1 of 31

ZeroSync

Introducing STARK proofs to Bitcoin

zerosync.org | @zerosync_ | @robin_linus

2 of 31

A Growing Problem

  • Millions of Bitcoin users, but only ~50000 full nodes
  • The chain is about 500 GB
  • Growing by up to 200 GB/yr
  • Running a node keeps getting harder
  • Can't we compress the chain?

zerosync.org

3 of 31

Zero-Knowledge Proofs

4 of 31

Proof Systems

zerosync.org

5 of 31

Chain State Proof

zerosync.org

6 of 31

Extreme Compression

500'000 MB

1 MB

zerosync.org

7 of 31

Chain State Proofs

  • Header chain proof
    • Hash chain, proof of work, difficulty adjustment
    • Merkle proof over the headers
  • "Assumevalid" chain proof
    • All consensus rules except for script validation
    • Manages the UTXO set using Utreexo
  • Full chain proof
    • All consensus rules, including signatures

zerosync.org

8 of 31

Bitcoin 🧡 ZKPs

  • No forks required! No activation drama
  • Prove once, millions of users can verify
  • Nodes can reshare the proof
  • Anyone can be a prover and extend the previous state proof

zerosync.org

9 of 31

Header Chain Proof

10 of 31

Proof Architecture

zerosync.org

11 of 31

Sync on Phone

zerosync.org/demo

12 of 31

Our Setup

13 of 31

STARK Proofs

  • Transparent proofs. No trusted party
  • Conservative cryptographic assumptions
  • Fastest proof systems

zerosync.org

14 of 31

Cairo Language

  • Arithmetic circuits are hard to work with
  • High-level language to express complex programs
  • Supports unbounded computation

zerosync.org

15 of 31

Proving

  • 14 machines
  • 3.5 GHz
  • 500 GB RAM + 1TB swap file
  • 8 days
  • $4000

zerosync.org

16 of 31

Verification

  • Proof size: 200kB
  • Time: 5 seconds on an iPhone

zerosync.org

17 of 31

Limitations

18 of 31

Longest Chain Rule

  • It's hard to prove something doesn't exist
  • Honest peer assumption required
  • Resolve instantly

zerosync.org

19 of 31

Is it a proof

if I cannot understand it?

20 of 31

Wizard Approved

Tabconf 2021

zerosync.org

21 of 31

$34 Million Bug Bounty

zerosync.org

22 of 31

"That's a hardfork"

23 of 31

Data Availability Problem

  • State proofs cannot verify data availability
    • State proof proves only the state and a UTXO set commitment
    • Updating UTXO inclusion proofs requires knowledge of the last block
  • Potential attack: data withholding attack
    • Scenario: millions of zkNodes vs 50'000 conventional nodes
    • Network split. zk-nodes believe in different state than conventional nodes
    • Withhold Lightning justice TXs?
    • Blackmail a user to pay for the proofs required to spend their coins?
  • How big is the problem actually?
    • Can only occur if most people only use proofs

zerosync.org

24 of 31

The ZeroSync Project

25 of 31

ZeroSync

  • Founded summer 2022
  • Swiss non-profit organisation
  • Free and open-source Bitcoin software
  • Funded by grants from Geometry, StarkWare, OpenSats
  • Team of 4 developers

​

zerosync.org

26 of 31

Roadmap

  • Integrate header chain proof into wallet apps
    • Neutrino, Electrum, ...
  • Improve prover performance by 100 - 1000x
    • Smaller field
    • Poseidon 2
    • Larger grinding factor
    • Builtin for SHA256
    • EC FFT for secp256k1
    • GPU / FPGA / ASICs
  • Complete a full chain proof

zerosync.org

27 of 31

Further Applications

  • miniSTARK prover is general purpose
  • ZDK: Toolkit to generate custom Bitcoin proofs
  • zkCoins: scalability and privacy
  • sats4files: decentralized hosting via LN
  • Blockstream Satellite

zerosync.org

28 of 31

Takeaways

29 of 31

Takeaways

  • ZKPs enable groundbreaking compression
  • Proof systems are likely the future of bitcoin
  • Main limitation: prover performance (probably solved soon)
  • zk-SPV clients are ready now

zerosync.org

30 of 31

Questions?

zerosync.org | @zerosync_ | @robin_linus

31 of 31