Exploring ZK Features for Celestia and Rollups

[evan-forbes]

Equivalence Prover

Currently, Celestia commits to its data using sha256 hashes. This makes it resource heavy for specific types of zk proofs to be generated if they have to prove inclusion to some data committed to in that root. In the future, we might want the validators to sign over multiple different data roots that are generated using different hash functions, including a hash function that requires fewer resources to prove. In order to do this, we would need to prove that the roots were created correctly using the same underlying data, aka prove equivalence between each of the roots.

Proving Block Validity Rules

Currently, Celestia makes heavy use of fraud proofs for its block validity rules so that rollups do not have to make an honest majority assumption. These fraud proofs include

Bad encoding fraud proofs

• Proves that a portion of the block was not erasure encoded correctly

Blob Inclusion fraud proofs

• Proves that a transaction was included in the block without also including the exact blob of data that it paid for.

State fraud proofs

• Proves that a given transaction was executed incorrectly.

We are evaluating replacing some of these fraud proofs with zk proofs.

ZK Proof Verifier

We're investigating adding the ability to verify zk proofs in a mostly stateless way to the celestia state machine, which would allow for the trust minimized deposit and withdrawal of TIA tokens into and out of a zk rollup without risking state bloat that would otherwise occur with a permission minimized settlement layer.

ZK Fraud Proofs

Single round fraud proofs are easy to implement but can get burdensomely large for light clients. Simultaneously, proving each block in a zk proof can be extremely expensive and is prone to latency. Combining both approaches could allow for an interesting tradeoff space, where zk proofs could be generated for single round fraud proofs. This would reduce the size of the fraud proofs for light clients while avoiding having to prove each block or set of blocks. short thread