Brendan Farmer
@_bfarmer
Followers
8K
Following
3K
Media
64
Statuses
2K
works on ZK @0xPolygon, previously mir
Joined October 2018
I have a ton of respect for anyone working on ZK tech. But I’m skeptical of ZK Alt-L1s for two reasons:. 1) There’s a false belief that ZKPs are more efficient on ZK L1s than on Ethereum. 2) They're effectively impossible to upgrade. Why you should stick with Ethereum. [1/n].
28
122
627
A year ago, @0xPolygon was seen as a stopgap, an EVM sidechain that served an immediate need before we all transitioned to L2s. Today, Polygon has the fastest ZK tech and the first production-ready zkEVM. How? 🧵on feedback loops and specialization. [1/n].
11
109
516
This is a really important breakthrough from @0xPolygon R&D. It allows us to use an *even smaller, even faster* field. Here's a brief explanation -> [0/n].
#ePrint Reed-Solomon Codes over the Circle Group: U Haböck, D Lubarov, J Nabaglo
57
147
441
I had a debate with @EdFelten a few weeks ago - I asserted that optimistic rollups have fundamental disadvantages:. 1) They don’t work well for L3s.2) 3rd party bridges don't work well during periods of volatility. Ed disagreed! I don’t want to FUD, so here's the argument. [1/n].
18
254
379
Not sure that I get this. Polygon spent a billion on ZK R&D, built the fastest ZK systems (plonky2+3) and open-sourced them. The only OP stack chain with ZKPs is running on Polygon tech. A lot of the FUD around rollups stems from OP running a 2/2 multisig without proofs.
24
92
442
The recursive STARKs pioneered by @0xPolygon let us parallelize proof generation and reduce latency, but what's really cool is that they allow us to exploit a space/time tradeoff. This lets us do crazy things like proving ~100 keccak hashes/second. on a laptop [1/4].
18
109
385
Controversial ZK opinion: optimizing for proof size below ~100kb - at the cost of prover time, recursion efficiency, and Ethereum compatibility - doesn’t make sense for blockchains. From this perspective, FRI-based schemes are more attractive than ECC-based SNARKs. 🧵.
25
116
369
Opening shots fired in the ZKR vs OR war of 2023 😁. I have a ton of respect for @sgoldfed and the whole @arbitrum team. I just have a different view, that the best way to scale Ethereum is with ZK, not optimistic rollups. Here's where I disagree with Steven's thread. 🧵
There's a narrative out there that ZK Rollups will be able to do everything that Optimistic Rollups do but better. The way this story goes is that we're just waiting for ZK rollups to be ready, but as soon as they are, they win hands down. Let me tell you why I disagree 🍿🧵.
17
73
327
We’re so excited to be joining @0xPolygon as Polygon Zero. This isn’t the end - we’re just getting started - but I want to recognize the people who have helped us get this far. 🧵.
8
35
335
On zkEVMs, EVM-equivalence, definitions, and who gets to define things. or. Is @0xPolygon zkEVM EVM-equivalent? Yes*. 1/n.
11
60
297
Many people don't know this, but @0xPolygonZero implemented recursive STARKs back in February @0xPolygon isn't just leading the way in adoption, but also in building the core technology needed to scale Ethereum.🚀.
25
100
284
Plonky2 is becoming a focal point for the entire ZK space as the most performant proving system available. This is extremely cool work from @0x0ece, Kevin Bowers, and the team at @jump_ Great to see contributions from outside of @0xPolygon.
33
115
258
Polygon zkEVM is the closest thing to Ethereum blockspace. [1/n].
23
58
265
We've been working on this for a while now, and we're excited to start a conversation with the community about the Polygon PoS upgrade. $2.5b bridged, thousands of dapps, millions of users -> a unified ZK ecosystem. But wait - is this even possible?. 0/n.
1/ Today a proposal was published to upgrade Polygon PoS to a zkEVM validium, a first-of-its-kind, decentralized ZK Layer 2. As a zkEVM validium, Polygon PoS would inherit Ethereum's unmatched security, while preserving low fees & high scalability. 👉🏽
30
97
270
Interesting thread, but worth noting: Stylus wouldn't reduce fees for existing Ethereum applications. Parallel EVMs do reduce fees but not by increasing the number of cores. Quick 🧵on EVM+ and parallel EVM. [1/5].
12
62
235
This is why the Mir team joined @0xPolygon, to be part of a vibrant and growing developer ecosystem.
1/ We're excited to finally publicize metrics on some crazy growth we've seen in the @0xPolygon developer ecosystem! 🔥 . Thousands of teams and applications are already built on Polygon, and the # of active developers is growing 2x every couple of months! 🧵👇.
9
79
254
I wrote this post to go deeper into what the Aggregated Blockchains Thesis means and to describe the Aggregation Layer in more detail. The scaling debate feels stuck between the monolithic and multi-chain/modular arguments. I argue that neither approach.
29
69
241
Besides Plonky2, @0xPolygonZero built Starky, the first recursive STARK implementation ever - and it's fast! (. @0xPolygon is a ZK project.
9
93
223
L2s like @0xPolygon zkEVM aren't just for scaling existing applications, but for enabling radically new ones. The set of applications that are viable on Ethereum L1 is limited. Apps must have:. - high economic value.- low computational complexity. L2 changes this. 1/n
9
47
230
I'm biased, but I don't think that anyone has contributed more to the progress of applied ZK over the last three years than @dlubarov and the Polygon Zero team. - Plonky3, the proving system for SP1, Valida, and others. - The initial design and implementation for Valida.- The.
The work done by @dlubarov in Plonky3 is the cornerstorne of so many new ZK projects. I think this is not appreciated enough. We should celebrate and support those that have shared their work from day one with others. We should be thanked to them. This is the spirit of open.
11
77
236
[whispering to myself] “Don’t become the Joker…”. But this is not a serious post from Matter. > ensure that the term “ZK” can be used freely in the context of “ZK Sync”,. If this were really the goal, trademark zkSync and zkStack. > you don’t have rights to the word or phrase
ZK technology belongs to the community. Full stop. We applied for ZK-related trademarks to ensure that the term “ZK” can be used freely in the context of “ZK Sync”, “ZK Stack” and other related names. Like it or not, trademarks are the only legal tool available for this today.
19
64
222
100%, been saying this. Generalized fraud proofs are actually difficult and complex - how do you provably guarantee that the attacker can't put the dispute game in an unreachable state? . ZKPs are complex due to immature tooling, but we're fixing this very quickly. Soon we'll.
the widespread consensus in 2019 was that optimistic rollups and generalized fraud proofs would be faster to market and ZKRs and related tech would be slow and prohibitively complex to build, the opposite seems to be true.
20
133
193
This is huge for Ethereum and for @0xPolygon: first zkEVM with working proofs. Even a year ago, many people building ORs and ZKRs thought that a full zkEVM was impractical - too expensive, too complex, "5 years away.". This is a tremendous achievement.
The future of Ethereum is #onPolygon.🦄💫. When we unveiled Polygon #zkEVM in July, it was a milestone not only for Polygon, but also for Ethereum & Web3. We're proud to announce Polygon zkEVM Public Testnet, the world's 1st open source zkEVM network!.
5
39
210
I'm biased. BUT I think that this is the most significant ZK engineering achievement of the last two years. It's a privilege to work with @dlubarov @williamborgeaud Hamish, Nick, @jnabaglo and Brendan.
1/5 Proud to present #Plonky2 - the world's fastest ZK scaling technology, built by @0xPolygonZero! 💫. Plonky2 is a recursive SNARK that is 100x faster than existing alternatives and natively compatible with #Ethereum. A 🧵 on why this is exciting…
6
27
206
The AggLayer is designed, discussed, and built in the open. . The AL is a collaboration between. @gateway_eth.@EspressoSys.@SuccinctLabs.@okx .@Fractal_ZKP .@ErigonEth .@union_build .@AstarNetwork .@nodekitorg.@0xPolygon.and more. Join us, anon.
12
76
208
This is a consensus view, but I disagree with it for a few reasons. Consider that an OR in this scenario will either be EVM or non-EVM. If it's EVM, then throughput will be limited by the EVM client, which means that tx fees will be non-negligible for high-throughput.
Optimistic rollups are probably the better solution for extremely high throughput and low composability applications such as onchain games due to the proving overhead of ZK. ZK probably still wins out for more monolithic usecases where composability matters though like DeFi.
8
29
199
This is an important step. When @dlubarov and I were starting Mir five years ago, we encountered a ton of skepticism. Many people thought that ZK tech wasn't ready, that even proving simple transfers would be impractical. Proving mainnet Ethereum? Not possible. What the.
Releasing the Type-1 upgrade to the zkEVM prover, the next generation of Polygon’s proving tech. It can generate proofs for any EVM chain—sidechain, optimistic rollup, even Ethereum itself. When proving Ethereum mainnet blocks, avg per-transaction costs are $0.002 - $0.003.
10
28
200
Credit to @zksync for the transparency and for dealing with this admirably. 💪 . To anyone tempted to be critical, this could happen to *any* L2 (including @0xPolygon). We're all working to ensure greater stability as we scale Ethereum.
Protocol liveness is @zksync's second top priority after security. We want to share, with full transparency, the details of this incident with our community. Here's an overview of what happened, the reasons behind it, our response, and future plans to prevent liveness issues.
6
154
159
I wrote about Optimium/AnyTrust, arguing that these systems have equivalent security to a sidechain.
21
52
161
“zksync don’t be evil” challenge, difficulty: well, you know. Projects and people should be judged by their actions, not by what they claim to believe. Matter repeatedly acts in bad faith and tries to deflect attention from bad behavior. > Trademarks, however, exist to protect.
Matter Labs is a zealous proponent of the libertarian, cypherpunk ethos and the values stated in the ZK Credo. We reject the very idea of “Intellectual Property”. Everything we create is released to the public under free open source licenses. Trademarks, however, exist to.
14
33
189
You don't hear as much about Solana REV justifying its market cap - this is because weekly REV is down 90% from ATH. I wrote about this a while ago (link below). The problem is that the types of activity that are great for generating REV (memecoin trading!) are generally
20
22
182
A true zkEVM (L1 code, tools, wallets all just work) is the holy grail for scaling Ethereum. w/ insanely fast ZK tech like plonky2, @0xPolygon zkEVM won't just be EVM-equivalent, it'll be the most performant ZK L2. *someone pls build flashbots for announcements.
We are proud to announce a giant leap forward for Ethereum scaling and ZK innovation. Introducing Polygon #zkEVM, the first EVM-equivalent ZK L2. Today we’re releasing a complete implementation, fully open-source, and we’re just getting started. [1/6]
4
26
161
Sometimes in crypto, people use the same language to describe very different things. This is unfortunate, because it obscures real and substantive differences that should be clear to the community - say, between @0xPolygon 2.0 and @zksync. Here's what I mean. [0/n].
8
36
168
On zk-rollups, rapid innovation, and optimizing for the right things. tldr: Sometimes being first can be a bad thing. Here’s how we think about the ZK landscape @0xPolygon. 1/n
10
50
172
Really cool work from @UHaboeck on the Polygon Labs team and @PapiniShahar and David from Starkware. We've been looking at the Mersenne-31 field for a while for Plonky3. Field arithmetic mod 2^31 - 1 is really fast on CPUs, and GPUs but there's a problem. We need to do FFTs.
Introducing Circle STARK 🔵. At Polygon Labs, we’ve been heavily focused on improving ZK performance with Plonky3. For the past three months, we've collaborated closely with the @StarkWareLtd team to develop an incredibly fast proving system that will be incorporated into
10
20
166
Amazing work from the @0xPolygonZero team and contributors from the ZK community. It's only going to get faster. .
Plonky3 is getting faster! On my M1 Macbook Air, it can prove around 750 Keccak-f permutations per second, ~5x more than Starky. This is an important metric for us (@0xPolygonZero), since Keccak is the main bottleneck in type-1 zkEVMs.
24
46
136
New paper from Angus Gruen @0xpolygon on improvements to zerocheck!. Angus joined us after finishing his math PhD at Caltech and we're extremely lucky to have him - he optimized our keccak circuit by 4x as an intern!.
16
32
165
Plonky3 got 2.5x faster in 2 months 😍.
After some optimization work at @0xPolygonZero, Plonky3 is up to ~2,500 Keccak-f permutations per second on an M3 Max! In other words, we can prove one of the least ZK-friendly hashes at a rate of about 340 KB/s.
6
42
157
Congratulations to the a16z team on developing Jolt. Exploring the design and tradeoff space is important given how early we are in building zkVMs. This is a huge achievement. [Stephen A Smith voice]: BUT. I think the comparison between SP1 (built on @0xPolygon 's Plonky3!) and
1/ We're excited to share the initial release of Jolt, a new approach to zkVM design. Early benchmarks indicate it outperforms RISC Zero by ~6x and SP1 by up to 2x. Major optimizations are still in the pipeline.
10
24
165
Proof aggregation services are great - they reduce the cost of ZK proof verification on L1. The agglayer has a different goal: to aggregate chains and unlock unified liquidity. In order to have unified liquidity, you need: . (1) Asset fungibility across chains .(2).
12
33
165
Just to clarify - Arbitrum still does not have permissionless fraud proofs. Challenges can only be initiated by a member of the whitelisted validator set. This isn't meant to be critical of Arb - every L2 has training wheels - but I think that it's indicative of the fact that.
I mean sure if we ignore Arbitrum, the largest L2 ecosystem that's had fraud proofs from day 1, then this is a great talking point.
11
12
153
how do you ensure safety among chains connected to the AggLayer?. introducing the pessimistic proof, a novel zero-knowledge proof that is flexible enough to support both zk and non-zk chains. why pessimistic? because it treats every chain suspiciously 🧵
9
66
151
For the last few years, whenever anyone asked what I thought was the most interesting ZK project, I always said Penumbra*. That's because Penumbra is the protocol that I wish that I could've built. For me, it's note-perfect from a technical standpoint and a strategic one -.
After years of toil in the dark,.tens of thousands of efforts made,.and a committed, energetic desire to exist,.a DEX from the future has arrived in the present. 🌒 PENUMBRA HAS ARRIVED 🌘.
11
21
157
ORs have a withdrawal delay so fraud proofs can be published (native withdrawals take 7 days). Ed noted that 3rd party bridges allow fast withdrawals, and as long as the operator of the bridge is running a full node, there’s no risk that the bridge can lose funds. [2/n].
2
0
139
Unfortunately not true. The referenced audit is for plonky2x, a separate codebase from plonky2 that was developed by an external team. The vulnerabilities found are specific to plonky2x, not plonky2. Plonky2 was audited by Least Authority (founded by @zooko ) in 2022. The audit.
Oof!. The good news is that Succinct Labs has published a security audit of the plonky2 codebase. The bad news is that the auditor found *fourteen* dangerous vulnerabilities in it. ⤵️.
6
36
139
I think that this is a valid argument, though the user is still trusting the bridge multisig/validators and paying a fee. But I don’t think that 3rd party bridging solves the fundamental problem for ORs. First, this model doesn’t work well for L3s. [3/n].
1
0
135
I'll hire as many trans devs as you have, right now. Let as many leave as you want. Then go fuck off.
11
8
152
A core advantage for ZK is that we can add blockspace, in the form of L3s, to meet demand. Users can seamlessly and atomically interact across L3s or L2s, in the time that it takes to generate a proof (or sometimes even faster). [4/n].
2
0
127
This is exactly right. Allowing anyone to submit a fraud proof isn't about decentralization. It's about security, and it's necessary to provide full L2 security for ORs. Here's why. The point of L2s is to extend Ethereum's security to other chains. Unlike a sidechain, where a.
For noobs like me, simplifying what @_bfarmer said — . The whole premise of Optimistic rollups is that someone will notice fraud in the chain and challenge it on the parent chain. If you don’t allow anyone to challenge, OR is not complete. ZKR doesn’t have that limitation.
4
22
135
StarkWare x Polygon = 🔥🔥🔥. Seriously though, it’s great to see dynamic collaboration across teams and amazing results from outside academia.
Here is the recent work of myself and @UHaboeck. The one liner is: you can do lookups with logUp using GKR. This is inspired by Lasso and @SuccinctJT's work.
1
13
134
How to Backfill a Narrative . I wrote about Solana, Ethereum, Memecoins and REV. I argue that SOL can't be realistically valued based on projected future REV and that memecoin dominance presents structural risk for Solana.
16
11
142
A few people have been critical of the fact that while @0xPolygon zkEVM prover's source code is available on Github, it doesn't have an open source license yet. This is true, but it's a weak critique for a few reasons.
8
28
124
This post is great - a much better framing than stupid semantic debates over what qualifies as an L2. Validiums satisfy a requirement for high throughput, low latency, and low fees, with more security than a sidechain. Dismissing them because they don't pay for DA on L1 is a.
Different types of layer 2s.
8
29
128
Congrats to the Core Devs on the Dencun upgrade. Upgrading a network securing hundreds of billions of dollars will never stop being impressive to me. We love the blobs.
6
14
137
Credit to L2Beat for making this change. I've argued for a while that OP's fraud proof system doesn't meet the criteria for a Stage 1 rollup because OP can unilaterally disable fraud proofs. This means that the operator of the rollup can steal funds if >25% of the security.
7
11
140
For three years running, @0xPolygon (via Polyon Zero) has delivered the fastest ZK proving systems. When Plonky2/Starky came out in 2022, it was ~50-100x faster than the SotA*. Now Plonky3 is proving 1.7m Poseidon2 hashes/s (!!), setting the standard. This is why Plonky3.
Plonky3 will get very fast on the server side thanks to @FabricCrypto, but we haven't forgotten about CPU performance. In the past few weeks, things have gotten 2-4x faster, with my laptop (M3 Max) now proving ~1.7 million Poseidon2 hashes per second.
14
26
138
First, definitions don't exist platonically, they're formed (and updated) by a community. Members of that community have distinct beliefs and agendas that color how they define terms, but disputes about meaning and definition are resolved collectively, not unilaterally. 2/n.
1
1
129
Extremely excited for Plonky3. From the team that brought you Plonky2, it's not a single proving system, but a devkit for building high-performance proving systems. Now supports BabyBear/STARK.Soon M31 and [redacted], maybe also Binius and binary fields?. 🔥.
This is a great explanation of Plonky3's Merkle trees. Just to add more context, Plonky2 supported "multi-STARK" schemes, but each STARK would get its own Merkle tree and FRI instance.
6
21
130
So how does this relate to zkEVMs and EVM-equivalence? EVM-equivalence is a term that has existed for a while and refers to zkEVMs that can process transactions in the same way as the EVM - so all code, tooling, infrastructure just works. It's the Holy Grail of scaling. 3/n.
1
0
125
Toly is right that ZK doesn't really help with vertical scalability - it just allows full nodes to massively increase hardware requirements without impacting verifiability. But, ZK does allow trustless partitioning of state and tx - so in aggregate, we aren't limited by.
@mteamisloading @0xBreadguy It doesn’t help with anything commercially. The network will be limited by full node bandwidth, the extra cores for classically computing the state are negligible. Yes, once a very long epoch the double spend quorum boxes can pull a snapshot with a zkp, or tee, or from a box.
11
17
136
Went to Denver, spent the entire time working with the @0xPolygon ZK teams. Extremely excited about what we'll be releasing this year 🚀.
I am so freaking excited about what will happen on and with @0xPolygon this year. 🦄💫.
2
17
125
ZK allows things like batching trades on L3 to execute on L2, increasing scalability by orders of magnitude + unifying liquidity and retaining composability. This doesn’t work with withdrawal delays. Imagine making a trade and waiting seven days for execution. Not great. [5/n].
1
0
115
At @0xPolygonLabs we're less focused on definitions and semantics, more on building industry-leading ZK technology and pushing the space forward.
nothing is more academic than modular #blockchain debates - its the theology department of #crypto. its also quite political, #l2beat lists several validiums for months but one fine day someone randomly decides to restart the debate because they can't compete on product
4
167
90
I want to go a bit deeper on the upgradability issue, as others have raised some good points. For background - before joining Polygon, I worked on a ZK Alt-L1 and upgradability kept me up at night. Here are some additional thoughts, though maybe the same conclusion. [1/n].
I have a ton of respect for anyone working on ZK tech. But I’m skeptical of ZK Alt-L1s for two reasons:. 1) There’s a false belief that ZKPs are more efficient on ZK L1s than on Ethereum. 2) They're effectively impossible to upgrade. Why you should stick with Ethereum. [1/n].
2
33
119
It seems like a reasonable interpretation of this data is that Base cannibalized OP Mainnet. 15% of profit from Base > OP mainnet profit only because OP mainnet revenue dropped massively (net negative for OP tokenholders). Base had a big impact in popularizing OP stack but.
We love to say the @Optimism collective strategy led to UX fragmentation and a overall bad user experience. We point to it as a strategic mistake. But as of Q4, the 15% sequencer revenue share from Base brings in more revenue than the 100% from OP main. were they right?
13
9
127
This seems deeply cynical to me. > protected against squatters. The only entity that has attempted to squat on the ZK trademark is Matter Labs (since February). In my understanding, they have already used their trademark application offensively in a dispute with another project.
The Matter Labs ZK Pledge. We are grateful to @VitalikButerin, @ilblackdragon, @hasufl, @MicahZoltu, @stonecoldpat0, @StaniKulechov, @lex_node, @hosseeb, @pcaversaccio, and others for their comments and suggestions on how to ensure critical terms like “ZK” remain freely available.
16
22
127
Hard to understate how big this is for zkEVM.
The new, high-performance, zkEVM RPC node is ready to be used in production, and it brings amazing improvement over the current RPC: . 🔥 150x faster sync times .🔥 10x less disk space. Polygon tech reaching the desired state. Get ready.
6
21
122
ZK wars are already spicy and full of FUD. Per @jbaylina, the accurate numbers are 2.27m gas for 1116 transactions, so the difference in efficiency is. basically zero.
@_bfarmer @0xPolygon How exactly are you going to optimize to overcome this whopping 128x difference in efficiency?.
7
18
115
Really enjoyed this! @jimpo_potamus @radi_cojbasic and co are one of the most impressive ZK teams in the space, huge respect for what they're building.
Wondering what Binius is and why a hardware company is developing a new ZK proof system? Our co-founders, Radi and Jim, explain it all in a new Zero Knowledge Podcast episode. Thanks to @AnnaRRose @_bfarmer and @zeroknowledgefm for hosting!.
5
8
122
Sincerely have a lot of respect for this; thank you @AndreCronjeTech. Obviously calling Polygon PoS an L2 wasn't the best idea (was before my time! 😅) but the double standard over the last few years has been a bad thing. We will keep doing ZK R&D and keep open sourcing it. 🫡.
@_bfarmer I legit owe Polygon and your team a MASSIVE apology. At the time I was frustrated at the narrative you guys were pushing of being an L2, by the standards at the time (stage 3 L2s) you guys were a sidechain. But comparing then to now, and you guys are 1000x closer to the L2.
8
9
124
This is very different from EVM-compatible zkEVMs, where code must be compiled, introducing incompatibilities, and *no* dev tooling or infrastructure just works - all must be separately maintained and updated. See: 4/n.
@paulmillr @toghrulmaharram requires custom libs to integrate e.g. with foundry and it's a bit of a pain, see example
1
0
117
This is an unpopular opinion, but enshrining pairing-based primitives as core components of Ethereum should be avoided. They're expensive in-circuit for ZKRs and they introduce complexity for rollup/client/app implementations.
every zk rollup will need to have an implementation of this, assuming eip4844 in its current state to prove equivalence between whatever polycommit they're using and kzg.
6
7
112
You could extend the third-party bridging concept to L3s, but it’s implausible that flows will always be symmetric between L3s and L2s, or that market makers will reserve enough capital to process large movements of funds. [6/n].
2
0
108
Thanks to @drakefjustin and the Ethereum Preconfirmation group for letting me present on the agglayer. The Agglayer is public infrastructure that's designed to help solve Ethereum's L2 fragmentation problem. Here's the recording:
5
27
112
We need to take the time to explain the full interoperability story for polygon 2.0, but the issues identified below are not really the problem/source of complexity. (1) You don't need "instant zk proofs" for atomic cross-rollup transactions to work. IMO it's fully acceptable to.
I’ve heard this idea several times that zk rollups will enable atomic cross-chain transactions or “operator-less shared sequencing” but the design seems to be flawed. Firstly, you’d need instant zk-proofs which we don’t have. Secondly, you’d need to know at the time of.
4
19
111
ORs could simply require the same sequencer set to operate all L3s and L2s, but this limits the user's ability to detect and challenge fraud. It also defeats the point of L3s: to use disjoint sequencer sets to add blockspace without increasing node requirements. [7/n].
3
0
105
[puts on bankless hat] Hyperliquid dominance is a good sign for Ethereum. No, wait, I'm serious. Hear me out. Ethereum envisions a world of heterogeneous rollups that make tradeoffs to better serve users. Solana envisions a world in which a single globally decentralized
17
11
118
Huge! We can efficiently verify signatures and pedersen hashes in proof systems that use the Goldilocks Field from Plonky2. imo Goldilocks STARKS/Plonky2 are the future of ZK on blockchains, and there's an amazing community developing, all led by @0xPolygon💜🚀.
11
70
107
But back to EVM-equivalence. Let's recognize that the definition of EVM-equivalence is arbitrary - why should it include identical gas pricing, but not identical state storage?. Better to see it as a spectrum, as @VitalikButerin does. 5/n.
1
3
109
ZK is actually the cheapest and most secure option. Here's why:. For ORs: the fees that users currently pay to third party bridges for fast exits are a super high hidden cost (>15k ETH on Arbitrum One since genesis, ref: . We would expect this to increase.
Three ways to build services:.1) zk: need to pay for prover cost .2) optimistic: need to wait for settlement lag.3) Cryptoeconomic: need to pay for capital cost during settlement lag. But instant. Choose your own adventure.
11
19
114
@ajwarner90 @0xMarcB It doesn't have "basically" the security of a sidechain, it has *the* security of a sidechain. The operators of an anytrust chain can collude to directly steal user funds, just like on a sidechain. This cannot happen on a validium, because even a malicious operator cannot.
2
2
113
This is very cool. Performance looks amazing - it uses Plonky3 (developed by @0xPolygon) as the proving system, so you know it's fast 😀. zkVMs that use existing languages are an amazing step for the ZK space. Looking forward to collaborating more with @SuccinctLabs and playing.
1/ We are excited to announce Succinct Processor 1 (SP1), our first generation, 100% open-source zkVM that proves arbitrary Rust programs. SP1 targets an order of magnitude performance improvement vs. existing zkVMs, and is already up to 28x faster for certain programs.
4
21
113
ZK L1s have raised hundreds of millions of $, in part based on the narrative that ZKPs will be more efficient and cheaper to verify than on Ethereum. So use cases like private identity, games with incomplete information (poker), ZKML, private DeFi will migrate to ZK L1s. [2/n].
1
0
99
I’m biased, but it’s clear to me that ZK offers the best path toward scaling without sacrificing composability or fragmenting liquidity. In short, scalability without compromise. [8/n].
2
0
98
But this just isn't correct. Verifying a proof on Ethereum may be expensive in gas terms, but with recursion, we can amortize this cost across any number of proofs. Since the introduction of Plonky2 by @0xPolygon we've had super fast recursive proofs on Ethereum. [3/n].
2
2
106
How did Polygon get so fast? . We had an entire team (Zero) dedicated to R&D, with the mandate to build the fastest ZK provers in the industry. Zero has incredibly strong cryptographers and engineers, which creates a feedback loop with huge benefits. [3/n]
1
17
100
Surprised at the level of misunderstanding of L3s. - Moving funds between L2s doesn't require withdrawing to L1. - The fixed costs of posting state updates to L1 can be amortized across many L2s. - Appchains need not be L3s. Why be an L3 when you can be an L2? . Embrace the.
6
25
103
@0xPolygon disproved the conventional wisdom that an EVM-equivalent zkEVM, the holy grail of scaling, was 3-5 years away. zkEVM is here. Now on testnet, soon on mainnet. Meanwhile, the Zero team is looking ahead. [8/8]
1
4
95
CALLDATA costs for @0xPolygon zkEVM will soon be much lower as we optimize. Our immediate goal isn't to maximize short-term usage and TVL, it's to ensure stability and safety. If you want a zkEVM for the long-term, compare prover performance - it's much harder to improve. 1/n.
💰 Cost: Storing state diffs is way more efficient. It's not just less data (e.g., signatures omitted) but also allows for "batching" multiple changes impacting the same accounts. Efficiency comparison? MASSIVE!.
3
24
101
Where does @0xPolygon zkEVM fall? Sort of in-between. We have identical gas pricing to L1, so we're better than Type-3 in that sense, but we don't support precompiles (yet). We've been extremely transparent about this - @jbaylina mentions it in almost every talk. 6/n.
2
0
101
An amazing collaboration with @SuccinctLabs continues. @0xPolygon built Plonky3, the proving system that SP1 uses, which enables its hyper-performance. Polygon’s own @dlubarov co-designed Valida, which inspired SP1's architecture. The amazing team at Succinct then built SP1,.
Polygon is using SP1. We’re thrilled to announce that Polygon Labs is using Succinct’s zkVM SP1 for building the AggLayer, their flagship interoperability protocol. Polygon accelerated development timelines with SP1's simple devex (just write Rust) and SOTA performance.
7
23
105
When it comes to ZK, performance matters. Sure, proving is parallelizable, but there's a huge difference between:. - 30 minute per-tx proof times, using many GPUs. - Polygon zkEVM, where we can prove a 10m gas batch in 2.5 min. on CPU (and this will come down a lot!). [2/n].
2
7
91
The second issue is with 3rd-party bridges. Obviously crypto assets are highly volatile, so market makers don’t want to hold them - certainly not for 7 days. So third-party bridges work well when the movement of funds into and out of a rollup is symmetric. [9/n].
1
1
94
So who gets to define EVM-equivalent and is Polygon zkEVM EVM-equivalent? I'd say yes, with an asterisk. Polygon zkEVM is EVM-equivalent for all contracts that don't use precompiles (pairings + specialized hash functions). So nearly 100% of contracts on L1. 7/n.
1
2
99
It's happening again! The @0xPolygon Zero team that brought you Goldilocks is making another prime field really fast. Really nice writeup from @jnabaglo on speeding up M31 (2^31 - 1) arithmetic on different CPU architectures. Will be useful.
1
20
105
The agglayer is not an L2. An L2 is an execution environment that allows an L1 to offload transaction execution. The agglayer cannot execute transactions, therefore it is not an L2. The problem is that the word "layer" is overloaded - we use it in the sense of modular.
8
20
103
Keep in mind, I'm biased - I work at @0xPolygonLabs!. But also keep in mind that there's a vested interest in modifying definitions to benefit different agendas. Not to pick on Toghrul, whom I respect, but as of last year, we weren't even a zkEVM!. 8/n.
@SadeSalisu9 @cryptodavidw Well, yes, but not a zkEVM.
1
0
96
To clarify, the argument is not that OP’s success depends on OP mainnet. Note that OP only benefits economically from superchain chains, not from uptake of OP stack in general. If Base has cannibalized OP mainnet, that implies that superchain chains are competitive with each.
It seems like a reasonable interpretation of this data is that Base cannibalized OP Mainnet. 15% of profit from Base > OP mainnet profit only because OP mainnet revenue dropped massively (net negative for OP tokenholders). Base had a big impact in popularizing OP stack but.
7
9
103