Latest / TFTC: A Bitcoin Podcast / #648: Simplicity on Liquid with Andrew Poelstra

Transcript

#648: Simplicity on Liquid with Andrew Poelstra · TFTC: A Bitcoin Podcast

• 0:00
  You've had a dynamic where money has become freer than free.
• 0:10
  You talk about a Fed just gone nuts.
• 0:13
  All the central banks going nuts.
• 0:16
  So it's all acting like safe haven.
• 0:18
  I believe that in a world where central bankers are tripping over themselves to devalue their currency,
• 0:24
  Bitcoin wins.
• 0:25
  In the world of fiat currencies, Bitcoin is the victor.
• 0:28
  I mean, that's part of the bull case for Bitcoin.
• 0:31
  If you're not paying attention, you probably should be.
• 0:37
  Andrew Polstra, welcome back to the show, sir.
• 0:39
  It's great to have you.
• 0:40
  Hey, great to be back.
• 0:43
  Like I said, I want to say it again.
• 0:44
  Congrats on getting simplicity over the line.
• 0:48
  I know it's been a long, almost a decade journey for Blockstream.
• 0:52
  Yep. Yeah, for sure.
• 0:53
  We got it onto the test network less than a year ago.
• 0:57
  that was a big deal but this is our first production network with with real money on it
• 1:01
  that you can use simplicity now with real money which is a pretty cool thing yeah so i guess for
• 1:07
  anybody out there who's either newer to bitcoin unaware of simplicity why don't we give uh a
• 1:16
  background i was gonna say brief background but i like your verbosity verbosity and you have deep
• 1:22
  on it so i'm not gonna i'm not gonna um give any false promises to the audience we're about to get
• 1:28
  an in-depth uh history on simplicity it really starts in 2012 when russle o'connor sort of
• 1:35
  sketched the design and then you guys decided to really lean into it a block stream in like 2016
• 1:40
  correct yep yeah that's about right um i would even say it started a little before how about this
• 1:46
  i will try to be brief i always i always say i don't know why i'm probably saying it but i'll
• 1:51
  try to be brief so uh that's even before even before simplicity in 2012 there was uh russell
• 1:57
  o'connor had been in the bitcoin space he showed up very early days um 2010 i think maybe 2011 i
• 2:03
  think it was 2010 and he had this concept called mast merkelized abstract syntax trees and this
• 2:10
  eventually turned into what uh is now taproot where the idea is rather than having a script
• 2:16
  system where you've got like if this then that kind of thing everybody runs this everybody has
• 2:21
  to download this whole program and then run it and then they've got various conditions that that
• 2:26
  apply under different conditions but they've always got to download it right they've always
• 2:30
  got to see the whole script what if instead every time there was a conditional if this thing then
• 2:38
  that thing what if we put them all in a merkle tree and so now you can have um hundreds or
• 2:43
  thousands or millions of conditions and when you want to spend your coins at the time of spending
• 2:49
  you know which conditions you're going to use to spend the coin so you just reveal that specific
• 2:53
  one and the premise behind a merkle tree is is you can do exactly that it's this big structure
• 2:58
  where you can commit to arbitrarily large numbers of things like up to up to billions before you're
• 3:05
  you're spending too much compute time on it and then if you only want to reveal one of those
• 3:11
  billions of things you have an overhead you reveal the one thing and then you have an overhead of
• 3:16
  you know some some fixed cost maybe like a kilobyte or something versus having an overhead
• 3:22
  of revealing a billion different things which is what you'd have to do in the traditional
• 3:26
  model of script where the way you handle branches is by having a bunch of if then statements and
• 3:32
  everybody's got to download the whole thing so in taproot we have that we have what's called the
• 3:36
  Tap tree, you've got all these different scripts you can have if you want to do like a five of 10 multi-sig for some reason.
• 3:44
  One way you can do that is by taking all of the 10 choose five possibilities that you might have as a number of a couple thousand, put them all into their own little tap branch.
• 3:55
  And then whichever five participants you happen to have at the time of spending, you take the branch corresponding to those.
• 4:00
  so this is an idea from 2010 2011 again like the very early days that eventually made it into tap
• 4:09
  root much much later of course and simplicity kind of came out i promise it's relevant to simplicity
• 4:16
  so the premise behind simplicity is what if we took that idea and we we really went to the extreme
• 4:22
  with it so one big thing that simplicity has well first off simplicity is the way that it fits into
• 4:29
  Bitcoin or the way that it fits into liquid is as basically a drop-in replacement for Bitcoin
• 4:34
  script or the drop-in replacement for tap script as it is now. So you've got a tap tree, you've got
• 4:39
  all these different scripts, and rather than using the existing Bitcoin script system, you use
• 4:42
  simplicity instead. And within simplicity, you have these branches and these conditionals. So if
• 4:52
  this person is available to sign, then check his signature. Otherwise, check this other signature.
• 4:56
  or if the coin is old, like past a certain age,
• 5:00
  then allow these backup keys to be used
• 5:02
  or whatever conditionals you might want.
• 5:05
  Then, okay, you've got these conditionals,
• 5:07
  you reveal whichever side that you actually take.
• 5:09
  That's cool.
• 5:10
  There's some efficiency there.
• 5:12
  Simplicity goes one step further.
• 5:15
  And I says, well, conditionals are one way
• 5:20
  of composing two pieces of code or two programs, right?
• 5:24
  You've got some sort of flag, something that makes you decide what to do.
• 5:28
  And you've got these two things that you might do.
• 5:30
  And based on your flag, you pick one.
• 5:32
  And you can compose things in other ways.
• 5:36
  You could say, I've got these two programs.
• 5:38
  I want to run them both in a row.
• 5:39
  Bitcoin script is really good at this.
• 5:41
  It's what's called a concatenative language.
• 5:43
  You have a program.
• 5:44
  You run it.
• 5:45
  You just stick the other program right after and you run them.
• 5:47
  You run them in order.
• 5:49
  You might compose them by running both of your programs in parallel.
• 5:54
  like on the same input and then somehow you combine their output.
• 5:57
  So there's a couple other things you might do.
• 5:59
  And it turns out that you can start with two different programs.
• 6:06
  One of them does nothing.
• 6:08
  It takes an arbitrary input and throws it away.
• 6:10
  And the other does nothing.
• 6:11
  It takes the arbitrary input and just passes it along.
• 6:14
  And you take those two programs, arbitrarily many copies of them,
• 6:17
  and you compose them with each other and other compositions
• 6:21
  and you can build up any computation.
• 6:24
  This is something called the sequent calculus, if you're into computer science, like historical computer science even.
• 6:32
  It turns out you can build any computation just using these two basic functions and these combinators.
• 6:38
  And that's the premise behind simplicity, is that rather than having an opcode-based language where you have in Bitcoin script, you know, 70 or 80 opcodes, they all do different things.
• 6:51
  most of them uh the bulk of them just push things onto the stack but then there are others that can
• 6:57
  duplicate items there are others that can compare them to for uh to each other compare them to true
• 7:02
  or false uh do branches based on them uh and then there's a collection of five or six that do kind
• 7:08
  of cryptography right there's there's ones for four different kinds of hashes that are built into
• 7:14
  bitcoin script there's one that checks a signature there's one that checks a multi-signature and
• 7:21
  And Taproot is tweaked a little bit, but essentially it's checking a multi-signature.
• 7:25
  And then there are a couple variants of these.
• 7:29
  There are things for lock times.
• 7:31
  And that's pretty much it, right?
• 7:33
  But the whole premise is that you have these built-in, the small set of built-in, pretty complicated functionality that are all one opcode.
• 7:42
  And then you can combine these in various ways by pushing and pulling things from the stack of data that you can also kind of insert stuff on.
• 7:50
  And that's how you build programs.
• 7:53
  And there are a few problems with this model.
• 7:57
  One is, as I mentioned, if you're trying to do conditionals, if you're trying to do if statements, then you wind up having to write a whole ton of code.
• 8:06
  Well, you always have to write a whole bunch of code.
• 8:07
  As a validator, you wind up having to download a whole bunch of code.
• 8:10
  So even code that doesn't even get executed, you've got to download it because your whole program is in a straight line.
• 8:15
  then another problem is that it's actually very difficult to reason formally about these things
• 8:22
  so if you've got a bitcoin script that is supposed to implement some kind of crazy business logic and
• 8:29
  stuff you ideally want some high assurance that it's going to do what you expect to the extent
• 8:35
  that you can specify what you expect right um and and certainly you want some assurance that it's
• 8:40
  not going to do like certain surprising things right the money won't move unless somebody signs
• 8:45
  off on it. The script has certain behavior until a certain time at which backup conditions become
• 8:52
  active. So those kind of things. And it's very hard to do this with Bitcoin script because the
• 8:58
  way that you translate your specification, again, I'm glossing over, I'm using the word
• 9:06
  specification in the interest of brevity. I'm not going to say what a formal specification is,
• 9:11
  but it's a thing you can make that describes exactly what a program should do.
• 9:15
  And to the extent you have a specification, to turn that into code in Bitcoin script is just you really got to do a whole bunch of ad hoc.
• 9:22
  Like, well, if I were a Bitcoin script interpreter, how would I do this?
• 9:26
  Well, I'm going to push this onto the stack and push another thing and compare them.
• 9:29
  And then I'm going to interpret this one as a public key and this other one as a signature.
• 9:33
  And then I'm going to swap some things.
• 9:34
  And I'm going to take the output of that, which is an opaque blob.
• 9:36
  But I know it's going to be either zero or one.
• 9:39
  And I'm going to move that to the alternate stack.
• 9:40
  So it's out of the way.
• 9:41
  And then I'm going to do this.
• 9:42
  You know, you're kind of jumping through a whole bunch of contortions, each of which is manipulating this arbitrarily sized stack of arbitrarily sized elements.
• 9:53
  And you're using these opcodes, which do kind of complicated things to stack and which themselves are defined in terms of what does what happens in script slash interpreter dot CPP in the Bitcoin core source code.
• 10:09
  versus if you were constructing a program by starting with these two dead simple functions
• 10:16
  the output nothing and the output what you give a function the the unit and the identity function
• 10:20
  and then combining them in these various ways and in total by the way in simplicity you've got
• 10:27
  those two basic functions and seven additional combinators that's it that's a whole language
• 10:31
  nine nine combinators okay plus an extra one we add for witnesses and uh plus an extra one
• 10:38
  called disconnect maybe we'll get into it okay 11 11 if i'm stretching um plus blockchain
• 10:45
  introspection but we can also actually forget about this blockchain introspection is
• 10:49
  even though formally we have to extend the language to support like how do you get what
• 10:53
  the current lock time is how do you get the current amount amounts how do you get the current output
• 10:57
  amounts etc all of those are very simple right they're just op codes op codes combinators that
• 11:04
  take no input and output whatever they're supposed to do so okay 11 basic combinators all of which
• 11:09
  are defined by like a single line of mathematical notation i've got a t-shirt i don't have it with
• 11:16
  me it's in the laundry but um you can it's so small you can print it on a t-shirt so we have
• 11:20
  these t-shirts with the entire definition of simplicity language printed on it and importantly
• 11:26
  it's not just simple in a uh kind of mathematical notation sentence it's simple in a formal sense
• 11:34
  that can be captured by things like the rock theorem proving assistant or the lean proof
• 11:40
  assistant or a language like idris or f sharp which has a type system that is capable of
• 11:47
  supporting formal proof and the idea here is that now if you well there are two big ideas
• 11:54
  come out of this so as a user of the language if you can specify what your program is supposed to do
• 12:00
  And then you can take your simplicity code, which itself is formally specified because it's defined in terms of these combinators that are simple enough to be fit to these specification languages.
• 12:10
  And then you can prove, you can produce a formal proof that your code matches the specification.
• 12:17
  And perhaps you don't have a full specification, right?
• 12:20
  Which is, it's difficult to create.
• 12:22
  But maybe you can at least say some specific things.
• 12:24
  You can say, at worst, no matter how this program executes, how much space will it take on my transaction?
• 12:32
  You can answer that very cheaply.
• 12:34
  And now you can bound your fee rates.
• 12:36
  You can do fee estimation very accurately for arbitrarily complicated programs.
• 12:41
  You can say, well, I don't really know.
• 12:45
  I'm some countersigner, right?
• 12:46
  I'm Blockstream.
• 12:47
  I'm the Blockstream app.
• 12:48
  I'm BitGo.
• 12:49
  I'm whatever I am.
• 12:50
  I don't know or care what this code is supposed to do, except that it shouldn't run without my signature.
• 12:57
  Okay, it's whatever the customer says, plus my signature.
• 13:00
  How can I formally prove that there's no possible way to spend this code without my signature?
• 13:05
  Well, yes, you can prove something like that.
• 13:08
  So that's one big thing.
• 13:09
  And that's huge for users.
• 13:11
  And the other thing is from an implementation standpoint, it means that when we're implementing our simplicity code, we can be assured that it's correct.
• 13:19
  so and we can be assured not only that's correct and that it matches the specification which we
• 13:25
  have that's super cool but also it's correct and that it matches our intuition so in bitcoin script
• 13:30
  there are at least once it used to be more frequent but like at least once every year or two
• 13:36
  there's some new novel behavior in bitcoin scripts that somebody will discover that as near as we can
• 13:41
  tell nobody knew before where if you kind of poke an opcode in exactly the right way then it will do
• 13:47
  something surprising and let me give an example of this kind of thing um the if opcode in bitcoin
• 13:55
  script it takes an input which is supposed to be true or false and in bitcoin script you don't have
• 14:00
  true or false you have kind of blobs of data okay so you might think well probably false you might
• 14:05
  represent by zero and and true you might represent by one is a natural way when you've got blobs of
• 14:09
  data well it uh it turns out that false is represented by the empty string okay and also
• 14:19
  zero and in fact also any arbitrarily long string of zeros except that also the leftmost zero is
• 14:27
  allowed to be a one okay that that specific bit doesn't count okay and that's what false means
• 14:32
  um oh and it can be arbitrarily long up to the 520 byte stack limit okay there's there's
• 14:37
  only one other opcode that takes arbitrarily sized inputs like that.
• 14:42
  And it's ifdup, which is the same, and not if.
• 14:45
  Okay, so it's three.
• 14:46
  All these if opcodes for something to take arbitrarily long inputs,
• 14:48
  even though nothing else will accept arbitrarily long inputs.
• 14:53
  Okay, so those are all the false values and everything else is true.
• 14:56
  So that's a little bit surprising, right?
• 14:57
  It means that if you could construct a public key or a signature
• 15:01
  that happens to have this wonky shape of all zeros and then a one at the end,
• 15:06
  then you could create a signature that evaluates to false,
• 15:11
  even though every real signature that somebody produces
• 15:14
  would evaluate to true.
• 15:16
  And it turns out that you can produce an ECDSA signature this way because there encoding rules that just force you to set other things to one You can produce a Schnorr signature this way that will parse as a Schnorr signature but it won validate because when we added Schnorr signatures to Bitcoin we designed them such that you cannot produce an arbitrary signature and then back compute what your keys and your message have to be
• 15:43
  In ECDSA, you can do that with something called public recovery, it turns out.
• 15:46
  So you can do like arbitrarily badly formed signatures.
• 15:49
  So I go into all those details to just kind of describe how insane Bitcoin script is because it was implemented the way it was.
• 15:56
  Just like kind of we need some extra functionality that's bolted on.
• 16:00
  And then there's kind of these like weird accidents of how certain opcodes interpret their input and they interact in crazy ways.
• 16:09
  And this is part of why it's so hard to get new things in the Bitcoin script, right?
• 16:14
  is that you can propose something like opcat,
• 16:17
  which is three lines of code.
• 16:18
  It's dead simple.
• 16:19
  But how do you know how it fits into the system?
• 16:21
  How do you know all of the behavior?
• 16:22
  It takes so long and so much mental energy
• 16:25
  to convince yourself that the simple-looking function
• 16:29
  is not going to do surprising things.
• 16:31
  And simplicity, by being the simple,
• 16:34
  formally specified model,
• 16:35
  saves you all of that effort.
• 16:37
  So I'll stop.
• 16:38
  so just building out not only comparing it to bitcoin script as it stands today but like i
• 16:47
  guess i i think many bitcoin developers would look at something like how ethereum's implemented
• 16:54
  script and it's it's created these sort of attack vectors that have been exploited
• 16:58
  over time and what i'm picking up from what you just described within bitcoin specifically like
• 17:05
  op codes or sort of this like modular way of doing it and i don't know if the intent of the
• 17:11
  design was like let's do this modularly so you can have something out of the box but as you
• 17:15
  described when you do that it's sort of clunky and you create um a burden for somebody trying
• 17:21
  to build so it's very hard to audit and know exactly what it's going to do and so simplicity
• 17:26
  just tries to be expressive yet finite um without having to have all that like complexity built in
• 17:34
  Is that correct?
• 17:36
  Yeah, exactly.
• 17:37
  And expressive yet finite.
• 17:39
  That's a good way to put it.
• 17:41
  So yeah, EVM took Bitcoin script and just bolted on everything we want to be able to do.
• 17:45
  Just bolted on to Bitcoin script, more or less, is roughly how EVM is structured.
• 17:50
  And then they realized that the Bitcoin stack language is not a good model for that.
• 17:55
  So they have what they call rich statefulness.
• 17:57
  We've got these series of global database lookups.
• 18:00
  So every contract has a bunch of code.
• 18:03
  It has variables.
• 18:03
  It can save and update and all this good stuff.
• 18:06
  But it is very difficult to reason about.
• 18:12
  They kind of inherited the difficulty in reasoning about Bitcoin script and in some ways made it much more complicated.
• 18:18
  They also did some kind of unnecessary, like in addition to extending it computationally, they also added this rich statefulness notion where you have these global key value lookups and everything becomes very stateful, which is hard to reason about.
• 18:31
  But then the big thing is this word finite.
• 18:33
  that you mentioned. So Ethereum for a while advertised itself as being Turing complete.
• 18:39
  And the idea behind that phrase is that a Turing complete language can do anything at all.
• 18:44
  A non-Turing complete language is kind of narrow and domain focused is the intuition, right? So as
• 18:51
  an example, right, a programming language like JavaScript or like Python is Turing complete.
• 18:57
  You can write anything that you can express, you can write in those languages.
• 19:00
  a language like html is not html can only uh produce uh draw web pages basically um some things
• 19:10
  would surprise you to learn that they're actually turing complete so css which is used to format
• 19:15
  web pages to set the colors and the widths and the styles and stuff it turns out css is turing
• 19:19
  complete because they're like conditional stylings that you can put in and the loops and stuff
• 19:23
  uh postscript which is a document formatting language that predates pdf is turing complete
• 19:28
  and I've exploited that to do some paper computer kind of projects.
• 19:34
  There's a whole pile of languages that really shouldn't be Turing complete,
• 19:38
  but accidentally are.
• 19:40
  And Ethereum more or less is on purpose.
• 19:44
  But there's a small caveat there.
• 19:46
  Strictly speaking, to be a Turing complete language,
• 19:49
  you need to have an infinite amount of memory
• 19:53
  and an unbounded amount of memory and an unbounded runtime.
• 19:57
  And in real life, of course, you're always bounded by, for one thing, by the constraints of your machine.
• 20:02
  And then on Ethereum, you're bounded by this quantity of gas.
• 20:06
  So you write an Ethereum transaction.
• 20:10
  You decide how long you expect the transaction's contract code to run for.
• 20:16
  And then you set a gas budget based on that, which is just actual Ether that you have to put up and you pay.
• 20:20
  and where ethereum runs into trouble or one one place where ethereum runs into trouble
• 20:27
  is that when you're trying to estimate how much gas your program's going to take you can't
• 20:34
  do that in general and so there's these whole uh kind of categories of smart contract bugs
• 20:40
  where it turns out that in order to call certain functions in a contract you have to use more gas
• 20:46
  and is available, which means that you effectively cannot call those.
• 20:50
  So there's functionality that you built into your script,
• 20:52
  but it turns out it's not accessible because of this external gas limitation.
• 20:57
  And that's kind of a problem for users.
• 21:00
  It turns out it's also a problem for validators
• 21:02
  because the way that you determine whether or not a script is valid,
• 21:09
  whether or not it's used, all of the gas that it's been allocated,
• 21:12
  is by running it.
• 21:13
  You start running the script.
• 21:14
  You figure out, did it run out of gas?
• 21:17
  If it did, then you got to stop.
• 21:20
  And you might think, okay, if you're a validator, you receive a transaction, it runs out of gas, it's invalid, so you throw it away, right?
• 21:27
  Well, you can't do that.
• 21:27
  That's a denial of service vector.
• 21:29
  You already did all the work to do that.
• 21:31
  So if somebody could just give you a program that ran for a minute and then failed, well, then you'd be churning away for a minute, right?
• 21:38
  And maybe you limit yourself per transaction, whatever.
• 21:40
  A bad guy gives you a million transactions that all take a microsecond.
• 21:44
  And now you still wasted a second.
• 21:46
  So in Ethereum, what happens is when you run out of gas, the transaction is still valid.
• 21:51
  You still pass it along.
• 21:53
  It winds up in the blockchain, but it doesn't do anything.
• 21:55
  It just burns your gas.
• 21:56
  And so there's this other category of kind of Ethereum failure modes where there are these transactions that wind up on the chain that don't do anything.
• 22:03
  They just burn gas and do nothing else.
• 22:05
  And these are almost certainly accidental because there's no reason for you to just burn gas the way that I'm describing.
• 22:14
  And the way that Bitcoin avoids this problem,
• 22:17
  in Bitcoin, if a transaction is invalid, it's invalid.
• 22:19
  It doesn't go on the chain.
• 22:21
  Is that in Bitcoin, there's kind of a neat trick we use,
• 22:25
  which is that every opcode takes one byte to encode.
• 22:29
  So Bitcoin script has no loops.
• 22:30
  So every opcode can be executed at most once.
• 22:33
  You can't go back and then redo stuff.
• 22:35
  Which means that if you see a byte,
• 22:36
  you know the absolute worst case,
• 22:39
  that byte represents a single opcode of work.
• 22:42
  And so you take the whole size of your transaction and you use that to swag how expensive that transaction will be.
• 22:49
  And then you look at the transaction's fee and you compute what's called the fee rate, which is how much did they pay per byte, or I should say per weight of the transaction because certain bytes count more than others.
• 23:00
  And that avoids this denial of service problem, basically.
• 23:03
  So you don't have a gas limit.
• 23:05
  What you have is the size of your transaction represents how much work it is.
• 23:08
  And then your fee, you just attach whatever fee is appropriate for that.
• 23:11
  And then miners and validators kind of order things,
• 23:14
  which has the highest fee per weight kind of thing.
• 23:17
  This is cool.
• 23:18
  This is pretty cool.
• 23:19
  But there's an obvious question then,
• 23:22
  well, what if we want to,
• 23:23
  surely we want to put loops
• 23:25
  and go to some way of doing this kind of stuff
• 23:27
  into Bitcoin, right?
• 23:28
  Are we just forbidden from ever having a way
• 23:30
  to execute an opcode more than once?
• 23:32
  Because then it would break this,
• 23:34
  how much the size of the transaction
• 23:37
  representing the computational cost kind of model.
• 23:39
  um and in ethereum the solution was gas they're like okay we're just going to have to throw away
• 23:46
  the size size represents computation model and we're going to have to do this this unfortunate
• 23:49
  thing in simplicity we have a much cooler solution which is that you can as a validator
• 24:00
  you can scan through the program one byte at a time technically one bit at a time and you can
• 24:06
  determine the maximum execution cost how much cpu is this going to use how much memory is it going
• 24:12
  to use statically just like a single pass through the program and the program this is kind of cool
• 24:18
  you can have a sub program or an op code however you want it to think of it that runs exponentially
• 24:25
  often so you encode this bit of your program once and when you actually run the script it gets
• 24:30
  evaluated you know like a trillion times you can totally do that in simplicity and your validators
• 24:36
  will scan through the program they see your little bit they evaluate it once they say oh
• 24:41
  that cost a trillion because it gets executed a trillion times and moves on and then eventually
• 24:45
  it was you know the validator will say you know what a trillion is a lot you can't you can't fit
• 24:48
  a trillion opcodes into into a single block kind of thing um but importantly even though you have
• 24:55
  this kind of arbitrary blow up between the size of your program and the actual cost,
• 25:02
  you still only have to scan the small one.
• 25:04
  You have to scan the bytes of the program to figure out what that cost is.
• 25:08
  And we call it a static analysis.
• 25:09
  We call it a static bound.
• 25:11
  And what that means is that we retain the Bitcoin ability for a validator to just look
• 25:15
  at the transaction and immediately compute what the fee rate is and whether it should
• 25:19
  be prioritized or whether it's never going to get into a block and we should just drop
• 25:23
  it without ever having to execute the code.
• 25:25
  And we do that while still getting this arbitrary amount of execution.
• 25:33
  And the reason this is possible is because what you're encoding in your program is actually a composition of all of these basic kind of building blocks of computer science, none of which are a loop, importantly.
• 25:50
  None of which are a loop and none of which are a go-to, but it turns out you can still get arbitrary.
• 25:55
  arbitrary computations this way and for each of those combinators as a validator you can say like
• 26:02
  well okay if this is a parallel composition i'm running two things in parallel the cpu cost is
• 26:07
  going to be you know the left guy plus the right guy the memory cost will be the maximum of either
• 26:12
  one of them that can you kind of do that kind of analysis over and over now people who are
• 26:20
  CS nerds or maybe just listening to me far too closely might be kind of suspicious about my claim
• 26:27
  that you can do loops, that you can do an arbitrary computation in simplicity,
• 26:34
  and that you don't have a looping construct or a go-to construct. And I'll briefly say something
• 26:40
  about that, which is that there's actually another form of composition, which is not
• 26:45
  sequential or conditional or parallel or these kind of basic things called recursive composition.
• 26:52
  And that's where you have a function that's able to call itself and basically do a loop, right?
• 26:56
  Go back.
• 26:57
  So simplicity does support this through this extra combinator we call disconnect.
• 27:02
  But it supports it in kind of a clever way where in principle, you can put an arbitrary
• 27:10
  number of loops into your program at the time that you define it, at the time that you
• 27:15
  construct your address that represents your program code. But when you actually go to spend it,
• 27:21
  you are required to unroll the loop however many times you actually execute it. So Disconnect
• 27:26
  Commender allows you to attach arbitrarily many copies of code, but you have to attach them as
• 27:32
  spending time. And then if they are actual literal copies, one after the other, you don't have to
• 27:37
  write the same code 20 times in a row. The encoding of simplicity will collapse it into a
• 27:43
  single copy but the static bound they're still able to see that it's executed 20 times and assign
• 27:48
  at a cost of 20 so in the end what hits the blockchain is in fact finite is in fact built up
• 27:55
  what hits the blockchain essentially does not have this recursive um uh way of combining of composing
• 28:03
  computations in the end when you put it on the chain you have to enroll it and then it's just
• 28:08
  regular old composition where you're running one thing after the other so you kind of get the best
• 28:13
  of both worlds where at commitment time when you're writing your program and generating addresses
• 28:19
  then you can do arbitrary unbounded computations but if you want to spend it on the blockchain
• 28:26
  you have to do the computation and it has to terminate and you have to bound how much that
• 28:31
  how long that computation took in order to put it on the chain otherwise you can't even code the
• 28:36
  results like it's just like a nonsensical transaction so it's a user transaction creator
• 28:40
  get this full expressivity,
• 28:42
  but validators don't have to deal
• 28:44
  with that expressivity,
• 28:45
  which they don't need, right?
• 28:48
  Like a validator knows
• 28:49
  if your transaction is going untamed,
• 28:52
  your program has to succeed, right?
• 28:53
  It has to be valid, right?
• 28:54
  That's like the one thing.
• 28:56
  Validators' job is not to like
• 28:57
  run the computation
• 28:58
  and see what happens, right?
• 28:59
  Their job is to validate
• 29:00
  that you did the computation
• 29:02
  and the right thing happened, right?
• 29:03
  And as cheaply,
• 29:05
  they want to do that as cheaply
• 29:06
  and as predictably as possible.
• 29:08
  So...
• 29:10
  Yeah, so in short, you're basically just guaranteeing expressiveness with formal safety guarantees that don't exist elsewhere and seems like has been a big problem needed to be solved for these particular types of systems.
• 29:28
  Yeah, absolutely. Thank you for zooming out so much. That's exactly it, right?
• 29:32
  all of these elaborate constructions i'm describing have that goal of how do we have something that
• 29:38
  you can formally reason about where when you're when you're implementing the system you want to
• 29:44
  know that it's doing something predictable that's not going to blow up people's computers or crash
• 29:47
  when you're writing code you want to know that your code that you're writing does what you expect
• 29:52
  it to and when you're running a full node when you're validating this stuff you want to know
• 29:57
  that very quickly you can figure out the cost of this validation and you can charge the transaction
• 30:02
  appropriately and with simplicity we've managed to do this in a model where we get the full
• 30:07
  expressivity of something like evm or or chialisp or any of these languages that are out there that
• 30:13
  you do arbitrary computations while preserving these goals yeah and i think this has been a big
• 30:21
  a big theme in bitcoin for the better part of eight years now or nine ten years since
• 30:31
  Ethereum launch specifically, which is like Bitcoin is an extremely important project.
• 30:36
  We're trying to separate money in states.
• 30:39
  And at this point it a two point two two point three trillion dollar market and is incredibly important that we make sure that the system doesn fail And so with that in mind we have to make sure we build things correctly so that protocol the network can stay sufficiently distributed and it actually achieves the goals it set out to
• 31:02
  And during that period, you had Ethereum, other smart contracting networks come to the market and say, look at us.
• 31:09
  We're doing it better.
• 31:10
  We're faster.
• 31:11
  We have more features than Bitcoin.
• 31:13
  And all the while, Bitcoiners, myself included, and I truly do believe this, it seems like it's beginning to manifest,
• 31:20
  have been saying it will eventually come to Bitcoin.
• 31:21
  We're just going to do it the right way.
• 31:23
  And it seems like that's what you guys have been working on in Simplicity for a decade is doing it the right way.
• 31:28
  Yeah.
• 31:28
  Yeah.
• 31:29
  Everything.
• 31:29
  everything ethereum added everything these other chains added right comes with some trade-offs
• 31:34
  and some of those are more reasonable than others right so a lot of these things have much faster
• 31:40
  blocks than bitcoin and i think if bitcoin had been developed if in 2008 somehow satoshi had
• 31:46
  compact blocks and mini sketch and all of this like peer-to-peer propagation tech that we have
• 31:52
  today probably we would have faster blocks right there's certainly a trade-off between fast blocks
• 31:56
  and decentralization.
• 31:58
  And it's not inherently obvious that the 10-minute block
• 32:03
  was the perfect optimal thing.
• 32:05
  But then there are other things that are just clearly
• 32:07
  very, very bad trade-offs, right?
• 32:09
  And Ethereum introducing this super expressive language
• 32:14
  with the trade-offs they made where validators have,
• 32:18
  where you have to be able to put invalid transactions
• 32:20
  into the chain because validators can't determine
• 32:22
  whether or not it's valid without executing
• 32:24
  an arbitrarily long piece of code.
• 32:25
  and where once a transaction is once they've even validated a transaction they can't know that it
• 32:32
  will stay valid until it's in a block because in ethereum it's possible to reorder transactions in
• 32:36
  ways that made previously valid transactions become valid there's another reason that that
• 32:40
  um that you have to just put bad transactions into blocks is because um you need you have to
• 32:47
  charge the person who created the transaction and even if it appears while the transaction is on the
• 32:52
  peer-to-peer network that it was legit. Maybe it turns out not to be legit because things changed.
• 32:59
  That's a terrible trade-off, right? We would never have accepted an extension to Bitcoin that
• 33:03
  added some sort of looping facility with these kind of problems. We would never have accepted
• 33:07
  an extension to Bitcoin that allowed you to introspect a transaction in a way where if the
• 33:12
  transaction appeared in a block in a different order or was reorgged back a block or two,
• 33:18
  then it would suddenly become invalid and invalidate all the work that people did to
• 33:22
  cash the transaction validity um we would never accept any change to bitcoin that changed what we
• 33:28
  call monotonicity once the transaction is valid it stays valid forever with one exception of it
• 33:34
  might get double spent and then the double spend might might wind up in the chain um but that
• 33:39
  doesn't require rechecking the scripts or anything that just requires knowing which inputs it spends
• 33:42
  and keeping an eye on them.
• 33:45
  Those are terribly, obviously terrible trade-offs.
• 33:48
  We would never accept an extension to Bitcoin
• 33:52
  that had rich statefulness,
• 33:53
  that had a global key value store of all this contract code
• 33:57
  so that anybody could call an arbitrary piece of contract
• 34:00
  and then call an arbitrary function in that.
• 34:03
  And that function itself had this map that you can update
• 34:05
  so that validating a single Bitcoin transaction
• 34:08
  requires an unpredictably deep dive
• 34:10
  into this massive terabyte-sized database that you've got to go through.
• 34:16
  And so running a full archival node on Ethereum,
• 34:21
  well, Jameson Lopp, I think, did some work trying to do this
• 34:24
  five or six years ago, and it was, I don't know that he succeeded.
• 34:29
  This is definitely worth looking up, and things have gotten even worse since then.
• 34:33
  That led to a situation where nobody is running a full Ethereum node,
• 34:37
  And where there's a culture of if your node kind of like gets bumped off of the network because you, you know, failed to validate something and then somehow you just got off the train, then you've got to just like restart your node and kind of trust the state that's coming into you and then carry on from there kind of thing.
• 34:52
  So those kind of things I would say are obviously bad tradeoffs that like Bitcoin would never accept, right?
• 35:00
  And as a historical thing, it's kind of interesting to me that Ethereum took so many of those choices, right?
• 35:07
  Not just like, could we have faster blocks?
• 35:09
  Could we have bigger blocks?
• 35:10
  What if we used PubQ recovery in certain places?
• 35:14
  What if we structured our transactions?
• 35:16
  Even what if we had accounts versus UTXOs?
• 35:19
  I think you can make arguments for both.
• 35:21
  I think they were clearly wrong about that,
• 35:23
  but it's just a much more subtle thing.
• 35:25
  But the rich statefulness and the loops
• 35:27
  and the inability to cash transaction validity
• 35:29
  is either just fundamentally complete non-starters for Bitcoin.
• 35:35
  right and that's that's a big part but but without them it's so hard to do anything right which is
• 35:40
  why here we are in in 2025 um debating opcat and also debating what kind of crazy programs can you
• 35:48
  build just as a concatenation opcode and by like abusing it to like fold back in on itself and like
• 35:53
  run through the signature it's like it's crazy the kind of hacks that we have when um kind of to
• 36:00
  somebody looking from the outside they'd be like guys this is crazy just put some freaking arithmetic
• 36:03
  into your blockchain so people can do math already and do some computations and then
• 36:07
  move on with your lives right um it's hard it turns out it's hard to preserve scalability and
• 36:13
  decentralization um it's hard to preserve the properties that bitcoin has that make it scalable
• 36:19
  and decentralized while getting this extra expressivity yeah and you said the word scalable
• 36:25
  there so this is obviously uh gone live on liquid's mainnet which is a federated side chain
• 36:32
  blockchain has been running for almost a decade now too and let's jump into that like the really
• 36:39
  exciting stuff which is like the use cases that is this unlocks whether it's covenants and vaults
• 36:45
  uh on-chain financial primitives programmable delegation like there's seems to be in endless
• 36:54
  amount of potential applications that can be built on simplicity so let's jump in why liquid
• 37:00
  how does it work on liquid specifically compared to how it could potentially work on bitcoin at the
• 37:06
  protocol level if it ever does in the future maybe we can talk about if that's even a good idea
• 37:12
  um and what do you expect to see get built sure so uh so liquid for people who don't know this
• 37:19
  is a side chain that was developed by blockstream and that has been running yeah since since 2018
• 37:24
  october 2018 was was our launch date uh liquid is what's called a federated side chain
• 37:30
  They're a set of 15 mutually distrusting parties spread across the globe who together, every minute, 11 of those 15 come together to sign a new liquid block.
• 37:42
  And so liquid is a sidechain.
• 37:45
  So in addition to being this kind of blockchain that has this federated signing model, it's a sidechain, meaning that it's possible to move Bitcoin from the Bitcoin network onto liquid and move it back.
• 37:55
  And the mechanism by which you do that is a little disappointing, I would say, which is that you literally transfer the Bitcoin into custody of the 15-member federation.
• 38:07
  And then any 11 of those are responsible for moving the money back when you request it on the Liquid blockchain.
• 38:12
  So that's how the pay-in and pay-out mechanism work there.
• 38:15
  And the Liquid has also made a couple trade-offs that are no-goes for Bitcoin, for sure.
• 38:24
  So one is a federated model, right?
• 38:25
  That's just completely alien to the Bitcoin proof of work based security model.
• 38:31
  And everybody has, well, everything comes down to proof of work ultimately in Bitcoin, as well as not your keys, not your coins, right?
• 38:40
  So even if like miners all shut down, if you just held on to your UTXOs that you couldn't spend, even if you didn't want to, nobody else can take them, right?
• 38:47
  Which is kind of nice.
• 38:50
  So that's one.
• 38:51
  So another trade-off that Liquid made that Bitcoin never would is that it has multiple assets that are native on the chain. And the reason Liquid can do that is because Liquid has block signers who are not being paid in kind. So Bitcoin, by using miners that are paid by new Bitcoins, needs, in order to function, in order to have the long-term economic properties that it has, Bitcoin needs to be the asset on the Bitcoin blockchain.
• 39:16
  You can't have economic activity that's happening in other assets, at least not to a significant degree that would rival Bitcoin, because then your minor incentives suddenly are not aligned with always extending the longest chain.
• 39:29
  Liquid doesn't have that problem because it has block centers.
• 39:32
  Liquid, by virtue of being smaller and by virtue of being developed by a block chain, is something that we can do cool crypto experiments on much faster than we can on Bitcoin.
• 39:44
  And here's really, you said, why Liquid?
• 39:46
  Why Liquid?
• 39:47
  We know Liquid and we can do stuff fast on Liquid.
• 39:50
  So Liquid historically has been kind of a demo for many things that wound up on Bitcoin eventually.
• 39:59
  So Liquid, or I should say the precursor to Liquid, what we called Elements Alpha, had SegWit before Bitcoin had SegWit.
• 40:05
  And actually it turned out, the fun history there, that the version of SegWit in Elements was terrible.
• 40:10
  It would have been a hard forking change.
• 40:11
  It had all these bad properties and stuff.
• 40:13
  And then Luke Dasher looked at this and he said, wait, we could tweak this.
• 40:16
  And then it's a soft fork and then we could do this way better thing.
• 40:19
  And then James and Lopp and Sipa and all these people kind of pulled together and produced SegWit on Bitcoin, which we all know and love.
• 40:28
  And then we pulled it back into Liquid.
• 40:29
  Yeah, that one's way better than ours.
• 40:31
  So that was a cool back and forth.
• 40:33
  Liquid also had check sequence verify, which is how you do lock time checks and script before Bitcoin did.
• 40:41
  liquid has what's called confidential transactions which are a way of hiding the amounts and the asset
• 40:47
  types of all of your inputs and outputs in a transaction which gets you a pretty big part of
• 40:54
  the kind of privacy that monero or or zcash have without the the worst of the scalability trade-offs
• 41:02
  and there there's there's an uncomfortable privacy uh scalability trade-off that liquid
• 41:07
  show the different place that that wound up being pulled into monero for example um and uh and so now
• 41:14
  we're working on simplicity right and so we took simplicity the nine or eleven if you want
• 41:21
  combinators that uh that define the language we added a few extra bolt-on facilities for
• 41:27
  introspecting liquid transactions which uh atsy would be much harder than doing the same thing
• 41:31
  on Bitcoin. And then we deployed it there as a tap leaf version. So Liquid has taproot.
• 41:39
  Frustratingly, Bitcoin got taproot before Liquid did. And we were like, internally,
• 41:42
  everything's harder on Liquid because we have multiple assets and we have constant
• 41:46
  transactions and stuff. But that one, we were like, internally, it was a race in our hearts.
• 41:51
  In my heart, it was a race and we lost. But okay, we have taproot on Liquid now.
• 41:56
  So within a taproot output on Liquid, you can choose for every script, you choose either to use scripts or to use simplicity.
• 42:07
  And there you go.
• 42:09
  That's how it fits in.
• 42:11
  And the tradeoffs that we make before I jump into use cases, right?
• 42:15
  So why do we do that on Liquid and why couldn't we just turn around and do it on Bitcoin?
• 42:20
  Well, simplicity is an entire replacement for the script interpreter, right?
• 42:24
  It's this giant blob of C code, which is several thousand lines at least.
• 42:31
  It has some cool, complicated things where it identifies programs by these Merkle roots.
• 42:38
  It builds this abstract tree of how your program is constructed and combined at a smaller thing.
• 42:43
  It computes these Merkle roots.
• 42:44
  It has a type system and a type inference system.
• 42:48
  It has this notion of sharing that allows you to collapse repeated pieces of code into one.
• 42:54
  And it has these new consensus rules related to how sharing has to be enforced to ensure that certain kinds of transaction malleability are eliminated and certain kinds of denial of service vectors are eliminated.
• 43:06
  And the whole thing is just a very new – there's a lot of code that's like a really core piece of consensus.
• 43:13
  And it's a new model and it's a scary thing.
• 43:16
  And we wouldn't even – we'd be laughed out of the room if we even proposed that for Bitcoin without having some real-world usage kind of thing.
• 43:23
  whereas on liquid we can just kind of do it right um we got to get we got to get approval from the
• 43:30
  15 functionaries they all all these participants think that's a pretty cool thing um liquid well
• 43:37
  we have very high assurance that simplicity is correct and it's not going to like lose money
• 43:41
  and it's not going to crash the system or something um certainly nobody is at risk from simplicity who
• 43:46
  isn't directly using it right which is nice that would also be true on bitcoin but uh but on bitcoin
• 43:51
  there's always this worry that like what if it turns out that you can like crash nodes with it
• 43:55
  or something and liquid just by nature of it's federated like that is not i really like it's not
• 44:04
  going to happen it's like not i'm not suggesting that we would deploy something where it's possible
• 44:08
  but if it did we would pick up the piece of the move on and on liquid we can kind of do that
• 44:13
  because it's a federated system um and because ultimately all the coins are are uh backed by
• 44:19
  bitcoins and and real bitcoins that are not moving on the bitcoin chain and stuff in a way that
• 44:24
  bitcoin just can't right you you can't you can never never risk bitcoin doing that so um so we
• 44:31
  launched it on liquid and in our kind of long-term vision of getting simplicity into into bitcoin
• 44:39
  into real bitcoin users hands and like um getting out into the real world outside of liquid um
• 44:46
  So this is a place, it's deployed on a blockchain.
• 44:49
  This got some kind of neat asset features, which are useful for demonstrating simplicity.
• 44:54
  And we can start to learn how simplicity behaves on the blockchain.
• 44:59
  So as you hinted at, simplicity includes covenant support.
• 45:04
  It includes the ability to look at transactions and make decisions based on the shape of your transactions.
• 45:09
  So that's pretty cool.
• 45:09
  So that gives you vaults.
• 45:11
  That gives you kind of rate limiting kind of stuff.
• 45:14
  Those are kind of the big ones.
• 45:16
  it gives you um jeremy rubin has a construction i forget the name where where um if you're an
• 45:22
  exchange you can process like a thousand withdrawals in one output and then each person takes their
• 45:27
  part and puts the rest back into the output so the recipient pays for fee in this model uh which
• 45:32
  which um greatly improves the incentives around exchange withdrawals and setting network fees
• 45:39
  you can do all those kind of classic constructions on bitcoin but then because simplicity allows you
• 45:45
  to do arbitrary computations,
• 45:47
  there's a whole bunch of cool new stuff that you can do.
• 45:50
  So you could write a zero-knowledge proof verifier in simplicity.
• 45:54
  You could write a quantum hard signature scheme in simplicity.
• 45:58
  You could write a kind of like code that checks arbitrary cryptographic instructions arbitrary Merkle routes these kind of things you can write kind of like weighted threshold constructions
• 46:13
  where you say if um this is going to be a two of three multi-sig except if the fee rate is super
• 46:21
  low then it needs to be three of three say because like then like you know you need all
• 46:27
  everybody has to agree to do something that kind of screwy right you can like do constructions like
• 46:30
  that you can do delegation you can do rebindable signatures um so uh in bitcoin we talk about
• 46:38
  sig hash any prep out as like this extension that would allow lightning to be implemented with
• 46:42
  with backups that aren't growing linearly right uh in simplicity you can just implement sig hash
• 46:47
  any prep out you can implement whatever sig hash mode that you want um you can implement sig hashes
• 46:53
  where you sign the output of an arbitrary computation on your transaction which sounds
• 46:58
  like just crazy cs you know wankery but but there's there's real applications here where
• 47:02
  for example um i could sign i could have a two of two with my child where i sign the transaction
• 47:12
  such that his signature is only valid if the output stays like within a certain range within
• 47:18
  a certain fee rate uh only going to a certain destination you know i can kind of sign the
• 47:22
  high level parameters um of the transaction and he can he can fill in the rest and sign the rest of
• 47:27
  that kind of thing. And I don't have to choose that upfront, right?
• 47:31
  In my script code, what I say basically is if Andrew's key,
• 47:35
  it's signed some conditions and the kid's key needs to,
• 47:40
  needs to follow, needs to sign the whole transaction,
• 47:43
  following those conditions, right? End of story.
• 47:45
  And you can imagine like less personal, right?
• 47:49
  Kind of corporate settings where you have business policy that you want to
• 47:52
  enforce in this way, where you've got some sort of hierarchy of,
• 47:56
  of trust and hierarchy of business logic and you uh you can implement that directly in simplicity
• 48:04
  and like kind of no matter how arbitrarily complicated what you're describing is
• 48:09
  if you can specify it you can prove that your program meets the specification
• 48:13
  um one more example is you can create a signature where you sign that your fee rate has to be a
• 48:21
  certain amount but then based on how old your output is the allowable fee rate goes up so if
• 48:29
  you write a transaction it doesn't confirm rather than you having to resign it um you can just say
• 48:35
  or anybody can just kind of edit the transaction maybe the second party was a weak key who has to
• 48:38
  resign it which you probably want um you don't have to go get your keys out of cold storage to
• 48:43
  resign it with a higher fee rate just by dint of being old enough and having not confirmed to spend
• 48:49
  the new higher fee rate becomes valid with your original signature.
• 48:52
  And you can define these kind of ramping up signatures kind of stuff.
• 48:56
  So there's a whole pile of stuff that really nobody is talking about on Bitcoin
• 49:02
  because you really need this total arbitrary computational ability
• 49:07
  to do these kind of things on Bitcoin.
• 49:08
  And even with something like Rusty's Great Strip Restoration Project,
• 49:13
  some of these are too out there to describe,
• 49:16
  like having these exponential ramp-up curves of allowable fee rates
• 49:20
  or trying to do like zero-knowledge proofs or giant Merkle tree reductions
• 49:25
  or all this kind of crazy stuff.
• 49:31
  Yeah, it's fascinating.
• 49:32
  And you guys have built what seems to be, from the outside looking at it,
• 49:36
  I haven't played around with it, but like a sort of a UI front-end with simplicity HL.
• 49:41
  so is is this sort of just trying to abstract everything and make it
• 49:46
  uh easy for people to interact with simplicity and without having to get deep into the weeds
• 49:52
  yeah for sure so simplicity itself um it sounds so wonderful it sounds so simple when i say it in
• 50:01
  these high level oh you just compose these things um every time somebody new at blockstream tries
• 50:07
  to write Simplicity.
• 50:09
  They get so upset by how difficult it is
• 50:11
  to wrap your head around this programming model
• 50:13
  and how difficult it is to construct these programs
• 50:16
  that they turn around and write their own programming language
• 50:19
  that compiles down to Simplicity.
• 50:20
  It's kind of funny.
• 50:21
  This happened three times in a row.
• 50:24
  And the latest iteration, which we're letting the public use,
• 50:28
  that we really want to be out there and usable,
• 50:30
  is Simplicity HL, as you said.
• 50:31
  So while simplicity is a very low level, like, you know, contort your computation into this composition of identities and units kind of construction, simplicity HL looks and feels like the Rust programming language.
• 50:46
  you can tell as you're writing it that like secretly you're doing some sort of functional
• 50:52
  construction thing but it looks like you do like do this then that if this then do this
• 50:57
  do this you know the loop this many loop over this you know at most this many times kind of thing
• 51:04
  and that that at most restriction is because these programs are finite we would like to remove that
• 51:09
  using the disconnect off code but there's there's more work to be done behind the scenes there
• 51:13
  um so simplicity so you can go to simplicity-lang.org is where our our sandbox and documentation
• 51:21
  sandbox our play uh playground that's the word uh we've got like a web interface you can write
• 51:26
  the simplicity hl code and compile it to simplicity see what it looks like and so on
• 51:30
  and simplicity hl we expect will be the way that people interact with simplicity programs
• 51:37
  until somebody makes a better language than simplicity hl that can also compiles down to it
• 51:42
  um so yeah so directly interacting with with simplicity that's that's for compilers and for
• 51:48
  proof assistance right so it's really not for humans because it's such a solo level and such a
• 51:54
  strange way to think about computation so simplicity hl is out there it works we've got a compiler you
• 52:00
  can use it uh there's a lot of stuff still to do um so one of the first things people come to us
• 52:06
  and they're like well i want to use libraries and i want to like call to these other functions and
• 52:09
  have modules and stuff well we don't have a module system and we don't have libraries yet like you
• 52:14
  just got to kind of write all your code and you can break it into functions but it's all just like
• 52:17
  one giant file with all your functions listed so so that's not great and we'll hopefully have that
• 52:22
  addressed in the coming weeks and months um there are kind of unbounded loops um people want loops
• 52:30
  that feel unbounded it's a little bit tricky because remember behind the scenes this has to
• 52:34
  turn into disconnect it has to turn into something bounded and we still want to make sure that we're
• 52:38
  showing users what the actual cost will be right not you know an ethereum style like who knows how
• 52:45
  much this will cost like good luck you can deploy this but you know you might be paying an infinite
• 52:48
  fee rate or an infinity fee to to satisfy it kind of thing um there are a few other kind of just
• 52:58
  extensions to the language i talked about how in simplicity you can implement sigh hash any prev out
• 53:02
  you can't do that in simplicity hl unfortunately because we don't we haven't exposed enough of the
• 53:07
  low-level SIG hashing kind of mechanisms and stuff.
• 53:11
  But if you want to write a zero-knowledge proof verifier,
• 53:15
  you totally can.
• 53:16
  If you want to write any of the crazy delegation code
• 53:20
  that I described, if you want to write a program
• 53:23
  that restrains your fee rate to some sort of curve
• 53:27
  based on the age of your coins, you can totally do that.
• 53:31
  Although I think parametrizing it by the signature,
• 53:35
  I think you can do it.
• 53:36
  So I'd have to think about that for a sec.
• 53:40
  There's most of the things that I described in my description.
• 53:44
  If you want to implement vaults, you can totally do that.
• 53:46
  If you want to implement delegation, you can totally do that.
• 53:49
  All the kind of like big covenant applications that are out there,
• 53:52
  you can totally implement today in Simplicity HL.
• 53:55
  So we have the compiler.
• 53:59
  You can produce Simplicity code.
• 54:00
  We've got a tool that will produce addresses from that.
• 54:04
  once you're actually building transactions
• 54:06
  and you better be a programmer
• 54:08
  who's developing a wallet
• 54:10
  because right now we don't have
• 54:11
  like the user-facing tooling
• 54:13
  to do cool stuff like this.
• 54:16
  We've got to build that into wallets
• 54:18
  over the coming weeks.
• 54:20
  So it's not something that today
• 54:21
  as like a user of Bitcoin
• 54:23
  just hoping to move money around
• 54:25
  might write these simple programs.
• 54:27
  We're not there yet,
• 54:28
  but we're certainly at the point
• 54:29
  where we're wallet developers
• 54:31
  who say I want my users
• 54:33
  to be able to do these arbitrary cool things,
• 54:36
  we'll have the toolkit to make that possible.
• 54:40
  Yeah, and on that point,
• 54:41
  who's out there at the Museum of Aqua,
• 54:44
  BullBitcoins implemented, Liquid,
• 54:47
  there are a few others.
• 54:50
  Have you guys been having conversations
• 54:53
  with these wallet developers,
• 54:55
  and what are they most excited about?
• 54:58
  Yeah, for sure.
• 55:00
  So there's a couple people.
• 55:01
  I'm not sure who all I'm allowed to talk about here.
• 55:05
  The one big one that you can find on GitHub,
• 55:08
  and I don't know when this podcast is going live,
• 55:12
  but they'll have a blog post out soon,
• 55:13
  is that the Starkware folks have developed a Stark verifier,
• 55:16
  a zero-knowledge proof verifier that works on simplicity.
• 55:18
  So that's personally, I think, the coolest thing that people are building.
• 55:22
  And then as far as wallet development goes,
• 55:26
  we're in the very early stages.
• 55:29
  So what we're hearing is that we need to implement simplicity.
• 55:33
  We need to integrate simplicity into, for example, LWK, the Liquid Wallet Toolkit.
• 55:38
  We've got to provide higher level interfaces.
• 55:41
  So right now we are talking to several people who are excited about using simplicity.
• 55:47
  And we're at the stage right now where they think is very cool, but there's a gap between how do I take the simplicity code and how do I integrate it into my existing wallet?
• 55:57
  Like how do I make it real?
• 55:58
  and there there's a couple layers of integration work that we are we're putting together in
• 56:03
  particular integration into lwk because that's that's the wallet toolkit that's what lets people
• 56:08
  you know connect simplicity to real utxos that the wallet's taken care of
• 56:13
  yeah it's exciting stuff then is your hope that there will be an incredible amount of development
• 56:23
  activity around simplicity on liquid and then sometime down the line it'll prove to be
• 56:31
  sufficiently robust expressive finite secure that the conversation will begin to potentially
• 56:38
  implement on the bitcoin protocol or is this something that should exist on a second layer
• 56:46
  federated side chain like liquid no no we'd like to go towards bitcoin so the uh it's a long we've
• 56:53
  got a long roadmap here right so so what we're doing right now is this launch on liquid is like
• 56:57
  the very first like um identifying like if we want to use simplicity in real life what are the gaps
• 57:05
  that didn't even occur to us on like the product and usability front like this is great we've got
• 57:09
  the language we've got a front-end language we've got a compiler we've got this command line tooling
• 57:12
  like this is great we did we built the whole language here and then you try to use it and
• 57:16
  you're like oh wait a minute how do i how does a wallet how is a wallet supposed to reason about
• 57:20
  these like fee rates that are increasing how is the wallet supposed to like figure out how to work
• 57:25
  with covenants how is the wallet how is the wallet supposed to do anything in this whole
• 57:28
  so that's what we're doing right now on the low level like simplicity on liquid uh how do we get
• 57:36
  it past liquid because liquid aside from being a small federated side chain off of bitcoin and not
• 57:42
  not bitcoin itself it also behaves in some ways it's the same as bitcoin it's still the utxo model
• 57:49
  Right. Still, your work was wrapped Bitcoin. So it's the same currency. But in other ways, it behaves quite differently because of the multi-assets and because of confidential transactions are the two big things.
• 58:01
  so our next big plan is that we are working on the bitcoin integration branch right now so you
• 58:08
  can go to the simplicity repo there's a branch that's that's reasonably up to date it should be
• 58:13
  up to date as of today um that is an extension of bitcoin core that includes simplicity and our
• 58:20
  game plan here is that we hope by the end of the year maybe maybe early next year to be able to go
• 58:28
  to one of the more experimental test networks out there.
• 58:34
  So as people may know, there's Bitcoin at the main net,
• 58:37
  and there's this thing called Testnet 4,
• 58:39
  which is like the official Bitcoin test network
• 58:41
  that exactly matches what's on Bitcoin.
• 58:43
  But then there's also something called SigNet,
• 58:45
  which is a signing-based network that has signed blocks.
• 58:50
  It matches Bitcoin, but with a few proposed extensions to Bitcoin
• 58:54
  that people want to experiment with.
• 58:55
  And then there's MutinyNet, which is like Cygnet, but even more just like, let's just put crazy stuff on here that we really want to see what would happen.
• 59:03
  And then it turns out there's even more of these networks out there, some of which are pretty widely used.
• 59:08
  And a couple months ago, I was talking to Jeremy Rubin, who's one of the main developers or admin kind of people for one of these networks.
• 59:18
  And I said this to him.
• 59:20
  I said, yeah, we're going to propose it to Cygnet, but maybe then we'll try MutinyNet.
• 59:24
  And then that seems more likely.
• 59:26
  And then we'll try.
• 59:26
  And he says, put it on mine.
• 59:27
  Do you have a branch?
• 59:28
  I'll deploy it right now.
• 59:29
  I laughed.
• 59:30
  This is like in April, right?
• 59:31
  I just said, I have a branch, but don't do it.
• 59:36
  It was super cool to get that kind of enthusiasm.
• 59:39
  So we're very confident that we'll be able to find one of these test networks that is based off of Bitcoin where people really want to deploy simplicity.
• 59:47
  And that's where, that's probably where we're going to start seeing like experimentation from the wider Bitcoin community and like, cool, like, can we, so I've said we can implement any, say gosh, any Prevout in simplicity.
• 1:00:02
  Well, is anyone going to actually do it?
• 1:00:04
  Can we try to use simplicity as a specification language for any Prevout or for OpCat or for CTV or any of these proposals?
• 1:00:13
  In principle, you can implement them all in simplicity and do so has the benefit that then you can say this is exactly the behavior of my proposed opcode.
• 1:00:22
  And your QA problem of how do we know it's going to behave well is reduced to how do we know that the C++ code will match the simplicity code, which at least is a more tangible target.
• 1:00:36
  That's the kind of exciting stuff that I'm looking forward to seeing.
• 1:00:39
  And right now with the Liquid launch, we're at the step before that, where rather than what are all the cool stuff that we can build and deploy, it's like, how can we build and deploy something that's like do the full end-to-end stack?
• 1:00:53
  What all is involved in doing a full deployment of something novel using Simplicity to do a full end-to-end stack?
• 1:01:00
  And frustratingly, like with all such things, it's bigger than we expected, right?
• 1:01:06
  We're a small team right now.
• 1:01:08
  The simplicity team right now is four people.
• 1:01:12
  And one of us is not even a developer.
• 1:01:15
  And we really thought we could get all of this pulled together.
• 1:01:21
  We thought we could do it even sooner.
• 1:01:23
  But it turns out that there's a lot more to writing a blockchain language than just writing the blockchain.
• 1:01:30
  validation code.
• 1:01:32
  Ironically, all of the low-level consensus code,
• 1:01:36
  the stuff that we fight so much over in Bitcoin,
• 1:01:38
  is actually the easy part of any of these things
• 1:01:41
  when you actually want it to change things for real users.
• 1:01:45
  So yeah, we're excited.
• 1:01:47
  This is a huge step.
• 1:01:49
  Despite me like, oh, we're still in the early days,
• 1:01:51
  this is a huge step getting this launched onto Liquid.
• 1:01:54
  This is what lets us start.
• 1:01:57
  Now it begins, basically.
• 1:01:58
  But what's beginning?
• 1:02:00
  It's a pretty big project.
• 1:02:01
  It's been a 13-year journey from paper.
• 1:02:04
  Well, you said even longer from math to here.
• 1:02:06
  Yeah.
• 1:02:07
  15 years if we look at it that way.
• 1:02:09
  And so many people will hear like simplicity, if it ever makes it on the Bitcoin, will enable all this stuff and get worried that it will disrupt the fee market.
• 1:02:21
  You'll have all this perceived junk on chain.
• 1:02:25
  Does implementing this stuff via simplicity sort of prevent, like you said, like you know exactly what's going to happen, you have that certainty.
• 1:02:35
  Does that prevent sort of unknown consequences that many people surmise these individual opcodes, if added, will introduce to the network?
• 1:02:45
  Yeah, yeah.
• 1:02:46
  Um, no, it will not prevent it, but using simplicity as an upgrade mechanism should make these things tractable and manageable.
• 1:02:58
  So let me first say is that if we want no MEV and none of these kind of risks that people will find a way to build new assets on the Bitcoin kind of thing, then probably we can't do any extensions at all.
• 1:03:20
  It seems like almost everything we do, and even maybe doing nothing, still makes it possible to do these kind of elaborate things.
• 1:03:27
  But one nice thing is that one reason this stuff is such a problem on chains like Ethereum or Solana is that the easy path for wallet developers is one that enables these kind of things.
• 1:03:46
  Ethereum really encourages the creation of DEXs that enable front running and contract code where the behavior changes based on your reordering of transactions.
• 1:03:57
  The account model also contributes to that, which Bitcoin doesn't have.
• 1:03:59
  so if we were to develop code if we were to have a simplicity interpreter as a mechanism for adding
• 1:04:06
  new features and new functionality to bitcoin then wallet developers would have the tools at
• 1:04:11
  their disposal to say here's how i can make sure there's only one path whatever the user chooses
• 1:04:18
  to do that is that is what's going to happen and it's not going to be other weird things that
• 1:04:21
  happen to the transaction along the way here's how i can bound the total size of my witnesses
• 1:04:27
  so my fee rates are manageable.
• 1:04:29
  And here's how I can change my code to tighten that bound
• 1:04:31
  to improve predictability.
• 1:04:33
  Because a fortunate economic truth is that MEV is bad
• 1:04:38
  not only for the network, but it's bad for individual users.
• 1:04:41
  And the reason that MEV happens is because it's just difficult
• 1:04:46
  to design these giant and complicated systems.
• 1:04:48
  But if we give people the tools to avoid MEV then they will use those tools because it valuable to them That very fortunate because sometimes in economics you get the opposite where just like your incentives are inherently stacked against you And that a very difficult problem Then your problem becomes like
• 1:05:07
  how do we just ban all bad behavior? How do we make it impossible to do anything bad because
• 1:05:10
  incentives are so lossful? But fortunately with things like MEV, they're not.
• 1:05:14
  um will simplicity related to mev right will simplicity enable these like alternate asset
• 1:05:22
  markets on top of bitcoin and then will you have economic activity on bitcoin that is not in bitcoin
• 1:05:28
  and that skews mining incentives and and all this terrible stuff and it will i don't think it will
• 1:05:38
  make it any more possible than it is today.
• 1:05:42
  So I've been surprised and kind of disappointed at how much ordinals took off, where ordinals
• 1:05:50
  or sorry, inscriptions, which are based on ordinals, where there's no Bitcoin script
• 1:05:58
  functionality being used at all for inscriptions, right?
• 1:06:04
  The way that inscriptions work is you take Bitcoin's UTXO model and we say, well, certain UTXOs outside of the network are assigned a special number or they were created with a particular JPEG attached to them.
• 1:06:16
  Or, you know, somehow or other just the virtue of how they were created on the Bitcoin chain.
• 1:06:24
  External to Bitcoin, there is a set of value that has been kind of layered onto that, which has created this market and all these distortions and stuff.
• 1:06:31
  And so as disappointed as I am by that, it takes a little bit of the pressure off of script extensions and new functionality for Bitcoin to see that actually what's blocking this stuff is not extra functionality, right?
• 1:06:48
  What's blocking this stuff is kind of nothing, right?
• 1:06:51
  It's just like the cost of using the Bitcoin network.
• 1:06:53
  And then when you frame it that way, well, if we can make legitimate uses of the Bitcoin network more productive and more valuable, then that should help crowd out these kind of inscription type behaviors.
• 1:07:08
  And then that will make Bitcoin be used for Bitcoin.
• 1:07:10
  And if we can make Bitcoin more valuable so that people aren't creating like wrapped versions of other assets, they're just using Bitcoin.
• 1:07:17
  That again, it means that Bitcoin is in an even stronger position as the asset on the Bitcoin network that miners are being paid in and that are incentivizing miners to continue the chain working correctly.
• 1:07:33
  So my feeling is I'm not an ossificationist.
• 1:07:38
  I don't think we should stop dead where we are.
• 1:07:41
  And given that, I think that if we're going to move forward at all on these extra script expressivity projects, I think the simplicity is a really good way to go in that direction.
• 1:07:53
  and if we were to try to implement
• 1:07:56
  kind of like arbitrary computations
• 1:07:59
  of the form that you would need
• 1:08:00
  to introduce like new quantum hard signatures
• 1:08:03
  or other like crazy new cryptography
• 1:08:05
  I think simplicity is pretty much the only way to go
• 1:08:08
  where we would preserve the ability
• 1:08:11
  to reason about transaction code
• 1:08:14
  while having these extra abilities Yeah that makes sense Like you say you you know simplicity enabling like one of the examples i
• 1:08:26
  been a big big advocate of for years hasn't uh hasn't hit the scale or adoption yet but like
• 1:08:33
  something like dlcs where you have like these like external events that are basically feeding data to
• 1:08:40
  a conditional transaction sending bitcoin one way or the other depending on what the conditions of
• 1:08:45
  the particular contract are like you can see people building financial sort of products on
• 1:08:52
  top of that denominated in bitcoin which make a lot of sense today yeah dlcs are so cool i i agree
• 1:08:59
  like they should be so much bigger than they are um and it's it's a slow burn i think in part because
• 1:09:04
  it's technically difficult to build big stuff with dlcs right i guess it's a pretty uh
• 1:09:09
  that's clunky right yeah yeah that's a good i was gonna say like a rigid building block right
• 1:09:13
  clunky right it's hard to hard to build complicated and flexible it's hard to build flexible things
• 1:09:19
  with with dlcs but those are super cool um and simplicity in some ways
• 1:09:27
  kind of takes the fun out of it because in simplicity you can directly check oracle signatures
• 1:09:32
  um right so if you have some external event and you have some some third party that's willing to
• 1:09:38
  sign on on that event being uh having happened one way or the other you can directly check that
• 1:09:43
  simplicity although the one crazy thing that dlcs have that almost nothing else has is that
• 1:09:51
  you have a third party in oracle broadcasting that like a game came out one way or another or
• 1:09:58
  you know a hurricane did or did not devastate a particular lot unit or whatever kind of insurance
• 1:10:03
  slash gambling product you're trying to build with it.
• 1:10:13
  With DLCs, you can use that in your script
• 1:10:16
  and the person making the signatures can't tell.
• 1:10:19
  Property that you get,
• 1:10:21
  which is that you can use these signatures
• 1:10:22
  without having to reveal that you're using the signature
• 1:10:26
  so that the person producing the signature
• 1:10:28
  can't come after you and say,
• 1:10:30
  like we were using our signatures in violation of return to service or like we don't like
• 1:10:34
  the particular construction that you did or or what so um i'm gonna stop because your screen
• 1:10:41
  has locked up i saw it stopped for like 10 like 10 seconds storing dlcs but i think okay perfect the um
• 1:10:50
  so you're you're just explaining there's like this oracle problem that exists yeah yeah so
• 1:10:56
  The brief summary is, right, Simplicity can do oracles directly.
• 1:11:00
  DLCs do oracles in a way where the oracle can't tell
• 1:11:03
  even after the fact that you're using their signature.
• 1:11:05
  Yeah.
• 1:11:06
  So that's a really cool anti-censorship property, the DLCs.
• 1:11:10
  And a lot of these kind of like tweaking signatures kind of tech has.
• 1:11:14
  So that's super cool.
• 1:11:16
  And where Simplicity will help that stuff, I think, is in the unhappy case.
• 1:11:23
  So a lot of the kind of trick with a lot of these DLC type constructions and adapter signatures
• 1:11:30
  and PTLCs and all these related things is that they, as long as the parties are both
• 1:11:35
  online and following the protocol correctly, they work perfectly.
• 1:11:39
  And then if somebody goes offline or is providing inconsistent data or somehow misbehaving you got to have this backup condition right And you DLCs themselves can do it right
• 1:11:52
  So you wind up as like, it's cool DLC stuff
• 1:11:55
  plus this extra backup condition.
• 1:11:57
  And simplicity hopefully can make those backup conditions
• 1:12:02
  more subtle or flexible and make DLCs user
• 1:12:05
  more user friendly and usable in other contexts, basically.
• 1:12:10
  but yeah no i think those problems are also further mitigated by just using like a threshold
• 1:12:17
  of multiple oracles providing the same data yeah yep yeah exactly um and that i mean bitcoin's
• 1:12:23
  great at doing thresholds of signatures um simplicity can improve on that but like
• 1:12:28
  in ways that matter no right um the bitcoin's really good at threshold signatures so that's
• 1:12:34
  part of why dlcs are so exciting yeah well it's been awesome i'm gonna say it again i'm pumped
• 1:12:41
  you guys i think yeah thanks university has been talked about for most of the time that i've been
• 1:12:47
  paying attention and involved in bitcoin it was uh really cool to see that you guys got it on
• 1:12:52
  liquid maiden and hopefully people that already have liquid liquid implemented into their wallets
• 1:13:00
  start playing around with it. Obviously,
• 1:13:03
  as you mentioned, there's
• 1:13:04
  some development kits and
• 1:13:06
  interfaces that need to
• 1:13:07
  be built out, but it seems like we're finally
• 1:13:10
  at the point where, all right, we can get cooking
• 1:13:12
  with this stuff.
• 1:13:14
  Yeah, absolutely. We've launched on
• 1:13:16
  Mainnet. We have a high-level language
• 1:13:18
  that compiles to Simplicity. You can use it today.
• 1:13:20
  simplicity-lang.org
• 1:13:21
  If you've been wondering,
• 1:13:24
  should I pay attention to Simplicity?
• 1:13:26
  Now the answer is yes. Finally,
• 1:13:28
  the answer is yes.
• 1:13:30
  Well, congrats again. Thank you for all the work and for coming and explaining this to us.
• 1:13:37
  I hope at the beginning when I prefaced to the audience that you like to go down rabbit holes and explain things thoroughly.
• 1:13:47
  You didn't take it as a dig.
• 1:13:48
  I love speaking with you because the extent of the detail that you go into just really triggers my nerd, my inner nerd.
• 1:13:59
  And I get giddy when you go down these rants.
• 1:14:01
  So thank you.
• 1:14:02
  And don't ever try to be brief is what I'm trying to say.
• 1:14:06
  All right.
• 1:14:06
  Thank you.
• 1:14:07
  There we go.
• 1:14:07
  I'll stop apologizing.
• 1:14:08
  Yeah.
• 1:14:10
  Thanks.
• 1:14:11
  Any final parting messages for anybody listening?
• 1:14:14
  No, I'm just going to repeat the website again.
• 1:14:19
  Simplicity-lang.org.
• 1:14:22
  And keep an eye on our GitHub as well.
• 1:14:25
  GitHub.com slash blockstreamresearch
• 1:14:26
  is where our Simplicity and our SimplicityHL
• 1:14:30
  and Rust Simplicity,
• 1:14:32
  we have a whole Rust library for building this stuff.
• 1:14:34
  That's where all those things live.
• 1:14:36
  If you want to get involved,
• 1:14:37
  if you want to be a developer,
• 1:14:38
  if you want to be a tester, that's great.
• 1:14:40
  If you want to work for us,
• 1:14:41
  we are we've got some simplicity related positions open uh so definitely keep an eye on our jobs
• 1:14:47
  posting i forget the url for that now um or just you know shoot me an email shoot any of us an email
• 1:14:53
  and we'll figure it out so so yeah thanks i will uh let me see company careers blockstream.com
• 1:15:01
  slash careers if you're looking for those jobs uh perfect andrew thank you uh excited to see
• 1:15:08
  what gets built.
• 1:15:10
  Yep. Thank you.
• 1:15:11
  Peace and love, freaks.