccinctJT
's work.
4
23
93
1
14
133
This is exactly right. Allowing anyone to submit a fraud proof isn't about decentralization. It's about security, and it's necessary to provide full L2 security for ORs. Here's why.
The point of L2s is to extend Ethereum's security to other chains. Unlike a sidechain, where a…
For noobs like me, simplifying what
@_bfarmer
said —
The whole premise of Optimistic rollups is that someone will notice fraud in the chain and challenge it on the parent chain. If you don’t allow anyone to challenge, OR is not complete.
ZKR doesn’t have that limitation.
4
6
87
5
23
135
First, definitions don't exist platonically, they're formed (and updated) by a community.
Members of that community have distinct beliefs and agendas that color how they define terms, but disputes about meaning and definition are resolved collectively, not unilaterally.
2/n
1
1
129
Extremely excited for Plonky3.
From the team that brought you Plonky2, it's not a single proving system, but a devkit for building high-performance proving systems.
Now supports BabyBear/STARK.Soon M31 and [redacted], maybe also Binius and binary fields?
🔥
This is a great explanation of Plonky3's Merkle trees. Just to add more context, Plonky2 supported "multi-STARK" schemes, but each STARK would get its own Merkle tree and FRI instance.
2
19
100
6
21
133
So how does this relate to zkEVMs and EVM-equivalence? EVM-equivalence is a term that has existed for a while and refers to zkEVMs that can process transactions in the same way as the EVM - so all code, tooling, infrastructure just works.
It's the Holy Grail of scaling.
3/n
1
0
124
Went to Denver, spent the entire time working with the
@0xPolygon
ZK teams. Extremely excited about what we'll be releasing this year 🚀
4
18
130
ZK allows things like batching trades on L3 to execute on L2, increasing scalability by orders of magnitude + unifying liquidity and retaining composability.
This doesn’t work with withdrawal delays. Imagine making a trade and waiting seven days for execution. Not great.
[5/n]
1
0
117
Credit to
@zksync
for the transparency and for dealing with this admirably. 💪
To anyone tempted to be critical, this could happen to *any* L2 (including
@0xPolygon
). We're all working to ensure greater stability as we scale Ethereum.
Protocol liveness is
@zksync
's second top priority after security.
We want to share, with full transparency, the details of this incident with our community. Here's an overview of what happened, the reasons behind it, our response, and future plans to prevent liveness issues.
114
528
2K
6
17
119
I want to go a bit deeper on the upgradability issue, as others have raised some good points.
For background - before joining Polygon, I worked on a ZK Alt-L1 and upgradability kept me up at night.
Here are some additional thoughts, though maybe the same conclusion.
[1/n]
I have a ton of respect for anyone working on ZK tech.
But I’m skeptical of ZK Alt-L1s for two reasons:
1) There’s a false belief that ZKPs are more efficient on ZK L1s than on Ethereum
2) They're effectively impossible to upgrade.
Why you should stick with Ethereum...
[1/n]
35
127
641
2
33
121
Congrats to the Core Devs on the Dencun upgrade. Upgrading a network securing hundreds of billions of dollars will never stop being impressive to me.
We love the blobs.
7
14
132
Really excited to speak at Messari's Mainnet in two weeks!
4
6
122
This post is great - a much better framing than stupid semantic debates over what qualifies as an L2.
Validiums satisfy a requirement for high throughput, low latency, and low fees, with more security than a sidechain. Dismissing them because they don't pay for DA on L1 is a…
8
25
116
Huge! We can efficiently verify signatures and pedersen hashes in proof systems that use the Goldilocks Field from Plonky2.
imo Goldilocks STARKS/Plonky2 are the future of ZK on blockchains, and there's an amazing community developing, all led by
@0xPolygon
💜🚀
16
82
111
ZK wars are already spicy and full of FUD. Per
@jbaylina
, the accurate numbers are 2.27m gas for 1116 transactions, so the difference in efficiency is... basically zero.
@_bfarmer
@0xPolygon
How exactly are you going to optimize to overcome this whopping 128x difference in efficiency?
1
0
15
7
17
115
This is very different from EVM-compatible zkEVMs, where code must be compiled, introducing incompatibilities, and *no* dev tooling or infrastructure just works - all must be separately maintained and updated.
See:
4/n
@paulmillr
@toghrulmaharram
requires custom libs to integrate e.g. with foundry and it's a bit of a pain, see example
1
1
14
1
0
117
You could extend the third-party bridging concept to L3s, but it’s implausible that flows will always be symmetric between L3s and L2s, or that market makers will reserve enough capital to process large movements of funds.
[6/n]
2
0
110
This is an unpopular opinion, but enshrining pairing-based primitives as core components of Ethereum should be avoided. They're expensive in-circuit for ZKRs and they introduce complexity for rollup/client/app implementations.
every zk rollup will need to have an implementation of this, assuming eip4844 in its current state to prove equivalence between whatever polycommit they're using and kzg
2
2
23
8
9
112
Really enjoyed this!
@jimpo_potamus
@radi_cojbasic
and co are one of the most impressive ZK teams in the space, huge respect for what they're building.
Wondering what Binius is and why a hardware company is developing a new ZK proof system? Our co-founders, Radi and Jim, explain it all in a new Zero Knowledge Podcast episode.
Thanks to
@AnnaRRose
@_bfarmer
and
@zeroknowledgefm
for hosting!
3
12
64
5
7
120
Hard to understate how big this is for zkEVM.
The new, high-performance, zkEVM RPC node is ready to be used in production, and it brings amazing improvement over the current RPC:
🔥 150x faster sync times
🔥 10x less disk space
Polygon tech reaching the desired state. Get ready.
35
63
305
6
19
120
Thanks to
@drakefjustin
and the Ethereum Preconfirmation group for letting me present on the agglayer.
The Agglayer is public infrastructure that's designed to help solve Ethereum's L2 fragmentation problem. Here's the recording:
5
28
111
ORs could simply require the same sequencer set to operate all L3s and L2s, but this limits the user's ability to detect and challenge fraud.
It also defeats the point of L3s: to use disjoint sequencer sets to add blockspace without increasing node requirements.
[7/n]
3
0
107
We need to take the time to explain the full interoperability story for polygon 2.0, but the issues identified below are not really the problem/source of complexity.
(1) You don't need "instant zk proofs" for atomic cross-rollup transactions to work. IMO it's fully acceptable to…
I’ve heard this idea several times that zk rollups will enable atomic cross-chain transactions or “operator-less shared sequencing” but the design seems to be flawed.
Firstly, you’d need instant zk-proofs which we don’t have.
Secondly, you’d need to know at the time of…
16
18
99
4
19
114
But back to EVM-equivalence. Let's recognize that the definition of EVM-equivalence is arbitrary - why should it include identical gas pricing, but not identical state storage?
Better to see it as a spectrum, as
@VitalikButerin
does.
5/n
1
3
109
@ajwarner90
@0xMarcB
It doesn't have "basically" the security of a sidechain, it has *the* security of a sidechain.
The operators of an anytrust chain can collude to directly steal user funds, just like on a sidechain.
This cannot happen on a validium, because even a malicious operator cannot…
2
2
114
ZK L1s have raised hundreds of millions of $, in part based on the narrative that ZKPs will be more efficient and cheaper to verify than on Ethereum.
So use cases like private identity, games with incomplete information (poker), ZKML, private DeFi will migrate to ZK L1s.
[2/n]
1
0
97
But this just isn't correct.
Verifying a proof on Ethereum may be expensive in gas terms, but with recursion, we can amortize this cost across any number of proofs.
Since the introduction of Plonky2 by
@0xPolygon
we've had super fast recursive proofs on Ethereum
[3/n]
2
2
105
I’m biased, but it’s clear to me that ZK offers the best path toward scaling without sacrificing composability or fragmenting liquidity.
In short, scalability without compromise.
[8/n]
2
0
100
How did Polygon get so fast?
We had an entire team (Zero) dedicated to R&D, with the mandate to build the fastest ZK provers in the industry.
Zero has incredibly strong cryptographers and engineers, which creates a feedback loop with huge benefits.
[3/n]
1
17
101
CALLDATA costs for
@0xPolygon
zkEVM will soon be much lower as we optimize. Our immediate goal isn't to maximize short-term usage and TVL, it's to ensure stability and safety.
If you want a zkEVM for the long-term, compare prover performance - it's much harder to improve.
1/n
💰 Cost: Storing state diffs is way more efficient. It's not just less data (e.g., signatures omitted) but also allows for "batching" multiple changes impacting the same accounts.
Efficiency comparison? MASSIVE!
4
9
69
3
24
102
@0xPolygon
disproved the conventional wisdom that an EVM-equivalent zkEVM, the holy grail of scaling, was 3-5 years away.
zkEVM is here. Now on testnet, soon on mainnet.
Meanwhile, the Zero team is looking ahead...
[8/8]
1
4
95
This is very cool. Performance looks amazing - it uses Plonky3 (developed by
@0xPolygon
) as the proving system, so you know it's fast 😀
zkVMs that use existing languages are an amazing step for the ZK space. Looking forward to collaborating more with
@SuccinctLabs
and playing…
1/ We are excited to announce Succinct Processor 1 (SP1), our first generation, 100% open-source zkVM that proves arbitrary Rust programs.
SP1 targets an order of magnitude performance improvement vs. existing zkVMs, and is already up to 28x faster for certain programs.
27
175
777
5
19
110
Surprised at the level of misunderstanding of L3s.
- Moving funds between L2s doesn't require withdrawing to L1.
- The fixed costs of posting state updates to L1 can be amortized across many L2s.
- Appchains need not be L3s.
Why be an L3 when you can be an L2?
Embrace the…
7
25
106
Where does
@0xPolygon
zkEVM fall? Sort of in-between. We have identical gas pricing to L1, so we're better than Type-3 in that sense, but we don't support precompiles (yet).
We've been extremely transparent about this -
@jbaylina
mentions it in almost every talk.
6/n
2
0
102
When it comes to ZK, performance matters. Sure, proving is parallelizable, but there's a huge difference between:
- 30 minute per-tx proof times, using many GPUs
- Polygon zkEVM, where we can prove a 10m gas batch in 2.5 min... on CPU (and this will come down a lot!).
[2/n]
2
7
91
The second issue is with 3rd-party bridges. Obviously crypto assets are highly volatile, so market makers don’t want to hold them - certainly not for 7 days.
So third-party bridges work well when the movement of funds into and out of a rollup is symmetric.
[9/n]
1
1
95
So who gets to define EVM-equivalent and is Polygon zkEVM EVM-equivalent? I'd say yes, with an asterisk.
Polygon zkEVM is EVM-equivalent for all contracts that don't use precompiles (pairings + specialized hash functions). So nearly 100% of contracts on L1.
7/n
1
2
99
Keep in mind, I'm biased - I work at
@0xPolygonLabs
!
But also keep in mind that there's a vested interest in modifying definitions to benefit different agendas. Not to pick on Toghrul, whom I respect, but as of last year, we weren't even a zkEVM!
8/n
1
0
95
But what about when flows aren’t symmetric? During periods of extreme volatility, you might really want to get your funds off of an L2.
This isn’t really a tail risk - there have already been instances of extreme price movement when bridges have effectively shut down.
[10/n]
1
0
94
It's happening again! The
@0xPolygon
Zero team that brought you Goldilocks is making another prime field really fast.
Really nice writeup from
@jnabaglo
on speeding up M31 (2^31 - 1) arithmetic on different CPU architectures.
Will be useful...
1
20
103
That means that apps using ZKPs on Ethereum, for games, identity, etc, can do so at low cost by sharing verification cost.
I believe that
@StarkWareLtd
is already doing this with the SHARP service.
Build your ZK app on Ethereum, not on an Alt-L1.
[4/n]
1
0
94
The agglayer is not an L2.
An L2 is an execution environment that allows an L1 to offload transaction execution. The agglayer cannot execute transactions, therefore it is not an L2.
The problem is that the word "layer" is overloaded - we use it in the sense of modular…
8
20
102
I feel like crypto is especially vulnerable to narrative drift - when the story told about something stops bearing any resemblance to what that thing is and how it functions.
Many examples: "play-to-earn", "liquidity mining", this:
5
14
97
There's an interesting question that arises for zkEVMs: how do we price gas? There are at least three options:
1. Keep the gas schedule the same
2. Reprice opcodes
3. Keep the gas schedule, introduce DoS mitigation
How should we think about each one?
[1/n]
4
23
93
It’s also natively compatible with Ethereum, unlike other recursion schemes like Halo. Size-optimized proofs are 45kb, and after EIP-4488, it should be the cheapest recursive SNARK to verify on Ethereum.
We think it's the best approach for ZKP's on blockchains.
@0xPolygon
🚀
7
9
95
The focus in academic cryptography is primarily on asymptotic (big-O) performance. Does your proof system use O(nlogn) field ops, O(n) group ops, etc.
There are performance benchmarks, but they're less useful because implementations aren't heavily optimized.
[4/n]
1
4
84
I have a huge amount of respect for Ed and the Arbitrum team - they are industry leaders for a reason.
I also have an agenda - I'm appearing on another panel tomorrow, and don't want to spread FUD. So CT, please let me know if this argument is wrong or unfair! 😅
12/12
2
1
85
😍 In a year,
@0xPolygon
has moved to the forefront of ZK R&D. Very excited to see what this year brings... starky2?
⏱️Starky is 5x-50x faster than SNARKs, at the cost of larger proof sizes
💾Among all SNARKs, rapidsnark is the most memory-efficient. Halo2 uses more memory when the pre-image size is small due to the fixed setup cost of a lookup table
💾Starky is 10x memory-efficient than SNARKs
1
25
95
4
28
84
So, in my (admittedly biased) view, bridges from ORs are marginally worse than ZKRs in the normal case (fees + additional trust assumption) but they present a substantial risk at the moment when you might most want to withdraw funds.
[11/n]
1
0
86
To give an example: a theorist might not distinguish between proof systems using O(nlogn) field ops.
But from a perf perspective, a prover using 256-bit fields will be much slower than one using the 64-bit Goldilocks field identified by Polygon, all else held equal.
[6/n]
3
4
82
Why not call the zkEVM bytecode-compatible?
"Bytecode-compatible" is (imho) a terrible descriptor. It's very technical and unclear to many how it compares to "EVM-compatible".
But more importantly, we *are* EVM-equivalent for the 99% of devs that don't need precompiles
9/n
2
0
87
The realization from Zero was that constants matter a lot!
This created a feedback loop - cryptographers working with engineers to identify and use more efficient tools (smaller fields, faster hash functions) that would yield much faster ZK provers.
[5/n]
1
4
82
There's a common misconception that the AggLayer is just a proof aggregation service or middleware - it's not.
When we talk about aggregation, we're talking about aggregating *chains* - the AggLayer provides safety for a shared bridge (even with heterogeneous execution…
6
28
91
The Polygon zkEVM testnet is amazing.
Many people don't know that it's the first and only zkEVM testnet with a working prover that's generating proofs - and everything is open source!
6
23
86
Strongly agree. My view is that L3s are completely unnecessary when you have aggregation. They only provide worse UX.
L2s aggressively pushing L3s is a strategic business move rather than a scaling one, and one that Ethereum L1 should be cautious of the power dynamics
27
20
227
8
13
89
I'll end with a prediction as well. 😃
There will be a true, full-featured zkEVM in production on mainnet before any Optimistic Rollup (supporting the EVM) has permissionless fraud proofs.
Our team has been hard at work adding incredible features to the Arbitrum stack. Lots more to share on this soon.
And I'll end with a prediction: you'll be able to write Rust contracts alongside Solidity on Arbitrum before we see a true, full-featured production zkEVM.
23
27
200
4
10
80
@0xPolygon
marketing isn't perfect, but we feel a strong responsibility to be honest and transparent.
So DYOR and remember that definitions are made by people with different interests and agendas. We'll keep engaging on this with the whole community!
10/10
1
2
84
The FRI (really small field PCS) vs MSM debate is spicy and I like it.
It's also much less stupid than the STARK vs SNARK debate from a few years ago that focused on proof size and trusted setups.
5
3
77
ZK alt-L1s do provide anonymity, which isn't a native feature of Ethereum.
But
@aztecnetwork
does the same thing on L2, with the added benefit of Ethereum security and access to Ethereum liquidity. 🤩
Be careful with ZK narratives and hype. Do your own research.
[10/10]
5
3
87
More people getting lower fees on Polygon!
We’re making it faster, easier, and cheaper to access web3: over the next month, eligible Coinbase customers will be able to send and receive ETH, MATIC, and USDC on
@0xPolygon
and USDC on
@solana
.
553
426
1K
0
4
84
The second issue with ZK L1s is that upgrading the proving system is effectively impossible - so you're stuck with proving tech developed years ago.
To see why this is, let's look at most programmable ZK L1s work.
[5/n]
1
0
74