Succinct 백서 전문

Succinct Network: Prove the World’s Software Uma Roy Succinct uma@succinct.xyz John Guibas Succinct john@succinct.xyz Kshitij Kulkarni Succinct k@succinct.xyz Mallesh Pai Rice University and SMG mallesh.pai@mechanism.org Dan Robinson Paradigm dan@paradigm.xyz Abstract We propose the Succinct Network, a decentralized protocol that proves the world’s software. The network coordinates a distributed set of provers who generate zero- knowledge proofs through a novel incentive mechanism called proof contests to create the world’s most eﬀicient, robust proving cluster. Users submit requests in the form of RISC-V programs with inputs and fees that determine proving priority. Provers en- gage in proof contests, which are all-pay auctions for the right to generate proofs with minimal latency and cost, in order to earn fees. The auctions settle on an application- specific blockchain. Both proof contests and the blockchain are codesigned with SP1, a zkVM that proves the execution of RISC-V bytecode. Proof contests are specifically designed to balance the competing goals of minimizing proving costs while encourag- ing a decentralized set of provers. The network coordinates the ecosystem of users, hardware teams, and infrastructure operators with cryptoeconomic incentives. Permis- sionless participation in the protocol catalyzes a global-scale infrastructure buildout that drives down the cost and latency of zero-knowledge proof generation for all. 1 Introduction Decentralized systems such as blockchains operate based on distributed consensus: multiple parties reexecute computation and agree on the result. In exchange, blockchains allow for trustless applications that do not have a centralized mediator. This idea was first applied to decentralized money with Bitcoin and then to arbitrary trustless com- putation with Ethereum [ Nak08; But13]. Redundant computation, however, is costly and imposes overhead on blockchains relative to their centralized counterparts. Due to this reason, blockchains remain bottlenecked. Succinct zero-knowledge (ZK) proofs promise a path forward. They enable a prover to convince a verifier of the knowledge of a claim (such as the execution of a program 1 (a) Proof systems have experienced exponen- tial performance improvements. (b) ZK virtual machines convert application- specific circuits to general purpose programs. Figure 1: ZK proving technology has seen rapid progress. with optionally private inputs) with a proof that is much shorter than the claim itself [BS+13; BS+14]. This allows blockchains to scale their throughput by separating transaction execution, which is expensive, from transaction verification, which can be made cheap through ZK proofs. Only a small fraction of the participants in the system have to do expensive computation, while many nodes can just verify it. In the case of Ethereum, with real-time ZK proofs, “attesters can verify cheap SNARKs instead of naively reexecuting EVM transactions,” allowing Ethereum to arbitrarily scale [ Dra24]. Beyond their implications for making blockchains scalable and commercially viable, ZK proofs herald a fundamentally new kind of computing paradigm— cryptographic computing—that enables verifiability in all systems. The implications of ubiquitous verifiability are wide-ranging. Today, tasks such as authentication, identity manage- ment and transaction verification take up the resources of governments and global companies. With cryptographic computing, it may be possible to vastly reduce the overhead these entities face via protocols that consume ZK proofs and automatically verify correct program execution over private user information. Crucially, ZK proofs differ from earlier cryptographic primitives such as digital signatures, which enabled authentication on the internet, in their programmability. They can allow for verifiable statements about any computation on any private or public inputs, vastly opening the design space for decentralized protocols and business logic involving attestations or identity. Today, there are two important trends in ZK technology that indicate we are at a significant inflection point. The first is the rapid increase in performance in practi- cal ZK proof systems. While eﬀicient interactive proof systems were introduced in the 1980s [GMR85], they remained diﬀicult to use until modern proof systems made signif- icant advances in proving overhead, cost, and latency [ Halo20; Plonky22; Plonky23]. ZK proving performance has been on an exponential curve due to improvements in software and performance engineering (Figure 1(a)). The second is the progress in 2 Figure 2: The Succinct Network creates a global, distributed proving cluster with a unified experience for users, powered by proof contests. ZK proving technology from application-specific circuit design, which encodes program logic in an arithmetic circuit, to general purpose ZK virtual machines (zkVMs) that enable the proving of arbitrary deterministic programs and can utilize normal code and existing software (Figure 1(b)). The flexibility of normal programming languages allows for reuse for existing code. General purpose zkVMs such as SP1 have radically expanded the number of developers who can build applications using ZK and have allowed blockchains to become early consumers of ZK proving [ SP124]. The confluence of both exponential performance improvements and general purpose zkVMs suggests a reexamination of the ingredients that will be required to accelerate the adoption of the cryptographic computing paradigm. ZK proving is a computa- tionally intensive workload, on the order of large scale AI systems or Bitcoin mining. Production tasks like proving the execution of a blockchain’s state transition func- tion can require specialized hardware such as GPUs and may require custom ASICs in the future. As the adoption of ZK technology accelerates, proving will necessitate an ecosystem of infrastructure providers, from datacenter buildouts in areas with low cost of electricity to deployment of specialized hardware. For blockchain use-cases, it is important that proving be decentralized, with geographically distributed proving operators in addition to home provers, who can provide reliability and liveness. Realizing this ecosystem, composed of users, provers, and infrastructure providers, requires global-scale coordination and a network that appropriately incentivizes hard- ware acceleration, prover decentralization, and cost competition on ZK proving. To ensure that advances in proving technology accrue to end users, this network ought to be codesigned with a single zkVM. Network codesign ensures that users can write applications on a canonical, open-source zkVM that experiences continual performance improvements, and hardware teams and infrastructure providers can coordinate on a unified platform. The combination of coordination and competition between provers is a catalyst for the creation of a maximally eﬀicient network. 3 Figure 3: The network, by aggregating supply and demand, creates a virtuous flywheel for proving infrastructure and R&D. 2 Succinct Network The Succinct Network introduces the idea of a global, distributed proving cluster code- signed with SP1 and powered by a competitive auction mechanism called proof contests to dramatically expand the proving capacity of the world (Figure 2). 1. A global, distributed proving cluster: The network provides a unified platform for users to submit proof requests and for anyone in the world to provide proving capacity. Provers can join the network permissionlessly and participate by running node software and users can get high-reliability guarantees for their requests. 2. Proof contests: The proof contest mechanism is a novel auction that bal- ances proving cost and decentralization, and induces free market competition on proving. It functions as an all-pay auction with collateral that allows for ef- fective price discovery on requests while maintaining a decentralized prover set and solving several related problems, such as proof spamming, contention, and griefing. Proof contests settle on an application-specific blockchain designed for coordinating provers with requests. 2.1 Market Structure There are two primary participants in the network: applications who demand ZK proving and provers who provide proving capacity and infrastructure. The cluster and proof contest mechanism jointly induce a market structure with a virtuous flywheel by aggregating supply and demand (Figure 3). This incentivizes global scale competition 4 for developing increasingly eﬀicient proving infrastructure. Tight integration with SP1 development and the network also ensures that technological and algorithmic advances in proving can quickly accrue to users. We detail this process and how it affects the market participants. 2.1.1 The network kickstarts a virtuous flywheel by aggregating sup- ply and demand The network is explicitly architected so that any user can permissionlessly send requests in a unified interface and so that any prover can join and provide capacity according to pricing determined by the proof contest mechanism. The existence of this free market aggregates demand across many applications and supply across many provers. This has the following implications: 1. A unified request experience means more eﬀiciency . Without the aggre- gation of supply and demand, it is likely that the market for proving degenerates into applications and provers making bespoke agreements or applications setting up in-house infrastructure. Over the long run, application teams may not be well-positioned to run their own proving infrastructure due to the specialized operational and technical skills involved. Over-the-counter deals are not eﬀicient and lead to frictions in the market. A transparent market with a unified protocol for pricing proofs provided by an aggregated supply chain reduces integration time, development cost, and generates eﬀicient prices. 2. T ransparent pricing accelerates infrastructure. With transparent pricing and aggregated demand, provers face economics that are far easier to forecast. Provers can build out infrastructure faster and with more certainty because their cash flows are more predictable. The existence of a transparent market for prov- ing means that provers’ risks can be priced and financed eﬀiciently. 3. Home provers with low cost of capital can form proving pools . The protocol allows for anyone in the world with spare proving capacity to join. Often, individuals with home GPUs and hardware have far smaller capital costs due to spare capacity and lower operational costs due to cheap electricity than larger operators. By allowing home provers to participate, proving capacity can be dramatically increased and eﬀicient prices can be maintained. In Section 3.4, we introduce the notion of a proving pool, which is a set of provers that pool their capacity together to jointly bid in the proof contest mechanism. This allows home provers to mitigate economic risks. 4. Permissionless participation encourages prover decentralization. Be- cause entry into the market from both sides is permissionless, the frictions for joining and beginning to provide proving capacity are minimized. This allows provers to join from anywhere, enabling geographic decentralization. In contrast to a marketplace where only certain actors can participate, this means that down- stream users and applications can reliably receive proofs and are not bottlenecked by provers in a particular location. 5 Importantly, markets that aggregate supply and demand have historically resulted in ever-greater eﬀiciency and better prices for all participants. The virtuous flywheel accelerates both the demand and supply side. 2.1.2 Proof contests incentivize global-scale competition while main- taining prover decentralization The proof contest mechanism induces competition on proving and incentivizes a decen- tralized prover set, ensuring that applications that require high reliability and liveness are able to receive proofs for minimal cost. Proof contests are all-pay auctions where provers compete to receive fees provided by proof requests sent by users. The all-pay feature induces prover decentralization. We provide more detail about the mechanism in Section 3. 1. Proof contests enable competition between provers. Primarily, proof contests are designed to enable provers anywhere in the world to participate in the network while competing on proving costs. This is achieved by asking provers to bid in auctions to be able to receive fees set by users. Proof contests surface price signals by adjusting their fees to find market clearing prices for proofs. 2. Price discovery allows for reinvestment. Proof contests pay out a large share of fees set by users to provers that perform their core task well: eﬀiciently generating low-cost ZK proofs within a user-specified deadline. This allows re- turns from the contests to be reinvested in better proving infrastructure and algorithmic and hardware improvements in proving. Provers are incentivized to continually improve their proving infrastructure. Proving pools can also provide smoothed fees to individual provers, allowing them to participate in the network in a “plug-and-play” fashion. 3. Gains from competition accrue to applications. End users are the primary beneficiaries from competition between provers. Over time, provers directly com- pete with each other on the main feature that users demand: low cost proofs de- livered within user-specified deadlines. Importantly, there are applications that require proofs to be delivered at low costs to be viable at scale. The network uses free market competition to serve these applications. 4. The mechanism enables prover decentralization. In contrast to naïve mechanisms in which a prover who can generate proofs at a lower cost than any other would be expected to win 100% of auctions, such as a simple reverse auction, the proof contest mechanism incentivizes decentralization even under the existence of such a prover. This is done via an all-pay feature that resembles Tullock contests or contests for fixed prizes. This incentivizes a broad prover set and prevents prover concentration, which helps ensure long-term robustness of the network. This requires sacrificing some eﬀiciency, since it necessarily involves sometimes allocating proofs to higher-cost provers. In exchange, having a robust, decentralized prover set allows applications to rely on the network. 6 Permissionless Participation Incentive Application Bitcoin Setup a miner Proof-of-work Decentralized money Filecoin Setup storage Proof-of-replication Decentralized storage Aleo Setup a prover Proof-of-succinct-work Private blockchain Succinct Network Setup a prover Proof contests Decentralized proving T able 1: Comparisons to networks that incentivized infrastructure buildouts. 2.2 Related Works The Succinct Network draws its inspiration from a line of related works that that used cryptoeconomic incentives to coordinate global-scale compute infrastructure buildouts, such as Bitcoin and Filecoin. Today, Bitcoin has a hashrate that exceeds the capacity of any one company or nation. This was catalyzed by the incentives set up by the proof- of-work protocol. We compare and contrast the key features of existing infrastructure buildouts that used incentives with the Succinct Network; Table 1 summarizes this comparison on the axes of permissionless participation, incentives, and the application. 1. Bitcoin. Bitcoin bootstrapped a decentralized monetary system by incentiviz- ing miners via the proof-of-work mechanism [ Nak08]. The Bitcoin network’s incentives have led to hardware investment and specialized energy management infrastructure. It has also led to the creation of large mining pools that allow individuals to participate in block construction. Bitcoin users, however, do not explicitly demand low cost and low latency block construction from miners. 2. Filecoin. Filecoin set up a decentralized storage network via the proof-of- spacetime and proof-of-replication mechanisms [ Ben17]. In Filecoin, storage providers can earn rewards for providing capacity to users and users can use the network for long-term, encrypted storage. As the service being provided to users is a commodity (storage), the primary requirement for participating as a storage provider is capital, which is required to purchase hardware. Running a storage node can also require specialized datacenter operation skills. In contrast to proof generation, Filecoin does not require specialized algorithmic knowledge and significant reinvestment in hardware improvements. 3. Aleo. Aleo enabled a privacy-first blockchain by incentivizing validators and provers via a mixture of proof-of-stake and proof-of-succinct-work [ Wu23]. In Aleo, validators are responsible for proposing batches of transactions to the net- work, and provers solve coinbase puzzles, akin to proof-of-work mining and gen- erate ZK proofs to earn rewards. The puzzles incentivize provers to invest in hardware acceleration. However, Aleo provers do not face the problem of de- livering cost-effective proofs to end users. For this reason, provers can tolerate redundant work and contention caused by mining. 7 3 Proof Contests We now introduce the proof contest mechanism, which is an auction that allocates requests to provers in the network and allows them to earn fees by balancing the dual forces of cost effectiveness and decentralization. At any time, users have sent a set of outstanding proof requests {r1, . . . , rn} and a set of provers {p1, . . . , pm} are available to prove them. Each request rj comes attached with a fee fj, which is the amount the user pays for the proof request, a cycle count sj, which is a measure of the amount of work required to generate a proof of the request, and a deadline, which is the maximum amount of time the user is willing to wait for the request after assignment. Provers have private capacities for the maximum amount of cycles they can prove and private marginal costs per cycle cj. There are several criteria that any mechanism for allocating proof requests to provers should satisfy. 1. Eﬀiciency . The mechanism should match the highest value requests to the lowest cost provers to maximize the surplus and correspondingly quote the user low prices. Provers should compete to offer users preferential prices. 2. User experience. Users should experience transparent, competitive prices. Re- quests should be filled within user-specified deadlines with very high reliability. Requesting proofs should be simple. 3. Prover decentralization. The mechanism should incentivize a decentralized prover set and allow home provers to join. Applications may not be able to rely on a single, concentrated prover that comes to dominate the market due to economies of scale. 4. Spam proofs. Neither provers nor users should be incentivized to send spam proofs to the network to collect fees. The network should maximize the allocation of proving capacity and rewards to proof requests with real economic value. 5. Throughput. The mechanism should minimize contention on requests and max- imize assignment of requests to available capacity, and correspondingly maximize throughput. We first cover three candidate mechanisms and evaluate them on the above criteria. In Table 2, we compare these mechanisms with proof contests, which we describe shortly. Strawman mechanism: mining. As a first approach, we can consider a mech- anism commonly found in prior work on proof-of-work blockchains. In this approach, multiple provers may work on a proof request simultaneously and submit the resulting proof to earn rewards. One way of assigning rewards is to ask provers to submit proofs that satisfy a certain diﬀiculty level. This approach was pioneered by [ KB23] and Aleo [ Wu23] in the context of designing a consensus protocol;